Identifying Managerial Factors Affecting Security Breaches within Publicly Traded Organizations

Identifying Managerial Factors Affecting Security

Breaches within Publicly Traded Organizations

Chapter 1: Introduction to the Study

Business leaders continued to maintain a lens on the prevention of vulnerable

touch points to corporate information; the value of the continuity of business processes;

the reduction of security-based shortfalls and occurrences; and the opportunity for

integrity, maintenance, and confidentiality of business data and assets pertinent to

obtained information (Akey, Lewellen, & Liskovich, 2018). Security systems were

comprised of a balance between technical and social factors, ranging from the solely

lingering obstacle was to ascertain the prominent circumstances that can benefit with

diminishing organizational security vulnerabilities and attacks.

According to Duxbury and Halinski (2014), 91% of employees did not adhere to

regulatory security protocol. A lack of employee education has been recorded as a

primary cause of estimates between one-half to three-quarters of systems security

infringements, culminating in an excess of $20 billion in damages for establishments in

the United States. In other words, security transgressions may cost an institution up to

23% of its annual revenue (Dockery & Bawa, 2014). In the research study, I scrutinized

the elements that affect organizational recognition pertaining to systems security and the

breaches of publicly traded companies listed with the National Association of Securities

that can led to damages beyond repair. The conducted study was devised to will be

conducted to review the correlation among established policies on systems, security

breach intensity, and the earnings noted for public firms listed with the exchange on the

NASDAQ. The NASDAQ was selected as a main component of the research study,

because Belzuegui, Erro, and Pastor (2014) argued that, traditionally, smaller and

younger organizations are listed on the exchange with the NASDAQ. An exchange for

stock purchases with a propensity of smaller and younger firms was an ideal environment

to examine information assurance levels of awareness. Results yielded that productive

business administrators have in place protocols for addressing security concerns within

public entities traded on the NASDAQ exchange.

information and communications technologies that ensured consistent interchanges and

connections. Incorporating pertinent systems granted users a great ability to leverage the

requirements for project-based constraints, financial needs, and completed activities

(Golden & Watt, 2013). Continued returns stemmed from the successful incorporation of

and breach preventions for all corporate personnel (Greenhaus & Kossek, 2014). Greer

and Payne (2014) studied the impact of business systems procedures in federal agencies,

state institutions, and discovered business leaders were more likely to report the breaches

of systems when resources were available to utilize to effectively manage occurrence of

security violations. Hall, Kossek, Briscoe, Pichler, and Lee (2013) examined the notes of

seasoned business leaders which framed how barriers existed in the workplace that were

tied to training, culture, and even the utilization of technologies. Harrington and Santiago

(2015) suggested that the lack fortified infrastructures, training, and maintaining of

systems steps led to shortcomings when policies were not in place. The identified goal

was then to establish and maintain policies that can be utilized during all organizational

Competitive firms were then those with managers who led by setting the example

of problem identification, training deficits, shortcomings pertinent to security knowledge,

and applications for busy project environments. During all organizational activities, it

became clear that business leaders must instill a culture focused on acquiring the skills

only prepare organizational environments for potential security breaches, but to also

thwart unforeseen attacks. The challenges associated with data management, information

sharing, and training initiatives were noted to serve as potential barriers; however, these

can be reduced or eliminated by continued collaborations and partnerships across

institutions. The obstacles remained for not only government agencies, but also for firms

publicly traded on the NASDAQ exchange. The identified initiatives of information

sharing, instilling executive champions, developing policies pertinent to information

systems security breaches, integrating controls, and encouraging increases training can all

provide the greatest returns. The greatest returns were easily identified via corporate

earnings and increased revenues; however, other drivers also surfaced as investor

An identified challenge in the business environment was to ensure collaborations

and information sharing occurred via protected communication modalities. In this regard,

secure collaborations and communications can also be linked to project performance and

the overall productivity of business initiatives. Anderson, Kaplan, and Vega (2014)

organizational teams, departments, agencies, and even throughout supply-chain partners.

The remaining goal was to ensure that information systems security policies existed that

guided and protected all collaborations and information sharing.

There was a constant theme in the literature about level of risk and how this

information is applied to the work environment. Weisberg and Porell (2011) noted that

risk level should be included within training programs and policy considerations to ensure

stakeholders are knowledgeable about the potential severity of threats. Studies have also

been conducted that support risk level integration within both quarterly and annual

training events (Hosseinnezhad, 2013). Ho and Carol (2015) reported that many security

breaches occur because of identified vulnerabilities in a system, which can be due to

There are a variety of factors that have led to identified information security

breaches for publicly traded companies. In regard to the variety of vulnerabilities that

can occur, Jakobsn and Lueg (2014) identified factors pertaining to frequency of training

for employees, the curriculum that is utilized during training events, the stakeholders

of substantiated training approaches that have led to the greatest return for employee

awareness, comprehension, and even for application within a work environment. The

research framed the significance of leader involvement in policy development,

implementation, and with training opportunities. For example, some findings purported

that gestalt approaches can enhance planned processes, enhanced focus on provided

information, and with respect to enhanced awareness levels. Reflection steps highlighted

that more engaged business leaders had a positive impact on employee and stakeholder

willingness to ascertain training guidance and also to implement the recommendations

provided. The motivation for employees certainly is a straightforward consideration to

implement all provided guidance; however, the ability for executives, managers, and

to positive returns for implantation and the eventual reduction in successful security

breaches.

applicable information served as a key motivator and vital resource for active learners

stemmed from information systems security breaches, attacks, and even thwarted

activities should follow the same guidance and lead to operational environments centered

on proactive stakeholders actively looking to thwart potential breaches.

