Orig­i­nal source pub­li­ca­tion: Lopes, I. M. and F. de Sá-Soares (2010). Infor­ma­tion Sys­tems Secu­rity Poli­cies: A Sur­vey in Por­tuguese Pub­lic Admin­is­tra­tion. In M. B. Nunes, P. Isaías and P. Pow­ell (Eds.), Pro­ceed­ings of the IADIS Inter­na­tional Con­fer­ence on Infor­ma­tion Sys­tems 2010, 61–69. Porto (Por­tu­gal). IADIS Press, ISBN: 978-972-8939-09-0.
The final pub­li­ca­tion is avail­able here.

Infor­ma­tion Sys­tems Secu­rity Poli­cies: A Sur­vey in Por­tuguese Pub­lic Admin­is­tra­tion

Isabel Maria Lopes^a and Fil­ipe de Sá-Soares^b

^a Insti­tuto Politéc­nico de Bra­gança, Por­tu­gal
^b Uni­ver­sity of Minho, Por­tu­gal

1. Introduction

Infor­ma­tion Sys­tems Secu­rity (ISS) is a cru­cial issue for most orga­ni­za­tions. With the advent of infor­ma­tion tech­nol­ogy (IT) and the mas­sive use of the Inter­net and its ser­vices, the num­ber of attacks to which infor­ma­tion is sub­ject is increas­ingly higher and, con­se­quently, the need to pro­tect infor­ma­tion sys­tems (IS) is becom­ing impe­ri­ous.

Secu­rity poli­cies have a cen­tral role in ISS lit­er­a­ture, appear­ing as one of the cru­cial fac­tors to the infor­ma­tion secu­rity of an orga­ni­za­tion.

There are a rea­son­able num­ber of stud­ies focus­ing on secu­rity poli­cies in the ISS research domain. How­ever, this num­ber is sig­nif­i­cantly reduced when we con­sider empir­i­cal works on the adop­tion of secu­rity poli­cies. This real­ity has been high­lighted by sev­eral authors, who have pointed out cer­tain lim­i­ta­tions to the research done on that area. The main crit­i­cisms are related to the inex­is­tence of a coher­ent the­ory about secu­rity poli­cies [Hong et al. 2003], inex­is­tence or low expres­sion of empir­i­cal stud­ies focus­ing on the adop­tion, con­tent and imple­men­ta­tion of ISS poli­cies [Ful­ford and Doherty 2003; Knapp et al. 2006], lack of empir­i­cally sup­ported research on ISS [Kotulic and Clark 2004] and a con­cern which is too cen­tered in poli­cies con­tent and struc­ture, and in the prob­lem of gath­er­ing man­age­ment sup­port with respect to pol­icy for­mu­la­tion, imple­men­ta­tion and enforce­ment [Baskerville and Sipo­nen 2002].

This fact brings about a dif­fi­cult issue, as it raises the ques­tion about the real agree­ment between what is claimed in lit­er­a­ture about ISS poli­cies and what is actu­ally done in prac­tice.

Although each orga­ni­za­tion has spe­cific needs in terms of ISS, Pub­lic Admin­is­tra­tion con­sti­tutes an inter­est­ing sec­tor to con­duct research on IS, as sug­gested by the fact of being one of the major investors in IT [Gart­ner 2009] and due to the spe­cific chal­lenges it raises [Bretschnei­der 1990; New­comer and Cau­dle 1991]. Among the var­i­ous Pub­lic Admin­is­tra­tion insti­tu­tional agents, the City Coun­cils assume a spe­cific rel­e­vance, as they con­dense a grow­ing strong demand from their cit­i­zens for infor­ma­tion ser­vices, and for the infor­ma­tion diver­sity and quan­tity they deal with in the per­for­mance of their duties. There­fore, the effi­ciency of their IS is cru­cial. Due to the infor­ma­tion they receive, store, process and dis­trib­ute, the secu­rity of their IS is indis­pens­able to their nor­mal func­tion­ing and to the pro­tec­tion of per­sonal data which they are trusted with.

In the case of Local Pub­lic Admin­is­tra­tion in Por­tu­gal, the stud­ies focus­ing on ISS are almost inex­is­tent. Indeed, we only found two gov­ern­men­tal tech­ni­cal reports (cf. [OSIC and UMIC 2004; OSIC and UMIC 2006]), whose pri­mar­ily con­cern was on the use of IT by Por­tuguese munic­i­pal­i­ties, that included some data regard­ing ISS, although lim­ited to secu­rity tech­nolo­gies employed and to the main secu­rity prob­lems faced by munic­i­pal­i­ties. Con­se­quently, the first dif­fi­culty we come across is a gen­eral lack of knowl­edge about the Por­tuguese City Coun­cils real­ity con­cern­ing the adop­tion and appli­ca­tion of ISS poli­cies.

Bear­ing in mind this dif­fi­culty, we have tried to mit­i­gate the gap iden­ti­fied in lit­er­a­ture by con­duct­ing a sur­vey directly in the 308 Por­tuguese munic­i­pal enti­ties. The sur­vey con­sisted of a num­ber of ques­tions about ISS poli­cies, focus­ing on the exis­tence and fea­tures of such doc­u­ments.

