Exploring Security Processes in Organizations: the Case of Smartphones

Abstract

We present results of two exploratory qualitative studies of smartphone security in organizations. The first study provides insights into the process of security development. The second study analyzes the effects of smartphone security measures on the productivity and behavior of end users. We find that smartphones create specific conflicts between security and productivity, because they have different technical characteristics and are used for different purposes than laptops and PCs. Nevertheless, security development processes for smartphones do not differ from other security processes, and the conflicts with productivity cannot be observed by security experts due to lack of structured feedback in organizations. Structured user involvement has a great potential to improve alignment of security processes with specific technologies and decrease negative effects of security measures on productivity. This, in turn, can increase the compliance behavior and consequently the organizational security level.