Value‐focused assessment of information system security in organizations

Abstract

. Information system (IS) security continues to present a challenge for executives and professionals. A large part of IS security research is technical in nature with limited consideration of people and organizational issues. The study presented in this paper adopts a broader perspective and presents an understanding of IS security in terms of the values of people from an organizational perspective. It uses the value‐focused thinking approach to identify ‘fundamental’ objectives for IS security and ‘means’ of achieving them in an organization. Data for the study were collected through in‐depth interviews with 103 managers about their values in managing IS security. Interview results suggest 86 objectives that are essential in managing IS security. The 86 objectives are organized into 25 clusters of nine fundamental and 16 means categories. These results are validated by a panel of seven IS security experts. The findings suggest that for maintaining IS security in organizations, it is necessary to go beyond technical considerations and adopt organizationally grounded principles and values.

Análisis de la seguridad en los sistemas de e-Gobierno mediante el problema SAT

“…Estudios han demostrado que los aspectos no téc-nicos son tan importantes como los técnicos al momento de salvaguardar una organización, y estos aspectos no técnicos están relacionados con la administración de los recursos [2]. Es por este motivo, que la seguridad también tiene que ser administrada.…”

Value Focused Approach to Information Systems Risk Management

“…[ Dhillon and Torkzadeh 2006] present an assessment of information systems security in organizations, in which they use a value focused approach with the major objective of maximizing information systems security in organizations. They interviewed 103 managers from multiple organizations and initially identified general values for managing information systems security and recorded them in a wishlist.…”

Value-Focused Assessment of Information Communication and Technology Security Awareness in an Academic Environment

“…Hassan applied it to the environmental selection of wall structures [8] while Nah, Sian and Sheng used the approach to describe the value of mobile applications [7]. Other examples can be found in Dhillon et a1 [9], [lo] where the value-focused thinking approach was used in assessment of IS security in organizations and privacy concerns for Internet commerce. In this study the valuefocused approach was applied at a university to identify key areas of concern to ICT security awareness.…”