Research findings provided a lens focused on traditional technical challenges

connected to corporate training sessions. Shekarhizadeh, Ghasemi, Tadi, Soltani, and

Nili (2015) highlighted the established challenges tied to technical access and availability

for employee training events. One challenged was derived directly from the need to

provide computer workstations available for participants to utilize and work on during

instruction activities. Examples were tied to the lack of access to computer systems, how

virtual workers were engaged, resources that kept of interest of participants, and

training sessions at a distance and how current technologies were also leveraged to meet

the needs of participants.

virtual workers were not the only ones who need technical considerations when planning

connected via distribution processes, procurements, marketing, and via targeted sales.

Leaders need to be cognizant and motivated for the planning and utilization of all

pertinent resources throughout the enterprise; whether, technology, communication, or

policy based.

During the planned review of organizational security systems, managers have

found success with identifying and sharing potential risks with all stakeholders. Margo,

Prybutok, and Ryan (2014) suggested that information systems security risks have

stemmed from system vulnerabilities due to technical deficiencies as well as from the

contributions of personnel. In some regards, the greatest risks stem from personal

activities, social engineering, and even from training deficits (Maruyama & Tietze, 2012).

enhanced training sessions, and strengthened systems had a lasting effect on the success

of managerial steps. In regard to support services, business leaders strengthened

corporate systems by not only enhancing training, policies, and available resources, but

also via the integration of planned and structured wellness opportunities.

The value of social collaborations remained evident during the review of

leaders. Maintaining a socially connected workforce should have the increased ability to

enhance feelings of connections, collaborations, and reduce the potential of apathy for

information systems security attacks.

Engaged, trained, and motivated stakeholders may be the difference between

increased information systems security breaches and a heightened sense of thwarting

attacks. Effective business leaders must have the proactive attitude of planning, policy

development, and guiding engaging training sessions to develop a culture designed to

withstand system attacks and to reduce the severity of breaches. The strength of a

company will certainly be evidenced via the willingness of the personnel to support the

mission, objectives, and operational activities.

An important area for constraint analysis was also with training program

availability and a focus on information systems security. Teo, Wong, and Chai (2008)

framed the value of training programs to assist all employees within an organization,

especially firms positioned for market expansion where virtual workers and those who

constraints within a system as a process that can build up over time, gain momentum, and

even collapse a system (Shaw, Chen, Harris, & Huang, 2009). The same was true for

information systems security, where effective business leaders and managers needed to

embrace the factors of policy development and training and the confirmed influences of

these factors on overall corporate financial performance. The utilization of the Theory of

Constraints assisted with shining a light on the importance of training programs and

policy development for public firms looking to compete in the competitive marketplace.

Nature of the Study

The quantitative method with a correlational design were utilized for this research

initiative. The selection of a quantitative method was utilized to focus specifically on the

identified variables and confirmed relationships. The foundational variables utilized were

the dependent variable focused on annual reported earnings of publicly traded companies

on the NASDAQ Stock Exchange and an examination of overall business performance,

based on the submitted filings with the Security and Exchange

security considerations. The population utilized for the study involved 3,200 firms listed

constraints. The Theory of Constraints served as the foundational theory and guiding

direction to examine information systems security breaches for publicly traded firms

listed on the NASDAQ. Annual filings of public NASDAQ companies provided the data

and information needed to examine results and confirmed trends for operations within the

US.

The size of the sample was calculated via the utilization of G*Power 3.1.5; which

included, a two-tailed analysis and a medium effect size. The population of 3,200 firms

on the NASDAQ exchange were examined in detail to derive the needed size of the

sample. Key considerations involved with deriving the sample size included distribution,

level of confidence, margin of error, and the overall size of the targeted population. The

A guiding component of this initiative was to include pertinent operational and

managerial definitions. The utilized definitions in the study are listed below:

Annual Reports: Financial 10-K submissions submitted to the SEC and similar

governing bodies.

Level or Degree of Information Systems Security Policy: A systems policy

established to effectively identify, facilitate, utilize, and manage security attacks and

vulnerabilities.

Publicly-Traded Firms: For the purposes of this study, public firms were

identified as those listed on the NASDAQ exchange.

Security Attacks, Breaches, or Vulnerabilities: This occurs when protected

There were assumptions that persisted throughout the research study. A guiding

assumption was that a random selection of publicly traded companies listed on the

NASDAQ Stock Exchange served as a reliable representation of the targeted public

companies. In addition, the presented definitions provided a frame of reference

throughout the imitative. The established statistical measurements were also trusted to

provide a reliable lens for the review of research questions and the null and alternative

hypotheses.

The scope of the quantitative research project involved the analysis of companies

positioned with the NASDAQ exchange. A derived random sample was established to

NASDAQ exchange (Swift & Virick, 2013). An additional limitation of the research

established US guidelines.

