Information Security by Words Alone: The Case for Strong Security Policies

Addressing The Problem

U.S. businesses have a strong interest in data protection and the efforts that are underway to protect the personal information of its customer community. From a business standpoint, policy is used to specify the company’s approach to security. Management selects and implements technology, but it is policy that guides and coordinates the selection and implementation of technologies. Security policy issues ranked sixth in an international survey of 874 certified information system security professionals (Knapp, Marshall, Rainer, and Morrow, 2006). There is no evidence that the importance of security policies should or will change in the foreseeable future.

Web-based security policies must reach beyond protecting against the threats of hackers and must extend to the causes of and solutions to insider threats. These Internal security breaches often result from worker stress brought on by organizational change or unpredictability. Events that may trigger internal breaches include “reengineering, downsizing, upsizing, mergers or acquisitions, rapid changes in markets or the economy, litigation, organized labor actions, and other traumatic phenomena” (Parker, 1996, p. 21). Although a company safeguards personal information from traditional hackers, there is evidence from the authoritative CSI Annual Security Survey respondents that more serious problems exist as “insider attacks edged out virus incidents as the most pressing security problem” (Richardson, 2007, p. 2).