Towards a Framework for Strategic Security Context in Information Security Governance

Sean B Maynard, Terrence Tan, Atif Ahmad, Tobias Ruighaver

Abstract


Information security governance influences the quality of strategic decision-making to ensure that investments in security are effective. Security governance involves a range of activities including adjusting organizational structures, designating roles and responsibilities, allocating resources, managing risks, measuring results, and gauging the adequacy of audits and reviews. We identified three security issues in an organization around strategic context in an in-depth and revelatory case study. These are (1) limited diversity in decision-making; (2) lack of guidance in corporate-level mission statements to security decision-makers; (3) a bottom-up approach to security strategic context development. We further argue that instead of an approach that is based on risk and controls, organizations should address objectives and strategies through developing depth in their security strategic context.


Keywords


Security Culture; Decentralized Decision Making; Security Strategic Context; Business Security Strategies; Information Security Governance

Full Text:

PDF
Views 346

Maynard, S. B., Tan, T., Ahmad, A., and Ruighaver, T. (2018). Towards a Framework for Strategic Security Context in Information Security Governance. Pacific Asia Journal of the Association for Information Systems, 10(4), 65-88.