This is the con­text of the present work, which aims to find out about the Por­tuguese City Coun­cils real­ity as far as their ISS is con­cerned, as well as to quan­tify those which have adopted ISS poli­cies.

The struc­ture of the paper is as fol­lows. After this intro­duc­tion, we briefly review the lit­er­a­ture on ISS poli­cies in terms of poli­cies’ impor­tance, fea­tures and com­po­nents. Then, in Sec­tion 3, we state the research pur­pose that moti­vated the pro­mo­tion of a sur­vey to char­ac­ter­ize the adop­tion of ISS poli­cies by Por­tuguese City Coun­cils. On Sec­tion 4, the sur­vey, its tar­get pop­u­la­tion, struc­ture and results are pre­sented. In the sub­se­quent sec­tion the find­ings are dis­cussed. In the last sec­tion, tak­ing into account the results of the study we iden­tify future work oppor­tu­ni­ties.

2. Information Systems Security Policies

Infor­ma­tion is one of the present orga­ni­za­tions main assets. There­fore, it is nat­ural that the sys­tems sup­port­ing infor­ma­tion are increas­ingly exposed to either inten­tional or acci­den­tal threats. These threats put at risk the con­fi­den­tial­ity, integrity and avail­abil­ity of infor­ma­tion and sys­tems which manip­u­late it. Con­se­quently, the peo­ple in charge of orga­ni­za­tions should con­sider and imple­ment mea­sures aim­ing to pre­vent, detect and respond to such threats.

In order to suc­ceed in their IS pro­tec­tion actions, orga­ni­za­tions need to adopt sev­eral types of mea­sures. They need to imple­ment not only ISS tech­ni­cal mea­sures, but also and increas­ingly more orga­ni­za­tional and social mea­sures, as this is the only way to reach orga­ni­za­tional well-being as well as main­tain orga­ni­za­tions integrity [Dhillon and Back­house 2000].

ISS poli­cies have been pointed out in lit­er­a­ture as the most appro­pri­ate and indis­pens­able way to launch and sus­tain the orga­ni­za­tions’ ISS pro­gram, so that orga­ni­za­tions may achieve a cer­tain secu­rity level of their IS.

Con­sid­er­ing the present tech­nol­ogy and busi­ness con­text, orga­ni­za­tions have to stop wor­ry­ing only about crack­ers attacks or fire­walls and antivirus imple­men­ta­tion, to start focus­ing on the cre­ation of a wider and more com­plete and com­plex ISS pol­icy. As noticed by Wood [1995], only by set­ting up a fire­wall, we can­not ensure that, for exam­ple, the Inter­net access is safe. There is the need to con­sider sev­eral other issues, such as poli­cies, pro­ce­dures, stan­dards and guide­lines which will direct users’ actions.

2.1 Importance

Lit­er­a­ture review sug­gests a high level of agree­ment on the impor­tance of an ISS pol­icy in orga­ni­za­tions, being con­sid­ered by sev­eral authors as the foun­da­tion of the secu­rity effort. This recog­ni­tion can be observed in the fol­low­ing state­ments:

• “The secu­rity pol­icy is to the secu­rity envi­ron­ment like the law is to a legal sys­tem. (...) A pol­icy is the start of secu­rity man­age­ment.” [Hig­gins 1999, p. 217]

• “... a dig­i­tal sys­tem with­out a secu­rity pol­icy is likely to have a hodge-podge of coun­ter­mea­sures. The pol­icy is what ties every­thing together.” [Schneier 2000, p. 308]

• “An effec­tive infor­ma­tion secu­rity pol­icy is as nec­es­sary to a good infor­ma­tion secu­rity pro­gram as a solid foun­da­tion is to a house.” [King et al. 2001, p. 13]

• “The cor­ner­stone of an effec­tive infor­ma­tion secu­rity archi­tec­ture is a well-writ­ten pol­icy state­ment.” [Peltier 2002, p. 21]

• “The infor­ma­tion secu­rity pol­icy is one of the most impor­tant doc­u­ments in an orga­ni­za­tion...” [Höne and Eloff 2002a, p. 409]

• “... the secu­rity pol­icy is the foun­da­tion on which all secu­rity is based.” [Shorten 2004, p. 917]

  “Secu­rity poli­cies are the foun­da­tion and the bot­tom line of infor­ma­tion secu­rity in an orga­ni­za­tion.” [Kee 2001, p. 1]

The increas­ing high level of impor­tance given to ISS poli­cies can be explained by the use that these doc­u­ments reveal to have in terms of the ini­tia­tives devel­oped by orga­ni­za­tions for IS pro­tec­tion [de Sá-Soares 2005].

Accord­ing to Höne and Eloff [2002a], secu­rity poli­cies are a priv­i­leged vehi­cle for the peo­ple in charge to explain the need for secu­rity in the orga­ni­za­tion infor­ma­tion sys­tem.

Poli­cies also reveal their use­ful­ness through the estab­lish­ment of the major ISS guide­lines, giv­ing direc­tion to the infor­ma­tion sys­tem pro­tec­tion ini­tia­tives, and defin­ing the role that ISS plays in sup­port­ing the orga­ni­za­tional mis­sion and goals [JISC 2001].

