Information Security Policy Research Agenda

Abstract

For the past two decades, it has been argued that an ‘information revolution’ is taking place that is having a significant impact upon all aspects of organizational life (e.g., Porter & Millar, 1985; Drucker, 1988). If applied effectively as a strategic resource, investment in information can result in the realization of significant corporate benefits. Indeed it has been contended that “information is the firm’s primary strategic asset” (Glazer, 1993), and elsewhere that it is the “lifeblood of the organization” (CBI, 1992) contributing directly, as it does, to the organization’s operational performance and financial health. (Bowonder & Miyake, 1992; McPherson, 1996). However, information can only be recognized as a vital organizational resource if managers can readily gain access to it when required. Unfortunately, as a consequence of the high incidence of security breaches, many organizations are failing to consistently provide the information resources that their managers require (Angell, 1996; Gaston, 1996).