An analysis of United Kingdom schools’ information security policies: a socio-technical approach

Martin Sparrius; Moufida Sadok

doi:10.1007/978-3-030-86858-1_10

An analysis of United Kingdom schools’ information security policies: a socio-technical approach

Martin Sparrius, Moufida Sadok

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

64 Downloads (Pure)

Abstract

UK schools collect and store large amounts of data on their students, parents, and staff. This makes them attractive targets for both external and internal attackers. To respond to and manage security risks, many schools have developed and implemented Information Security policies. This paper explores and analyses the content of 100 UK schools’ security policies with an aim to examine the extent to which these policies address security risks faced by schools. Such exploration has the potential to assess the effectiveness and the relevance of security policies. The key findings show that many security policies are primarily centered on traditional technology-focused solutions and not on threats targeting the human elements in their organisations. In addition, it could be argued that between poor readability scores and large word counts, these policies are not very accessible to staff. This paper proposes that a socio-technical approach to information security would potentially result in better understanding of the role and application of security policies in schools and, therefore, improved information security.

Original language	English
Title of host publication	Organizing in a Digitized World
Subtitle of host publication	Individual, Managerial and Societal Issues
Editors	Stefano Za, Augusta Consorti, Francesco Virili
Publisher	Springer
Pages	176-189
Number of pages	14
ISBN (Electronic)	9783030868581
ISBN (Print)	9783030868574
DOIs	https://doi.org/10.1007/978-3-030-86858-1_10
Publication status	Published - 9 Dec 2021
Event	The XVII Annual Conference of the Italian Section of AIS - University of Chieti-Pescara, Pescara, Italy Duration: 16 Oct 2020 → 17 Oct 2020 http://www.itais.org/conference/2020/

Publication series

Name	Lecture Notes in Information Systems and Organisation
Publisher	Springer
Volume	50
ISSN (Print)	2195-4968
ISSN (Electronic)	2195-4976

Conference

Conference	The XVII Annual Conference of the Italian Section of AIS
Country/Territory	Italy
City	Pescara
Period	16/10/20 → 17/10/20
Internet address	http://www.itais.org/conference/2020/

Keywords

cyber security
UK schools
information security policies
socio-technical approach

Access to Document

10.1007/978-3-030-86858-1_10

An analysis of United Kingdom Schools’ Information Security Policies A socio-technical approach - Copy
This is a post-peer-review, pre-copyedit version of an article published in Sparrius M., Sadok M. (2022) An Analysis of United Kingdom Schools’ Information Security Policies: A Socio-Technical Approach. In: Za S., Consorti A., Virili F. (eds) Organizing in a Digitized World. ItAIS 2020. Lecture Notes in Information Systems and Organisation, vol 50. The final authenticated version is available online at: https://doi.org/10.1007/978-3-030-86858-1_10.
Accepted author manuscript (Post-print), 246 KB

Cite this

Sparrius, M., & Sadok, M. (2021). An analysis of United Kingdom schools’ information security policies: a socio-technical approach. In S. Za, A. Consorti, & F. Virili (Eds.), Organizing in a Digitized World: Individual, Managerial and Societal Issues (pp. 176-189). (Lecture Notes in Information Systems and Organisation; Vol. 50). Springer. https://doi.org/10.1007/978-3-030-86858-1_10

@inproceedings{a6a8aa0405c44128997c39dc8979cdde,

title = "An analysis of United Kingdom schools{\textquoteright} information security policies: a socio-technical approach",

abstract = "UK schools collect and store large amounts of data on their students, parents, and staff. This makes them attractive targets for both external and internal attackers. To respond to and manage security risks, many schools have developed and implemented Information Security policies. This paper explores and analyses the content of 100 UK schools{\textquoteright} security policies with an aim to examine the extent to which these policies address security risks faced by schools. Such exploration has the potential to assess the effectiveness and the relevance of security policies. The key findings show that many security policies are primarily centered on traditional technology-focused solutions and not on threats targeting the human elements in their organisations. In addition, it could be argued that between poor readability scores and large word counts, these policies are not very accessible to staff. This paper proposes that a socio-technical approach to information security would potentially result in better understanding of the role and application of security policies in schools and, therefore, improved information security.",

