A stronger information security system can mean a competitive advantage for businesses, says a group of Iowa State University researchers who want to change the way businesses defend against cyber attacks.
The research was conducted by Iowa State University professors Samuel DeMarie, Brian Mennecke and Anthony Townsend. The three researchers will present their paper, "Strategic Information Systems Security: Definition and Theoretical Model," next month at the Americas Conference on Information Systems in Chicago.
Researchers spoke with 15 businesses over the past 24 months in Iowa, Illinois, Indiana and Minnesota, said DeMarie, a professor of management. Through the conversations with these businesses, they found a hole in the way security is handled, said Townsend, an associate professor of management information services.
"There is a tendency for most companies to look at security as just sort of an add-on to your normal IT function ... . It just happens mystically or something," Townsend said.
Businesses need to have a strategic-level orientation toward security. Most companies assume their information is safe and don't consider its security ahead of time.
Businesses are increasingly dependent on their websites to interact with their customers and suppliers, DeMarie said.
"Even just to have their system down for a day can be a huge problem for some firms," he said.
"Everything that they're saying certainly mirrors the trends that we see in the malware marketplace," said Ed Barrett, vice president of marketing and communications at Cedar-Rapids based SecurityCoverage, which focuses on consumer and mobile security. "It is always much easier to protect yourself than it is to respond to a threat after the fact."
SecurityCoverage was not one of the businesses consulted by researchers for the paper.
There are benefits to improving security, Townsend said."If you want to be a popular player out there in the new organizational landscape, you've got to be able to hook up with other firms easily," he said. "If you can easily hook up to another firm, seamlessly integrate your data and their data ... , we think that's a significant competitive advantage and part of that competitive advantage of being good at connectivity is being good at highly secured connectivity."