Juhani
Anttila
Venture Knowledgist Quality Integration
Helsinki, Finland
www.QualityIntegration.biz
BUSINESS-INTEGRATED
INFORMATION SECURITY MANAGEMENT AND BUSINESS LEADERS' ROLE
Introduction
Information and knowledge are basic building blocks of our modern
society and need to be managed properly. This paper approaches the
question of information security from the viewpoint of business
management. Information security is not a separate entity, isolated
from other business practices; rather, it constitutes an integral
part of the modern business management system, and supports the
organization to achieve and maintain a competitive advantage over
its business rivals. The aim for business performance, including
information security, is superiority over competitors. Fulfilling
only the minimum requirements or achieving mediocrity is not enough.
Since modern businesses are based on a process approach, also information
security should be integrated into the management of business processes.
[22]
Business leaders' role is crucial in striving for information security
in all kinds of organizations. Situation in practice, however, is
not adequate. There are much guidance and education available but
that does not seem to help or even may make situation more confusing.
The problem is considered in this paper on the basis of the synthesis
of multiple research references through the following questions:
What is the state of art in business people commitment to information
security? Why is business leaders' commitment to information security
crucial? Why is senior executives' commitment to information security
in practice not satisfactory? After a comprehensive analysis the
paper proposes practical advice to what should be done for enhancing
organizations' senior executives' commitment to information security.
Key aspect of the proposed management approach is to reinforce integration
and awareness of information security within the organizations and
then to use innovative methodology for managing information security.
This kind of comprehensive approach has been considered only very
little in the existing literature that typically deal it and its
sub-areas as distinct expert issues. [21]
Information and security
Information forms the basis of all intelligent activities. Thus,
the performance of individuals and organizations depends on acquiring
useful knowledge at the right time and using it to manage and improve
their operational business and prepare their strategic plans for
the future. This observation is relevant for all kinds of organizations,
including private companies, public civil service organizations
as well as third sector voluntary and not-for-profit organizations.
Many organizations collaborate with their stakeholders on a global
scale, and they are strongly dependent on electronic information
and communication technology as well as network solutions and services.
[13]
Business knowledge is a valuable asset and is consequently highly
interesting also for others, such as business competitors and hostile
groups. Sometimes this situation is described as information war
[24]. The incidence of data abuse is on the rise, producing considerable
damage. As a result, information security and security management
have become central issues in the social and business activities
of organizations.
Integration of information security
management into business management system
Information security is related to many different topics of business
and science (see figure 1). All these aspects should be taken into
account also for practical organizational situations in an adequate
way in order to consider management of information comprehensively.
Figure 1. A comprehensive approach to information security
The implementation of information security forms an integral part
of all business activities, management activities in particular,
both on the strategic and operational management level. Thus, we
may speak of integrated information security management [10]. To
achieve its aims, information security requires a professional approach
and close cooperation between security experts and business executives.
A company with superior information security knowledge has a great
advantage over the competition, a lead that is difficult to close.
Neither technological solutions nor software-based security measures
are sufficient as such. Even in principle, it is hardly likely that
information security could be accomplished by means of separate
information security systems. These might in fact cause more harm
than benefit. Business management systems (see figure 2) have no
room for such systems; all business activities must be flavoured
by professional information security measures.
Figure 2. Elements of a typical business management system form
the basis for integrating information security management. Each
company must develop its own management practices incorporating
the necessary business needs.
Operationally, information security originates from process-related
activities and information flows between these activities. Thus,
information security is affected directly in real time through process
arrangements, tools and people which, in turn, are influenced by
appropriate and systematic process management practices. Integrating
information security practices and management, it is extremely important
to understand information security issues in the context of business
processes. This is because, in practice, information security is
a cross-functional discipline, which requires close cooperation
and multifarious expertise.
In today's world, e-business is an existing reality and offers
increasing opportunities to organizations in all sectors. It is
important to realize that Internet-based e-business is not merely
a technological issue. The Internet provides a rapidly expanding
worldwide communication infrastructure that covers all aspects of
business and life. The net includes all people, organizations, cultures
and communities, and it has already changed conditions for interaction
as well as behaviours. E-business is no longer concerned only with
explicit data and information possessed by organizations, but it
extends to tacit knowledge which people rely on in communication.
Information security should also be adapted to these new business
realities. And that is not the end of it, e-business also creates
new opportunities both for business management and operations and
- consequently - for information security [23].
