IDEAS home Printed from https://ideas.repec.org/a/spr/infosf/v22y2020i1d10.1007_s10796-018-9855-6.html
   My bibliography  Save this article

Benchmarking Methodology for Information Security Policy (BMISP): Artifact Development and Evaluation

Author

Listed:
  • Martin (Dae Youp) Kang

    (The University of Memphis)

  • Anat Hovav

    (Korea University Business School)

Abstract

The benchmarking of information security policies has two challenges. Organizations are reluctant to share data regarding information security and no two organizations are identical. In this paper, we attempt to propose an artifact for a benchmarking method of information security policy, which can resolve the above challenges. We employ design science methodology, activity theory and international standards to design the artifact as a proof of concept. The artifact facilitates the implementation of efficient information security policies. Organizations can utilize the artifact to analyze and benchmark information security policies. We illustrate the completeness and reliability of the artifact through a case study using information security policies from six companies.

Suggested Citation

  • Martin (Dae Youp) Kang & Anat Hovav, 2020. "Benchmarking Methodology for Information Security Policy (BMISP): Artifact Development and Evaluation," Information Systems Frontiers, Springer, vol. 22(1), pages 221-242, February.
    • Handle: RePEc:spr:infosf:v:22:y:2020:i:1:d:10.1007_s10796-018-9855-6
    DOI: 10.1007/s10796-018-9855-6
    as

    Download full text from publisher

    File URL: http://link.springer.com/10.1007/s10796-018-9855-6
    File Function: Abstract
    Download Restriction: Access to the full text of the articles in this series is restricted.
    File URL: https://libkey.io/10.1007/s10796-018-9855-6?utm_source=ideas
    LibKey link: if access is restricted and if your library uses this service, LibKey will redirect you to where you can use your library subscription to access this item
    ---><---

    As the access to this document is restricted, you may want to search for a different version of it.

    References listed on IDEAS

    as
    1. Daniel Schatz & Rabih Bashroush, 2017. "Economic valuation for information security investment: a systematic literature review," Information Systems Frontiers, Springer, vol. 19(5), pages 1205-1228, October.
    2. Anastasia Papazafeiropoulou & Konstantina Spanaki, 2016. "Understanding governance, risk and compliance information systems (GRC IS): The experts view," Information Systems Frontiers, Springer, vol. 18(6), pages 1251-1263, December.
    3. John D’Arcy & Anat Hovav, 2009. "Does One Size Fit All? Examining the Differential Effects of IS Security Countermeasures," Journal of Business Ethics, Springer, vol. 89(1), pages 59-71, May.
    4. Derrick Huang, C. & Hu, Qing & Behara, Ravi S., 2008. "An economic analysis of the optimal information security investment in the case of a risk-averse firm," International Journal of Production Economics, Elsevier, vol. 114(2), pages 793-804, August.
    5. Simone Kriglstein & Maria Leitner & Sonja Kabicher-Fuchs & Stefanie Rinderle-Ma, 2016. "Evaluation Methods in Process-Aware Information Systems Research with a Perspective on Human Orientation," Business & Information Systems Engineering: The International Journal of WIRTSCHAFTSINFORMATIK, Springer;Gesellschaft für Informatik e.V. (GI), vol. 58(6), pages 397-414, December.
    6. Stefan Strecker & David Heise & Ulrich Frank, 2011. "RiskM: A multi-perspective modeling method for IT risk assessment," Information Systems Frontiers, Springer, vol. 13(4), pages 595-611, September.
    7. Richard Baskerville & Jan Pries-Heje, 2010. "Explanatory Design Theory," Business & Information Systems Engineering: The International Journal of WIRTSCHAFTSINFORMATIK, Springer;Gesellschaft für Informatik e.V. (GI), vol. 2(5), pages 271-282, October.
    8. Ting Li & Zongmin Ma, 2017. "Object-stack: An object-oriented approach for top-k keyword querying over fuzzy XML," Information Systems Frontiers, Springer, vol. 19(3), pages 669-697, June.
    9. Ting Li & Zongmin Ma, 0. "Object-stack: An object-oriented approach for top-k keyword querying over fuzzy XML," Information Systems Frontiers, Springer, vol. 0, pages 1-29.
    10. Joseph G. Walls & George R. Widmeyer & Omar A. El Sawy, 1992. "Building an Information System Design Theory for Vigilant EIS," Information Systems Research, INFORMS, vol. 3(1), pages 36-59, March.
    11. Anat Goldstein & Ulrich Frank, 2016. "Components of a multi-perspective modeling method for designing and managing IT security systems," Information Systems and e-Business Management, Springer, vol. 14(1), pages 101-140, February.
    12. Daniel Schatz & Rabih Bashroush, 0. "Economic valuation for information security investment: a systematic literature review," Information Systems Frontiers, Springer, vol. 0, pages 1-24.
    13. John D'Arcy & Anat Hovav & Dennis Galletta, 2009. "User Awareness of Security Countermeasures and Its Impact on Information Systems Misuse: A Deterrence Approach," Information Systems Research, INFORMS, vol. 20(1), pages 79-98, March.
    Full references (including those not matched with items on IDEAS)