The significance of the study can be seen by even though the growth and maturity

of information is widespread throughout the market, there still seem to be many

organizational challenges and impacts involved with information systems security

breaches (Edwards, Grinter, Mahajan, & Wetherall, 2011: Wyrzykowska, 2014). The

next step is evidenced with the identified importance of tracking corporate security

the same firms listed with the NASDAQ Stock Market (Al-Haderi, 2013). The identified

results of the study should serve as a resource for the establishment of a body of

knowledge to frame the importance of identifying and addressing connections with

information systems security breaches, organizational policies, and corporate earnings for

Schorno, 2018). The importance of the topic of this research project became more

apparent as information systems security breaches continue to occur, increase, and have

become more pervasive throughout the marketplace (Lending,

Minnick, & Schorno, 2018; Lister & Harnish, 2012).

Significance to Theory

The advantage of effective security policies were evidenced by the support

provided via established systems and training programs to guide operations and to assist

personnel. Raghuram and Fang (2014) suggested that the identification of one constraint

provided the foundation to examine potential associations and subsequent impacts within

The confirmed results of the study should serve as resources for managers

working to guide and implement information systems security plans and policies.

Sharing the importance of the findings with managers, project leaders, and employees

will assist with the incorporation of security guidance, training, and implementation

throughout publicly traded companies. The emphasis of security best practices

throughout training and organizational activities should assist with the adoption of best

practices for employees (Harandi, 2012; Lin, 2011). Maintaining information systems

security considerations with organizational practices should also contribute to more

sustainable corporate projects and services.

Significance to Social Change

improve the perception of information system security considerations for all

organizational stakeholders; to include, consumers, partners, and community

shareholders. Provisions for social change will tie directly to how systems, security, and

training are utilized throughout a community and may also lead to enhanced

more knowledgeable technology users. The findings may also assist with removing

barriers to technological change and instilling a greater confidence with those who use

and plan for secure systems. Lastly, a focus on information systems security planning

and policies can enhance overall organizational operations and earnings for publicly

traded firms listed on the NASDAQ Stock Market.

Summary and Transition

throughout the study. Early evidence has surfaced for the need for effective and secure

systems within government environments; however, the same rationale and guidance

were proven to also serve as important tenets for leaders within public organizations.

Seminal and current research was introduced to provide framing guidance for the focus of

information systems security vulnerabilities, attacks, and preventative steps. The framing

thoughts also served as the supported and championed problem statement and purpose of

the research initiative. The research initiative may assist with filling a gap in the

policies, training, and practices throughout public firms listed on the NASDAQ.

Chapter 2: Literature Review

The general business problem was to analyze the yearly filings of public

companies partnered with the NASDAQ exchange to garner market patterns and financial

breaches. The pervasiveness of corporate vulnerabilities and attacks was verified to have

a direct impact on the price of stocks and the progression of company revenues.

The inclusion of Chapter 2 assisted with the development of a literature review

pertaining to information systems security. The main points presented in Chapter 2

consisted of an analysis of the connections with public companies, notices pertaining to

security attacks, and confirmed financial losses. The pervasiveness of organizational

security attacks was verified to significantly impact the reported revenues for publicly

traded firms listed with the NASDAQ exchange. The timing and duration of security

attacks provided the framework for the utilization of the TOC. Akey, Lewellen, and

Liskovich (2018) posited that previous studies ignored the identified constraints and the

resulting impacts on stakeholder morale and organizational performance. The yearly

performance of public companies operating in the US. The examination of the confirmed

connections provided the framework to make recommendations for managers and

business leaders pertinent to planning, policies, and training activities to deter or prevent

information systems security breaches.

organizational best practices provided the foundation; however, business leaders

An important area for constraint analysis was also with training program

availability and a focus on information systems security. Aboelmaged and El Subbaugh

(2012) framed the value of training programs to assist all employees within an

organization, especially firms positioned for market expansion where virtual workers and

project activities within an organization. Researchers have also written about the

challenge of not addressing constraints within a system as a process that can build up

over time, gain momentum, and even collapse a system (Sharma & Yetton, 2011). The

same was true for information systems security, where effective business leaders and

managers needed to embrace the factors of policy development and training and the

confirmed influences of these factors on overall corporate financial performance. The

utilization of the Theory of Constraints assisted with shining a light on the importance of

training programs and policy development for public firms looking to compete in the

competitive business environment.

Literature Review

The evolving marketplace maintained a continuance of expansion across multiple

industries. The growth of the marketplace was attributed to an increase in technology

utilization, increasing company profits, and positive consumer sentiment. Sato (2013)

framed the role of information technology and systems utilization as a powerful force

throughout the business environment, especially within the United States. The need to

integrate IT and systems development has provided the means to improve product

Nachmias, 2008; Sardeshmukh, Sharma, & Golden, 2012). Initial research has centered

on technical components and steps to secure computers and networks. These steps have

bene important gauges of progress and as a foundation to dig deeper into a review of

systems security. Harrington and Santiago (2015) suggested that additional research

steps were also needed to support the impact of security vulnerabilities and attacks on

organizational performance. The importance of company performance for publicly

traded firms was deemed an appropriate next step.

