Organizational information security as a complex adaptive system: insights from three agent-based models

A. J. Burns, Clay Posey (), James F. Courtney, Tom L. Roberts and Prabhashi Nanayakkara
Additional contact information
A. J. Burns: The University of Texas at Tyler
Clay Posey: The University of Alabama
James F. Courtney: Louisiana Tech University
Tom L. Roberts: The University of Texas at Tyler
Prabhashi Nanayakkara: University of Houston-Clear Lake

Information Systems Frontiers, 2017, vol. 19, issue 3, No 7, 509-524

Abstract: Abstract The management of information security can be conceptualized as a complex adaptive system because the actions of both insiders and outsiders co-evolve with the organizational environment, thereby leading to the emergence of overall security of informational assets within an organization. Thus, the interactions among individuals and their environments at the micro-level form the overall security posture at the macro-level. Additionally, in this complex environment, security threats evolve constantly, leaving organizations little choice but to evolve alongside those threats or risk losing everything. In order to protect organizational information systems and associated informational assets, managers are forced to adapt to security threats by training employees and by keeping systems and security procedures updated. This research explains how organizational information security can perhaps best be managed as a complex adaptive system (CAS) and models the complexity of IS security risks and organizational responses using agent-based modeling (ABM). We present agent-based models that illustrate simple probabilistic phishing problems as well as models that simulate the organizational security outcomes of complex theoretical security approaches based on general deterrence theory (GDT) and protection motivation theory (PMT).

Keywords: Complex Adaptive Systems (CAS); Agent-Based Modeling (ABM); Information Assurance (IA); Information Security; General Deterrence Theory (GDT); Protection Motivation Theory (PMT); Phishing; NetLogo (search for similar items in EconPapers)
Date: 2017
References: View references in EconPapers View complete reference list from CitEc
Citations: View citations in EconPapers (7)

Downloads: (external link)
http://link.springer.com/10.1007/s10796-015-9608-8 Abstract (text/html)
Access to the full text of the articles in this series is restricted.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:spr:infosf:v:19:y:2017:i:3:d:10.1007_s10796-015-9608-8

Ordering information: This journal article can be ordered from
http://www.springer.com/journal/10796

DOI: 10.1007/s10796-015-9608-8

Access Statistics for this article

Information Systems Frontiers is currently edited by Ram Ramesh and Raghav Rao

More articles in Information Systems Frontiers from Springer
Bibliographic data for series maintained by Sonal Shukla () and Springer Nature Abstracting and Indexing ().