Embedding a Systems / Lifeworld Approach in Information Security (Risk) Management and Broadening its Application

All intellectual property rights, including copyright in this publication, except for those attributed to named sources, are owned by the author(s) of this research memorandum. No part of this publication may be copied or transmitted in any form without the prior written consent from the author(s) whose contact address is given on the title page of the research memorandum. 3 This paper is drawn from an ongoing eight-year research study that was motivated by evidence that Information Security predominantly focuses on technical issues within an environment that clearly affects and is affected by people. To address this, and give a richer understanding of the domain, Information Security (ISec) has been deconstructed using an evaluative model, which explicitly focuses on both the technical and human aspects of the domain. The outcome is a theoretically and empirically informed perspective on ISec which casts it as predominantly technical and functionalist. The research then moves on to the question of how the management of ISec may be changed to address this issue. This results in the development of an action framework for information security management explicitly based on critical social theory, together with clear guidance on implementing and testing the framework. Finally, the whole project is critically reviewed, and a discussion opened regarding future directions in the research