Mitigating enterprise-level risks in storing sensitive data in the cloud: Implications for organizational leaders

This research study used enterprise risk management theory as the theoretical framework and social cognitive theory as the theoretical lens to review and synthesize empirical evidence to address how organizational leaders can mitigate enterprise-level risks by the hosting of sensitive data in the cloud. Cloud computing is defined as a “business model of sharing computing services such as platform, software, and infrastructure between multiple organizations over the internet” ( Mell & Grance, 2011, p. 2). An exploration of risks across the organization, enterprise leadership, and mitigation strategies that align with enterprise goals and strategic objectives wasconducted. This study is a systematic review of 35 studies on cloud adoption, enterprise risks, and leadership. Quality appraisals, data extraction, and data synthesis of the evidence from the selected studies were conducted, which resulted in findings and management recommendations which included (a) the need for a comprehensive enterprise risk assessment, (b) the need for the seamless integration of innovative enterprise-wide security software solutions, (c) recurring security training and awareness programs for employees, and (d) legal and regulatory compliance reviews.The research concluded that organizational leaders could mitigate the risks of cloud adoption by implementing the risk management strategies/recommendations, which would lead to improvements in system performance and overall cost reductions in information technology operational cost, ensuring that the organization remains competitive in their business domain.STRATEGIES FOR MITIGATING ENTERPRISE-LEVEL RISK IN THE CLOUD i ABSTRACT Title of Dissertation: MITIGATING ENTERPRISE-LEVEL RISKS IN STORING SENSITIVE DATA IN THE CLOUD: IMPLICATIONS FOR ORGANIZATIONAL LEADERS Akpo Turhobore Okoro Doctor of Business Administration, 2021 This research study used enterprise risk management theory as the theoretical framework and social cognitive theory as the theoretical lens to review and synthesize empirical evidence to address how organizational leaders can mitigate enterprise-level risks by the hosting of sensitive data in the cloud. Cloud computing is defined as a “business model of sharing computing services such as platform, software, and infrastructure between multiple organizations over the internet” (Mell & Grance, 2011, p. 2). An exploration of risks across the organization, enterprise leadership, and mitigation strategies that align with enterprise goals and strategic objectives was conducted. This study is a systematic review of 35 studies on cloud adoption, enterprise risks, and leadership. Quality appraisals, data extraction, and data synthesis of the evidence from the selected studies were conducted, which resulted in findings and management recommendations which included (a) the need for a comprehensive enterprise risk assessment, (b) the need for the seamless integration of innovative enterprise-wide security software solutions, (c) recurring security training and awareness programs for employees, and (d) legal and regulatory STRATEGIES FOR MITIGATING ENTERPRISE-LEVEL RISK IN THE CLOUD ii compliance reviews. The research concluded that organizational leaders could mitigate the risks of cloud adoption by implementing the risk management strategies/recommendations, which would lead to improvements in system performance and overall cost reductions in information technology operational cost, ensuring that the organization remains competitive in their business domain. Keywords: cloud adoption, cloud computing, cloud shared services, enterprise risk management, mitigation strategies, organizational leadership, sensitive data, social cognitive theory STRATEGIES FOR MITIGATING ENTERPRISE-LEVEL RISK IN THE CLOUD iii MITIGATING ENTERPRISE-LEVEL RISKS IN STORING SENSITIVE DATA IN THE CLOUD: IMPLICATIONS FOR ORGANIZATIONAL LEADERS By Akpo Turhobore Okoro Dissertation submitted to the School of Business, University of Maryland Global Campus, in partial fulfillment of the requirements for the degree of Doctor of Business Administration 2021 STRATEGIES FOR MITIGATING ENTERPRISE-LEVEL RISK IN THE CLOUD iv © Copyright by Akpo Turhobore Okoro 2021 STRATEGIES FOR MITIGATING ENTERPRISE-LEVEL RISK IN THE CLOUD v Dedication I want to thank the Almighty God and his son Jesus Christ before thanking my family for making this journey a success. This dissertation is most especially dedicated to my loving wife, Evelyn Okoro, and my children Jite, Enite, and Runo Okoro. Evelyn is the epitome of love, sacrifice, and selflessness who held the family together while I was working on this research study. Eva, this pursuit would not have been possible without your support. From the bottom of my heart, I say, “thank you.” To Jite, Enite, and Runo Okoro, I owe you guys everything for denying you the attention you craved while this work was ongoing. This research is also dedicated to my father, Mr. V.E Okoro (late); my mother, Mrs. Bethel Okoro; my elder brother, Mr. Ovie Okoro; and my sister in-law, Mrs. Nkechi Okoro. Mr. V.E Okoro and Mr. Ovie Okoro are the two people that helped shape my life and always believed that I could do anything, even when I doubted myself. To my brother, Ovie, I continue to say, “thank you.” To my late father, I say, you truly believed; your faith in me is what continues to propel me even though you are no longer with us. STRATEGIES FOR MITIGATING ENTERPRISE-LEVEL RISK IN THE CLOUD vi Acknowledgements I want to take this opportunity to acknowledge these significant contributors that led to my success in this program: • Dr. Wanda Wagner, my dissertation mentor, for her encouragement and guidance through this journey. Your support was instrumental to my success. • Dr. Kathleen Edwards, your words, “Nobody ever gives up on Dr. Edwards, and Dr. Wagner,” was a motivation. Thank you. • The UMGC faculty, administrative support staff, and my fellow cohort: The support from this group cannot be quantified. I have to mention Ms. Marina Caminis and Ms. Cynthia Thomes. “Thank you.” • Support and prayers from my family and friends. Mrs. Edirin, Sikprako (nee Okoro), Ufuoma, Igho, Bami, Dafe, and Jero Okoro. Ms. Mayowa Ogundiyun and Mr. Paul Obi. Your words of encouragement helped me through this process. • Mr. Dave Castille (President, FEI Systems, Inc), for supporting this journey and guiding my career growth. STRATEGIES FOR MITIGATING ENTERPRISE-LEVEL RISK IN THE CLOUD vii Table of Contents ABSTRACT .................................................................................................................................... i Dedication ...................................................................................................................................... v Acknowledgements ........................................................................................................................ vi Table of Contents .......................................................................................................................... vii List of Tables ............................................................................................................................... xii List of Figures .............................................................................................................................. xiii List of Abbreviations ................................................................................................................... xiv Chapter 1: Introduction and Overview of the Management Problem ............................................. 