Do information security policies reduce the incidence of security breaches: An exploratory analysis

Information Resources Management Journal

Volumn 18, Issue 4, 2005, Pages 21-38

  Doherty, Neil F ^a,b   Fulford, Heather ^a,b  

^a LOUGHBOROUGH UNIVERSITY   (United Kingdom)

^b LOUGHBOROUGH UNIVERSITY   (United Kingdom)

Author keywords

Information security policy; Large business; Policy scope; Policy uptake; Security management

Indexed keywords

COMPUTER CRIME; COMPUTER SCIENCE; COMPUTER VIRUSES; ERROR DETECTION; INFORMATION SCIENCE; PUBLIC POLICY;

INFORMATION SECURITY POLICY; LARGE BUSINESS; POLICY SCOPE; POLICY UPTAKE; SECURITY MANAGEMENT;

SECURITY OF DATA;

EID: 25144436981     PISSN: 10401628     EISSN: 10401628     Source Type: Journal    
DOI: 10.4018/irmj.2005100102     Document Type: Article

References (39)

1. Arnott, S. (2002, February). Strategy paper. Computing.
2. Austin, R.D. & Darby, C.A. (2003, June). The myth of secure computing. Harvard Business Review.
3. Barnard, L. & von Solms, R. (1998). The evaluation and certification of information security against BS 7799. Information Management and Computer Security, 6(2), 72-77.
4. Canavan, S. (2003). An information security policy development guide for large companies. SANS Institute. Retrieved from http://www.SANS.org
5. David, J. (2002). Policy enforcement in the workplace. Computers and Security, 27(6), 506-513.
6. De Campeaux, D. (2002). Taking responsibility for worms and viruses. Communications of the ACM, 45(4), 15-16.
7. Dhillon, G. (1997). Managing information systems security. London: Macmillan Press.
8. Dhillon, G. (1999). Managing and controlling computer misuse. Information Management and Computer Security, 7(4), 171-175.
9. Dhillon, G. (2004). The challenge of managing information security. International Journal of Information Management, 24, 3-4.
10. Dhillon, G. & Backhouse, J. (1996). Risks in the use of information technology within organizations. International Journal of Information Management, 76(1), 65-74.
11. Doherty, N.F. & Fulford, H. (2003). Information security policies in large organisations: Developing a conceptual framework to explore their impact. In M. Khosrow-Pour (Ed.), Information Technology & Organizations: Trends, Issues, Challenges & Solutions, 2003 Information Resources Management Association International Conference, Philadelphia, Pennsylvania, May 18-21 (pp. 1052-1053). Hershey, PA: Idea Group Publishing.
12. Fulford, H. & Doherty, N.F. (2003). The application of information security policies in large UK-based organizations. Information Management and Computer Security, 11(3), 106-114.
13. Garg, A., Curtis, J., & Halper, H. (2003). Quantifying the financial impact of information security breaches. Information Management and Computer Security, 11(2), 74-83.
14. Gaston, S.J. (1996).Information security: Strategies for successful management. Toronto: CICA.
15. Glazer, R. (1993). Measuring the value of information: The information intensive organization. IBM Systems Journal., 32(1), 99-110.
16. Higgins, H.N. (1999). Corporate system security: Towards an integrated management approach. Information Management and Computer Security, 7(5), 217-222.
17. Hinde, S. (2002). Security surveys spring crop. Computers and Security, 21(4), 310-321.
18. Hinde, S. (2003). Cyber-terrorism in context. Computers and Security, 22(3), 188-192.
19. Hone, K. & Eloff, J.H.P. (2002a). Information security policy: What do international security standards say. Computers & Security, 21(5), 402-409.
20. Hone, K. & Eloff, J.H.P. (2002b). What makes an effective information security policy. Network Security, 20(6), 14-16.
21. Hong, K., Chi, Y., Chao, L., & Tang, J. (2003). An integrated system theory of information security management. Information Management and Computer Security, 11(5), 243-248.
22. I.S.O. (2000). Information technology. Code of practice for information security management, ISO 17799. International Standards Organization.
23. Kotulic, A.G. & Clark, J.G. (2004). Why there aren't more information security research studies. Information & Management, 41, 5907-607.
24. Kwoc, L. & Longley, D. (1999). Information security management & modelling. Information Management and Computer Security, 7 1), 30-39.
25. Lindner, J.R., Murphy, T.H., & Briers, G.E. (2001). Handling non-response in social science research. Journal of Agricultural Education, 42(4), 43-53.
26. Loch, K.D., Carr, H.H., & Warkentin, M.E. (1992). Threats to information systems: Today's reality, yesterday's understanding. MIS Quarterly, 16(2), 173-186.
27. Menzies, R. (1993). Information systems security. In J. Peppard (Ed.), IT strategy for business. London: Pitman Publishing.
28. Mitchell, R.C., Marcella, R., & Baxter, G. (1999). Corporate information security. New Library World, 100 1150), 213-277.
29. Pernul, G. (1995). Information systems security: Scope, state of the art and evaluation of techniques. International Journal of Information Management, 75(3), 165-180.
30. Pfleeger, C.P. (1997). Security in computing. Englewood Cliffs, NJ: Prentice Hall.
31. Premkumar, G. & King, W.R. (1992). An empirical assessment of information systems planning and the role of information systems in organizations. Journal of Management Information Systems, 19(2), 99-125.
32. Rees, J., Bandyopadhyay, S., & Spafford, E.H. (2003). PFIRES: A policy framework for information security. Communications of the ACM, 46(1), 101-106.
33. Siponen, M. (2000). Policies for construction of information systems' security guidelines. In Proceedings of the 15th International Information Security Conference (IFIP TC11/SEC2000), Beijing, China, August (pp. 111-120).
34. Straub, D.W. & Welke, R.J. (1998). Coping with systems risk: Security planning models for management decision making. MIS Quarterly, 22(4), 441-470.
35. von Solms, B. & von Solms, R. (2004). The ten deadly sins of information security management. Computers & Security, 23, 371-376.
36. Wadlow, T.A. (2000). The process of network security. Reading, MA: Addison-Wesley.
37. Whitman. (2004). In defense of the realm: Understanding threats to information security. International Journal of Information Management, 24, 3-4.
38. Wood, C.C. (1996). Writing infosec policies. Computers & Security, 14(8), 667-674.
39. Wood, C.C. (2000). An unappreciated reason why information security policies fail. Computer Fraud & Security, 10, 13-14.