Enterprise information security policy assessment : an extended framework for metrics development utilising the goal-question-metric approach

Effective enterprise information security policy management requires review and assessment activities to ensure information security policies are aligned with business goals and objectives. As security policy management involves the elements of policy development process and the security policy as output, the context for security policy assessment requires goal-based metrics for these two elements. However, the current security management assessment methods only provide checklist types of assessment that are predefined by industry best practices and do not allow for developing specific goal-based metrics. Utilizing theories drawn from literature, this paper proposes the Enterprise Information Security Policy Assessment approach that expands on the Goal-Question-Metric (GQM) approach. The proposed assessment approach is then applied in a case scenario example to illustrate a practical application. It is shown that the proposed framework addresses the requirement for developing assessment metrics and allows for the concurrent undertaking of process-based and product-based assessment. Recommendations for further research activities include the conduct of empirical research to validate the propositions and the practical application of the proposed assessment approach in case studies to provide opportunities to introduce further enhancements to the approach.

Information technology and business value in a global economy : do information technology investments pay off in a developing economy?

Understanding the business value of IT has mostly been studied in developed countries, but because most investment in developing countries is derived from external sources, the influence of that investment on business value is likely to be different. We test this notion using a two-layer model. We examine the impact of IT investments on firm processes, and the relationship of these processes to firm performance in a developing country. Our findings suggest that investment in different areas of IT positively relates to improvements in intermediate business processes and these intermediate business processes positively relate to the overall financial performance of firms in a developing country.

Information technology resources,complementaries and capabilities : towards a deeper understanding of leveraging business value from IT

Organisations devote substantial resources to acquire information technology (IT), and explaining the important issue of how IT can affect performance has posed a significant challenge to information system (IS) researchers. Owing to the importance of expanding our understanding on how and where IT and IT-related resources impact organisational performance, this study investigates the differential effects of IT resources and IT-related capabilities, in the presence of platform-related complementarities, on business process performance. We test these relationships empirically via a field survey of 216 firms. The findings suggest that IT resources and IT-related capabilities explain variance in performance. Of interest is the finding that IT resources and IT-related capabilities ability to explain variance in business process is further enhanced by the presence of the platform-related complementarities. Our findings are largely consistent with the resource-based and complementarity arguments of sources of IT-related business value.

Information technology and business value: how complementary IT usage platform and capable resources explain IT business value variation

Understanding information technology’s (ITs) contribution to business value is an imperative issue, and while we have attempted to untangle the relationship between IT and business value with some success, our knowledge of specific factors leading to ITs contribution to business value still remains limited. In this paper we propose that complementing IT resources, by establishing a sound IT platform with capable organisational resources may aid in ITs ability to contribute to business value. We suggest that performance measurement of this contribution be undertaken at the business process level first, and then mapped through to firm level performance measurement to obtain a better understanding of the path of IT business value contribution.

Towards a Deeper Understanding of Information Technology Governance Effectiveness : A Capabilities-Based Approach

We examine the relationship between the effectiveness of IT steering committee-driven IT governance initiatives and firm’s IT management and IT infrastructure related capabilities. We test these relationships empirically by a field survey of 216 firms. Results of this study suggest that a firms’ effectiveness of IT steering committee-driven IT governance initiatives positively relate to the level of their IT-related capabilities. We also found positive relationships between IT-related capabilities and internal process-level performance, which positively relate to improvement in customer service and firm-level performance. For researchers, we demonstrate that the resourcebased theory provides a more robust explanation of the determinants of firms IT governance initiatives. This would be ideal in evaluating other IT governance initiatives effectiveness in relation to how they contribute to building performance-differentiating IT-related capabilities. For decision makers, we hope our study has reiterated the notion that IT governance is truly a coordinated effort, embracing all levels of human resources.

The Impact of Information Technology Investments on Firm Processes and Performance

This book provides the much needed international dimension on the payoffs of information technology investments. The bulk of the research on the impact of information technology investments has been undertaken in developed economies, mainly the United States. This research provides an alternative dimension - a developing country perspective on how information technology investments impacts organizations. Secondly, there has been much debate and controversy on how we measure information technology investment payoffs. This research uses an innovative two-stage model where it proposes that information technology investments will first impact the process and improvement in the processes will then impact the performance. In doing so, it considers sectors of information technology investment rather than taking it as one. Finally, almost all prior studies in this area have considered only the tangible impact of information technology investments. This research proposes that one can only better understand the benefits by looking at both the tangible and intangible benefits.

Exploring information experience using social media during the 2011 Queensland floods : a pilot study

Social media networks have emerged as a powerful tool in allowing collaboration and sharing of information during times of crisis (Bruns, The Centre for Creative Industries Blog, comment posted on January 19,2011). The 2011 Queensland floods provided a unique opportunity to explore social media use during an emergency. This paper presents the findings of a pilot study that explored the information experiences of people using social media during the flooding of the Brisbane River. Analysis of data from four interviews supported the emergence of four categories of information experience. Examination of the categories revealed variation between the way in which individuals experienced social media and the point of the flooding at which each category of experience occurred. Information regarding individual’s use of social media has the potential to inform the development of social media platforms that can provide relevant and accessible information for the general public in event of a natural disaster.