An important step during the examination of information systems security was to

ascertain the path of empirical research and reviews. Vesala and Tuomivaara (2015)

highlighted the detailed research available on network and computer systems pertinent to

and attacks. An important consideration of how business leaders report and thwart

security breaches surfaced as a need for future research.

and Ngwenyama (2011) argued that project sustainability was a cornerstone for

championed and maintained.

Monitoring and managing a rich data environment was seen as a needed step to

the progression of effective information sharing. Harrington and Santiago (2015) posited

that secure data repositories would lead to more enhanced information sharing and

decision making. The need to provide effective training programs continued to surface as

information sharing surfaced via the need for timely and thorough announcements for

stakeholder reviews as required via SEC guidelines. Maintaining a clear announcement

protocol for organizational stakeholders would directly support internal processes of clear

policy development, information sharing, and the confirmed requirement of a secure

operating environment for all organizational activities.

Security Benefit

The benefits of information systems security were universal throughout all

organizational departments. Weinert (2015) monitored the progress of project

completion cycles and learned that trustworthiness of personnel, data, information, and

systems were paramount for successful initiatives. Weinert (2015) garnered that

leadership supported the initiative. Likewise, throughout the project steps, stakeholders

will rally to project completion if colleagues support the effort, data are reliable, and there

is ample information sharing. The challenge for business leaders was to ensure secure

systems were in place to assist with effective data storage, mining techniques,

information sharing, and supportive training sessions to reinforce project milestones.

An ability to initiate well-planned projects was an important step; however, a

development and growth regardless of the diversity of participants. For example,

ethnicity, age, and gender all appeared to have the same relationship to systems security;

whereas, the value of a secure operating environment would promote sustained projects

and the potential for growth opportunities (Finna & Forgacs, 2010; Niles, 1997; Wicks,

2002). The same proved to be true for novice and experienced users throughout the

business environment.

The examination of information systems security often began with government

protocols. Neirotti, Paolucci, and Raguseo (2013) posited that government regulations

and policies provided the framework for beneficial initial steps for secure operating

environments. Examples can be evidenced via the Paperwork Reduction Act to promote

considerations. The development of federal Chief Information Officer and Chief

Information Security Officer positions also supported the rollout of information assurance

requirements to maintain and support secure infrastructures.

government guidance and regulations. Fortunately, the focus on secure systems

research study was to translate the value of information systems security to sustained

operational steps throughout publicly traded firms on the NASDAQ exchange.

relationship to senior leader guidance and support. Freeman and Hasnaoui (2011)

were planned and positioned appropriately for positive outcomes. The value of senior

leader guidance appeared to provide a building block throughout the research study in

support of stakeholder attitudes and effort. Maintaining a high level of executive support

and stakeholder participation was a vital factor when examining the role of information

systems security processes.

(2012) reflected on the role of senior leader support for virtual and complex project

notification processes throughout firms.

level or degree of security focus by business leaders and managers throughout annual

information systems security planning and involvement by all organizational stakeholders

served as a key component for a productive business environment. The necessity rested

on the need to have consistency with respect to the frequency and timing for secure

systems guidance throughout quarterly and annual processes.

A focus on information systems security should be a mandate for all

organizational stakeholders. Grant, Wallace, and Spurgeon (2013) framed the

significance that stemmed from stakeholder involvement in all planning and training

steps to support the overall mission of the firm. An example of stakeholder participation

component for a sustained focus on information assurance guidance and best practices.

Incorporating a consistent and overarching focus on information systems security

will provide the framework for sustained and productive business activities.

MonteroMarín, Carrasco, Roca, Serrano-Blanco, Gili, Mayoral, Luciano, Lopez-del-

Hoyo, Olivan, Collazo, Araya, Banos, and Botella (2013) articulated the requirement to

have consistent and proactive messages throughout a firm in order to maintain a

heightened focus on mission critical areas. Secure systems has proven to be a mission

critical area that all stakeholders need to champion. Including all stakeholders in

planning steps provided an additional foundation to assist with rolling-out training

programs for executives, managers, supervisors, project leaders, team members, and other

Security Training

Once a focus on all stakeholders was secured, managers could then ensure an

organizational wide training program was planned, developed, and integrated throughout

(Domiinique & Der, 2010; Morganson, Major, Oborn, Verive, & Heelan, 2010;

managers, departmental leaders, and team members was paramount for success. In

addition, research touched on the value of business partners, customers, and community

members to share in value-added company activities (Baruch, 2001; Watson, Blackstone,

& Gardiner, 2007; Shahangian, 2007). Taking a holistic approach proved to be most

effective during the planning, development, and implantation of information systems

security programs.

for business leaders. Potential options that assisted stakeholder participation included

asynchronous and synchronous training sessions. Valmohammadi (2012) presented the

need for diversity of participation for effective training programs. Similarly, Vesala and

Tuomivaara (2015) posited that comprehensive and user focused training initiatives

proved to have the longest lasting outcomes. In regard to stakeholder involvement,

researchers also discussed the value stemming from active participation. Examples that

stemmed from active stakeholder participation in training sessions included improved

sense of connectiveness to the firm, heightened morale, less social anxiety via

instill a passion for the acceptance of planned system steps and integration throughout an

organization. The necessity for acceptance to information systems security initiatives

was confirmed to be just as valuable throughout the research study. Research supported

the proposition that security protocols and performance would improve as acceptance was

supported and championed throughout a company. The result led to increased revenues

for firms with proactive and engaged managers working to champion to security initiative

throughout the organization.

