Enterprise information security policy assessment : an extended framework for metrics development utilising the goal-question-metric approach

Effective enterprise information security policy management requires review and assessment activities to ensure information security policies are aligned with business goals and objectives. As security policy management involves the elements of policy development process and the security policy as output, the context for security policy assessment requires goal-based metrics for these two elements. However, the current security management assessment methods only provide checklist types of assessment that are predefined by industry best practices and do not allow for developing specific goal-based metrics. Utilizing theories drawn from literature, this paper proposes the Enterprise Information Security Policy Assessment approach that expands on the Goal-Question-Metric (GQM) approach. The proposed assessment approach is then applied in a case scenario example to illustrate a practical application. It is shown that the proposed framework addresses the requirement for developing assessment metrics and allows for the concurrent undertaking of process-based and product-based assessment. Recommendations for further research activities include the conduct of empirical research to validate the propositions and the practical application of the proposed assessment approach in case studies to provide opportunities to introduce further enhancements to the approach.

The enterprise information security policy as a strategic business policy within the corporate strategic plan (extended abstract)

Information security has been recognized as a core requirement for corporate governance that is expected to facilitate not only the management of risks, but also as a corporate enabler that supports and contributes to the sustainability of organizational operations. In implementing information security, the enterprise information security policy is the set of principles and strategies that guide the course of action for the security activities and may be represented as a brief statement that defines program goals and sets information security and risk requirements. The enterprise information security policy (alternatively referred to as security policy in this paper) that represents the meta-policy of information security is an element of corporate ICT governance and is derived from the strategic requirements for risk management and corporate governance. Consistent alignment between the security policy and the other corporate business policies and strategies has to be maintained if information security is to be implemented according to evolving business objectives. This alignment may be facilitated by managing security policy alongside other corporate business policies within the strategic management cycle. There are however limitations in current approaches for developing and managing the security policy to facilitate consistent strategic alignment. This paper proposes a conceptual framework for security policy management by presenting propositions to positively affect security policy alignment with business policies and prescribing a security policy management approach that expounds on the propositions.

The creative sector in New Zealand : mapping and economic role : report to New Zealand Trade and Enterprise

