Search

As organizations increasingly view information as one of their most valuable assets, which supports the creation and distribution of their products and services, information security will be an integral part of the design and operation of organizational business processes. Yet, risks associated with cyber-attacks are on the rise. Organizations that are subjected to attacks can suffer significant reputational damage as well as loss of information and knowledge. As a consequence, effective leadership is cited as a critical factor for ensuring corporate level attention for information security. However, there is a lack of empirical understanding as to the roles strategic leaders play in shaping and supporting the cyber-security strategy. This article seeks to address this gap in the literature by focusing on how senior leaders support the cyber-security strategy. The authors conducted a series of exploratory interviews with leaders in the positions of Chief Information Officer, Chief Security Information Officer, and Chief Technology Officer. The findings revealed that leaders are engaged in both transitional, where the focus is on improving governance and integration and transformational support, which involves fostering a new cultural mindset for cyber-resiliency and the development of an ecosystem approach to security thinking. [ABSTRACT FROM AUTHOR]

Technologies and procedures for effectively securing the enterprise in cyberspace exist, but are largely underdeployed. Reasons for this shortcoming include the neglect of the role of stakeholder perceptions in organizational reward systems, and misaligned incentives for effective allocation of resources. We present a methodology for practitioners to employ, with examples for identification of perverse incentives—situations where the interests of a manager or employee are not aligned with those of the organization—and for estimation of the damage caused by incentive misalignment. We present our revision to the risk perception model developed by Fischhoff and Slovic. We also present the results of our findings from our interviews of 42 information security executives across the U.S. about the role of risk perception and incentives in information security decisions. We discuss how to identify and to correct misalignments, to develop efficient incentive structures, and to include perceptual principles and security governance in making information security a property of the organizational environment. This research contributes to the practice and theory of information security, and has several implications for practitioners and researchers in the alignment of incentives and symmetrization of information across organizations. [ABSTRACT FROM PUBLISHER]

Explores the need to protect the content and information gleamed from the Internet while, at the same time, ensure that freedom of access and quality of content remains intact. Claims that there is a choice - do we want to make protection of individual Internet elements the owners? problem for all values of ?owner,? subject to unpredictable differentiation and a picking of winners and losers by emergent processes that we can perhaps still influence but never again control? Or do we want near monocultures of a few winning platforms whose vastness represents empire and thus requires a level of defense that only a nationstate can provide, if at all? On the former lies the path of so much science fiction, especially if the Singularity is imminent. On the latter lies the path to a state-level control far more invasive than fiat currency and secret standing armies. If neither of these options appeals, now is the time to apply the brakes. Now is the time, individually and collectively, to tamp down risk by tamping down dependence on the Internet. Now is the time to say that target richness is a disease for which the cure is intolerable. [ABSTRACT FROM PUBLISHER]

How do we solve the workforce problem? Guest editor Mischel Kwon brought together a group of people from government, private-sector, and academic backgrounds to discuss the challenges in educating cyber professionals. [ABSTRACT FROM PUBLISHER]

How do IT security managers make decisions in the absence of empirical data, and how do they know these decisions are successful? Some security managers seem more successful at making decisions than others. Are they guessing, or are they using some tacit knowledge? To address these questions, a study employed open-ended interviews with highly regarded, experienced security practitioners. [ABSTRACT FROM PUBLISHER]

Turbulent times exacerbate many existing information risks and create new security management challenges. Discussions and interviews with chief information security officers from a broad range of large firms about how they addressed the challenges of the economic downturn provide both actionable ideas and clues for future research. [ABSTRACT FROM PUBLISHER]