IT governance and organizational design for security management

Information Security: Policy, Processes, and Practices

Volumn , Issue , 2016, Pages 46-68

  Warkentin, Merrill ^a   Johnston, Allen C ^b  

^a MISSISSIPPI STATE UNIVERSITY   (United States)

^b UNIVERSITY OF ALABAMA AT BIRMINGHAM   (United States)

Author keywords

Case study; Centralization; Decentralization; Governance; IT architecture; It governance; Procedures; Security policy

Indexed keywords

EID: 85106113141     PISSN: None     EISSN: None     Source Type: Book    
DOI: 10.4324/9781315288697-10     Document Type: Chapter

References (32)

1. Allen, B.R., and Boynton, A.C. 1991. Information architecture: in search of efficient flexibility. MIS Quarterly, 15, 4, 435-445.
2. Beath, C.M., and Straub, D.W. 1991. Department level information resource management: a theoretical argument for a decentralized approach. Journal of the American Society for Information Science, 42, 2, 124-127.
3. Bekker, S. 2003. Sobig damage estimate increased. ENT (available at www.entmag.com/news/article. asp?EditorialsID=5936 accessed on May 1, 2005).
4. Bolles, G.A. 2004. Whiteboard: business by design. C/O Insight (available at www.cioinsight.com/ article2/0, 1397, 1457058, 00.asp accessed on May 1, 2005).
5. Brand, K., and Boonen, H. 2004. IT Governance: A Pocket Guide Based on COBlT, 3rd ed. The Netherlands:van Haren.
6. Brown, C.Y., and Bostrom, R.P. 1994. Organization design for the management of end-user computing:reexamining the contingencies. Journal of Management Information Systems, 10, 4, 183-211.
7. Brown, C.Y., and Magill, S.L. 1994. Alignment of the IS functions with the enterprise: toward a model of antecedents. MIS Quarterly, 18, 4, 371-404.
8. CIMAlIFAC. 2004. Enterprise Governance: Getting the Balance Right (available at www.cimaglobal.com/ downloads/enterprise_governance.pdf accessed on Jan. 1, 2005).
9. Delio, M. 2003. Worm exploits weak link: PC users. Wired News (available at www.wired.com/news/ infostructure/0, 1377, 59994, 00.html accessed on May 1, 2005).
10. Dhillon, G., and Mishra, S. 2006. The impact of the Sarbanes Oxley (SOX) act on information security governance. In M. Warkentin and R. Vaughn (eds.), Enterprise Information Security Assurance and System Security: Managerial and Technical Issues. Hershey, PA: Idea Group Publishing, pp. 62-79.
11. Hodgkinson, S. 1996. The role of the corporate IT function in the federal IT organization. In M. Earl (ed.), Information Management: The Organizational Dimension. New York: Oxford University Press, pp. 247-269.
12. IT Governance Institute. 2003. Board Briefing on IT Governance (available at www.ITgovernance.org/ resources.htm accessed on Sept. 6, 2004).
13. Jaikumar, Y. 2003. IT managers say they are being worn down by wave of attacks. ComputerWorld, 37, 34, 1-2.
14. Johnston, A.C.; Schmidt, M.B.; and Bekkering, E. 2004. IT security management practices: successes and failures in coping with Blaster and Sobig. F. Proceedings of the 2004 ISOne World International Conference.Las Vegas, NY.
15. Kroenke, D., and Hatch, R. 1994. Management Information Systems. Watsonville, CA: McGraw-Hill.
16. Landwehr, C.E., and Goldschlag, D.M. 1997. Security issues in networks with internet access. Proceedings of the IEEE, 85, 12, 2034-2051.
17. Loch, KD.; Carr, H.H.; and Warkentin, M.E. 1992. Threats to information systems: today’s reality, yesterday’s understanding. MIS Quarterly, 16, 2, 173-186.
18. Marshall, C., and Rossman, G.B. 1989. Designing Qualitative Research. Beverly Hills, CA: Sage.
19. Milliken, FJ. 1987. Three types of perceived uncertainty about the enviroument, state, effect, and response uncertainty. Academy of Management Review, 12, 1, 133-143.
20. Monds, K.E., and Wang, C.P. 2003. CDC’s new epidemic: an investigation into awareness, attitudes, actions, and knowledge of computer viruses among students utilizing campus computer labs. Journal of Computer Information Systems, 43, 3, 118-126.
21. Mukherji, A. 2002. The evolution of information systems: their impact on organizations and structures. Management Decisions, 40, 5, 497-507.
22. Pfteeger, C.P., and Pfteeger, S.L. 2002. Security in Computing, 3rd ed. Upper Saddle River, NJ: Prentice Hall.
23. Robson, W. 1997. Strategic Management and Information Systems: An Integrated Approach. London:Pitman.
24. Sambamurthy, v., and Zmud, R.W. 1999. Arrangements for information technology governance: a theory of multiple contingencies. MIS Quarterly, 23, 2, 261-288.
25. Sambamurthy, v., and Zmud, R.W. 2000. Research commentary: the organizing logic for an enterprise’s IT activities in the digital era-a prognosis of practice and a call for research. Information Systems Research, 11, 2, 105-114.
26. Straub, D.W. 1988. Organizational structuring of the computer security function. Computers and Security, 7, Summer, 185-195.
27. Varghese, S. 2003. Blaster worm took heavy toll: survey. Sydney Morning Herald Online (available at www. smh.com.au/articlesI2003/09/23/1064082983214.html accessed on May 1, 2005).
28. Walker, K.B. 1993. Centralized information systems services: managing the transition to decentralization. Industrial Management & Data Systems, 93, 8, 8-12.
29. Warkentin, M., and Johnston, A.C. 2006. IT security governance and security centralization vs. decentralization. In M. Warkentin and R. Vaughn (eds.), Enterprise Information Security Assurance and System Security: Managerial and Technical Issues. Hershey, PA: Idea Group Publishing, pp. 16-24.
30. Watson, R.T., and Brancheau, J.C. 1991. Key issues in information systems management. Information & Management, 20, 3, 213-223.
31. Whitman, M.E. 2003. Enemy at the gate: threats to information security. Communications of the ACM, 46, 8, 91-95.
32. Zmud, R.W. 1984. Design alternatives for organizing information systems activities. MIS Quarterly, 8, 2, 79-93.