Octopus: University of The Aegean Research & Project Outputs System

Περιοδικό

Συγγραφείς:	Tsohou A., Karyda M., Kokolakis S., Kiountouzis E.
Τίτλος:	Formulating Information Systems Risk Management Strategies through Cultural Theory
Περιοδικό:	Information Management and Computer Security
Volume:	14
Αριθμός:	3
Σελίδες:	198-217
Έτος:	2006
Εκδότης:	Emerald
Να εμφανιστεί:	Όχι
Δεσμός:	http://www.emeraldinsight.com/journals.htm?issn=0968-5227&volume=14&issue=3&articleid=1556708
ISI:	Όχι
Impact Factor:
Όνομα αρχείου:
Περίληψη:	Purpose – The purpose of this paper is to examine the potential of cultural theory as a tool for identifying patterns in the stakeholders’ perception of risk and its effect on information system (IS) risk management. Design/methodology/approach – Risk management involves a number of human activities which are based on the way the various stakeholders perceive risk associated with IS assets. Cultural theory claims that risk perception within social groups and structures is predictable according to group and individual worldviews; therefore this paper examines the implications of cultural theory on IS risk management as a means for security experts to manage stakeholders perceptions. Findings – A basic theoretical element of cultural theory is the grid/group typology, where four cultural groups with differentiating worldviews are identified. This paper presents how these worldviews affect the process of IS risk management and suggests key issues to be considered in developing strategies of risk management according to the different perceptions cultural groups have. Research limitations/implications – The findings of this research are based on theoretical analysis and are not supported by relevant empirical research. Further research is also required for incorporating the identified key issues into information security management systems (ISMS). Originality/value – IS security management overlooks stakeholders’ risk perception; for example,there is no scheme developed to understand and manage the perception of IS stakeholders. This paper proposes some key issues that should be taken into account when developing strategies for addressing the issue of understanding and managing the perception of IS stakeholders.