Understanding information security strategy in organisations

© 2018 Craig Andrew HorneThe research topic under investigation in this thesis is information security strategy in organisations and I propose a substantive theory for understanding this phenomenon under varying environmental and internal conditions. My original contribution to knowledge includes a definition for information security strategy, criteria for organisational environment and information assessment, a conceptual model of information security strategy, a substantive theory on information security strategy, and a descriptive set of benefits that can be adopted after strategy selection and approval. Organisations are progressively undertaking digital transformation of their products and services to reduce costs, improve customer relationships, and consolidate operations. Information is the “lifeblood” of any organisation and is increasingly being used to support this digital transformation across the entire organisation. Yet, the boundaries of information, its value, and importance in supporting organisational goals are frequently overlooked, creating security exposures and vulnerabilities. One reason for this is a lack of attention paid to cataloguing and controlling valuable information being used as a business resource. Others are that usage of emerging disruptive technology such as cloud-based applications can create porous network borders, that security controls used to protect information can be expensive and complex, and that organisational leaders may resist the implementation of security controls due to a perception that they impede productivity. This then leads to increased risk to information, affecting organisational leaders in the governing body, who currently have no consistent guidance available to help them in selecting a strategy or setting a strategic direction for information security. To address this problem, I examine a range of concepts when adopting an approach to securing information, by interviewing security leaders in larger organisations. In a qualitative study, I interviewed twenty-five participants and took a phenomenological approach to understanding their lived experiences with developing and using an information security strategy. I used grounded theory methodology and techniques to analyse the interview transcripts and their organisation’s information security strategy documents when permitted, to understand significant information security concepts and their relationships in an organisational context. The results show that organisational leaders choose from four main strategies when making decisions to secure their organisation’s information, which are Fortification, Devaluation, Outsourcing and Minimisation. Their selection depends on consideration of organisational factors including constraints on outsourcing decisions and the value of information held within the organisation. This facilitated the development of a conceptual model of information security strategy and a substantive theory on information security strategy. The implications of this are that organisations can continue business operations towards the achievement of strategic goals using information as a resource, and that the selection of an information security strategy can lead to a more complete understanding of the comprehensive strategic plans required to implement operational security controls throughout an organisation, making them more applicable and cost effective