All these issues relate very strongly to the decisions and actions
of the top management (the strategic viewpoint) and to the practices
used in the management of business process (the operational viewpoint).
Business people are not adequately
committed to information security
There are studies and observations from small and big companies,
governmental offices and universities that demonstrate that most
people - including business leaders - in organizations are quite
familiar with the fundamental and basic principles of information
security, recognize their importance and even may be motivated [6].
That is obviously due to a lot of general and organization-dedicated
information security information and education for increasing awareness
and skills of information security [7].
However, senior executives in those organizations [6]:
- Are not really interested in information security in their own
management practice
- Don't understand or recognize their managing role for information
security
- Have only a superficial understanding of information security
- Lack the necessary skills for managing an organization with regard
to information security
- Easily delegate their responsible duties to external consultants
or even outsource the whole issue
Therefore it is essential to understand more deeply business leaders'
role in organizational information security and reasons to the inadequate
situations.
Business leaders' commitment to information
security is crucial
All recognized references, e.g. international standards for information
security management [2-3], OECD guidelines for information security
[1], and a lot of published professional literature references for
information security emphasize the importance of senior executives'
commitment to information security. [6] They justify this e.g. with
the following facts:
- All organizations are today increasingly information-intensive
and information-dependent in their business activities, and information
security is crucial for their successful business performance and
reputation.
- Development of the information society is the major aim of societal
development all over the world. Information society is not only
a question of tomorrow but it is already an existing issue.
- Information security is a central management issue at both strategic
and operational level of management. It cannot be realized only
by experts, technology, or money.
- Information security risks are often major business risks.
- Most information security breaches and violations take place within
organizations by their own people.
- Information security is strongly an organizational culture-issue
following the behaviour and role model of the top management.
As an example, OECD's principles towards a culture of information
security [1] emphasize the managing role of business leaders comprising
awareness, responsibility, responsiveness, ethics, democracy, risk
management, security design and implementation, and assessments
for information security.
All this entails much greater emphasis on information security
than what is typical now in organizations. Commitment and actions
are expected by governments, businesses, other organizations and
individual users who develop, own, provide and manage information
services, or use information systems and networks. [7] Top managers
are in key position to get that happen in practice in their organizations.
Reasons to business leaders' poor commitment
to information security
There are many reasons why business leaders are not adequately
involved, committed, and effectively contributing to information
security [8]:
- Basic professional information security concepts, e.g. integrity,
availability, confidentiality, authority, authenticity, are difficult,
complicated and strange to business people. Organizational overall
information security performance depends on all these detailed aspects
in a complicated way.
- Information security management requires specific knowledge and
skills. The organizational information security is a fuzzy concept
(see figure 3). One should have consistent methodologies in use
in an organization to evaluate its current status, to project targets
for the future performance, and to improve continually the performance.
- Guidance materials for information security management are complicated
and confusing, and difficult to realize and apply consistently.
[1-4,8, 25] Examples include: a) General standards and guidelines,
e.g. ISO/IEC 27001:2005, ISO/IEC 27002:2005, and OECD Guidelines
b) Information technology and service references that normally consider
also information security aspects, e.g. ISO/IEC 20000:2005, ITIL,
COBIT, Sarbanes-Oxley Act, Basel ll, FISMA, HIPAA, GLBA, etc. and
c) General management references, e.g. ISO 9000 standards [4], extensive
and multifaceted general management literature, and management education,
e.g. MBA programmes, don't clarify information security as a management
issue and don't explicitly promote the issue.
- Information security is a multidisciplinary issue and difficult
to cope with simple managerial practices.
- Communication between business leaders and information security
(and other related) experts is ineffective and uncreative in general
and within organizations.
- Business leaders are very busy, subjective, authoritative, and
holistic generalists.
- External third party audits and certifications undermine business
leaders' active responsibility.
- Business information is principally based on tacit (implicit)
knowledge, and management of the security of tacit knowledge is
a sophisticated issue [14].
Figure 3. Information security is a fuzzy organizational performance
factor. There is always a certain "Is" level of information
security in organizations. It is essential to business leaders where
we are right now, what the needs, "Should be", for improvements
are, and how to carry out evaluations and necessary development
activities. [4]
Consequences when senior executives
don't commit to information security
Information security management cannot be delegated and cannot
be happen genuinely and effectively in organizations without business
leaders' consistent contributions based on their organizational
position, authority, and role. If that does not happen:
a) Information security is not being managed business-minded and
not aligned with real business needs.
b) Information security is seen only as a reactive and negative
question to fulfil some standardized requirements.
c) Organizations keep busy with separate and restricted information
security questions
d) Organizations take only "cosmetic" or superficial actions
for information security.
e) Organizations keep silent on their problems or incompetence in
information security - and suffer consequences, or hope that nothing
serious will happen.
