Organizational Security Management Research Articles

The defining features of a robust information security climate

Data breaches have become a common occurrence with serious consequences, making organizational security management critically important. Nonetheless, the research community has not yet clearly defined the characteristics of a strong organizational security climate. This study conducts a comprehensive literature analysis to identify a collection of research-based and managerially relevant constructs that represent the essential components of a strong security climate. We operationalize the identified measures of the constructs and empirically validate them for reliability, construct validity, and nomological validity in terms of their relationships with employees' security awareness, neutralization, and intention to comply with organizational information security policies (ISPs). The results suggest that these integral elements, when embraced by organizations, discourage employees’ use of neutralization to justify violation of ISPs and improve employees’ security awareness and their ISP compliance intention. Organizations can use the identified subcomponents and their corresponding measures as a diagnostic decision support instrument to make a reliable and valid assessment of the strengths and weaknesses of their security climate, to continuously monitor their security climate, and to develop interventions that contribute to a strong security climate.

Human Resources in Organizational Security Management

Human Resources in Organizational Security Management

The Case for Medical Device Cybersecurity Hygiene Practices for Frontline Personnel

The Case for Medical Device Cybersecurity Hygiene Practices for Frontline Personnel

Exponential discounting in security games of timing

Abstract Strategic game models of defense against stealthy, targeted attacks that cannot be prevented but only mitigated are the subject of a significant body of recent research, often in the context of advanced persistent threats (APTs). In these game models, the timing of attack and defense moves plays a central role. A common assumption, in this literature, is that players are indifferent between costs and gains now and those in the distant future, which conflicts with the widely accepted treatment of intertemporal choice across economic contexts. This article investigates the significance of this assumption by studying changes in optimal player behavior when introducing time discounting. Specifically, we adapt a popular model in the games of timing literature, the FlipIt model, by allowing for exponential discounting of gains and costs over time. We investigate changes of best responses and the location of Nash equilibria through analysis of two well-known classes of player strategies: those where the time between players’ moves is constant, and a second class where the time between players’ moves is stochastic and exponentially distributed. By introducing time discounting in the framework of games of timing, we increase its level of realism as well as applicability to organizational security management, which is in dire need of sound theoretic work to respond to sophisticated, stealthy attack vectors.

Cost benefit analysis within organization security management

The present time is constantly evolving, advancing and bringing new challenges and threats that may have an adverse impact on individuals and organizations. Each organization must adapt its activities to the current situation. It must also take care of its security, which it needs to ensure its existence, successful functioning and continuous improvement of its position within the global environment. Security must therefore be part of the organization’s main strategies. Therefore, appropriate attention should be paid to security and the organization should regularly allocate sufficient resources to ensure its security. The aim of this article is to point out the possibilities of using the CBA method in the framework of security management in the concept of socially responsible business. The CBA method provides scope to develop and incorporate its methodological framework into standard risk management practices within a company by assessing the costs and benefits of the proposed preventive measures related to ensuring the required level of security within the organization.

The Differential Effects of Interpersonal Justice and Injustice on Computer Abuse

Insider employees have become one of the top security threats to organizations. In order to mitigate their detrimental security behaviors, it is important to understand the thought processes of these insider offenders. Recent security research has examined the role of perceptions of injustice in explaining employee security behaviors. However, there is a paucity of research investigating the differential effects of justice and injustice. Based on regulatory focus theory, this article examines the emotional and behavioral reactions to perceptions of interpersonal justice and injustice. The results show that perceptions of interpersonal injustice are more relevant to employee experiences of hostility than perceptions of interpersonal justice. In addition, the results show that promotion focus and prevention focus have asymmetric effects on the role of emotions in computer abuse. The results have important theoretical contributions to justice and security behavior research and provide critical guidance to organizational security management.

Organizational Citizenship Behavior Regarding Security: Leadership Approach Perspective

ABSTRACTThis study takes a relational perspective to introduce the concept of organizational citizenship behavior regarding security (OCB-S) and to examine its predictors. Utilizing social exchange and role theories, we develop a model explicating the indirect effects of the way information systems (IS) departments lead IS initiatives and manages its relationships with end-users on end-users’ OCB-S. Based on survey data from 223 employees of Chinese firms, we demonstrate that IS departments’ management approaches play an important role in influencing business users–IS department exchange (BIX) and user perceptions regarding whether IS security is their responsibility (extra-role perceptions regarding security). These factors, in turn, influence the extent to which end-users engage in OCB-S. Theoretically, this study advances our understanding of end-user security-related behaviors and their antecedents. Practically, this study highlights the importance of business users–IS department relationships and role perceptions for improving organizational security management.

Mathematical model-based security management framework for future ICT outsourcing project

The information communication technology (ICT) outsourcing market is growing larger every year from the increasing number of companies that utilize ICT outsourcing, as industry scale increases and industrial specialization intensifies. However, the current circumstance is that security accidents related to ICT outsourcing are continuously occurring at an increasing scale. There is a lack of studies measuring the level of security management of organizational ICT outsourcing, which is the first step in performing security management of ICT outsourcing. In addition, most studies focus on general organizational security management. Accordingly, this paper aimed to design a model to measure the level of security management of companies utilizing ICT outsourcing. Specifically, this paper analyzed security vulnerabilities that could occur in ICT outsourcing that may be mapped with the accorded security measures as solutions to deduce items for ICT outsourcing security inspections. Next, this paper developed an ICT outsourcing security level quantification model by verifying the validity of the security inspection items deduced and by estimating item-specific weighted points. Additionally, the applicability of the ICT outsourcing security level quantification model developed was verified by applying it to actual companies.

Ethics Studies in Graduate-Level Security Management Education Programs in the United States

This study identified a grounded theory related to ethics studies within graduate organizational Security Management programs in the United States. The study used data analysis of program curricula, course descriptions, and program Web sites, as well as interviews of program faculty and administrators (n = 15) to explore (a) how ethics studies are incorporated into graduate organizational Security Management program curricula in the United States, (b) the role that ethics studies play in graduate organizational Security Management studies, (c) instruction and evaluation methods for ethics studies within the programs, (d) difficulties in teaching ethics, and (e) barriers to incorporating ethics into a curriculum. The research findings resulted in the creation of theoretical models depicting ethics studies in graduate Security Management programs and the role of ethics studies in the professionalization of security.

Ethics in Security Management: Development of a Theoretical Model

This study used qualitative interviews (n = 15) to identify a grounded theory related to ethics in security management. The study explored how educators in graduate level organizational Security Management programs in the United States describe their definitions of ethics in security management and the role that ethics play in security management as a practice and as a profession. The research findings resulted in the creation of a theoretical model for ethics in security management emphasizing a balance between various personal and professional factors. In addition, the findings resulted in a model for the role of ethics in organizational security, which is based on trust, and combines security's heightened authority and access to information with increased exposure to potential ethical decisions, which result in significant personal, organizational, and professional consequences for ethical failure.

Searching for the Right Fit: Balancing IT Security Management Model Trade-Offs

IT security professionals' effectiveness in an organization is influenced not only by how usable their security management tools are but also by how well the organization's security management model (SMM) fits. Finding the right SMM is critical but can be challenging - trade-offs are inherent to each approach, but their implications aren't always clear. The authors present a case study of one academic institution that created a centralized security team but disbanded it in favor of a more distributed approach three years later. They contrast these experiences with expectations from industry standards.