Where is IT in Information Security? The Interrelationship Among IT Investment, Security Awareness, and Data Breaches

SKU
15713

Publication History

Received: September 11, 2018
Revised: August 27, 2019; April 16, 2020; December 18, 2020; August 8, 2021; March 20, 2022
Accepted: April 8, 2022
Published Online as Accepted Author Version Preprint: Forthcoming
Published Online as Articles in Advance: Forthcoming

https://doi.org/10.25300/MISQ/2022/15713

$0.00
Abstract

Data breaches can severely damage a firm’s reputation and its customers’ confidence. Firms must, therefore, continuously invest in security measures to prevent such breaches. However, the effectiveness of security investment has been questioned by both practitioners and academics. We illustrate the bidirectional dynamic relationship between information technology (IT) investment and data breaches moderated by threat and countermeasure security awareness using an eight-year panel of 311 U.S.-listed firms to provide empirical evidence that threat awareness broadens firms’ scope for addressing data-breach issues by investing more in IT than in security. Countermeasure awareness equips firms with sufficient knowledge and experience to ensure effective implementation of IT, which provides more comprehensive protection than security investment alone. Our results suggest that firms should evolve beyond the reactive mindset of solely upgrading security and begin nurturing both threat awareness and countermeasure awareness to address the underlying IT system issues that are the cause of data breaches.

Additional Details
Author Wilson Weixun Li, Alvin Chung Man Leung, and Wei Thoo Yue
Year 0
Volume Forthcoming
Issue Forthcoming
Keywords Security investment, IT investment, security awareness, threat awareness, countermeasure awareness, data breach, panel vector autoregression model
Page Numbers
Copyright © 2022 MISQ. All rights reserved.