INFORMATION SECURITY OBJECTIVES AND PRACTICES: An Exploratory Study

Information security is a management problem, not atechnology one. Experience indicates that technologycannot provide all the answers to the problems posedby people in the context of information securitymanagement (ISM). Although many different frameworksand guidelines have been proposed by researchers,practitioners, consultants, government andorganizations, current information securityobjectives and practices are inconsistent ormisleading to practitioners. Concepts in the fieldof ISM are largely based on case studies, anecdotalevidence and the prescription ofindustry "leaders". There is little consensus onwhich security objectives should be achieved, whichfactors are critical to achieve successful securityinitiatives, and what is the relationship betweenbest practices and objectives.To help practitioners effectively achieve theirinformation security goals, this study aims toanswer these questions.