Inter-organisational information security: a systematic literature review. (14th November 2016)

• Record Type: Journal Article
• Authors: Karlsson, Fredrik; Kolkowska, Ella; Prenkert, Frans
• Is Part Of: Information and computer security. Volume 24:Number 5(2016)
• Page Start: 418
• Page End: 451
• Publication Date: 2016-11-14
• Subjects: Information security -- Literature review -- Inter-organisational -- State-of-the-art review; Computer security -- Management -- Periodicals; Computer networks -- Security measures -- Periodicals; Data protection -- Management -- Periodicals; 658.47
• DOI: 10.1108/ICS-11-2016-091
• Languages: English
• ISSNs: 2056-4961

Abstract

Abstract : Purpose: The purpose of this paper is to survey existing inter-organisational information security research to scrutinise the kind of knowledge that is currently available and the way in which this knowledge has been brought about. Design/methodology/approach: The results are based on a literature review of inter-organisational information security research published between 1990 and 2014. Findings: The authors conclude that existing research has focused on a limited set of research topics. A majority of the research has focused management issues, while employees'/non-staffs' actual information security work in inter-organisational settings is an understudied area. In addition, the majority of the studies have used a subjective/argumentative method, and few studies combine theoretical work and empirical data. Research limitations/implications: The findings suggest that future research should address a broader set of research topics, focusing especially on employees/non-staff and their use of processes and technology in inter-organisational settings, as well as on cultural aspects, which are lacking currently; focus more on theory generation or theory testing to increase the maturity of this sub-field; and use a broader set of research methods. Practical implications: The authors conclude that existing research is to a large extent descriptive, philosophical or theoretical. Thus, it is difficult for practitioners to adopt existing research results, such as governance frameworks, which have not been empirically validated. Originality/value: Few systematic reviews have assessed the maturity of existing inter-organisational information security research. Findings of authors on research topics, maturity and research methods extend beyond the existing knowledge base, which allow for a critical discussion about existing research in this sub-field of information security.