Tietoturvastrategiat terveydenhuollon organisaatioissa - Turunen, Timo (2018)
The role of information systems in today’s organization’s business processes is increasing. At the same time the role of information security as business enabler and protector is increasing. Continually evolving technologies and attack methods creates a need to think the information security as a strategic problem, as organizations aims to protect their business within their available resources. The concept of information security strategy is fairly new concept and it has been given multiple different definition in prior literature and practice. This research aims to clarify the concept and study information security strategies in healthcare context. The objectives of information security can differ in healthcare sector when compared to other sectors. In healthcare employees’ values, legal requirements and the aim to improve the well-being of citizens can create challenges for strategic information security planning. This study used case study as a research method to understand this phenomenon in its natural setting in public healthcare organizations. Based on the findings, information security has important role in the study cases, but information security strategies are not being used to plan and maintain organizations’ information security practices, although prior information security literature has highlighted the possible benefits of the strategies. The lack of clear benefits compared to information security policies and risk management could explain why organizations have not created these strategies. Based on the findings and prior literature this thesis proposed factors (i.e. business needs, risks, culture, legal compliance and information systems) that organizations need to consider while creating information security strategy. Despite the lack of clear benefits, the proposed model of this research could help organizations to move toward strategic approach to information security and improve and maintain their overall security posture.