A Research Framework for Information Systems Security

Securing the IT infrastructure and the data it contains is one of the most critical components of IT that management faces today. Technologies such as the Internet and the wide-spread dissemination of computers to more users has increased the vulnerabilities of IT infrastructures as well as the likelihood of internal and external threats to companies. Managers are able to prevent or mitigate some of the damage caused by these attacks by aligning security policies with IT infrastructures to protect the organization’s information capital. The purpose of this study was to examine security articles in top-tier IS journals from 1996 to 2005 to determine what types of security research has been performed, to find out if a comprehensive framework for security in IS exists, and; if not, to develop a framework based upon the current literature and theory. Through the analysis of hypotheses, frameworks, and variables, security research appears to be very narrow and highly fragmented, suggesting security research remains fertile, yet immature. Additionally, no comprehensive framework was present in the analyzed literature; thus a comprehensive research framework is proposed for IS security