corporate projects. The challenge was identified to have a direct connection with

business leaders who champion the importance of security initiatives, training events, and

protocols throughout all departments (Burke & Cooper, 2008; Caillier, 2011; Nave,

vulnerabilities and attacks. Instilling guidance from leaders within an organization will

have a lasting impact with directing activities directed toward the corporate mission,

goals, and objectives. Multiple researchers have confirmed the value of executive leaders

participation via the enhancement of company training, projects, and collaborations on a

need to have executive managers leading and championing in the front for productive

business initiatives. The confirmed importance of executive champions was to instill

confidence in all stakeholders that the organizational mission and objectives were

planned and positioned appropriately for positive outcomes. The value of senior leader

guidance appeared to provide a building block throughout the study in support of

stakeholder attitudes and effort. Maintaining a high level of executive support and

stakeholder participation was a vital factor when examining the role of information

systems security processes.

To maintain a corporate focus, business leaders should campion and focus on the

variables that can motivate sustained interactions. Ellison (2013) framed the true

necessity of identifying and incorporating pertinent variables to begin and maintain

identified business directives. In a competitive marketplace, researchers have framed the

vigilance needed to avoid security breaches and costly damages tied to project delays,

information theft, and data loss. Forward looking managers can instill corporate

directives into training steps, organizational activities, and via all project initiatives across

departments. A more challenging component was the need to bring in external

cloudbased monitoring tools and intrusion detection systems. Executive managers can

establish policies to ensure stakeholders serve as active participants in training sessions

and adhere to annual guidelines for compliance steps. Information security metrics

served as the framework for the establishment of strategic steps as well as operational

requirements to assist with project milestones across organizational departments.

data, sharing of information, and associated with decision making interactions with

customers. Examples were championed that tied to effective system management for

updates; utilization of anti-virus and malware applications; monitoring intrusion detection

activities via established demilitarized zones for network and cloud-based access;

adherence to compliance training; and a proactive environment where open collaborations

and information sharing were encouraged by senior leaders, managers, project leads, and

team members.

Research supported the continued requirement for collaborations and information

sharing throughout an organization (Diana, 2010; Schulte, 2015). The focus of key

indicators to ensure staff are properly trained and tools were available for utilization via

all project team members. The careful monitoring of information systems security

indictors can provide a seamless step for annual and quarterly audits.

continual information systems audits throughout organizations. The value of careful

participants can ensure systems are available for managers to review, for auditors to

examine, and schedules are managed via a cloud-based system where all pertinent

stakeholders can schedule meetings and follow-up discussions. Incorporating active

communications via information systems security oversight and auditing steps can lead to

proactive employees engaged in information assurance steps to maintain sustainable

operations.

A competitive step for business leaders to champion information systems security

best practices was embedded in systematic planning and operational steps. Kossek,

Hammer, Kelly, and Moen (2014) articulated the necessity for business leaders to garner

traditional advisory committees, where diverse stakeholders are engaged in reviewing

best practices and providing operational guidance.

operating in the United States. Advisory committee development can be comprised of

challenged to participate in advisory committee activities. The establishment of advisory

committees may also have an influential impact on middle managers, where information

systems security metrics are established, championed, and carried-out on a quarterly and

annual basis throughout the activities of public companies operating on the NASDAQ

exchange. The continuation of established procedures for information systems security

procedures can establish the long-term strategic goal for secure operations, as well as the

guideposts for daily, weekly, monthly, and quarterly steps to complete tasks and to fulfill

requirements within established expectations. Incorporating diverse advisory committee

security steps into organizational activities. Industry practices have demonstrated that

information systems studies assisted with the integration of cognitive concepts into

operational steps. In regard to applying cognitive steps, empirical activities have

demonstrated that information assurance activities can invigorate security vigilance if

effective training standards were introduced, maintained, reinforced, and audited on a

continued basis. Continued integration of information systems security initiatives,

programs, and vigilance proved to be effective for the removal of factors pertaining to

security weaknesses, vulnerabilities, and the ramifications of attacks.

The factors chosen for review in the research project were anticipated

continuations of areas needed for additional analysis in the field of information systems

security. Rivera-Rodriguez, McGuire, Carayon, Kleiner, Wears, Robertson, Holden, and

Waterson (2013) analyzed the steps needed to obtain stakeholder support and then the

subsequent interest of stakeholders to share obtained and gained information with fellow

team members and employees. The analysis revealed that an organizational environment

that encouraged information sharing would be less susceptible to violations and breaches

of established protocols. The same results were proven to exist with the study and the

connection to the revenues of public companies. The timing and frequencies of system

attacks provided the lens to review the TOC and to provide best practices for managers

and business leaders within public firms. Ojala, Nätti, and Anttila (2014) suggested that

previous quantitative studies avoided the review of drivers impacting stakeholder morale

with system vulnerabilities and attacks. The reviewed financial statements of public

companies partnered with the NASDAQ exchange served as valuable resources to

ascertain results and trends for operations in the US. The analyzed predictions and

connections provided the statistical basis for the confirmed relationships and subsequent

recommendations pertinent to policy development, corporate revenues, training, and

system vulnerabilities.

