Joseph H. Schuessler Ph.D.

Appendix 2 – Survey Instrument

General Deterrence Theory: Assessing Information System Security Effectiveness in Large Versus Small Businesses

Thank you for taking the time to respond to this survey. The Association of Information Technology Professionals (AITP) partners with educational institutions and others in order to provide information that advances the knowledge of IT professionals. The purpose of this research study is to compare and contrast how small versus large sized businesses and address their information systems security concerns. The approximate time to complete this survey is 10-20 minutes. You must be 18 years of age or older to participate in this study. If you choose not to participate in this study there will be no adverse consequences and your consent is provided by completing the survey instrument. No individual responses will be reported and data will be reported on a group basis only. As compensation for your efforts, you will be provided with immediate feedback by being directed to a website that contains your responses along with a summary of the responses of others who have participated in this research study. Please remember, no identifying information will be reported. Additionally, the AITP will be provided with an executive summary of the findings for dissemination to the membership. If you wish, you may complete part of the survey and continue again at a later time without losing your responses. Simply re-click the link in the email and follow the on-screen instructions. However, only after submitting the completed survey will you be directed to the site containing the results of the survey. If you have questions regarding this study, please contact Joseph H. Schuessler at joseph.schuessler@unt.edu or 940-565-3128 in the ITDS department of the College of Business. Alternatively, you may contact Dr. John Windsor at john.windsor@unt.edu or 940-565-4147 in the ITDS department of the College of Business. This project has been reviewed and approved by the University of North Texas Institutional Review Board (940)565-3940. You are welcome to print this page for your records.

Using the definitions below, please rate on a scale of 1 to 7 (1 being for the least effective and 7 for being the most effective) the effectiveness of your organization's efforts in protecting it's Information System assets.

Deterrence is defined as “the inhibition of criminal behavior by fear, especially of punishment.” In other words, deterrence activities provide disincentives for would-be computer abusers. Examples of deterrent efforts include “administrative policies, employee training, and visible security functions”

Prevention is defined as a hindrance or an obstacle. These can include physical obstacles such as guards, locked doors, and so on and/or software tools such as authentication devices and firewalls.

Detection is defined as the act or process of discovery. As it relates to information systems (IS), it is the process of attempting to discover security breaches within an organization by examining system logs, monitoring suspicious activity reports, and so on.

Remedy is defined as “a legal order of preventing or redressing a wrong or enforcing a right.” Remedies serve as a way for an organization to seek restitution in some fashion, whether through internal sanctions such as reprimands or termination, or externally through legal or regulatory systems.

The information security function is primarily viewed as:

an administrative job focused on granting user access and establishing degrees of privilege.
critical to the long-term survival of the organization with emphasis on maintaining relationships with employees, business partners and government regulators.
technically oriented with an emphasis on addressing authentication and authorization issues and maintaining physical security of computer resources.
as a resource to maintain compliance with information security standards and best practices.

The senior information security manager is:

a part-time position with the duties to implement technical solutions to authentication and authorization issues and physically secure the computing resources.
a full-time position with the administrative duties of granting user access and monitoring authentication issues.
a full-time position where the primary duties consists of conducting periodic risk analysis, implementing ‘best practices’ and monitoring user compliance.
a full-time position where the primary duty is establishing and maintaining relationships with employees, business partners, information security vendors, management and government.

Please indicate the frequency of top management’s participation in information security planning:

almost always
frequent
infrequent
seldom

Please indicate the frequency of user participation in information security planning:

almost always
frequent
infrequent
seldom

The performance criteria for the information security function are:

long-term impact on the organization and support of organizational goals and objectives.
there are no performance reviews of the information security function.
ability to address authentication and authorization issues and minimizing costs.
compliance with ‘best practices’ and information security laws.

The development or implementation of information security controls is primarily triggered by:

perceived need on the part of the information security manager.
an information security budget and a need to get the ‘most bang for the buck’
a need to comply with ‘best practices’ and information security laws.
needs identified during long-term business planning.

The senior information security manager is __________ levels below the CEO:

One
Two
Three
Four or more

Please indicate the frequency of the senior information security manager’s participation in business planning:

almost always
frequent
infrequent
seldom

Please indicate by selecting the appropriate number the extent to which you agree or disagree with the following statements as they relate to your organization's portfolio of existing information systems (1 meaning strongly disagree and 7 meaning strongly agree).

Please indicate by selecting the appropriate number the significance of the following items as components of your portfolio of planned system development projects (1 being least significant and 7 being most significant).

Please rate on a scale of 1 to 7 (1 being the lowest degree and 7 being the highest degree) the degree to which each potential threat listed below has on your organization's information system.

Please indicate whether your organization:

Countermeasures are defined as an array of organizational devices to deter, prevent, or detect security breaches. With this in mind, please consider the following question:

Please rate on a scale of 1 to 7 (1 being little or no use and 7 being used extensively) your organization's use of each countermeasure listed below.

Please indicate your organization's primary industry affiliation.

Average number of employees in your entire organization?

Average annual receipts of your organization (in millions of dollars)?

Are your organization's financial assets (as reported on your organization's annual finanical statements) worth over $165 million dollars?

Yes
No

What portion of your IT budget is spent on IT security?

How long have you been employed by your organization (in years)?

Format: 99

What is your occupational role in your organization?

What is your AITP membership classification?

Gender

Male
Female

What is your age?

What is the highest level of education you have attained to date?

High school graduate or less
Attending/attended college 1 - 3 years
Graduated from 4 year college
Postgraduate study or degree

Thank you for completing the survey. Your responses will help academicians and practitioners alike in assessing information systems security effectiveness as well as the relationships between various threats and countermeasures. Should you have any questions, please feel free to contact Joseph H. Schuessler at joseph.schuessler@unt.edu or at 940-565-3128. Again thank you for your time and responses.

Please note, when you click the submit button below, you will be redirected to a site providing you with immediate feedback about your answers as well as those provided by others taking this survey. Please save the URL as a bookmark or favorite so that you may revisit the site as more surveys are received. The password for the site is "GDT" without the quotes.

[ Home ] [ Up ]