The New Zealand creative sector was responsible for almost 121,000 jobs at the time of the 2006 Census (6.3% of total employment). These are divided between • 35,751 creative specialists – persons employed doing creative work in creative industries • 42,300 support workers - persons providing management and support services in creative industries • 42,792 embedded creative workers – persons engaged in creative work in other types of enterprise The most striking feature of this breakdown is the fact that the largest group of creative workers are employed outside the creative industries, i.e. in other types of businesses. Even within the creative industries, there are fewer people directly engaged in creative work than in providing management and support. Creative sector employees earned incomes of approximately $52,000 per annum at the time of the 2006 Census. This is relatively uniform across all three types of creative worker, and is significantly above the average for all employed persons (of approximately $40,700). Creative employment and incomes were growing strongly over both five year periods between the 1996, 2001 and 2006 Censuses. However, when we compare creative and general trends, we see two distinct phases in the development of the creative sector: • rapid structural growth over the five years to 2001 (especially led by developments in ICT), with creative employment and incomes increasing rapidly at a time when they were growing modestly across the whole economy; • subsequent consolidation, with growth driven by more by national economic expansion than structural change, and creative employment and incomes moving in parallel with strong economy-wide growth. Other important trends revealed by the data are that • the strongest growth during the decade was in embedded creative workers, especially over the first five years. The weakest growth was in creative specialists, with support workers in creative industries in the middle rank, • by far the strongest growth in creative industries’ employment was in Software & digital content, which trebled in size over the decade Comparing New Zealand with the United Kingdom and Australia, the two southern hemisphere nations have significantly lower proportions of total employment in the creative sector (both in creative industries and embedded employment). New Zealand’s and Australia’s creative shares in 2001 were similar (5.4% each), but in the following five years, our share has expanded (to 5.7%) whereas Australia’s fell slightly (to 5.2%) – in both cases, through changes in creative industries’ employment. The creative industries generated $10.5 billion in total gross output in the March 2006 year. Resulting from this was value added totalling $5.1b, representing 3.3% of New Zealand’s total GDP. Overall, value added in the creative industries represents 49% of industry gross output, which is higher than the average across the whole economy, 45%. This is a reflection of the relatively high labour intensity and high earnings of the creative industries. Industries which have an above-average ratio of value added to gross output are usually labour-intensive, especially when wages and salaries are above average. This is true for Software & Digital Content and Architecture, Design & Visual Arts, with ratios of 60.4% and 55.2% respectively. However there is significant variation in this ratio between different parts of the creative industries, with some parts (e.g. Software & Digital Content and Architecture, Design & Visual Arts) generating even higher value added relative to output, and others (e.g. TV & Radio, Publishing and Music & Performing Arts) less, because of high capital intensity and import content. When we take into account the impact of the creative industries’ demand for goods and services from its suppliers and consumption spending from incomes earned, we estimate that there is an addition to economic activity of: • $30.9 billion in gross output, $41.4b in total • $15.1b in value added, $20.3b in total • 158,100 people employed, 234,600 in total The total economic impact of the creative industries is approximately four times their direct output and value added, and three times their direct employment. Their effect on output and value added is roughly in line with the average over all industries, although the effect on employment is significantly lower. This is because of the relatively high labour intensity (and high earnings) of the creative industries, which generate below-average demand from suppliers, but normal levels of demand though expenditure from incomes. Drawing on these numbers and conclusions, we suggest some (slightly speculative) directions for future research. The goal is to better understand the contribution the creative sector makes to productivity growth; in particular, the distinctive contributions from creative firms and embedded creative workers. The ideas for future research can be organised into the several categories: • Understanding the categories of the creative sector– who is doing the business? In other words, examine via more fine grained research (at a firm level perhaps) just what is the creative contribution from the different aspects of the creative sector industries. It may be possible to categorise these in terms of more or less striking innovations. • Investigate the relationship between the characteristics and the performance of the various creative industries/ sectors; • Look more closely at innovation at an industry level e.g. using an index of relative growth of exports, and see if this can be related to intensity of use of creative inputs; • Undertake case studies of the creative sector; • Undertake case studies of the embedded contribution to growth in the firms and industries that employ them, by examining taking several high performing noncreative industries (in the same way as proposed for the creative sector). • Look at the aggregates – drawing on the broad picture of the extent of the numbers of creative workers embedded within the different industries, consider the extent to which these might explain aspects of the industries’ varied performance in terms of exports, growth and so on. • This might be able to extended to examine issues like the type of creative workers that are most effective when embedded, or test the hypothesis that each industry has its own particular requirements for embedded creative workers that overwhelms any generic contributions from say design, or IT.

Book review of Hitz, M., Sigala., M., & Murphy. J, (Eds). Information and Communication Technologies in Tourism 2006

This volume represents the proceedings of the 13th ENTER conference, held at Lausanne, Switzerland during 2006. The conference brought together academics and practitioners across four tracks, which were eSolutions, refereed research papers, work-in-progress papers, and a Ph.D workshop. This proceedings contains 40 refereed papers, which is less that the 51 papers presented in 2005. However, the editors advise the scientific committee was stricter than in previous years, to the extent that the acceptance rate was 50%. A significant change in the current proceedings is the inclusion of extended abstracts of the 23 work-in-progress presentations. The papers cover a diverse range of topics across 16 research streams. This reviewer has adopted the approach of succinctly summarising the contribution of each of the 40 refereed papers, in the order in which they appear...

