Knowledge for Managing Information Systems Security: Review and Future Research Directions

Knowledge for Managing Information Systems Security: Review and Future Research Directions

Ken H. Guo (McMaster University, Canada)
Copyright: © 2011 |Pages: 22
DOI: 10.4018/978-1-61692-016-6.ch016

Abstract

Knowledge is one of the critical factors that organizations need to consider when managing the security of resource management systems or information systems in general. This is because knowledge is not only the subject but also a tool of IS security management. On the one hand, IS security is about the security of knowledge (including data and information). On the other hand, IS security management is a knowledge-intensive activity that depends heavily on IS professionals’ expertise and skills and end user awareness. Given the important role of knowledge, this chapter aims to review current security research by applying knowledge management concepts and frameworks as a tool and lens. Based on the systemic review, this chapter identifies gaps in the current information systems security literature and provides some guidelines for future research and security practices.
Chapter Preview
Top

A Brief Background Of Information Systems Security

In the IS literature, there are many seemingly similar terms used for the concept of security, e.g. computer security, information security, and information systems security, to name a few. The term of computer security is often technical-oriented and encompasses technologies such as encryption algorithm. It may also refer to the security of a single computer. Information security, according to International Standards Organization, is “the protection of information from a wide range of threats”(ISO/IEC, 2005). Information systems security differs from information security in that the former concept encompass not only data or information itself but also those systems that process and store such data and information (Theoharidou, Kokolakis, Karyda, & Kiountouzis, 2005). Despite the subtle differences, researchers and practitioners by and large use these terms interchangeably (this approach is adopted in this chapter). For example, the term of information security is also defined as the protection of both information and the systems and hardware that use, store, and transmit that information (Whitman & Mattord, 2003, p. 9).

Complete Chapter List

Search this Book:
Reset