The progression of technical system integrations, subsequent vulnerabilities, and

attacks have had a negative impact on stakeholder morale and public company

performance for many years (Fonner & Stache, 2012; Offstein, Morwick, & Koskinen,

2010). An important challenge that stems from system vulnerabilities, attacks, and

inadequate training was confirmed to tie directly to a reduced interest in system

integration, new product development, and a lack of recommendations for creative

productivity, poor performance, and losses in corporate revenues.

The focus of research steps and analytics in Chapter 3 were initiated to frame the

research method, design, and subsequent steps. A rigorous focus of the research method,

design, participant data, sampling techniques, information gathering, hypotheses, analysis

of data, ethical concepts, limitations, and validity were examined. Chapter 4 was

developed to provide a detailed analysis of the research questions, hypotheses, and

subsequent research findings pertinent to the project. The culmination of the research

project surfaced via Chapter 5, where social change considerations, implications,

recommendations, and a discussion on garnered information systems security best

practices will be provided for business leaders within publicly traded firms listed on the

Chapter 3: Research Method

Based on information systems serving as a foundational backbone for competitive

firms today, systems breaches and violations have grown in occurrence and severity

results and trends for organizational operations within the US. An examination of the

predictions and connections provided the diagnostic to ascertain relationships and to

garner specific guidance for public company operations, policy notifications, annual

revenues, and best practices pertinent to information systems security operations.

Research Design and Rationale

specific guidance for public company operations, policy notifications, annual revenues,

and best practices pertinent to information systems security operations. The dependent

variable was corporate performance and revenues as denoted by annual and quarterly

reports. The independent variables were degree of secure systems and the availability of

The quantitative method with a correlational design were utilized for this research

identified variables and confirmed relationships. The foundational variables utilized were

Sampling Procedures

and reported earnings. The timing and duration of information systems security attacks

served as the lens to examine constraints. The Theory of Constraints served as the

foundational theory and guiding direction to examine information systems security

breaches for publicly traded firms listed on the NASDAQ. Annual filings of public

sample. Key considerations involved with deriving the sample size included distribution,

level of confidence, margin of error, and the overall size of the targeted population. The

study consisted of an examination of 134 annual filings via a review of annual earnings

and noted security policies for firms operating via the NASDAQ exchange.

Procedures for Recruitment, Participation, and Data Collection (Primary Data)

information and intrinsic data steps were sufficient for the successful completion of the

planned research steps and overall project.

An important aspect of research procedures was the incorporation of ethical

considerations throughout each step of the study. During the planned and developed

research initiative, professional protocols were implemented to assist with maintaining

continue to participate in training, guidance, and instructional steps to apply and

implement all required processes throughout research initiatives. In regard to the

research process, the Walden IRB Department served as a continued source of guidance

for data collection and ethical best practices throughout the research initiative. In the

research study, data were gathered from the annual filings of 10-K reports via SEC

guidelines. The annual reports of publicly traded companies listed on the NASDAQ

exchange served as the source of data points and information that were utilized during the

statistical analysis steps. In the research study, participants were not required, because

the quantitative initiative focused on an analysis of correlational data targeting the

established research questions and hypotheses. Confidentiality will be maintained by

company anonymity was achieved via coding, and at a recommended date, all data and

information will be destroyed in accordance with established procedures.

The goal of the correlational research study was to ascertain the association and

connections of vigilant corporate policies and stakeholder involvement with public

companies, notices pertinent to breaches of security, and reported earnings. A persistence

connections was used as the lens to ascertain relationships and to garner specific guidance

for public company operations, policy notifications, annual revenues, and best practices

pertinent to information systems security operations. The dependent variable was

corporate performance and revenues as denoted by annual and quarterly reports. The

independent variables were degree of secure systems and the availability of technical

assistance. The population for the research initiative stemmed from a calculated sample

of public companies partnered with the NASDAQ exchange. The research activity may

be noted as a guide to champion social change initiatives via the effective management of

training and policy development pertinent to corporate security activities.

The pervasiveness of technical system integrations, subsequent vulnerabilities,

and attacks have had a negative impact on stakeholder morale and public company

performance for many years (Fonner & Stache, 2012; Offstein, Morwick, & Koskinen,

2010). An important challenge that stems from system vulnerabilities, attacks, and

inadequate training was confirmed to tie directly to a reduced interest in system

integration, new product development, and a lack of recommendations for creative

business solutions. In regard to effective system preparations and training, Watad and

The intent of research steps and analytics in Chapter 3 were initiated to frame the

research method, design, and subsequent steps. A detailed focus of the research method,

design, participant data, sampling techniques, information gathering, hypotheses, analysis

of data, ethical concepts, limitations, and validity were examined. Chapter 4 was

developed to provide a detailed analysis of the research questions, hypotheses, and

subsequent research findings pertinent to the project. The culmination of the research

project surfaced via Chapter 5, where social change considerations, implications,

recommendations, and a discussion on garnered information systems security best

practices will be provided for business leaders within publicly traded firms operating in

the US and listed on the NASDAQ exchange.

