Loughborough University
Leicestershire, UK
LE11 3TU
+44 (0)1509 263171
Loughborough University

Loughborough University Institutional Repository

Please use this identifier to cite or link to this item: https://dspace.lboro.ac.uk/2134/9056

Title: Reinforcing the security of corporate information resources: a critical review of the role of the acceptable use policy
Authors: Doherty, Neil
Anastasakis, Leonidas
Fulford, Heather
Keywords: Acceptable use policies
Computer use policies
Policy positioning
Policy content
Higher education sector
Issue Date: 2011
Publisher: © Elsevier
Citation: DOHERTY, N.F., ANASTASAKIS, L. and FULFORD, H., 2011. Reinforcing the security of corporate information resources: a critical review of the role of the acceptable use policy. International Journal of Information Management, 31(3), pp. 201-9
Abstract: Increasingly users are seen as the weak link in the chain, when it comes to the security of corporate information. Should the users of computer systems act in any inappropriate or insecure manner, then they may put their employers in danger of financial losses, information degradation or litigation, and themselves in danger of dismissal or prosecution. This is a particularly important concern for knowledge-intensive organisations, such as Universities, as the effective conduct of their core teaching and research activities is becoming ever more reliant on the availability, integrity and accuracy of computer-based information resources. One increasingly important mechanism for reducing the occurrence of inappropriate behaviours, and in so doing, protecting corporate information, is through the formulation and application of a formal ‘acceptable use policy (AUP). Whilst the AUP has attracted some academic interest, it has tended to be prescriptive and overly focussed on the role of the Internet, and there is relatively little empirical material that explicitly addresses the purpose, positioning or content of real acceptable use policies. The broad aim of the study, reported in this paper, is to fill this gap in the literature by critically examining the structure and composition of a sample of authentic policies – taken from the higher education sector - rather than simply making general prescriptions about what they ought to contain. There are two important conclusions to be drawn from this study: 1) the primary role of the AUP appears to be as a mechanism for dealing with unacceptable behaviour, rather than proactively promoting desirable and effective security behaviours, and 2) the wide variation found in the coverage and positioning of the reviewed policies is unlikely to be fostering a coherent approach to security management, across the higher education sector.
Description: This article was published in the International Journal of Information Management [© Elsevier] and the definitive version is available at: http://dx.doi.org/10.1016/j.ijinfomgt.2010.06.001
Version: Accepted for publication
DOI: 10.1016/j.ijinfomgt.2010.06.001
URI: https://dspace.lboro.ac.uk/2134/9056
Publisher Link: http://dx.doi.org/10.1016/j.ijinfomgt.2010.06.001
ISSN: 0268-4012
Appears in Collections:Published Articles (Business School)

Files associated with this item:

File Description SizeFormat
Doherty2.pdf153.17 kBAdobe PDFView/Open


SFX Query

Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.