Fostering information security culture in small and medium size enterprises: an interpretive study in Australia

By having an effective organisational information security culture where employees intuitively protect corporate information assets, small and medium size enterprises (SMEs) could improve information security. However, previous research has largely overlooked the development of such a culture for SMEs, and the national context in which SMEs operate. The paper explores this topic and provides key findings from an interpretive Australian study based on a literature review, two focus groups and three case studies. A holistic framework is provided for fostering an information security culture in SMEs in a national setting. The paper discusses key managerial challenges for SMEs attempting to develop such a culture. The main findings suggest that Australian SME owners do not provide sufficient support for information security due to insufficient awareness of its importance and may also be affected by national attitudes to risk. The paper concludes that Australian SME owners may benefit from adopting a risk-based approach to information security and should be educated about the potential strategic role of information technology and information security. The paper also identifies the value and difficulty of promoting a behavioural and learning approach to information security to complement traditional technological and managerial approaches. Implications for theory and practice are discussed.

Understanding informations systems outsourcing success and risks through the lens of cognitive biases

Because outsourcing of information systems (IS) is now widespread, it is generally assumed to be successful. It is also often assumed that outsourcing risks are easily managed. In this paper we adopt an “evidence based management” approach to first test these assumptions through a qualitative metaanalysis of academic studies into IS outsourcing outcomes. Our research reveals a shortage of reliable and valid evidence for outsourcing’s benefits, and for the level of risk involved. We then use data from a series of focus groups to explain the paradox of widespread adoption of a strategy with limited empirical support. These focus groups were interpreted through the lens of research on a
range of cognitive mechanisms and biases that are known to affect decision makers. We conclude that cognitive mechanisms that are likely to affect sourcing decisions include framing biases, cognitive dissonance, attribution error, and the “optimism”, “confirmation”, “disconfirmation” and “overconfidence” biases. Given the shortage of supporting evidence, and the potential for these biases to operate, we argue that researchers need to be more critical in their analysis of reports of the success and risks of IS outsourcing.

Explaining and predicting information systems acceptance and success: an integrative model

This paper proposes a new model – the Information Systems Acceptance (ISA) model - to explain and predict IS acceptance. Drawing on previous literature, and the results of a series of case studies, the ISA model integrates four sets of factors influencing IS acceptance: (i) technology characteristics; (ii) management actions; (iii) service quality; and (iv) system use, user satisfaction and system outcomes. These sets of factors are drawn from well-established frameworks. Building on established theories, the model incorporates previous research, overcomes some of the limitations associated with these individual theories, and assembles IS acceptance factors into a comprehensive and useable conceptual framework.

Explaining organizational investment in CRM point solutions

This paper asks why organisations invest in non-integrated CRM point solutions when many of the benefits of enterprise systems are claimed to be due to integration of processes and information. This paper identifies six factors that explain why organisations invest in CRM point solutions: reduced risk; lower cost; quick benefits realization; low integration ability, low interdependence of business units, and high business-unit differentiation. The evidence suggests that when interdependence between parts of an organization is low, possibly due to one unit producing a clearly differentiated product, the attractions of lower risk, lower cost, and/or faster access to the benefits are likely to induce organizations to adopt CRM point solutions. The contribution of this study is that it recognizes that, and explains why, it is not always optimal for organizations to adopt integrated CRM solutions.