Social innovation and social enterprise : evidence from Australia

‘Social innovation’ is a construct increasingly used to explain the practices, processes and actors through which sustained positive transformation occurs in the network society (Mulgan, G., Tucker, S., Ali, R., Sander, B. (2007). Social innovation: What it is, why it matters and how can it be accelerated. Oxford:Skoll Centre for Social Entrepreneurship; Phills, J. A., Deiglmeier, K., & Miller, D. T. Stanford Social Innovation Review, 6(4):34–43, 2008.). Social innovation has been defined as a “novel solution to a social problem that is more effective, efficient, sustainable, or just than existing solutions, and for which the value created accrues primarily to society as a whole rather than private individuals.” (Phills,J. A., Deiglmeier, K., & Miller, D. T. Stanford Social Innovation Review, 6 (4):34–43, 2008: 34.) Emergent ideas of social innovation challenge some traditional understandings of the nature and role of the Third Sector, as well as shining a light on those enterprises within the social economy that configure resources in novel ways. In this context, social enterprises – which provide a social or community benefit and trade to fulfil their mission – have attracted considerable policy attention as one source of social innovation within a wider field of action (see Leadbeater, C. (2007). ‘Social enterprise and social innovation: Strategies for the next 10 years’, Cabinet office,Office of the third sector http://www.charlesleadbeater.net/cms xstandard/social_enterprise_innovation.pdf. Last accessed 19/5/2011.). And yet, while social enterprise seems to have gained some symbolic traction in society, there is to date relatively limited evidence of its real world impacts.(Dart, R. Not for Profit Management and Leadership, 14(4):411–424, 2004.) In other words, we do not know much about the social innovation capabilities and effects of social enterprise. In this chapter, we consider the social innovation practices of social enterprise, drawing on Mulgan, G., Tucker, S., Ali, R., Sander, B. (2007). Social innovation: What it is, why it matters and how can it be accelerated. Oxford: Skoll Centre for Social Entrepreneurship: 5) three dimensions of social innovation: new combinations or hybrids of existing elements; cutting across organisational, sectoral and disciplinary boundaries; and leaving behind compelling new relationships. Based on a detailed survey of 365 Australian social enterprises, we examine their self-reported business and mission-related innovations, the ways in which they configure and access resources and the practices through which they diffuse innovation in support of their mission. We then consider how these findings inform our understanding of the social innovation capabilities and effects of social enterprise,and their implications for public policy development.

Fostering wellbeing of immigrants and refugees? Evaluating the outcomes of work integration social enterprise

Work integration social enterprises (WISE) seek to create employment and pathways to employment for those highly disadvantaged in the labour market. This chapter examines the effects of WISE on the wellbeing of immigrants and refugees experiencing multiple barriers to economic and social participation. Drawing on an evaluation of a programme that supports seven such enterprises in the Australian state of Victoria, the effects of involvement for individual participants and their communities are examined. The study finds that this social enterprise model affords unique local opportunities for economic and social participation for groups experiencing significant barriers to meaningful employment. These opportunities have a positive impact on individual and community-level wellbeing. However, the financial costs of the model are high relative to other employment programmes, which is consistent with international findings on intermediate labour market programmes. The productivity costs of WISE are also disproportionately high compared to private sector competitors in some industries. This raises considerable dilemmas for social enterprise operators seeking to produce social value and achieve business sustainability while bearing high productivity costs to fulfil their mission. Further, the evaluation illuminates an ongoing need to address the systemic and structural drivers of health and labour market inequalities that characterize socio-economic participation for immigrants and refugees.

The emerging role of the Board of Directors in enterprise business technology governance

In an increasingly business technology (BT) dependent world, the impact of the extraordinary changes brought about by the nexus of mobile and cloud technologies, social media and big data is increasingly being felt in the board room. As leaders of enterprises of every type and size, board directors can no longer afford to ignore, delegate or avoid BT-related decisions. Competitive, financial and reputational risk is increased if boards fail to recognize their role in governing technology as an asset and in removing barriers to improving enterprise business technology governance (EBTG). Directors’ awareness of the need for EBTG is increasing. However, industry research shows that board level willingness to rectify the gap between awareness and action is very low or non-existent. This literature review-based research identifies barriers to EBTG effectiveness. It provides a practical starting point for board analysis. We offer four outcomes that boards might focus on to ensure the organizations they govern are not left behind by those led by the upcoming new breed of technology-savvy leaders. Most extant research looks backward for examples, examining data pre-2010, the time when a tipping point in the personal and business use of multimedia and mobile-internet devices significantly deepened the impacts of the identified nexus technology forces, and began rapidly changing the way many businesses engage with their customers, employees and stakeholders. We situate our work amidst these nexus forces, discuss the board’s role in EBTG in this context, and modernize current definitions of enterprise technology governance. The primary limitation faced is the lack of scholarly research relating to EBTG in the rapidly changing digital economy. Although we have used recent (2011 - 2013) industry surveys, the volume of these surveys and congruence across them is significant in terms of levels of increased awareness and calls for increased board attention and competency in EBTG and strategic information use. Where possible we have used scholarly research to illustrate or discuss industry findings.

