Security risk management of information systems with proactive and reactive approaches : a case study of small- and medium-sized enterprise organizations in Bangkok metropolis

Abstract

The objectives of this study were 1) to study the relationship between proactive and reactive security management approaches and the success of information system security in the small- and, medium-sized enterprise organizations; 2) to compare the success of Information systems security to the proactive and reactive security management approaches of the small- and, medium-sized enterprise organizations; and (3) to provide a guidance in the security management approaches for the small- and, medium-sized enterprise organizations. The research sample consisted of 221 small- and medium-sized enterprise organizations in Bangkok metropolis. The survey questionnaire was used to collect data and then the data is analyzed using descriptive statistics including frequency, percentage, mean and standard deviation. One-Way ANOVA, Chi-square and Cramer’s V were also used to test these research hypotheses. The findings are as follows:1) Organizations with the differences in the total of employees exhibited a difference in their choice for either a proactive or a reactive security management approach at the statistically significant level of .05. 2) Organizations with the differences in the information security budget exhibited a difference their choice for either a proactive or a reactive security management approaches at the statistically significant level of .05. 3) IT employees with different levels in the security knowledge exhibited their choice for either a proactive or a reactive security management approaches at the statistically significant level of .05. 4)  Executives/owners with different levels in the security knowledge exhibited their choice for either a proactive or a reactive security management approaches at the statistically significant level of .05. 5) The proactive approach of the security managements had a greater effect on increasing security success than the reactive approach had with a moderation level in both all perspective and each aspect of confidentiality, integrity and availability, at the statistically significant level of .05. 6) The proactive approach of the security managements had a better success in security than the reactive approach at the statistically significant level of .05.