Framing the Corporate Security Problem: The Ecology of Security

Introduction Security and information systems are intertwined. The complex interactions and interconnections among people, software applications, networks, operating systems, and organizational policies create myriads of exploitable points. Daily newspapers present accounts of intrusions, stolen laptops, and other security breakdowns. The global implications of a security meltdown of apocalyptic proportions has been the guise of a novel (Brown, 1998). Intrusions and attempts at intruding are happening continuously at every moment of an information system's life. According to Consumer Reports (2006), in any given 24 hour period there are approximately 60 million intrusion attempts. The estimated cost of security defenses in the face of attacks is approximately $7.8 billion for 2004-2006; the costs of spamming and viruses are approximately $5.2 billion; the costs of spyware intrusions are approximately $2.6 billion. Phishing intrusions amount approximately $630 million (Consumer Reports, 2006). There are other estimates (Bodin, Gordon & Loeb, 2005; Kros, Foltz & Metcalf, 2004-2005). What the cost is now or will be in a year's time is anyone's guess. In the Information Age, where interconnectivity and information access and availability are paramount, malware and malicious exploitation of information system vulnerabilities have become epidemic (Seshadri, Luk, Perrig, Van Doorn, & Khosla, 2006; Whitman, 2003). Security and security awareness are necessary elements of a secure environment, even as people have access to required information and information resources. "Information security involves making information accessible to those who need the information, while maintaining integrity and confidentiality" (Carstens, McCauley-Bell, Malone, & DeMara, 2004, p. 68). Security Vulnerabilities In the digital world, where an individual's desk top computer is networked not only within the organization but also to the world via the WWW, it is safe to say that everything: the computer and its operating system, the network and web site, the information on it or in corporate databases, the software used to conduct business and query the databases, and the person, is vulnerable and subject to some kind of malicious attack. "A vulnerability is a weakness...that might be exploited to cause loss or harm" (Pfleeger, 1997, p. 3). Hardware is vulnerable to interruptions (also called "denial of service") and interceptions (by stealing) (Pfleeger, 1997; Graff & van Wyk, 2003). The accessibility and visibility of computers (laptops are stolen), printers, even cables, and equipment (hard drives are recycled) of all kinds make them vulnerable to security breakdowns (Pfleeger, 1997; Whitman, 2003; Volonino & Robinson, 2004). Software is open to interruptive (being deleted) threats. Software, at least in part, and its functionality can be captured and used without appropriate permissions. Software can be changed in unpermitted ways by unauthorized persons (Pfleeger, 1997; Whitman, 2003). Information can be subject to unauthorized capture and use. Use of information can be disrupted. Unauthorized access to an information system can lead to information being inappropriately changed, even made up, or appropriated contrary to privacy laws (Pfleeger, 1997; Whitman, 2003; Volonino & Robinson, 2004). People are especially prime points of exploitation for unpermitted access to and use of information and its system. People become opened gates for incursions into applications, operating systems, and networks (Carstens et al., 2004; Bailes & Templeton, 2006; Campbell, 2006). Information systems become vulnerable when key personnel are unavailable and are not reliable. This happens in many possible ways, but the chief manner is framed by and works through people's mental models of trust. There is also a problem with usability designs of systems. For the user, security ought to be transparent. …