1 Background and Overview ....................................................................................................... 1 Cloud Shared Services and Security ................................................................................... 3 Infrastructure as a Service (IaaS). 3 Platform as a Service (PaaS). 4 Software as a Service (SaaS). 4 Cloud Security. 4 Enterprise Risk and Executive Leadership ......................................................................... 5 Enterprise Risk. 5 Executive Leadership. 6 Sensitive Information .......................................................................................................... 7 Problem Statement and Significance of the Problem ............................................................... 8 Research Problem ............................................................................................................... 8 Problem Significance .......................................................................................................... 9 Purpose of the Study and the Research Question ..................................................................... 9 Purpose of the Study ........................................................................................................... 9 Research Question ............................................................................................................ 10 STRATEGIES FOR MITIGATING ENTERPRISE-LEVEL RISK IN THE CLOUD viii Significance of the Study ........................................................................................................ 10 Discussion of Concepts and Themes ...................................................................................... 11 Definitions and Terminology .................................................................................................. 13 Chapter Summary ................................................................................................................... 14 Organization of the Dissertation ............................................................................................. 15 Chapter 2: Scoping Literature Review and Theoretical Framework ............................................ 16 Scoping Literature ................................................................................................................... 16 Information Security Theory ............................................................................................. 16 Risk Management .............................................................................................................. 20 Enterprise Risk Management (ERM) Theory .................................................................... 22 Define Corporate Philosophy and Objectives. 24 Risk Identification. 24 Quantify Risk. 25 Risk Treatment. 25 Define Risk Management Policies/Procedures. 27 Risk Control/Strategies. 27 Monitor and Communicate. 27 Review and Performance. 27 Organizational Management ............................................................................................ 29 Leadership Levels. 30 Leadership Relationships. 31 Theoretical Framework ........................................................................................................... 32 Theoretical Lens: Social Cognitive Theory ...................................................................... 32 Conceptual Framework ........................................................................................................... 35 Chapter Summary ................................................................................................................... 37 Chapter 3: Method ........................................................................................................................ 38 STRATEGIES FOR MITIGATING ENTERPRISE-LEVEL RISK IN THE CLOUD ix Research Design and Methodology ........................................................................................ 38 Evidence-Based Research Framework ............................................................................. 39 Systematic Reviews ........................................................................................................... 41 Systematic Review Process ............................................................................................... 42 Search Initiation. 43 Review Question and Methodology. 44 Search Strategy. 44 Search Process and Terms. 45 Inclusion and Exclusion Criteria from the Search String. 46 Inclusion/Exclusion Scan of Article Titles, Keywords, and Abstracts. 48 Quality Appraisal of the Included Studies ........................................................................ 48 Synthesis, Data Extraction, and Coding ........................................................................... 50 Chapter Summary ................................................................................................................... 50 Chapter 4: Analysis and Findings ................................................................................................. 52 Review of the Research Question ........................................................................................... 52 Description of the Dataset ....................................................................................................... 52 Results of Search String and Limiters ............................................................................... 53 Results of Scanning Titles, Keywords, and Abstracts for Inclusion and Exclusion .......... 55 Additional Study Characteristics ...................................................................................... 55 Results of the Quality Appraisal and Coding of Data ............................................................. 58 Quality Appraisal .............................................................................................................. 59 Coding and Coding Categories ........................................................................................ 60 Descriptive Themes ........................................................................................................... 63 Findings and Discussion ......................................................................................................... 65 STRATEGIES FOR MITIGATING ENTERPRISE-LEVEL RISK IN THE CLOUD x Finding 1. Cloud Adoption by Organizational Leaders Leads to an Overall Reduction in IT Operational Cost .......................................................................................................... 66 Finding 2. The Decision to Adopt Cloud Technologies Depends on the Outcome of a Comprehensive Enterprise Risk Analysis and Assessment ............................................... 