ISS poli­cies are also impor­tant for secu­rity per­son­nel, since they pro­vide indi­ca­tions about the assets the orga­ni­za­tion wants to pro­tect and the pro­tec­tion degree which is to be given to each of those assets [King et al. 2001].

In addi­tion to that, ISS poli­cies assist in the coor­di­na­tion of IS pro­tec­tion actions, pre­vent­ing the frag­men­ta­tion of efforts and act­ing as a guide in the process of selec­tion, devel­op­ment and imple­men­ta­tion of ISS con­trols [Bar­man 2001].

Another aspect we can high­light is the ISS pol­icy con­tri­bu­tion to the orga­ni­za­tion as a whole, so that every­one behaves in a coher­ently accept­able way as far as infor­ma­tion secu­rity is con­cerned [Lee 2001].

We can also refer its role in the assur­ance that the orga­ni­za­tion is com­ply­ing with the appro­pri­ate leg­is­la­tion, namely by avoid­ing or lim­it­ing civil or crim­i­nal respon­si­bil­i­ties [Dhillon and Back­house 1997].

2.2 Features

In what con­cerns the fea­tures of a secu­rity pol­icy, Höne and Eloff [2002b] claim that the pol­icy doc­u­ment should not include the tech­ni­cal aspects related to the imple­men­ta­tion of secu­rity mech­a­nisms, as these may change through­out time. On the other hand, it should be a doc­u­ment which is easy to read and under­stand, short, and writ­ten with a high abstrac­tion level in mind. Finally, with respect to its dura­bil­ity, pol­icy reviews should be car­ried out on a reg­u­lar but not con­stant basis.

Many of the fac­tors listed above are shared by Kee [2001], who thinks the first thing to bear in mind when writ­ing a pol­icy is to write it in a lan­guage that is easy to under­stand instead of mak­ing it com­pli­cated. To this author, poli­cies should be writ­ten using the SMART rule, which stands for Spe­cific, Mea­sur­able, Agree­able, Real­is­tic and Time-bound.

Another aspect to con­sider is related to the struc­tur­ing of ISS poli­cies state­ments. Dif­fer­ent authors sup­port dif­fer­ent struc­tur­ing ways.

Lindup [1995] acknowl­edges the exis­tence of orga­ni­za­tional poli­cies, which estab­lish gen­eral guide­lines for the ISS pro­gram, and tech­ni­cal poli­cies, which estab­lish the secu­rity require­ments that a com­puter prod­uct or sys­tem to be devel­oped should observe.

In con­trast, Baskerville and Sipo­nen [2002] dis­tin­guish three ISS poli­cies cat­e­gories:

• High level poli­cies—They con­sist of high level global plans which include the gen­eral goals and accept­able pro­ce­dures in the realm of ISS.

• Low level poli­cies—They are infor­ma­tion secu­rity action meth­ods, defined and selected among the var­i­ous alter­na­tives and in the light of cer­tain data and con­di­tions which guide and deter­mine the present and future infor­ma­tion secu­rity deci­sions.

• Metapoli­cies—They are the “poli­cies for the poli­cies”, in other words, the orga­ni­za­tional guide­lines for the poli­cies for­mu­la­tion and main­te­nance.
  Apart from those, Whit­man et al. [2001] observe three fun­da­men­tal struc­tures for ISS poli­cies:

• Indi­vid­ual pol­icy—In this struc­ture, the orga­ni­za­tion cre­ates a sep­a­rate and inde­pen­dent secu­rity pol­icy for each tech­nol­ogy and sys­tem in use.

• Com­plete pol­icy—Accord­ing to this struc­ture, which is the most com­mon accord­ing to the authors, the orga­ni­za­tion cen­trally defines, con­trols and man­ages one sin­gle doc­u­ment which includes all the tech­nolo­gies used and pro­vides gen­eral guide­lines to all sys­tems used by the orga­ni­za­tion.

• Mod­u­lar com­plete pol­icy—This pol­icy is cen­trally con­trolled and man­aged as it is the case of the com­plete pol­icy, and it con­sists of gen­eral sec­tions, with descrip­tions of the tech­nolo­gies used, and dis­cus­sions about the sys­tems respon­si­ble and appro­pri­ate use. It dif­fers from the pre­vi­ous struc­ture because it includes mod­u­lar appen­dixes, which pro­vide spe­cific details on each tech­nol­ogy and bring for­ward par­tic­u­lar obser­va­tions, dif­fer­ences, restric­tions and func­tion­al­i­ties related to the use of tech­nol­ogy which are not prop­erly cov­ered in the base pol­icy doc­u­ment. For these authors, this is the most effec­tive struc­ture for ISS poli­cies.

2.3 Components

As far as com­po­nents are con­cerned, some authors warn us about the depen­dence of these doc­u­ments com­po­si­tion on the orga­ni­za­tion nature, size and goals, mak­ing dif­fi­cult the gen­er­al­iza­tion of ele­ments which must be part of a secu­rity pol­icy.