Building the profession together : towards holistic library and information science education

How can a holistic approach to library and information science education encompassing vocational and university sectors that meets the future information workforce requirements be achieved? This paper will outline a twelve month national project that considered this very question. Funded by the Australian Learning and Teaching Council (ALTC).

Information system experts : definition, identification, and application

Experts’ views and commentary have been highly respected in every discipline. However, unlike traditional disciplines like medicine, mathematics and engineering, Information System (IS) expertise is difficult to define. Despite seeking expert advice and views is common in the areas of IS project management, system implementations and evaluations. This research-in-progress paper attempts to understand the characteristics of IS-expert through a comprehensive literature review of analogous disciplines and then derives a formative research model with three main constructs. A validated construct of expertise of IS will have a wide range of implications for research and practice.

Beyond broadcasting: customer service, community and information experience in the Twittersphere

What opportunities does a channel like Twitter offer to libraries, beyond the realm of marketing? We would like to highlight three roles for Twitter in the academic library environment: Twitter as a service delivery and service recovery channel; Twitter as a community builder; Twitter as a site for information experience.

Post-graduate health promotion students assess their information literacy

Purpose - The purpose of this paper is to examine post-graduate health promotion students’ self-perceptions of information literacy skills prior to, and after completing PILOT, an online information literacy tutorial. Design/methodology/approach – Post graduate students at Queensland University of Technology enrolled in PUP038 New Developments in Health Promotion completed a pre- and post- self-assessment questionnaire. From 2008-2011 students were required to rate their academic writing and research skills before and after completing the PILOT online information literacy tutorial. Quantitative trends and qualitative themes were analysed to establish students’ self-assessment and the effectiveness of the PILOT tutorial. Findings – The results from four years of post-graduate students’ self-assessment questionnaires provide evidence of perceived improvements in information literacy skills after completing PILOT. Some students continued to have trouble with locating quality information and analysis as well as issues surrounding referencing and plagiarism. Feedback was generally positive and students’ responses indicated they found the tutorial highly beneficial in improving their research skills. Originality/value - This paper is original because it describes post-graduate health promotion students’ self-assessment of information literacy skills over a period of four years. The literature is limited in the health promotion domain and self-assessment of post-graduate students’ information literacy skills. Keywords – Self-assessment, Post-graduate, Information literacy, Library instruction, Higher education, Health promotion, Evidence-based practice Paper Type - Research paper

Design science research and the core of information systems

Design Science Research (DSR) has emerged as an important approach in Information Systems (IS) research, evidenced by the plethora of recent related articles in recognized IS outlets. Nonetheless, discussion continues on the value of DSR for IS and how to conduct strong DSR, with further discussion necessary to better position DSR as a mature and stable research paradigm appropriate for IS. This paper contributes to address this need, by providing a comprehensive conceptual and argumentative positioning of DSR relative to the core of IS. This paper seeks to argue the relevance of DSR as a paradigm that addresses the core of IS discipline well. Here we use the framework defined by Wand and Weber, to position what the core of IS is.

An empirical investigation of health information system failure in regional Sri Lanka

Public health decision making is critically dependant on accurate, timely and reliable information. There is a widespread belief that most of the national and sub-national health information systems fail in providing much needed information support for evidence based health planning and interventions. This situation is more acute in developing nations where resources are either stagnant or decreasing, coupled with the situations of demographic transition and double burden of diseases. Literature abounds with publications, which provide information on misguided health interventions in developing nations, leading to failure and waste of resources. Health information system failure is widely blamed for this situation. Nevertheless, there is a dearth of comprehensive evaluations of existing national or sub-national health information systems, especially in the region of South-East Asia. This study makes an attempt to bridge this knowledge gap by evaluating a regional health information system in Sri Lanka. It explores the strengths and weaknesses of the current health information system and related causative factors in a decentralised health system and then proposes strategic recommendations for reform measures. A mix methodological and phased approach was adopted to reach the objectives. An initial self administered questionnaire survey was conducted among health managers to study their perceptions in relation to the regional health information system and its management support. The survey findings were used to establish the presence of health information system failure in the region and also as a precursor to the more in-depth case study which was followed. The sources of data for the case study were literature review, document analysis and key stake holder interviews. Health information system resources, health indicators, data sources, data management, data quality, and information dissemination were the six major components investigated. The study findings reveal that accurate, timely and reliable health information is unavailable and therefore evidence based health planning is lacking in the studied health region. Strengths and weaknesses of the current health information system were identified and strategic recommendations were formulated accordingly. It is anticipated that this research will make a significant and multi-fold contribution for health information management in developing countries. First, it will attempt to bridge an existing knowledge gap by presenting the findings of a comprehensive case study to reveal the strengths and weaknesses of a decentralised health information system in a developing country. Second, it will enrich the literature by providing an assessment tool and a research method for the evaluation of regional health information systems. Third, it will make a rewarding practical contribution by presenting valuable guidelines for improving health information systems in regional Sri Lanka.