arXiv 2302.017532023-02cs.CR

一种改进组织信息安全治理的过程模型

A Process Model to Improve Information Security Governance in Organisations

Chee Kong Wong

备注：: 313 pages, PhD Thesis

摘要：

信息安全治理（ISG）是一个相对较新的研究课题。文献回顾表明，缺乏一个ISG的框架或模型，可以帮助实施ISG。本研究旨在介绍一个基于经验的ISG过程模型作为一个实际的参考，以促进ISG在组织中的实施。本研究采用了探索性的研究方法，在综合现有文献和详细回顾相关框架和模型的基础上，提出了一个概念性的ISG过程模型。随后，根据从3个案例研究组织收集的经验数据，对概念ISG过程模型进行了改进。经过6次专家访谈，最终验证了改进后的ISG过程模型。本研究开发了一个基于经验的ISG过程模型，识别利益相关者群体，并解释了核心ISG过程和子过程如何相互作用。具体而言，研究贡献：（1）发展ISG过程理论，因为ISG是一系列发生在组织背景下的事件;和（2）发展信息处理的ISG的角度来看，作为过程模型识别信息和通信流，利益相关者群体之间的关系。此外，本研究还：（3）根据ISG在现实组织中的实践情况，对ISG流程模型进行了实证检验和验证;（4）对公司治理理论进行了检验，以提供额外的视角，确保ISG流程模型与公司治理目标保持一致;（5）确定了影响ISG实施的其他因素，需要进一步研究;最后（6）通过引入基于经验的ISG过程模型扩展了现有的开创性研究，该模型是在综合前人研究积累的知识的基础上开发的，并通过经验数据进行了验证。

英文摘要：

Information security governance (ISG) is a relatively new and under-researched topic. A review of literature shows the lack of an ISG framework or model that can help the implementation of ISG. This research aims to introduce an empirically grounded ISG process model as a practical reference to facilitate the implementation of ISG in organisations. This research has adopted an exploratory research approach where a conceptual ISG process model was proposed based on synthesis of extant literature and detailed review of relevant frameworks and models. The conceptual ISG process model was subsequently refined based on empirical data gathered from 3 case study organisations. The refined ISG process model was finally validated in 6 expert interviews. This research has developed an empirically grounded ISG process model identifying stakeholder groups and explaining how core ISG processes and sub-processes interact. Specifically, the research contributes by: (1) developing ISG process theory, as ISG is a series of events occurring within an organisational context; and (2) developing an information-processing perspective on ISG, as the process model identifies the information and communication flows, and the relationships among stakeholder groups. In addition, the research has: (3) empirically examined and validated the ISG process model based on how ISG is practised in real-world organisations; (4) examined corporate governance theories to provide additional perspectives to ensure that the ISG process model is aligned with corporate governance objectives; (5) identified additional factors that influence the implementation of ISG requiring further research; and finally (6) expanded existing seminal research by introducing an empirically grounded ISG process model that has been developed based on synthesis of cumulative knowledge from previous research and validated with empirical data.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

摘要：

英文摘要：

相关论文