Enhancing business leaders' commitment
to information security
Major means for enhancing business leaders' commitment to information
security consist of:
a) Integration of information security seamlessly with business
management decisions and strategic and operational activities [10,
11, 25]
b) Strengthening the general information security awareness and
culture in organization under the leadership of senior executives
[7]
Integrating information security management with business management
in organizations implies the following:
- Information security should be understood as a crucial business
issue that cannot be realized successfully without particular expert
knowledge. Information security experts have an important assisting
role for organizational information security.
- Basic concept of information security management should be clearly
a business management concept and defined as coordinated activities
to direct and control an organization with regard to information
security.
- Organizations should define clear guiding ideas and principles
for information security management reflecting their own business
needs and expectations.
- Information security management should be a responsibility of
an organization's business management that takes place through the
managing actions of business leaders. It should be embedded within
normal strategic and operational business management activities,
including managerial decisions. [10,11]
- Sound overall business management system and consistent practices
by using profound knowledge should form the steadfast basis for
a sustainable success in information security management.
- Recognized business management tools, e.g. PDCA (Plan-Do-Check-Act)
model, business process approach, and business audits and assessments,
should be used and combined with information security specialized
methodology. Especially well-known quality management tools are
useful also for information security management. [9]
- Effective communication between business leaders and information
security experts should be established and facilitated. [13]
- Real business conditions and facilities as well as business needs
and expectations should be taken into account in developing managerial
actions for information security [12, 13]. General information security
standards and guidance material should be used as reference material
for organization-dedicated information security development.
- An organization's information security status (see figure 1) should
be assessed against organization's business needs and expectations
and information security risks managed as business risks. Suitable
assessment methodology should be used in assessments where especially
continual development actions and results are appreciated. [11]
- Information security development should be included within organization's
business strategies and strategic and operational business development
projects.
- Both reactive (rational) and proactive (creative) measures and
continual improvement should be driven decisively by business needs
in order to avoid random drifting or superficial solutions.
- Information security development should be targeted towards excellent
information security performance instead of only fulfilling standardized
minimum requirements.
Information security management needs managerial responsibilities
at three different areas [9]:
- Control: Managing daily operations in business processes in order
to achieve the specified results. Normally rectifying nonconformities
is carried out in connection with control.
- Prevention and operational improvements: Solving acute problems,
preventing nonconformities, and finding / implementing operational
step by step improvements in business processes continually
- Breakthrough improvement and change management: Innovating and
implementing strategically significant changes in the way doing
business
These areas are very typical and normal within actual practices
of business leaders but they are not normally applied for managing
information security [8, 9]. Especially rapid responsive and innovative
business development is required in modern rapidly changing business
environments [12]. This sets pressure also to innovativeness in
the development of solutions of information security. Unfortunately
the existing standardization of information security management
has not been able to follow the development of the society.
Information security awareness is a complicated issue [15, 16]
and is required consistently among business leaders, experts (not
only information security professionals but also e.g. R&D engineers
who are developing information technology and communication solutions
and their security practices), and all employees. Different personal
categories require different skills and competences and different
deepness of awareness of information security. [7]
Strengthening general information security awareness and culture
in organizations is possible only under the leadership and participation
of senior executives. This may include the following:
- Promoting discussion and understanding what information security
is all about and why it is important in the case of a particular
organization's business
- Establishing and communicating corporate information security
policy consisting of the general intention and direction in information
security within the organization
- Practicing open and transparent information security related multilateral
communication in the organization, its business community, and society
at large
- Promoting collaborative cooperation and networking of different
expert disciplines within the organization, and avoiding harmful
competing and conflicting movements among them
- Arranging traditional training events or e-learning facilities
for the basics of information security within the organization and
also participated by business leaders [5]. However, much this kind
of formal training and education or information security awareness
programs has not necessarily created real awareness or commitment
successfully or effectively. Most (80%) of all learning takes place
in practice through informal learning. [7, 17, 18, 20]
- Facilitating on-the-job learning (learning by doing), informal
learning, and information security auto-control (self-management)
within business processes and their particular activities [7, 13].
