An empirical investigation of factors influencing the effectiveness of information systems security

With the increasing dependence on information systems (IS) for operational and strategic business activities, safeguarding IS against potential security threats has become one of the critical issues in management of IS. Although numerous studies have focused on factors impacting IS security, the influence of environmental factors on IS security has rarely been comprehensively investigated.;This study examined the influence of IS environment on the effectiveness of IS security. The research questions raised in this study were: (1) Does IS environment influence an organization's IS security efforts? (2) Are the security efforts effective in reducing IS security risks? (3) Does the IS environment affect IS security efforts? and (4) Is there any difference in security risks between financial and non-financial industries?;Analysis of the questionnaire survey for Fortune 1,000 companies with linear structural relations (LISREL) and multivariate analysis of variance (MANOVA) confirmed the influence of IS environment on IS security efforts as well as IS security risks. It also revealed that IS security efforts have been effective in reducing security risks. However, it did not find any difference of security risks between financial and non-financial industries.;One of the most significant implications of the findings of this study is that management needs to be more informed and responsive to potential security risks posed by the recent trends in IS such as end-user computing and system networking. The second implication is that, since the effectiveness of IS security is directly related to the level of investment in IS security, more investment in IS security is justifiable in order to reduce potential IS security risks. Finally, because an organization's IS environment influences the degree of IS security risks, management needs to evaluate potential security risks of its IS environment to determine adequate level of investment in IS security.