Value conflicts for information security management

  • Authors:

  • Karin Hedström;Ella Kolkowska;Fredrik Karlsson;J. P. Allen

  • Affiliations:

  • Swedish Business School, Örebro University, 701 82 Örebro, Sweden;Swedish Business School, Örebro University, 701 82 Örebro, Sweden;Swedish Business School, Örebro University, 701 82 Örebro, Sweden and University of Skövde, 541 28 Skövde, Sweden;School of Business and Professional Studies, University of San Francisco, 2130 Fulton Street, MH 222, San Francisco, CA 94117-1045, USA

  • Venue:
  • The Journal of Strategic Information Systems
  • Year:
  • 2011

Quantified Score

Hi-index 0.00

Visualization

Abstract

A business's information is one of its most important assets, making the protection of information a strategic issue. In this paper, we investigate the tension between information security policies and information security practice through longitudinal case studies at two health care facilities. The management of information security is traditionally informed by a control-based compliance model, which assumes that human behavior needs to be controlled and regulated. We propose a different theoretical model: the value-based compliance model, assuming that multiple forms of rationality are employed in organizational actions at one time, causing potential value conflicts. This has strong strategic implications for the management of information security. We believe health care situations can be better managed using the assumptions of a value-based compliance model.