Although it is accepted that an ISS pol­icy varies con­sid­er­ably from orga­ni­za­tion to orga­ni­za­tion, to Wood [1995] this doc­u­ment should typ­i­cally include the fol­low­ing ele­ments: gen­eral state­ments of aims, goals, beliefs and respon­si­bil­i­ties, fre­quently accom­pa­nied by gen­eral pro­ce­dures for their achieve­ment.

Whit­man [2004] defines that a good ISS pol­icy should out­line indi­vid­ual respon­si­bil­i­ties, define which users are allowed to use the sys­tem, inform work­ers about poten­tial threats to the sys­tem, define penal­ties for vio­la­tions of the pol­icy, and pro­vide a pol­icy updat­ing mech­a­nism.

Forcht and Ayers [2001] pro­pose that an ISS pol­icy should con­tain the fol­low­ing ele­ments: scope, def­i­n­i­tions, risk pro­file, require­ments, secu­rity mea­sures, dis­as­ter recov­ery pro­ce­dures, inter­net secu­rity, appli­ca­tion of pol­icy, and coor­di­na­tor’s iden­ti­fi­ca­tion.

In the face of the diver­sity of pro­pos­als for ISS pol­icy com­po­nents, Höne and Eloff [2002a] under­took a com­par­i­son of sev­eral ISS inter­na­tional stan­dards and gath­ered the key ele­ments of an ISS pol­icy as listed in Table 1.

Table 1: ISS Poli­cies Com­po­nents
Adapted from Höne and Eloff [2002a]

3. Research Purpose

As men­tioned in the intro­duc­tion, there is a lack of empir­i­cal stud­ies in ISS poli­cies. Despite the fre­quent crit­i­cisms of the lack of research on ISS poli­cies and the inex­is­tence of empir­i­cal stud­ies in this area, we can observe, from the lit­er­a­ture review, some dif­fi­cul­ties to invert this sit­u­a­tion.

In the sequence of this obser­va­tion, this work aims to con­trib­ute to fill that gap, seek­ing to develop research which takes those crit­i­cisms into account, espe­cially as far as the con­duc­tion of empir­i­cal stud­ies and the con­tex­tu­al­iza­tion of secu­rity poli­cies appli­ca­tion are con­cerned.

Thus, we intend to quan­tify ISS poli­cies adop­tion by orga­ni­za­tions. Faced with the diver­sity and dimen­sion of the poten­tial tar­get sec­tors of this analy­sis, we chose to focus our atten­tion on Pub­lic Admin­is­tra­tion, one of main investors in IT [Gart­ner 2009] and a sec­tor which is in the inter­est of a high num­ber of con­stituents, in other words, all cit­i­zens. Hence, the pur­pose of this study was to char­ac­ter­ize the cur­rent adop­tion of ISS poli­cies by Por­tuguese City Coun­cils.

4. Survey

In order to char­ac­ter­ize empir­i­cally the adop­tion of ISS poli­cies by Por­tuguese City Coun­cils, a sur­vey was thought to be the appro­pri­ate tech­nique to apply, as it enables a clear, direct and objec­tive answer to the ques­tions pre­sented to respon­dents. Besides this, since the aim was a com­plete char­ac­ter­i­za­tion of the pop­u­la­tion, made up of 308 City Coun­cils, this num­ber was thought to make the use of alter­na­tive research tech­niques impos­si­ble or inad­vis­able.

As the sur­vey focused on ISS poli­cies, it became of cen­tral impor­tance to adopt a def­i­n­i­tion which might be eas­ily trans­mit­ted and under­stood by the respon­dents. There­fore, we chose to adopt the def­i­n­i­tion used by de Sá-Soares [2005, p. 56], for whom ISS poli­cies are “doc­u­ments which guide or reg­u­late peo­ple or sys­tems actions in the domain of infor­ma­tion sys­tems secu­rity”. This is a suf­fi­ciently broad def­i­n­i­tion that does not pre­clude the pos­si­bil­ity of City Coun­cils hav­ing pol­icy doc­u­ments of dif­fer­ent natures or with dif­fer­ent struc­tures, as pre­vi­ously dis­cussed in sub­sec­tion 2.2.

4.1 Population

The object of study of this work is Local Pub­lic Admin­is­tra­tion in Por­tu­gal, which is orga­nized in 308 City Coun­cils.

Among the 308 City Coun­cils tar­geted in the sur­vey, 308 ques­tion­naires were car­ried out, which cor­re­sponds to a response rate of 100%. The sur­vey was con­ducted to the whole pop­u­la­tion instead of using a ran­dom sam­ple, enabling the col­lec­tion of data about the whole pop­u­la­tion.

From the 308 con­tacts made, 299 were answered by phone and six by email after a pre­vi­ous phone call.

The respon­dents to this sur­vey were the peo­ple in charge of IS in munic­i­pal­i­ties.

In order to stan­dard­ize the ques­tion­ing and the expla­na­tions pro­vided to even­tual requests for clar­i­fi­ca­tion by the respon­dents, the phone calls were under­taken by one of the authors, who strived to main­tain a com­mon dis­course along the con­tacts so that poten­tial influ­ences on respon­dents’ answers could be min­i­mized. A brief expla­na­tion of the study was also pre­pared and trans­mit­ted to all the respon­dents on the ini­tial stages of the phone inter­ac­tion.