Chapter 4: Results

The theme focused on how an overabundance of information system uses by

discussion of how can such events be thwarted and reduced (Lo, van Breukelen, Peters, &

Kok, 2013). The dependent variable was consistently defined as the number of security

breaches and the self-reported loss in corporate earnings associated with the security

breach as a percentage of revenue. The dependence of security breaches was determined

protocols. The collection steps stemmed from a review of 134 randomly selected

companies on the NASDAQ Stock Exchange. Data were organized via an alphabetical

label to maintain anonymity. The company labels began with an A, progressed to AA,

AB, and ended with DE. The collected data were also organized based on the identified

variables of Level of ISS Policy, Loss of Revenue, and Number of ISS Breaches. The

Level of ISS Policy gathered data was based on a 1-5 Likert Scale. The Loss of Revenue

was tied to the percentage of revenue for the reviewed company. The Number of ISS

Breaches was based on the number reported annually. The Level of ISS Policy had

scores ranging from 1 to 5 with an average for all reviewed companies of 3.17. The Loss

of Revenue data had a range from 0 to .19 or 0% to 19% and an average of .051 or 5.1%

with an average for the reviewed companies of 2.40.

The phrase level of ISS Policy looked to be significant and implied a degree or

scale of understanding that is important for security functions. Reduced awareness levels

signified a substantial negligence of security risk that can led to damages beyond repair.

The conducted study was devised to review the correlation among established policies on

productive business administrators have in place protocols for addressing security

concerns within public entities traded on the NASDAQ exchange.

The governance of organizational information systems encompassed the

establishment of management levers within the business community to incorporate

information and communications technologies to ensure consistent interchanges and

connections. Incorporating pertinent systems granted users a great ability to leverage the

requirements for project-based constraints, financial needs, and fulfilled activities

(Khoda-yari & Rahnavard, 2013). Continued returns stemmed from the successful

incorporation of security systems, policies, training programs, and evidenced via

heightened company profits.

(Woodman, 2014). Statisticians have examined constraints pertinent to variables that can

impact the integration of policies for information system guidelines and breach

preventions for all corporate personnel (Ko, Hur, & Smith-Walter, 2013). Ko and Hur

(2014) studied the impact of business systems procedures in federal agencies, state

systems steps led to shortcomings when policies were not in place. The identified goal

was then to establish and maintain policies that can be utilized during all organizational

events.

Competitive firms were then those with managers who led by setting the example

of problem identification, training deficits, shortcomings pertinent to security knowledge,

and applications for busy project environments. During all organizational activities, it

became clear that business leaders must instill a culture focused on acquiring the skills

needed to maintain healthy systems and the avoidance of security breaches (Belle,

Burley, & Long, 2015). After federal events, state activities, and via published findings,

the sharing of information was noted has highly important for preparing for and

incorporating barriers, utilizing biometrics, and leveraging token-based accounts to not

only prepare organizational environments for potential security breaches, but to also

thwart unforeseen attacks.

training initiatives were noted to serve as potential barriers; however, these can be

the greatest returns. The greatest returns were easily identified via corporate earnings and

increased revenues; however, other drivers also surfaced as investor sentiment and the

satisfaction of customers, stakeholders, and even from current employees.

An identified challenge in the business environment was to ensure collaborations

and information sharing occurred via protected communication modalities. In this regard,

secure collaborations and communications can also be linked to project performance and

the overall productivity of business initiatives. Alizadeh (2012) posited that in many

successful business environments, diverse forms of communications were utilized for

collaborative purposes and to accomplish tasks at hand. A continued challenge was to

ensure guidelines were in place that assisted with guiding effective communications,

Bratton (2013) also suggested that pivotal and popular technologies assisted with project

team collaborations, information sharing, and distributing findings across organizational

teams, departments, agencies, and even throughout supply-chain partners. The remaining

goal was to ensure that information systems security policies existed that guided and

(Orttung & Overland, 2011). Belle, Burley, and Long (2015) reported that many security

breaches occur because of identified vulnerabilities in a system, which can be due to

personnel activities and even to a lack of system updates. Business leaders should

constantly challenge themselves and team members to be vigilant with all preparations.

A variety of factors have led to identified information security breaches for

publicly traded companies. In regard to the variety of vulnerabilities that can occur,

Belle, Burley, and Long (2015) identified factors pertaining to frequency of training for

employees, the curriculum that is utilized during training events, the stakeholders

engaged in preparation activities, and the policies utilized throughout an organization.

The trend with policy development appeared to focus more on intent, curriculum,

A key ingredient within information systems security policy and training

development was the value of stakeholder awareness. Chukudi and Daddie (2015)

provided an overview of substantiated training approaches that have led to the greatest

return for employee awareness, comprehension, and even for application within a work

implement the recommendations provided. The motivation for employees certainly is a

straightforward consideration to implement all provided guidance; however, the ability

for executives, managers, and project leaders to engage stakeholders on the periphery of

the company should also lead to positive returns for implantation and the eventual

reduction in successful security breaches.