keywords = "cyber security, UK schools, information security policies, socio-technical approach",

author = "Martin Sparrius and Moufida Sadok",

year = "2021",

month = dec,

day = "9",

doi = "10.1007/978-3-030-86858-1_10",

language = "English",

isbn = "9783030868574",

series = "Lecture Notes in Information Systems and Organisation",

publisher = "Springer",

pages = "176--189",

editor = "Stefano Za and Augusta Consorti and Francesco Virili",

booktitle = "Organizing in a Digitized World",

note = "The XVII Annual Conference of the Italian Section of AIS ; Conference date: 16-10-2020 Through 17-10-2020",

url = "http://www.itais.org/conference/2020/",

}

Sparrius, M & Sadok, M 2021, An analysis of United Kingdom schools’ information security policies: a socio-technical approach. in S Za, A Consorti & F Virili (eds), Organizing in a Digitized World: Individual, Managerial and Societal Issues. Lecture Notes in Information Systems and Organisation, vol. 50, Springer, pp. 176-189, The XVII Annual Conference of the Italian Section of AIS, Pescara, Italy, 16/10/20. https://doi.org/10.1007/978-3-030-86858-1_10

An analysis of United Kingdom schools’ information security policies: a socio-technical approach. / Sparrius, Martin ; Sadok, Moufida.
Organizing in a Digitized World: Individual, Managerial and Societal Issues. ed. / Stefano Za; Augusta Consorti; Francesco Virili. Springer, 2021. p. 176-189 (Lecture Notes in Information Systems and Organisation; Vol. 50).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - An analysis of United Kingdom schools’ information security policies: a socio-technical approach

AU - Sparrius, Martin

AU - Sadok, Moufida

PY - 2021/12/9

Y1 - 2021/12/9

N2 - UK schools collect and store large amounts of data on their students, parents, and staff. This makes them attractive targets for both external and internal attackers. To respond to and manage security risks, many schools have developed and implemented Information Security policies. This paper explores and analyses the content of 100 UK schools’ security policies with an aim to examine the extent to which these policies address security risks faced by schools. Such exploration has the potential to assess the effectiveness and the relevance of security policies. The key findings show that many security policies are primarily centered on traditional technology-focused solutions and not on threats targeting the human elements in their organisations. In addition, it could be argued that between poor readability scores and large word counts, these policies are not very accessible to staff. This paper proposes that a socio-technical approach to information security would potentially result in better understanding of the role and application of security policies in schools and, therefore, improved information security.

AB - UK schools collect and store large amounts of data on their students, parents, and staff. This makes them attractive targets for both external and internal attackers. To respond to and manage security risks, many schools have developed and implemented Information Security policies. This paper explores and analyses the content of 100 UK schools’ security policies with an aim to examine the extent to which these policies address security risks faced by schools. Such exploration has the potential to assess the effectiveness and the relevance of security policies. The key findings show that many security policies are primarily centered on traditional technology-focused solutions and not on threats targeting the human elements in their organisations. In addition, it could be argued that between poor readability scores and large word counts, these policies are not very accessible to staff. This paper proposes that a socio-technical approach to information security would potentially result in better understanding of the role and application of security policies in schools and, therefore, improved information security.

KW - cyber security

KW - UK schools

KW - information security policies

KW - socio-technical approach

UR - http://10.1007/978-3-030-86858-1

U2 - 10.1007/978-3-030-86858-1_10

DO - 10.1007/978-3-030-86858-1_10

M3 - Conference contribution

SN - 9783030868574

T3 - Lecture Notes in Information Systems and Organisation

SP - 176

EP - 189

BT - Organizing in a Digitized World

A2 - Za, Stefano

A2 - Consorti, Augusta

A2 - Virili, Francesco

PB - Springer

T2 - The XVII Annual Conference of the Italian Section of AIS

Y2 - 16 October 2020 through 17 October 2020

ER -

An analysis of United Kingdom schools’ information security policies: a socio-technical approach

Abstract

Publication series

Conference

Keywords

Access to Document

Fingerprint

Cite this