The Community for Technology Leaders
RSS Icon
Subscribe
Issue No.03 - May-June (2012 vol.10)
pp: 57-63
Karen Renaud , University of Glasgow, Glasgow
ABSTRACT
Information breaches demand a vigorous response from organizations. The traditional response is to institute policies to constrain and control employee behavior. Information security policies inform employees about appropriate uses of information technology in an organization. Unfortunately, limited evidence exists that such policies effectively reduce confidentiality breaches or information loss. This article explores the possible reasons for this and reports on a survey aiming to detect the presence of these factors in a UK National Health Service health board. This article argues that you must pay attention to the entire system, instead of focusing merely on individuals in the system. The survey shows how the pressures on the organization's staff members and the rules imposed by the policies often place staff in an impossible or untenable position. They sometimes feel this leaves them no option but to break the rules just to do their work. The Web extra is a list of additional resources.
INDEX TERMS
information breaches, compliance, policies, computer security, information security
CITATION
Karen Renaud, "Blaming Noncompliance Is Too Convenient: What Really Causes Information Breaches?", IEEE Security & Privacy, vol.10, no. 3, pp. 57-63, May-June 2012, doi:10.1109/MSP.2011.157
REFERENCES
1. CSI Computer Crime and Security Survey, Computer Security Inst., 2009.
2. P.F. Drucker, "Management and the World's Work," Harvard Business Rev., Sept. 1988, pp. 65–76.
3. C. Vermeulen and R. von Solms, "The Information Security Management Toolbox—Taking the Pain out of Security Management," Information Management & Computer Security, vol. 10, no. 3, 2002, pp. 119–125.
4. M.E. Thomson and R. von Solms, "Information Security Awareness: Educating Your Users Effectively," Information Management & Computer Security, vol. 6, no. 4, 1998, pp. 167–173.
5. P. Mascini, "The Blameworthiness of Health and Safety Rule Violations," Law & Policy, vol. 27, no. 3, 2005, pp. 472–490.
6. A. Adams and M.A. Sasse, "Users Are Not the Enemy: Why Users Compromise Security Mechanisms and How to Take Remedial Measures," Comm. ACM, vol. 42, no. 12, 1999, pp. 40–46.
7. D. Florêncio and C. Herley, "A Large-Scale Study of Web Password Habits," Proc. 16th Ann. Conf. World Wide Web (WWW 07), ACM, 2007, pp. 657–666.
8. J. Finegan, "The Impact of Personal Values on Judgments of Ethical Behaviour in the Workplace," J. Business Ethics, vol. 13, no. 9, 1994, pp. 747–755.
9. J.E. Driskell and E. Salas, Stress and Human Performance, Lawrence Erlbaum, 1996.
10. E.B. Dent and S. Galloway Goldberg, "Challenging 'Resistance to Change,'" J. Applied Behavioral Science, vol. 35, no. 1, 1999, pp. 25–41.
11. K. Höne and J.H.P. Eloff, "What Makes an Effective Information Security Policy?," Network Security, June 2002, pp. 14–16.
12. J.K. White and R.A. Ruh, "Effects of Personal Values on the Relationship between Participation and Job Attitudes," Administrative Science Q., vol. 18, no. 4, 1973, pp. 506–514.
13. A.E. Bauman et al., "Asthma Information: Can It Be Understood?," Health Education Research, vol. 4, no. 3, 1989, pp. 377–382.
14. P. Slovic and A. Tversky, "Who Accepts Savage's Axiom?," Behavioral Science, vol. 19, no. 6, 1974, pp. 368–373.
15. A. Degani, "Pilot Error in the 90s: Still Alive and Kicking," keynote address at 44th Ann. Meeting Flight Safety Foundation/Nat'l Business Aviation Assoc. (FSF/NBAA 99), 1999; http://ti.arc.nasa.gov/m/profile/adegani Pilot%20Error%20in%20the%2090s.pdf.
22 ms
(Ver 2.0)

Marketing Automation Platform Marketing Automation Tool