4.2 Structure

The sur­vey struc­ture was a result of the ISS poli­cies lit­er­a­ture review. The ques­tions in the sur­vey were orga­nized in four groups.

The first group aimed to obtain a short char­ac­ter­i­za­tion of both the City Coun­cil and the respon­dent, fol­lowed by groups of ques­tions con­cern­ing ISS poli­cies gen­eral fea­tures, which were pre­ceded by the fun­da­men­tal ques­tion: “Does the City Coun­cil have an ISS pol­icy?”.

Fol­low­ing the main ques­tion and in case the answer was neg­a­tive, the respon­dents answered the group of ques­tions in which they were asked whether they were plan­ning to for­mu­late a secu­rity pol­icy, since they didn’t have any. In case they were plan­ning to do so, they were asked if the pol­icy was already being pre­pared. When they were not think­ing of for­mu­lat­ing a secu­rity pol­icy, they were asked about whether their option was due to the fact that they did not con­sider ISS an impor­tant mat­ter.

When the answer to the main ques­tion was pos­i­tive, the respon­dents answered the groups of ques­tions focus­ing on poli­cies as a prod­uct and on their for­mu­la­tion and imple­men­ta­tion processes.

With respect to poli­cies as a prod­uct, the ques­tions were related to the way they are pre­sented; what they include; their size in num­ber of pages; who knows about the pol­icy; where it is avail­able; whether the roles, respon­si­bil­i­ties and penal­ties for its non-com­pli­ance are defined; and whether the users have signed a state­ment of accep­tance of the pol­icy.

As far as processes are con­cerned, the ques­tions were related to the poli­cies time­line; who started the for­mu­la­tion process; who devel­oped the pol­icy; whether it was approved by supe­ri­ors; who imple­mented it and who super­vises its enforce­ment; whether it was well accepted by its users; whether it is in force; whether it is reviewed; if there is one or many; and who it tar­gets.

One last ques­tion asked to the respon­dents was related to the exis­tence and iden­ti­fi­ca­tion of other infor­ma­tion pro­tec­tion coun­ter­mea­sures.

4.3 Results

The main ques­tion in the sur­vey aimed to find out about the exis­tence of ISS poli­cies in City Coun­cils in Por­tu­gal.

As we can see in the chart in Fig­ure 1, among the 308 City Coun­cils, 38 (12%) stated that they have adopted ISS poli­cies and 270 (88%) indi­cated that they have not adopted any pol­icy.

Fig­ure 1: Adop­tion of ISS Poli­cies

If we cross these answers with the respec­tive City Coun­cil elec­toral dimen­sion, we notice that among the 38 City Coun­cils hav­ing ISS poli­cies, 20 (52.6%) belong to “Medium Sized Munic­i­pal­i­ties” cat­e­gory, 9 (23.7%) to “Small Munic­i­pal­i­ties”, 6 (15.8%) to “Large Munic­i­pal­i­ties” and 3 (7.9%) to “Very Large Munic­i­pal­i­ties”. These per­cent­ages can be recal­cu­lated con­sid­er­ing the num­ber of City Coun­cils included in each of those four cat­e­gories, obtain­ing the dis­tri­bu­tion pre­sented in Table 2.

Table 2: Dis­tri­b­u­tion accord­ing to Elec­toral Dimen­sion

In rel­a­tive val­ues, we observe that the “Large Munic­i­pal­i­ties” cat­e­gory is the one which has the high­est num­ber of poli­cies, fol­lowed by the “Very Large Munic­i­pal­i­ties”, and with approx­i­mate fig­ures the “Medium Sized Munic­i­pal­i­ties”. “Small Munic­i­pal­i­ties” is the cat­e­gory with the low­est num­ber of adopted poli­cies.

The size of poli­cies, in terms of their of num­ber of pages, varies a lot in the uni­verse of the 38 City Coun­cils, the aver­age being of eight pages per doc­u­ment, between a max­i­mum of 30 pages and a min­i­mum of one page.

Among the 38 City Coun­cils hav­ing poli­cies, 92% (35) have poli­cies in which the users’ roles and respon­si­bil­i­ties are defined, whereas in the remain­ing 8% (3) such def­i­n­i­tion does not exist. In all of the 38 City Coun­cils, the poli­cies are known both by lead­ers and work­ers, with­out hav­ing been pub­li­cized among cit­i­zens, and are avail­able inter­nally in 97% (37) of the cases, and both inter­nally and pub­licly in 3% (1).

Penal­ties def­i­n­i­tion for non-com­pli­ance with pol­icy is not pro­vided in 63% (24) of the City Coun­cils. The respon­dents have jus­ti­fied such inex­is­tence by say­ing that work­ers obey the laws applied to civil ser­vice, thus being sub­ject to dis­ci­pli­nary action irre­spec­tive of the exis­tence or not of a defined penalty in the secu­rity pol­icy doc­u­ment.

The ini­tia­tive to develop the ISS pol­icy is clearly taken by City Coun­cils’ IT man­agers/experts. The same hap­pens with the respon­si­bil­ity for its for­mu­la­tion, imple­men­ta­tion and enforce­ment.

