The regulatory challenges of Australian information security practice. Issue 4 (August 2016)

• Record Type: Journal Article
• Authors: Burdon, Mark; Siganto, Jodie; Coles-Kemp, Lizzie
• Is Part Of: Computer law & security review. Volume 32:Issue 4(2016)
• Page Start: 623
• Page End: 633
• Publication Date: 2016-08
• Subjects: Information security -- Data protection -- Data breaches -- Information security management; Computers -- Law and legislation -- Periodicals; Computer security -- Law and legislation -- Periodicals; Electronic commerce -- Law and legislation -- Periodicals; Data protection -- Law and legislation -- Periodicals; Computer security -- Law and legislation; Computers -- Law and legislation; Data protection -- Law and legislation; Electronic commerce -- Law and legislation; Periodicals; 343.0999
• DOI: 10.1016/j.clsr.2016.05.004
• Languages: English
• ISSNs: 2212-473X

Abstract

Abstract: Information security is not directly regulated in Australia and is instead subject to a patchwork of different legal and regulatory frameworks. How Australian information security practitioners construct and action information security therefore becomes important to the overall operation of a fragmented regulatory framework. How then do Australian information security practitioners understand information security and make compliance-oriented decisions? Our exploratory interview research examined how nine Australian information security practitioners understood and constructed their role as delegated regulators of organisational information security processes. Participants expressed a number of concerns that reveal a very different world to that traditionally portrayed as the discipline and practice of information security. We examine these concerns and discuss what they mean in the context of the Australian environment.