Measurement as legitimacy versus legitimacy of measures : Performance evaluation of social enterprise

Purpose The purpose of this paper is to review the growing emphasis on quantifiable performance measures such as social return on investment (SROI) in third sector organisations – specifically, social enterprise – through a legitimacy theory lens. It then examines what social enterprises value (i.e. consider important) in terms of performance evaluation, using a case study approach. Design/methodology/approach Case studies involving interviews, documentary analysis, and observation, of three social enterprises at different life-cycle stages with different funding structures, were constructed to consider “what measures matter” from a practitioner's perspective. Findings Findings highlight a priority on quality outcomes and impacts in primarily qualitative terms to evaluate performance. Further, there is a noticeable lack of emphasis on financial measures other than basic access to financial resources to continue pursuing social goals. Social implications The practical challenges faced by social enterprises – many of which are small to medium sized – in evaluating performance and by implication organisational legitimacy are contrasted with measures such as SROI which are resource intensive and have inherent methodological limitations. Hence, findings suggest the limited and valuable resources of social enterprises would be better allocated towards documenting the actual outcomes and impacts as a first step, in order to evaluate social and financial performance in terms appropriate to each objective, in order to demonstrate organisational legitimacy. Originality/value Findings distinguish between processes which may hold symbolic legitimacy for select stakeholder groups, and processes which hold substantive, cognitive legitimacy for stakeholders more broadly, in the under-researched context of social enterprise.

A critical realist perspective of enterprise architecture evolution : preliminary findings

This paper investigates how Enterprise Architecture (EA) evolves due to emerging trends. It specifically explores how EA integrates the Service-oriented Architecture (SOA). Archer’s Morphogenetic theory is used as an analytical approach to distinguish the architectural conditions under which SOA is introduced, to study the relationships between these conditions and SOA introduction, and to reflect on EA evolution (elaborations) that then take place. The paper focuses on reasons for why EA evolution could take place, or not and what architectural changes could happen due to SOA integration. The research builds on sound theoretical foundations to discuss EA evolution in a field that often lacks a solid theoretical groundwork. Specifically, it proposes that critical realism, using the morphogenetic theory, can provide a useful theoretical foundation to study enterprise architecture (EA) evolution. The initial results of a literature review (a-priori model) were extended using explorative interviews. The findings of this study are threefold. First, there are five different levels of EA-SOA integration outcomes. Second, a mature EA, flexible and well-defined EA framework and comprehensive objectives of EA improve the integration outcomes. Third, the analytical separation using Archer’s theory is helpful in order to understand how these different integration outcomes are generated.

Grand tours in the glare of the sun : harnessing digital media to develop cultural tourism in Queensland, Australia

It has been well established that highlighting the cultural attributes of a region through stories of place, local histories, and the creative arts boosts tourism income to a region. Cultural tourism also serves to promote the creative industries to visitors and residents alike and, by enhancing a region’s cultural identity, fosters new opportunities for the arts. It can therefore offer considerable potential benefit to the creative economy in Australia. However, in comparison with Europe, where cultural tourism can rely upon an established historical, artistic and literary cultural identity that stretches back to Grand Tours of the seventeenth century, in Queensland, Australia the relatively new enterprise of cultural tourism must compete with visitor expectations of sun, surf and the natural landscapes, which have become the mainstay of tourism advertising. Moreover, in Queensland, it is essential to connect vast distances, diverse communities and a variety of cultural experiences. We must also take account of the expectations of contemporary tourists, who anticipate a digitally mediated travel experience and increasingly seek to connect with local communities in authentic ways. In this paper we consider the unique considerations that must be taken into account in the Queensland context and propose approaches to developing an integrated identity that embraces both the ‘great outdoors’ and the region’s cultural attributes. We make recommendations for providing the types of digitally mediated ‘local’ experiences that cultural tourists now expect, and illustrate the design principles we propose through early, tentative approaches to smart phones, locative media and augmented reality applications for cultural tourism in the region. We conclude by proposing additional ways to formulate a digital strategy in line with the recommendations we make.

