Information Security Assessment of SMEs as Coursework: Learning Information Security Management by Doing

1. INTRODUCTION The information systems field in general, and information systems education in particular, are criticized for the gap between theory and practice (e.g. Klein & Rowe, 2008; Mathiassen and Nielsen, 2008). The gap between the theoretical knowledge gained through research and practice-oriented knowledge is in some areas wide, and it needs to be closed in order to offer relevant education for future information systems professionals. Information security is an area where the teaching of university students faces many challenges. In some areas teaching defense against technological attacks teaches the students to attack at the same time (Logan and Clarkson, 2005), which causes ethical concerns. In other areas getting open information about information management failures and how they have been overcome is challenging (Dutta and McCrohan, 2002), and thus the teaching may lack real-life case examples. However, the understanding of information security management issues is vital for not only information security professionals, but also all managers in a high-level position (von Solms and von Solms, 2004). In the area of security, the mindset of companies is understandably to reveal nothing outside the company to avoid problems with image or direct information security threats. In this sort of environment, getting good educational material for business and technology students to learn about information security management is a challenge. Case-based teaching is found to be inspiring and it brings about good results among students (Bocker, 1987). When the cases come from real companies, it gives an additional layer of interest and relevance to a student. This paper describes a university course that answers these challenges by involving local small and medium-sized (SME) knowledge-intensive companies in the teaching. The companies let students come into their premises and perform an interview where one or more representatives of the company are interviewed on information security management issues. The scope of the course is management of information security, and thus the aim of the assignment is to assess the overall status of information security management in the participating companies. Information security literature emphasizes the awareness of executives of information security risks and countermeasures (Dutta and McCrohan, 2002; Kumar, Park and Subramaniam, 2008; von Solms and von Solms, 2004). One way to raise awareness of information security is to embed information security issues into the study curriculum of future managers, i.e. today's university students. When a course puts students into a position where they assess the information security status of a company, it forces them to think about the business of that company in addition to the information security threats and countermeasures. Information security management deals with finding the balance between reasonable investments in security and a reasonable level of protection (Bojanc and Jerman-Blazic, 2008; Wang, Chaudhury and Rao, 2008). If students simply study the theoretical ideals of information protection and countermeasures, they may be left with an unrealistic view of information security management. Information security management skills in the information systems or security curricula are called for by many authors (e.g. Kim and Surendran, 2002; Whitman and Mattord, 2004). The course this paper describes not only answers to this call but also aims for information security awareness of students that will not end up in positions of information security professionals. Awareness about information security threats fosters information security culture in organizations (Lacey, 2010; Van Niekerk and Von Solms, 2010). This assignment teaches students to assess information security from a general perspective. The goal is that the students will understand their own role in maintaining and improving the security status of a company, regardless of what role they have in the company they work for in the future. …