Octopus: University of The Aegean Research & Project Outputs System

Conference

Authors:	Karyda M., Kokolakis S., Kiountouzis E.
Title:	Content, Context, Process Analysis of IS Security Policy Formation
Conference:	18th IFIP International Conference on Information Security
Editors:	D. Gritzalis, S. de Capitani di Vimercati, P. Samarati, S.K.Katsikas
Ed:	No
Eds:	Yes
Pages:	145-156
To appear:	No
Month:	May
Year:	2003
Place:	Athens, Greece
Pubisher:	Kluwer Academic Publishers
Link:
File name:	B5.pdf##^^&&165741088.pdf
Abstract:	Security management is now acknowledged as a key constituent of Information Systems (IS) management. IS security management traditionally relies on the formation and application of security policies. Most of the research in this field address issues regarding the structure and content of security policies; whereas the context within which security policies are conceived and developed remains rather unexplored. However, security policies that are formed without taking into account the specific social and organisational environment within which they will be applied, are often proven to be inapplicable or ineffective. In this paper we explore the issues pertaining to the formation of security policies under the perspective of contextualism. Within the framework of contextualism, we study the context, content and process of IS security policies development. This paper aims to contribute to IS security research by bringing forth the issue of context-dependent formation of security policies. In addition, it provides a contextual framework, which we expect to improve the effectiveness of IS security policies development.