One area that has scarcely received attention in the IT security literature, is the role that individual compliance plays in preventing cyber-attacks. Specifically, how individuals take precautions, how they are motivated to take precautions, and the impact of corporate security policies on individual precaution-taking behaviour have not been extensively researched. Existing literature has underdeveloped conceptualizations of how these control systems work in the realm of information security. This chapter adds to the body of knowledge concerning the socio-organizational perspective for understanding IT security management in the organization that implement VLITP. It examines the VLITP implementation process for achieving IT security management BS 7799 Part 2 certification. The author also gives regards to the role of individual perceptions of the compulsion of controls as a significant part of the IT security process. Focusing more on behavioural aspects of security during the implementation of VLITP, this book considers Information security is to be different from computer security—which is the encompassing of information security in addition to the other aspects of security such as technical aspects, physical security, system security, networking issues, and so forth.. IT security risk considerations cause are capable of causing particular concern on the interdependence of IT systems and inject another element of complexity in the application of the policies governing VLITPs.
TopIntroduction
The primary purpose of this chapter is to identify the best approaches for integrating security into the delivery process of VLITP and improve the security of the facility throughout its life cycle. A secondary, though no less important, purpose is to provide a method to assess the impacts of common security approaches on key business outcomes for every sub-project objectives—including project cost, schedule, safety performance, etc.
Important concepts in the security objectives of VLITP deal with the issue of personal information—a valuable asset for doing business over the Internet. The host organization relies on its customers’ personal information not only to enable basic transactions and operations of their business but also to identify new business opportunities. Many risks could be involved in its e-commerce transaction such as poor product quality, unauthorized sharing of personal information, among others. We focus, in this chapter, on privacy risks relating to IT security when implementing VLITP by looking at two privacy beliefs formed from the assessment of privacy risks:
- •
Privacy protection is the subjective probability that customers of the host organization believe that their private information is fully protected according to their expected high standard (Pavlou and Chellappa 2001).
- •
Privacy risk on the other is where the host organization recognizes a potential loss associated with releasing personal information to the service provided implementing VLITP (Malhotra et al, 2004).
The above contrary privacy beliefs reflect different aspects of VLITP security risk assessment and their separation may allow the examination of the data privacy issues more closely. While both privacy beliefs may seem related, they are often driven or wrought by different factors; thus, play different roles in influencing IT security policies, behaviors and decisions during the implementation of VLITP. Although privacy protection belief is not related to the explicit benefits of the primary exchange, consumers with a high privacy protection belief should perceive more control over privacy risks and are more likely to disclose customers’ personal information. Conversely, host organizations in highly critical industry (i.e. healthcare or defense), quite often perceive a greater loss potential and may be wary about the disclosure of their customers’ personal information during the implementation of VLITP.
BS 7799 stems from the publication of A Code of Practice for Information Security Management in 1993 and then of BS 7799 Part 1 in 1995 in the United Kingdom. It emphasizes more on the development of an IS security management framework and policy, than the technical requirements of IT projects. While previous success of BS 7799 (Part 1) has led to its transformation into an international standard ISO/IEC 17799 (in 2000), BS 7799 Part 2 remains the associated certificate scheme (developed in December 2005) as ISO/IEC 27001. Backhouse et al (2006) describes the institutionalization process of BS 7799 at industry and international levels. This chapter examines the human aspects and organizational issues of BS 7799 during the implementation of VLITP and achieving BS 7799 Part 2 certificate as an evidence of institutionalize IT security management practice in the host organization.