Practices of literary tourism : an Australian case study

Purpose To present the results of tests for the development of literary trails for domestic visitors and tourists in Brisbane, Queensland, and to situate these findings in the context of recent state government policy changes in relation to culture, community engagement and the environment. Design Broadly cultural studies: the article analyses changes in international and national cultural tourism and Queensland based issues before presenting the research findings. Findings a gap in tourist and cultural development models exists for the implementation of a network of sustainable literary trails in Brisbane--this model can be extended to regions around the state to meet the demands of the new tourist. Limitations Queensland weather and Australian distance which will require a regional approach that networks with transport and community hubs. Practical implications the research has produced new software for the use of self-guided walks; the locations for two specific area trails; and the involvement of the State Library of Queensland as a “hub” for the trails. Substantial support exists for further development in advanced locative media and gaming. Social implications the research demonstrates the importance of developing a sense of place that relates to culture, literary history and community for tourists, as well as the potential for community engagement.

A critical realist perspective of Enterprise Architecture evolution : conditioning and outcomes

This paper investigates how Enterprise Architecture (EA) evolves due to emerging trends. It specifically explores how EA integrates the Service-oriented Architecture (SOA). Archer’s Morphogenetic theory is used as an analytical approach to distinguish the architectural conditions under which SOA is introduced, to study the relationships between these conditions and SOA introduction, and to reflect on EA evolution (elaborations) that then take place. The paper focuses on reasons for why EA evolution could take place, or not and what architectural changes could happen due to SOA integration. The research builds on sound theoretical foundations to discuss EA evolution in a field that often lacks a solid theoretical groundwork. Specifically, it proposes that critical realism, using the morphogenetic theory, can provide a useful theoretical foundation to study enterprise architecture (EA) evolution. The initial results of a literature review (a-priori model) were extended using explorative interviews. The findings of this study are threefold. First, there are five different levels of EA-SOA integration outcomes. Second, a mature EA, flexible and well-defined EA framework and comprehensive objectives of EA improve the integration outcomes. Third, the analytical separation using Archer’s theory is helpful in order to understand how these different integration outcomes are generated.

Quest for authenticity - representation of the Sami image in Christmas tourism

Tourism is one of important livelihoods in Lapland. Christmas tourism was launched in the early 1980s and it became a success story - being labelled as the most epochal tourism product in Finland. Hence, today Christmas tourists are one of the most significant foreign groups arriving to Lapland during the winter season and contributing considerably to the economics of the northeastern periphery of the EU. Christmas tourism concentrates around Father Christmas who uses reindeer for transportation. The Sämi are the only indigenous people in the EU. They are all stereotypically perceived to be reindeer herders. Somehow these three, that is, Santa Claus, reindeer and the Sämi, have been incorporated into same fairytale dominion. In practice, this has happened by using the most visible cultural but also significant identity marker of the Sämi, the Sämi costume. This, in turn, has created controversy over authenticity due to manners in which the costume is used in tourism - often in imitational, mismatched forms by non-Sämi. In this thesis, after relevant literature review I intend to establish how the Sâmi are represented in Christmas tourism through visual data consisting of ten images from three foreign sources. Then I clarify why and to whom it matters of how the Sâmi are represented in Christmas tourism with the aid of 65 questionnaires and nineteen expert interviews collected mainly in the Finnish Sâmi Home Region in October 2009. Through the multiplicity of the voices of various interest and ethnic groups and by using critical discourse analysis I attempt to give an overview of the respondents' opinions and look at some preliminary solutions to the controversy. Based on my data, the non-Sami appear to accept the Sami costume usage in Christmas tourism most readily. Consequently, respect and attitudinal changes have become the respondents' propositions in addition to common set of rules of how the Sami image could be appropriated without violating the integrity of the Sami people, or a similar system of S¿m¡ Duodji trademark guaranteeing the authenticity of the tourism products. Additionally, though half of the interviewees explicate Sami presence in Christmas tourism by adding local flavour to otherwise commercial enterprise, the other half see no rationale to connect facts with fiction, that is, the Sami with Santa Claus.