Organizations’ heavy reliance on information systems (IS) requires them to manage the risks associated with those systems. Today, risks related to information security are a major challenge for many organizations, since these risks may have dire consequences, including corporate liability, loss of credibility, and monetary damage (Cavusoglu, Cavusoglu, and Raghunathan 2004). Ensuring information security has become one of the top managerial priorities in many organizations(Brancheau et al. 1996; Lohmeyer et al. 2002; Ransbotham and Mitra 2009).
To reduce these risks and ensure information security,organizations often rely on technology-based solutions (Ernst & Young 2008; PricewaterhouseCoopers 2008). Although these types of solutions help improve information security (Straub 1990), relying on them exclusively (or excessively) is seldom enough to eliminate the risk (Cavusoglu et al. 2009; Dhillon and Backhouse 2001; Siponen 2005). Empirical and anecdotal evidence indicates that the number of incidents related to information security is increasing (AIRC 2008;Symantec 2009) even as organizations invest more in technology-based solutions. Success in information security
can be achieved when organizations invest in both technical and socio-organizational resources.