Abstract
Today’s organizations are exposed to high risk because the established digital technologies are vulnerable to security attacks. The increased impact of security on business demands a strategic approach to information security, commonly referred to as digital security governance. While there is a growing understanding that digital security is one of the leading risks and challenges of today’s organizations, organizations still find it difficult to implement security governance as part of their regular organizing change activities. This study focuses on providing more empirical insight into “tensions that are present during the implementation of digital security governance”.
We conducted an inductive study and interviewed 42 CISOs and CIOs of large organizations in the Netherlands. The study reveals the tensions that hinder the implementation of digital security governance. We draw from management theories to provide a fresh understanding of and guidance for how to unravel the tensions.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
- 1.
- 2.
- 3.
- 4.
Experts also have experience in CISO positions but often where self-employed or ex CISO of large organizations. We named them experts to be transparent about the fact they do not currently work in large-organizations.
References
AlGhamdi, S., Win, K.T., Vlahu-Gjorgievska, E.: Information security governance challenges and critical success factors: systematic review. Comput. Secur. 99, 102030 (2020)
Assal, H., Chiasson, S.: Security in the software development lifecycle. In: Fourteenth Symposium on Usable Privacy and Security ({SOUPS} 2018), pp. 281–296 (2018)
Gioia, D.A., Corley, K.G., Hamilton, A.L.: Seeking qualitative rigor in inductive research: notes on the Gioia methodology. Organ. Res. Meth. 16(1), 15–31 (2013). https://doi.org/10.1177/1094428112452151
Kam, H.J., Menard, P., Ormond, D., Crossler, R.E.: Cultivating cybersecurity learning: an integration of self-determination and flow. Comput. Secur. 101875 (2020)
Karlsson, F., Karlsson, M., Åström, J.: Measuring employees’ compliance – the importance of value pluralism. Inf. Comput. Secur. 25(3), 279–299 (2017). https://doi-org.vu-nl.idm.oclc.org/10.1108/ICS-11-2016-0084
Lidster, W., Rahman, S.S.: Obstacles to implementation of information security governance. In: 2018 17th IEEE International Conference On Trust, Security And Privacy in Computing and Communications/12th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE), pp. 1826–1831. IEEE, August 2018
Manjezi, Z., Botha, R.A.: From concept to practice: untangling the direct-control cycle. In: Proceedings of the 9th International Conference on Information Communication and Management, pp. 101–105, August 2019. https://doi-org.vu-nl.idm.oclc.org/10.1145/3357419.3357427
Maynard, S.B., Tan, T., Ahmad, A., Ruighaver, T.: Towards a framework for strategic security context in information security governance. Pacific Asia J. Assoc. Inf. Syst. 10(4) (2018)
Nicho, M.: A process model for implementing information systems security governance. Inf. Comput. Secur. 26(1), 10–38 (2018). https://doi.org/10.1108/ICS-07-2016-0061
O’Reilly, C.A., III., Tushman, M.L.: Organizational ambidexterity: past, present, and future. Acad. Manage. Perspect. 27(4), 324–338 (2013)
Risi, D., Wickert, C.: Reconsidering the ‘symmetry’ between institutionalization and professionalization: the case of corporate social responsibility managers. J. Manage. Stud. 54(5), 613–646 (2017)
Salovaara, A., Lyytinen, K., Penttinen, E.: High reliability in digital organizing: mindlessness, the frame problem, and digital operations. MIS Q. (2019). https://doi.org/10.25300/MISQ/2019/14577
Schinagl, S., Shahim, A.: What do we know about information security governance? “From the basement to the boardroom”: towards digital security governance. Inf. Comput. Secur. 28(2), 261–292 (2020). https://doi.org/10.1108/ICS-02-2019-0033
Slayton, R.: Governing uncertainty or uncertain governance? Information security and the challenge of cutting ties. Sci. Technol. Hum. Value 46(1), 81–111 (2021). https://doi.org/10.1177/0162243919901159
Smith, P., Beretta, M.: The gordian knot of practicing digital transformation: coping with emergent paradoxes in ambidextrous organizing structures. J. Product Innov. Manage. (2020)
Spremić, M., Šimunic, A.: Cyber security challenges in digital economy. In: Proceedings of the World Congress on Engineering, vol. 1, pp. 341–346 (2018)
Suddaby, R., Viale, T.: Professionals and field-level change: institutional work and the professional project. Curr. Sociol. 59(4), 423–442 (2011). https://doi.org/10.1177/0011392111402586
Vial, G.: Understanding digital transformation: ä review and a research agenda. J. Strat. Inf. Syst. 28(2), 118–144 (2019). https://doi.org/10.1016/j.jsis.2019.01.003
Von Solms, V., Von Solms, B.: Information security governance: a model based on the Direct-Control Cycle’. Comput. Secur. 25(6), 408–412 (2006). https://doi.org/10.1016/j.cose.2006.07.005
Weick, K.E., Sutcliffe, K.M., Obstfeld, D.: Organizing for high reliability: processes of collective mindfulness. In: Sutton, R.S., Staw, B.M. (eds.) Research in Organizational Behavior, vol. 1, pp. 81–123. JAI Press, Stanford (1999)
Wong, C.K., Maynard, S.B., Ahmad, A., Naseer, H.: Information security governance: a process model and pilot case study. In: Forty-First International Conference on Information Systems, India (2020)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2021 IFIP International Federation for Information Processing
About this paper
Cite this paper
Schinagl, S., Khapova, S., Shahim, A. (2021). Tensions that Hinder the Implementation of Digital Security Governance. In: Jøsang, A., Futcher, L., Hagen, J. (eds) ICT Systems Security and Privacy Protection. SEC 2021. IFIP Advances in Information and Communication Technology, vol 625. Springer, Cham. https://doi.org/10.1007/978-3-030-78120-0_28
Download citation
DOI: https://doi.org/10.1007/978-3-030-78120-0_28
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-78119-4
Online ISBN: 978-3-030-78120-0
eBook Packages: Computer ScienceComputer Science (R0)