This paper examines the role of information security incident reporting systems in the wider context of an information security management system. This work is based on four group model building workshops with participants from mnemonic AS, a Norwegian Managed Security Services Provider. We found that incident reporting is a crucial component in creating information security awareness among information system users. Our research indicates that increasing incident reporting rates does not necessarily mean poor security, but rather that the organisation is becoming more security aware, and, arguably, less exposed to information security risks. However, in an organisation with poor awareness, it is possible that incident reporting rates and risk increases simultaneously. Analogous results are known about industrial safety reporting systems and risk of organisational accidents.

This is the whole item.

Date created

• 2009 July 26-2009 July 30

Type

• Document

Processing Activity

• Processing documentation available at: https://wiki.albany.edu/display/SCA/Processing+Ingested+Digital+Files

License

• Creative Commons BY-NC-ND Attribution-NonCommercial-NoDerivs 4.0 International

  
  Contact Us for questions or additional rights.

ITEM CONTEXT

Part of

4818cb531cdd68d6ec6af3f291216fc7

Scope and Contents

Part of

b3584c6b53c3f58e0202549d7d851f84

Scope and Contents

Part of

23d738ba88f8333bc39725f9cb5bd0b8

Scope and Contents

Collection

System Dynamic Society Records

Scope and Contents

Collecting area

• This collection is part of the University Archives