Abstract/Summary

A significant body of literature explores the impacts of cyber security breaches and information security risk management practices. This research extends this investigation, by first analysing information security indicators that show how firms operating in different countries manage risks, and using econometrics to uncover systemic associations between these indicators. These associations are enabled by international channels – trade and foreign operations – that reveals the spillover effect of these channels on security risk management. Econometric tests based on literature and global security studies using cross-sectional data follow established spillover models (Coe and Helpman, 1995). The units of observation of the quantitative analysis were derived from company-level data, related to information security risk management, which have been aggregated and categorized by country to represent (proxy) the organisational perspective of security risk within each nation. The results of the quantitative analysis are reinforced by a qualitative analysis supported by interviews with leading practitioners in the security field. Five industry leaders with work experience in different continents were interviewed, and their interviews were subjected to a Thematic Analysis evaluation (King, 2004). The interview questions explored the informants’ personal and professional perspectives about the quantitative results. Findings of the research uncover explanatory associations, thus enabling better policy and decision-making for companies managing information security risk in an international context. The main contribution of this research is the development and testing of hypotheses related to the verified spillover effect of international trade relations and foreign investments on how firms manage security risks. The conclusion is twofold: firstly, that trade and foreign direct investment exchanges are intrinsically associated with how firms experience and manage information security risk (i.e., the spillover effect was found); and secondly, that the impact of these exchanges on security risk is systemic in nature and can be quantified (i.e., the spillover effect can be reliably quantified).