    Most related items

    These are the items that most often cite the same works as this one and are cited by the same works as this one.
    1. Simon Trang & Benedikt Brendel, 2019. "A Meta-Analysis of Deterrence Theory in Information Security Policy Compliance Research," Information Systems Frontiers, Springer, vol. 21(6), pages 1265-1284, December.
    2. Mazaher Kianpour & Stewart J. Kowalski & Harald Øverby, 2021. "Systematically Understanding Cybersecurity Economics: A Survey," Sustainability, MDPI, vol. 13(24), pages 1-28, December.
    3. Oliver Thomas & Simon Hagen & Ulrich Frank & Jan Recker & Lauri Wessel & Friedemann Kammler & Novica Zarvic & Ingo Timm, 2020. "Global Crises and the Role of BISE," Business & Information Systems Engineering: The International Journal of WIRTSCHAFTSINFORMATIK, Springer;Gesellschaft für Informatik e.V. (GI), vol. 62(4), pages 385-396, August.
    4. Roman Beck & Sven Weber & Robert Wayne Gregory, 2013. "Theory-generating design science research," Information Systems Frontiers, Springer, vol. 15(4), pages 637-651, September.
    5. Chang-Gyu Yang & Hee-Jun Lee, 2016. "A study on the antecedents of healthcare information protection intention," Information Systems Frontiers, Springer, vol. 18(2), pages 253-263, April.
    6. Chenglong Zhang & Nan Feng & Jianjian Chen & Dahui Li & Minqiang Li, 0. "Outsourcing Strategies for Information Security: Correlated Losses and Security Externalities," Information Systems Frontiers, Springer, vol. 0, pages 1-18.
    7. Stephan Diederich & Alfred Benedikt Brendel & Lutz M. Kolbe, 2020. "Designing Anthropomorphic Enterprise Conversational Agents," Business & Information Systems Engineering: The International Journal of WIRTSCHAFTSINFORMATIK, Springer;Gesellschaft für Informatik e.V. (GI), vol. 62(3), pages 193-209, June.
    8. Chenglong Zhang & Nan Feng & Jianjian Chen & Dahui Li & Minqiang Li, 2021. "Outsourcing Strategies for Information Security: Correlated Losses and Security Externalities," Information Systems Frontiers, Springer, vol. 23(3), pages 773-790, June.
    9. Martin Eling & Michael McShane & Trung Nguyen, 2021. "Cyber risk management: History and future research directions," Risk Management and Insurance Review, American Risk and Insurance Association, vol. 24(1), pages 93-125, March.
    10. Petar Radanliev & David Roure & Max Kleek & Uchenna Ani & Pete Burnap & Eirini Anthi & Jason R. C. Nurse & Omar Santos & Rafael Mantilla Montalvo & La’Treall Maddox, 2021. "Dynamic real-time risk analytics of uncontrollable states in complex internet of things systems: cyber risk at the edge," Environment Systems and Decisions, Springer, vol. 41(2), pages 236-247, June.
    11. Zhen Zhao & Zongmin Ma & Li Yan, 2021. "An Efficient Classification of Fuzzy XML Documents Based on Kernel ELM," Information Systems Frontiers, Springer, vol. 23(3), pages 515-530, June.
    12. David Rios Insua & Aitor Couce‐Vieira & Jose A. Rubio & Wolter Pieters & Katsiaryna Labunets & Daniel G. Rasines, 2021. "An Adversarial Risk Analysis Framework for Cybersecurity," Risk Analysis, John Wiley & Sons, vol. 41(1), pages 16-36, January.
    13. Jeffrey D. Wall & Prashant Palvia & John D’Arcy, 2022. "Theorizing the Behavioral Effects of Control Complementarity in Security Control Portfolios," Information Systems Frontiers, Springer, vol. 24(2), pages 637-658, April.
