The effect of acquisition decision making on security posture

Abstract

Purpose – The purpose of this paper is to examine the effectiveness of decision making in IT acquisition and security, and the disparity between the two domains. The paper postulates that improving decision processes during acquisition increases decision makers' security consciousness and security posture.Design/methodology/approach – Semi‐structured interviews were conducted with 15 IT decision makers of small‐to‐medium sized organizations using questions derived from previous research in psychology, HCI, and MIS. Questions from the security and acquisition areas were coded based upon a predefined rubric and correlation testing was performed. The author chose to focus on small‐to‐medium sized organizations since they often lack sufficient background and resources to address IT security concerns.Findings – Analysis suggests a significant positive correlation between the effectiveness of acquisition decision making and organizational security posture and attitudes, further suggesting that small improvement...