Principles for managing information system security

Abstract

This chapter brings together some of the key issues identified in the two case studies, and draws out some general statements for interpreting the management of information system security. Maintaining the interpretive mode adopted in this book, various elements of this synthesised perspective deliberately avoid considering problems as a consequence of a systems function. They are viewed as an emergent property of reflexive interaction between a system and its context. Four major themes are identified: the security policy itself; evaluation of security; design considerations in security; implementing information system security.