    14. Michael Blaschke & Uwe Riss & Kazem Haki & Stephan Aier, 2019. "Design principles for digital value co-creation networks: a service-dominant logic perspective," Electronic Markets, Springer;IIM University of St. Gallen, vol. 29(3), pages 443-472, September.
    15. Anders Dalén & Jan Krämer, 2017. "Towards a User-Centered Feedback Design for Smart Meter Interfaces to Support Efficient Energy-Use Choices," Business & Information Systems Engineering: The International Journal of WIRTSCHAFTSINFORMATIK, Springer;Gesellschaft für Informatik e.V. (GI), vol. 59(5), pages 361-373, October.
    16. Viviana Bastidas & Iris Reychav & Alon Ofir & Marija Bezbradica & Markus Helfert, 2022. "Concepts for Modeling Smart Cities," Business & Information Systems Engineering: The International Journal of WIRTSCHAFTSINFORMATIK, Springer;Gesellschaft für Informatik e.V. (GI), vol. 64(3), pages 359-373, June.
    17. Yosra Miaoui & Noureddine Boudriga, 2019. "Enterprise security investment through time when facing different types of vulnerabilities," Information Systems Frontiers, Springer, vol. 21(2), pages 261-300, April.
    18. Amanda M. Y. Chu & Mike K. P. So & Ray S. W. Chung, 2018. "Applying the Randomized Response Technique in Business Ethics Research: The Misuse of Information Systems Resources in the Workplace," Journal of Business Ethics, Springer, vol. 151(1), pages 195-212, August.
    19. Amanda M. Y. Chu & Mike K. P. So, 2020. "Organizational Information Security Management for Sustainable Information Systems: An Unethical Employee Information Security Behavior Perspective," Sustainability, MDPI, vol. 12(8), pages 1-25, April.
    20. Xing Gao & Weijun Zhong & Shue Mei, 2015. "Security investment and information sharing under an alternative security breach probability function," Information Systems Frontiers, Springer, vol. 17(2), pages 423-438, April.

    Corrections

    All material on this site has been provided by the respective publishers and authors. You can help correct errors and omissions. When requesting a correction, please mention this item's handle: RePEc:spr:infosf:v:22:y:2020:i:1:d:10.1007_s10796-018-9855-6. See general information about how to correct material in RePEc.

    If you have authored this item and are not yet registered with RePEc, we encourage you to do it here. This allows to link your profile to this item. It also allows you to accept potential citations to this item that we are uncertain about.

    If CitEc recognized a bibliographic reference but did not link an item in RePEc to it, you can help with this form .

    If you know of missing items citing this one, you can help us creating those links by adding the relevant references in the same way as above, for each refering item. If you are a registered author of this item, you may also want to check the "citations" tab in your RePEc Author Service profile, as there may be some citations waiting for confirmation.

    For technical questions regarding this item, or to correct its authors, title, abstract, bibliographic or download information, contact: Sonal Shukla or Springer Nature Abstracting and Indexing (email available below). General contact details of provider: http://www.springer.com .

    Please note that corrections may take a couple of weeks to filter through the various RePEc services.

    IDEAS is a RePEc service. RePEc uses bibliographic data supplied by the respective publishers.