The ISS poli­cies apply to peo­ple in 61% (23) of the cases, to peo­ple and tech­nol­ogy in 37% (14) of the cases, and only to tech­nol­ogy in the remain­ing 3% (1) of the cases. Data gath­ered in the cat­e­gories of appli­ca­tion can be observed in the chart in Fig­ure 2.

Fig­ure 2: Appli­ca­tion of ISS Pol­icy

When ques­tioned about the exis­tence of one or more ISS poli­cies, 89% (34) of the City Coun­cils hav­ing poli­cies said to have one global pol­icy and 11% (4) said to have sev­eral par­tial poli­cies.

As far as their accep­tance is con­cerned, poli­cies have been marked as well-accepted by work­ers in 79% (30) of the City Coun­cils.

Although the major­ity of City Coun­cils do not have an ISS pol­icy, there were many in which it was said that they were think­ing of for­mu­lat­ing an ISS pol­icy. More specif­i­cally, 66 % (177) of the respon­dents are con­sid­er­ing the cre­ation of an ISS pol­icy, against 34% (93) which are not plan­ning to for­mu­late any pol­icy.

Among the respon­dents who are plan­ning to adopt an ISS pol­icy, 42% (75) are already in the for­mu­la­tion process, whereas the remain­ing 58% (102) are will­ing to cre­ate a pol­icy, but have not started the for­mu­la­tion process yet.

ISS poli­cies are being enforced in the 38 City Coun­cils that have adopted such a doc­u­ment. Three years is the aver­age of the num­ber of years for which the poli­cies have existed in the sum of the 38 City Coun­cils which gave a pos­i­tive answer to the ques­tion related to the exis­tence of a pol­icy.

Finally, the exis­tence of IS/IT pro­tec­tion mech­a­nisms is a real­ity in all the City Coun­cils. The most com­monly used coun­ter­mea­sure is antivirus soft­ware. There are also fire­wall devices in many munic­i­pal­i­ties. Anti-spam fil­ters and daily infor­ma­tion back­ups are also widely used.

5. Discussion

Although the major­ity of City Coun­cils do not have an ISS pol­icy, there were many in which a pos­i­tive answer was given to the ques­tion about whether or not they were con­sid­er­ing the for­mu­la­tion of an ISS pol­icy. Accord­ing to the infor­ma­tion obtained from tele­phone con­tacts, this is mainly due to the present need to cer­tify their ser­vices, under Qual­ity Cer­ti­fi­ca­tion (ISO 9001), and to the adher­ence to dig­i­tal cities net­works projects in Por­tu­gal. It seems, there­fore, that in many cases, the ISS poli­cies adop­tion is based on a reac­tive process via fac­tors which are exoge­nous to City Coun­cils and related to cer­ti­fi­ca­tion and par­tic­i­pa­tion in regional com­put­er­i­za­tion projects.

Based on these results, we can observe that 66% (177) of the respon­dents not hav­ing ISS poli­cies are think­ing of adopt­ing one, whereas 34% (93) are not plan­ning to for­mu­late any pol­icy. In the light of this answer, these 93 respon­dents were asked about whether or not they con­sider ISS a mat­ter of con­cern. The answer was invari­ably pos­i­tive, in other words, although the respon­dents are not plan­ning to for­mu­late a pol­icy, they con­sider ISS a mat­ter of con­cern, jus­ti­fied by the value they admit infor­ma­tion has. In an attempt to find an expla­na­tion for this incon­gruity, the respon­dents gave some expla­na­tions based on the fact that they used sev­eral ISS safe­guards, thus not need­ing, in their view, an ISS pol­icy in the form of a writ­ten state­ment.

The aver­age of the num­ber of years of exis­tence of the pol­icy in the total of the 38 City Coun­cils is only three years. This sug­gests that sen­si­tive­ness towards the adop­tion of ISS poli­cies is a recent thing.

One of the start­ing dif­fi­cul­ties faced in the con­duc­tion of the sur­vey was related to a lack of a clear and uni­ver­sal under­stand­ing about the ISS pol­icy con­cept by the respon­dents. It was not with­out some dif­fi­culty that sev­eral respon­dents asso­ci­ated this con­cept with the set of secu­rity rules which estab­lish the use of munic­i­pal­i­ties IS. One thing that might con­trib­ute to this is the huge pro­fu­sion of for­mal “cov­ers” to pro­ce­dure norms and rules exis­tent in City Coun­cils, turned into a dis­par­ity of writ­ten doc­u­ments, such as inter­nal reg­u­la­tions, norms, orders, and even notices in the work­ing place.

With respect to the com­po­nents used in poli­cies, we observe that among the 38 City Coun­cils hav­ing an ISS pol­icy, 37 have defined users’ roles and respon­si­bil­i­ties. The def­i­n­i­tion of penal­ties for dis­obe­di­ence to the pol­icy only exists in 14 cases. The sig­na­ture of a state­ment of accep­tance of the pol­icy is car­ried out in 17 cases.

The pol­icy approval was car­ried out in 31 City Coun­cils by its Lead­ing Team, in five by the alder­man and in two by the Munic­i­pal Assem­bly. As far as the pol­icy enforce­ment is con­cerned, this task is done by the City Coun­cil IT depart­ment in 36 cases.

