A Risk Management Model for an Academic Institution's Information System

2.1. University IT Security

Due to the universities’ role as knowledge-intensive organizations, protecting their information is a public policy priority (Mok, 2005). Despite the value of the information stored in their systems, Mensch and Wilkie (2011, p. 91) find that “universities openly share a substantial amount of information and data, web sites are rarely banned and message content is not filtered”. Beyond the need to prevent the theft of valuable information, universities must also deal with the growing problem of student cheating. Three of four college students reported cheating at some point during their studies (Dick et al. 2003), with student cheating including hacking into the information systems to change grades (Smith, 2014). Examples of IT security models in academic institutions are Sridhar & Ahuja (2007) who present an implementation of security management infrastructure in a business school in India, and Drevin, Kruger & Steyn (2007) in a South African university.

Researchers have investigated the student features that affect the likelihood of computer-related crime and cheating. Our research is conducted in a college in which the majority of the student body is orthodox (religious) Jews pursuing computer sciences and related engineering degrees. Interestingly, Cronan (2006) reports that computer-savvy students are more likely to commit computer crime whereas Burton, Talpad & Haynes (2011) find that a high level of religiosity is associated with less academic cheating.