Looking for Case Studies and Documents about the Impact of Job Design on Enterprise Security Risks

I am looking for case studies, documents and statistics analysing the impact of job design choices on enterprise (security) risks.

Job design, in a nutshell, involves defining employee roles and related tasks associated for employees in an organisation.

Intuitively, job design decisions have an impact on the productivity of employees, number of accidental & deliberate incidents, exposure to security risks (e.g. by dealing/not dealing with separation of duties and/or empowering too much certain people/roles).

There are interesting studies tacking this issue from an economics perspective, such as the paper on “Limited Intertemporal Commitment and Job Design” (even if it is a little bit too abstract).

So far I have found very little in terms of studies and documents that scientifically analyse how changes in job design affect security risks in an organisation. Any link and reference would really be welcome.

--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

Gartner’s Report: Top Seven Cloud-computing Security Risks

I tend to agree with the outcomes of a recent Gartner’s Report on the top seven cloud-computing security risks. A related article, by Jon Brodkin, provides a nice overview and summary of the key taking points of this report:

“Cloud computing is fraught with security risks, according to analyst firm Gartner. Smart customers will ask tough questions, and consider getting a security assessment from a neutral third party before committing to a cloud vendor, Gartner says in a June report titled “Assessing the Security Risks of Cloud Computing.”

Cloud computing has “unique attributes that require risk assessment in areas such as data integrity, recovery and privacy, and an evaluation of legal issues in areas such as e-discovery, regulatory compliance and auditing,” Gartner says.”

In particular I believe that the aspects related to “privileged user access”, “regulatory compliance” and “data location/data segregation/privacy management” are potential key issues that, if not properly addressed, can expose organizations (and users) to high risks.

--- NOTE: my original HP blog can be found here ---