With respect to the reviews done to the pol­icy, 33 respon­dents with poli­cies have never done any review, two did one review, and two are due to do an annual review to the pol­icy.

In the light of the study and the uni­verse con­sid­ered, we observe a dif­fer­ence between what is claimed in lit­er­a­ture and what is seen in prac­tice. Although authors such as Baskerville and Sipo­nen [2002, p. 337] claim that it is “very con­sen­sual that a good infor­ma­tion secu­rity pol­icy is the basis for orga­ni­za­tions infor­ma­tion secu­rity”, the respon­dents do not seem to be suf­fi­ciently alert or con­vinced of the foun­da­tion of this argu­ment.

Whit­man and Mat­tord [2005] indi­cate that secu­rity poli­cies are the cheap­est mea­sures to for­mu­late, but the most dif­fi­cult to imple­ment prop­erly. We won­der whether respon­dents see the dif­fi­cul­ties in the con­crete appli­ca­tion of ISS poli­cies as one of the obsta­cles to their adop­tion. It is pos­si­ble that the prob­lem resides in a higher level, namely in the lack of a model for the ISS poli­cies for­mu­la­tion, con­tain­ing a clear indi­ca­tion of its fea­tures and com­po­nents, adapted to the Local Pub­lic Admin­is­tra­tion orga­ni­za­tional and insti­tu­tional real­ity.

6. Conclusion

This study was based on the con­duc­tion of a sur­vey to the 308 City Coun­cils in Por­tu­gal, hav­ing reached a response rate of 100%.

The aim of this work was to try to con­trib­ute to the knowl­edge of real­ity in Por­tu­gal as far as ISS poli­cies adop­tion is con­cerned, as well as to the enrich­ment of ISS lit­er­a­ture, which lacks empir­i­cal stud­ies.

The results of this study raise sev­eral inter­ro­ga­tions, based on the low level of ISS poli­cies adop­tion by Munic­i­pal­i­ties in Por­tu­gal. In order to plan the sub­se­quent research, we pro­pose that the works are orga­nized around the analy­sis of four orga­ni­za­tion clus­ters. The 308 City Coun­cils are thus dis­trib­uted as fol­lows: Clus­ter 1–City Coun­cils hav­ing an ISS pol­icy (38); Clus­ter 2–City coun­cils which do not have an ISS pol­icy, but are in a process of for­mu­la­tion (75); Clus­ter 3–City Coun­cils which do not have an ISS pol­icy, but are plan­ning to adopt one (102) and Clus­ter 4–City Coun­cils which do not have an ISS pol­icy and do not intend to adopt one (93).

Among the future works to be done, we high­light the iden­ti­fi­ca­tion of facil­i­tat­ing and inhibit­ing fac­tors to the adop­tion of ISS poli­cies by City Coun­cils, the pro­posal of a generic for­mat for ISS poli­cies to be adopted by City Coun­cils and the pro­posal of a frame­work which may help Munic­i­pal­i­ties to for­mu­late and imple­ment ISS poli­cies. We also intend to mon­i­tor the evo­lu­tion of ISS poli­cies adop­tion by Por­tuguese City Coun­cils through the pro­mo­tion of peri­odic sur­veys sim­i­lar to the one described in this paper.

References

• Bar­man, S. (2001). Writ­ing Infor­ma­tion Secu­rity Poli­cies. Indi­anapo­lis: New Rid­ers.

  Baskerville, R. and M. Sipo­nen (2002). An infor­ma­tion secu­rity meta-pol­icy for emer­gent orga­ni­za­tions. Logis­tics Infor­ma­tion Man­age­ment 15(5/6), 337–346.

  Bretschnei­der, S. (1990). Man­age­ment Infor­ma­tion Sys­tems in Pub­lic and Pri­vate Orga­ni­za­tions: An Empir­i­cal Test. The Pub­lic Admin­is­tra­tion Review 50(5), 536–545.

  Dhillon, G. and J. Back­house (1997). Man­ag­ing for secure orga­ni­za­tions: a cri­tique of infor­ma­tion sys­tems secu­rity research approaches. Tech­ni­cal Report, Lon­don School of Eco­nom­ics, Com­puter Secu­rity Research Cen­tre, Lon­don.

  Dhillon, G and J. Back­house (2000). Infor­ma­tion Sys­tem Secu­rity Man­age­ment in the New Mil­len­nium. Com­mu­ni­ca­tions of ACM 43(7), 125–128.

  Forcht, K. and W. Ayers (2001). Devel­op­ing a Com­puter Secu­rity Pol­icy for Orga­ni­za­tional Use and Imple­men­ta­tion. Jour­nal of Com­puter Infor­ma­tion Sys­tems 41(2), 52–57.

  Ful­ford, H. and N. F. Doherty (2003). The appli­ca­tion of infor­ma­tion secu­rity poli­cies in large UK-based orga­ni­za­tions: an exploratory inves­ti­ga­tion. Infor­ma­tion Man­age­ment & Com­puter Secu­rity 11(3), 106–114.

  Gart­ner (2009). Dataquest Alert: Fore­cast, IT Spend­ing in Indus­tries, World­wide, 3Q09 Update. Octo­ber.