This should also apply to the strategic management process of an
organization.
- Using normal managerial means to promote information security
awareness, e.g. through recognizing and rewarding especially successfully
established information security improvement actions and results
Increasing information security awareness is bioth individual and
organizational learning issue [7, 19].
Cooperation is the necessity in the organization also for information
security. The close cooperation between business managers and information
security experts is a necessity in order to get security happen
in a professional way. Information security is a cross-functional
discipline, which requires also close cooperation with other expertises
of the organization. Information security management is fully analogous
to the management of many other expertise areas important to a company.
These include [11]:
- Finance management
- Quality management
- Corporate governance
- Business risks management
- Human resource development
- Information management and communications
- Occupational health and safety factors
- Social responsibility
- Environmental protection
- Innovation management
- Ethical management
All these different expert disciplines have impacts also in information
security, and on the contrary. It is especially harmful to the organization's
business performance and information security if there is a competition
between different experts within the organization.
Conclusions
Information and knowledge are essential and crucial factors in
operations of all organizations. This creates growing and complicating
information security needs and expectations for organizations' management.
However, business leaders are now not adequately committed and skilled
to act for information security according their management duties.
Effective integration of information security with business management
activities and enhancement of extensive information security awareness
are needed in organizations and societies at large. New innovations
in information security thinking, methodologies and organizational
infrastructures, and new individual and organizational learning
practices are necessary for today's rapidly changing business environments.
Managerial motto for organizational information security management:
Always ready, never finished
References
[1] OECD, Guidelines for the security of information systems and
networks - Towards a culture of security, OECD Publications, Paris
2002
[2] ISO/IEC 27001:2005, Information technology - Security techniques
- Information security management systems - Requirements, ISO, Geneva
2005
[3] ISO/IEC 27002 (17799):2005, Information technology - Security
techniques - Code of practice for information security management,
ISO, Geneva 2005
[4] ISO 9000, Quality management standards, International Standardization
Organization, Geneva 2000, and the drafts for the next revisions
of the standards, 2008
[5] Kajava J, Savola R, Varonen R and Anttila J, Exploring the use
of an e-learning environment to enhance information security awareness
in a small company, the CIS2006 conference, Guangzhou 2006
[6] Kajava J, Anttila J, Varonen R, Savola R, Röning J, Senior
Executives Commitment to Information Security - from Motivation
to Responsibility, Computational Intelligence and Security CIS2006,
Guangzhou 2006
[7] Anttila J, Savola R, Kajava J, Lindfors J, Fulfilling the Needs
for Information Security Awareness and Learning in Information Society,
The 6th Annual Security Conference, Las Vegas 2007
[8] Anttila J, Information security standards and global business,
2006
[9] Anttila J, General managerial tools for business-integrated
information security management, 2006
[10] Anttila J, Business-integrated information security management,
2003
[11] Anttila J, Managing and assuring information security in integration
with the business management of a company, 1998
[12] Anttila J, Quality management in networked and flexible organizations,
2004
[13] Anttila J, Modern approach of information society to knowledge
work environment for management, 2006
[14] Anttila J, Tacit knowledge - The essense of quality management
systems, 2004
[15] Anttila J, Quality awareness, 2006
[16] Block N, Some concepts of consciousness, 1995
[17] Downes S, The Buntine Oration: Learning Networks, 2004
[18] Cross J, Informal learning - the other 80% , 2003
[19] Senge P, Roberts C, Ross B, Kleiner A, The Fifth Discipline
Fieldbook, Nicholas Brealey Publishing Limited, London, 1995
[20] Arina T, Serendipity 2.0: Missing third places of learning,
2007
[21] Anttila J, Reinforcing business leaders' role in striving for
information security, the CIS2007 conference, Harbin 2007
[22] Anttila J, Balanced integration of information security into
business management, 2004
[23] Anttila J, Business Integrated e-Quality - Innovative opportunity
for modern advanced organizations, 2002
[24] Denning D. Information Warfare and Security. Addison-Wesley.
ACM Press Books. Reading, Massachusetts. USA, 1999
[25] Anttila J, Kajava J, Varonen R, Quirchmayr G, Business-integrated
information security management, Ed. Javier Lopez, Securing information
and communication systems, Artech House, Boston/London, 2008
[This text has been presented in different forms in Harbin, China
in 2007 (CIS2007) and in Rovaniemi, Finland in 2008 (IPICS 2008)]
