Achieving Business Value in Information Security (PDF)

Inhaltsangabe:Abstract:
The beginning of the 21st century with the fear of the "Year 2000"-threat (Y2K) became a milestone for the "Information Age", a term coined for the post-industrial stage of leading countries ¿[¿] when information and information technologies become the main strategic national resource which results in an avalanche growth of information dependence in all spheres of society and state activities.¿. In organisations the awareness of the dependence on information has led to corporate initiatives to treat information as an asset, which includes various efforts for its protection. Management trends such as "knowledge management" have identified "knowledge sharing" as a new means for achieving competitive advantage, thus promoting information to be disseminated. Due to an ever closer relationship with customers, suppliers and even competitors, organisations have expanded their "information network" outside of the original boundaries.
The dualism of protection of information assets on the one hand and a free flow of information has been identified to become a challenge for organisations, described as ¿[¿] how to satisfy this need to share information without exposing the organization to undue risk.¿. With the information society implying radical changes, the need to act has been accelerated by a new mindset reacting to the advent of "e-business".
Information Security (InfoSec) is often mistaken to be a purely technical issue, handled by information system (IS) departments and used as a synonym for firewall, access controls, and encryption of e-mails. However, because of the risks involved for an organisation - including legal liabilities, loss of trust and severe financial damage - InfoSec needs to be a top management issue. Then again, although paying lip-service to treating information as an asset, top-management usually does not act upon it: the average InfoSec spending in the U.S. today is only 0.4 percent of an organisation¿s revenue.
In the following work it will be shown that a new approach to and a new understanding of InfoSec is vital for organisations to excel in the challenges faced by the information environment of the 21st century. The key focus of this study is to link existing InfoSec approaches to the concept of business value by ensuring their strategic fit with the corporate objectives. The first part will provide a common foundation with an evaluation of the role of information for organisations, relevant trends [...]