Centralized IT Decision Making and Cybersecurity Breaches: Evidence from US Higher Education Institutions

• 成果类型: Article
• 署名作者: Liu, Che-Wei; Huang, Peng; Lucas, Henry C., Jr.
• 署名单位: Indiana University System; Indiana University Bloomington; IU Kelley School of Business; University System of Maryland; University of Maryland College Park
• 刊物名称: JOURNAL OF MANAGEMENT INFORMATION SYSTEMS
• ISSN/ISSBN: 0742-1222
• DOI: 10.1080/07421222.2020.1790190
• 发表日期: 2020
• 页码: 758-787
• 关键词: information-technology governance; health-care; Security investments; software security; systems; management; BUSINESS; network; patch; infrastructure

摘要

Despite the consensus that information security should become an important consideration in information technology (IT) governance rather than the sole responsibility of the IT department, important IT governance decisions are often made on the basis of fulfilling business needs with a minimal amount of attention paid to their implications for information security. We study how an important IT governance mechanism-the degree of centralized decision making-affects the likelihood of cybersecurity breaches. Examining a sample of 504 U.S. higher-education institutions over a four-year period, we find that a university with centralized IT governance is associated with fewer breaches. Interestingly, the effect of centralized IT governance is contingent on the heterogeneity of a university's computing environment: Universities with more heterogeneous IT infrastructure benefit more from centralized IT decision making. In addition, we find the relationship between centralized governance and cybersecurity breaches is most pronounced in public universities and those with more intensive research activities. Collectively, these findings highlight the tradeoff between granting autonomy and flexibility in the use of information systems and enforcing standardized, organization-wide security protocols.