68 Finding 3. Recurring User Awareness and Cybersecurity Training Programs Reduce Security Breaches.............................................................................................................. 70 Finding 4. Innovative and Advanced Technology Software Solutions ............................. 73 Finding 5. Corporate Alignments, Contracts, Vendor Management, and Legal Implications...................................................................................................................... 75 Finding 6. Social Cognitive Theory (SCT) and Its Impact on the Successful Development of Organizational Risk Management Strategies ............................................................... 77 Finding 7. Enterprise Risk Management (ERM) Theory and the Relationship Between its Elements and the Evidence ............................................................................................... 79 Summary of Findings ........................................................................................................ 83 Revised Conceptual Model/Framework ................................................................................. 83 Chapter Summary ................................................................................................................... 86 Chapter 5: Conclusions and Implications ..................................................................................... 87 Answer to the Research Question ........................................................................................... 87 Management Implications (Recommendations) ..................................................................... 89 Recommendation 1 - Implementation of a Comprehensive Risk Assessment ................... 90 Recommendation 2 - Integration of Innovative Enterprise-Wide Security Solutions in the Security Plan ..................................................................................................................... 90 STRATEGIES FOR MITIGATING ENTERPRISE-LEVEL RISK IN THE CLOUD xi Recommendation 3 - Continuous Employee Security Training and Risk Awareness Program ............................................................................................................................ 91 Recommendation 4 - Legal and Regulatory Compliance Review ..................................... 91 Limitations of the Study.......................................................................................................... 92 Areas for Future Research ................................................................................................ 94 Final Summary and Conclusion .............................................................................................. 95 References .................................................................................................................................... 98 Appendix A ................................................................................................................................ 114 Appendix B ................................................................................................................................ 126 STRATEGIES FOR MITIGATING ENTERPRISE-LEVEL RISK IN THE CLOUD xii List of Tables Table 1 Search Keywords ................................................................................................. 45 Table 2 Inclusion Criteria ................................................................................................. 46 Table 3 Exclusion Criteria ................................................................................................ 47 Table A1 Database Searched and Other Sources .......................................................... 114 Table A2 Rubrics ............................................................................................................ 115 Table A3 Quality Appraisal ............................................................................................ 116 Table A4 Data Extraction .............................................................................................. 118 Table B1 Dissertation Codebook .................................................................................... 126 Table B2 Coding ............................................................................................................. 129 Table B3 Mapping of Study Findings ............................................................................. 133 STRATEGIES FOR MITIGATING ENTERPRISE-LEVEL RISK IN THE CLOUD xiii List of Figures Figure 1 A Theory of Information Security ....................................................................... 18 Figure 2 Risk Management Evolution ............................................................................... 21 Figure 3 Enterprise Risk Management Framework .......................................................... 23 Figure 4 Management Hierarchy ...................................................................................... 30 Figure 5 Social Cognitive Theory (SCT) Model ............................................................... 33 Figure 6 Enterprise Risk Research Mitigation Model ...................................................... 35 Figure 7 The Four Elements of Evidence-Based Management (EBMgt) .......................... 39 Figure 8 The Systematic Review Process .......................................................................... 42 Figure 9 PRISMA Flowchart ............................................................................................ 54 Figure 10 Study Methodology ........................................................................................... 56 Figure 11 Organizational Sector ...................................................................................... 57 Figure 12 Country of Study ............................................................................................... 58 Figure 13 Quality Appraisal Outcome .............................................................................. 59 Figure 14 Codes and Categories....................................................................................... 61 Figure 15 Descriptive Themes – Enterprise Risk Management (ERM) Theory ................ 63 Figure 16 Descriptive Themes – Social Cognitive Theory (SCT) ..................................... 64 Figure 17 Enhanced Conceptual Risk Mitigation Model .................................................. 84 STRATEGIES FOR MITIGATING ENTERPRISE-LEVEL RISK IN THE CLOUD xiv List of Abbreviations • Application Programming Interface – API • Enterprise Risk Management – ERM • Evidence Based Management - EBMgt • Chief Information Officer – CIO • Context Intervention Mechanism Outcome - CIMO • Committee of Sponsoring Organizations - COSO • Federal Information Security Management Act – FISMA • Infrastructure as a Service – IaaS • National Institute of Standards and Technology – NIST • Incident Response Plan – IRP • Information Security Theory – IST • Institute of Management and Accounting - IMA • Operating System (OS) • Personal Identifying Information – PII • Platform as a Service – PaaS • Preferred Reporting Items for Systematic Reviews and Meta-Analysis - PRISMA • Rules of Behavior – RoB • Social Cognitive Theory - SCT • Software as a Service – SaaS • Systematic R