Toward a disciplined alignment in information security management

Purpose This article examines the data breach that occurred in the Office of Personnel Management (OPM) in the US federal government to discuss the issues in information security management. The US federal government had the law and plenty of carefully examined guidance and information security management practices were mandated under them. Thus, the lack of a managerial framework was not the problem. This article tries to elaborate on the issues inherent in the current practices and propose a research program to overcome them. Design/methodology/approach We examine the OPM data breach to identify the issues in information security management. This leads to the identification of the following three issues: insecurity in risk analysis, distance from business risk analysis and alienation from corporate governance. Then, we refer to several relevant pieces of research to see how well those efforts help solve the issues. Subsequently, we enumerate three gaps between information security research and practices which inhibit the productive collaboration of researchers and practitioners. Findings The misalignment of risk conceptions between security and business practitioners is pointed out as the critical factor in catastrophic failures. In addition, the concept of misalignment is also applied between information security researchers and practitioners. The reconciliation of this variety of misalignments shall contribute to rational information security management. Originality/value A draft research program is proposed to overcome these issues and to build mutual trust among various parties. This program puts emphasis on secured risk analysis that is robust against the conflicts between business and security practitioners.