  Hig­gins, H. N. (1999). Cor­po­rate sys­tem secu­rity: towards an inte­grated man­age­ment approach. Infor­ma­tion Man­age­ment & Com­puter Secu­rity 7(5), 217–222.

  Höne, K. and J. Eloff (2002a). Infor­ma­tion secu­rity pol­icy—what do inter­na­tional infor­ma­tion secu­rity stan­dards say? Com­put­ers & Secu­rity 21(5), 402–409.

  Höne, K. and J. Eloff (2002b). What makes an effec­tive secu­rity pol­icy? Net­work Secu­rity 6(1), 14–16.

  Hong, K. S., Y.-P. Chi, L. R. Chao and J.-H. Tang (2003). An inte­grated sys­tem the­ory of infor­ma­tion secu­rity man­age­ment. Infor­ma­tion Man­age­ment & Com­puter Secu­rity 11(5), 243–248.

  JISC (2001). Devel­op­ing an Infor­ma­tion Secu­rity Pol­icy. Joint Infor­ma­tion Sys­tems Com­mit­tee (JISC).

  Kee, C. (2001). Secu­rity Pol­icy Roadmap—Process for Cre­at­ing Secu­rity Poli­cies. SANS Insti­tute.

  King, C. M., C. E. Dal­ton and T. E. Osman­oglu (2001). Secu­rity Archi­tec­ture: Design, Deploy­ment, and Oper­a­tions. Berke­ley: Osborne/McGraw-Hill.

  Knapp, K., R. Mar­shall, K. Rainer and N. Ford. (2006). Infor­ma­tion Secu­rity: Man­age­ment’s Effect on Cul­ture and Pol­icy. Infor­ma­tion Man­age­ment & Com­puter Secu­rity 11(1), 24–36.

  Kotulic, A. and J. Clark (2004). Why there aren’t more infor­ma­tion secu­rity research stud­ies. Infor­ma­tion & Man­age­ment 41(5), 597–607.

  Lee, D. (2001). Devel­op­ing Effec­tive Infor­ma­tion Sys­tems Secu­rity Poli­cies. SANS Insti­tute.

  Lindup, K. R. (1995). A New Model for Infor­ma­tion Secu­rity Poli­cies. Com­put­ers & Secu­rity 14(8), 691–695.

  New­comer, K. E. and S. L. Cau­dle (1991). Eval­u­at­ing Pub­lic Sec­tor Infor­ma­tion Sys­tems: More than Meets the Eye. The Pub­lic Admin­is­tra­tion Review 51(5), 377–384.

  OSIC and UMIC (2004). Inquérito à Uti­liza­ção das Tec­nolo­gias da Infor­mação e da Comu­ni­cação nas Câmaras Munic­i­pais 2004. Obser­vatório da Sociedade da Infor­mação e do Con­hec­i­mento and Agên­cia para a Sociedade do Con­hec­i­mento, Lis­boa (Por­tu­gal).

  OSIC and UMIC (2006). Inquérito à Uti­liza­ção das Tec­nolo­gias da Infor­mação e da Comu­ni­cação nas Câmaras Munic­i­pais 2006. Obser­vatório da Sociedade da Infor­mação e do Con­hec­i­mento and Agên­cia para a Sociedade do Con­hec­i­mento, Lis­boa (Por­tu­gal).

  Peltier, T. R. (2002). Infor­ma­tion Secu­rity Poli­cies, Pro­ce­dures, and Stan­dards: Guide­lines for Effec­tive Infor­ma­tion Secu­rity Man­age­ment. Boca Raton: Auer­bach Pub­li­ca­tions.

  de Sá-Soares, F. (2005). Inter­pre­tação da Segu­rança de Sis­temas de Infor­mação Segundo a Teo­ria da Acção. PhD The­sis in Infor­ma­tion Sys­tems and Tech­nolo­gies. Uni­ver­si­dade do Minho, Guimarães.

  Schneier, B. (2000). Secrets and Lies: Dig­i­tal Secu­rity in a Net­worked World. New York: John Wiley & Sons.

  Shorten, B. (2004). Infor­ma­tion Secu­rity Poli­cies from the Ground Up. In Tip­ton, H. F. and M. Krause (Eds.), Infor­ma­tion Secu­rity Man­age­ment Hand­book, fifth edi­tion, 917–924. Boca Raton: Auer­bach.

  Whit­man, M. E. (2004). In defense of the realm: Under­stand­ing threats to infor­ma­tion secu­rity. Infor­ma­tional Jour­nal of Infor­ma­tion Man­age­ment 24(1), 3–4.

  Whit­man, M. and H. Mat­tord (2005). Prin­ci­ples of Infor­ma­tion Secu­rity, sec­ond edi­tion. Boston: Course Tech­nol­ogy.

  Whit­man, M. E., A. M. Townsend and R. J. Aal­berts. (2001). Infor­ma­tion Sys­tems Secu­rity and the Need for Pol­icy. In Dhillon, G. (Ed.), Infor­ma­tion Secu­rity Man­age­ment: Global Chal­lenges in the New Mil­len­nium. Idea Group Pub­lish­ing.

  Wood, C. C. (1995). Writ­ing InfoSec Poli­cies. Com­put­ers & Secu­rity 14(8), 667–674.