The enhancement of curriculum in training sessions has a lasting impact on

participants. Sikes, Mason, and VonLehmden (2011) posited that the incorporation of

relevant and applicable information served as a key motivator and vital resource for

active learners who participated in training sessions. The foundational concept appeared

to center on the relevance of data and information provided for the participants. A look at

alpha of .05. Utilizing the provided values, a sample size was calculated at 134 publicly

traded firms listed on the NASDAQ. Once the needed firms were obtained and

organized, ratios were established. For the ratios, I organized the data to sort the top

onethird and top 10%, which were labeled as very high reliance and high reliance to

systems security breaches during this time period and for the opportunity to review

established data via the NASDAQ Stock Market site (Davis & Cates, 2013; Ghanbari &

Bakhtjoo, 2011). Leveraging a motivation to serve the larger business community assist

with a social science service to fellow professionals and organizations. The goal then is

to utilize the findings as a mechanism to share lessons learned and best practices with the

larger research and professional communities.

(Broadfoot, 2001; Pham, 2010; Siha & Monroe, 2006). An increased comfort and

familiarity with technology may be leading to more breaches within the business

community. The developed and conducted study looked to analyze breaches via required

reporting steps of publicly traded companies on the NASDAQ Stock Market with

earnings prior to occurrences and results after noted events. The findings proved to be

quite useful with organizing recommendations and providing additional insights.

applications, and resources. The growth of the marketplace was attributed to an increase

innovation. Naser (2015) posited that at the heart of a greater utilization of systems

integration was the growing concern of information systems security procedures.

considerations in all business environments (Schnijdirberg, 2011). Initial research has

centered on technical components and steps to secure computers and networks. These

steps have bene important gauges of progress and as a foundation to dig deeper into a

review of systems security. Pirdavani, Bellemans, Brijs, Kochan, and Wets (2014)

suggested that additional research steps were also needed to support the impact of

security vulnerabilities and attacks on organizational performance. The importance of

company performance for publicly traded firms was deemed an appropriate next step.

Komijan (2010) highlighted the detailed research available on network and computer

systems pertinent to technical advancements and system updates. The technical

advancements pertinent to security initiatives seemed to follow the same path as the

growth in system vulnerabilities and attacks. An important consideration of how business

and complexities of modern day projects can be evidenced via the numerous supply-chain

partnerships throughout industries and across the marketplace. To maintain sustainable

projects and business performance, secure systems need to be championed and

maintained.

The importance of information sharing was also ascertained as a key component

of organizational success and sustainment. Lending, Minnick, and Schorno (2018)

discussed the need to maintain a consistent flow of data and information for effective

decision making. In regard to proper data management and storage, security was of

paramount importance. Secure and reliable data were attributed to the highest levels of

quality-based information. The opportunity to leverage information that was accurate and

question raised was the heightened need for thorough training programs to keep

stakeholders prepared to monitor and leverage rich deposits of data mining.

and Nili (2015) posited that secure data repositories would lead to more enhanced

information sharing was framed as an ability to share timely information to decision

makers and customer support during all collaborations and planning steps. An additional

example of effective corporate information sharing surfaced via the need for timely and

thorough announcements for stakeholder reviews as required via SEC guidelines.

Maintaining a clear announcement protocol for organizational stakeholders would

directly support internal processes of clear policy development, information sharing, and

the confirmed requirement of a secure operating environment for all organizational

activities.

To assist with data review, organization, and dissemination, I was able to organize

pertinent and traditional naming conventions for key data attributes during the

organization and analyzation steps. Table 1 frames utilized naming conventions for

variables incorporated during the identified review period for the selected NASDAQ

companies.

ISRCHG Company losses that can be attributed to non-security breaches; such as,

NTINC The total income stemming from net revenue activities, which would minus

HReliance Refers to publicly-traded companies on the NASDAQ Stock Market that

the researcher and for managers or stakeholders who may benefit from a review of the

findings.

2010 and 2016, there is a notable increase in information security breaches and notices

submitted for publicly-traded companies operating on the NASDAQ Stock Market. The

United States economy was also recovery from a great recession, so managers and

business leaders were looking for every advantage possible to improve business

operations. As of 2010, there were 1,753 fewer companies operating in the

Pyöriä, 2011). In this regard, reviewing the data of 1,753, it is evident that 32% (560) of

traded companies on the NASDAQ. The goal, as much as possible, is to isolate financial

losses and business activities and decisions to the targeted activities and variables

stemming from information systems security breaches.

why certain organizations thrived and grew, while other firms lost revenues or ended

business operations.

The gathered data and analysis provided the ability to reject the null hypotheses

and support the assertion that a robust information systems security policy and ample

training assisted with reducing security breaches and revenue losses. It is evident that

noted below via each pertinent section.

The Research Question 1 was developed as follows: What is the relationship

between the level of information systems security policy and the number of security

H10: There is a not a statistically significant correlation between the independent variable

of level of information systems security policy and the dependent variable of the number

of security breaches.

H1a: There is a statistically significant correlation between the independent variable of the

level of information systems security policy and the dependent variable of the number of

Appendix B then highlighted a conducted Pearson Correlation for Research Question 1.

The calculation revealed a significant correlation between information systems security

policy and the number of breaches via a score above +/- .7, calculated as -.857.

The Research Question 2 was developed as follows: What is the relationship

between the level of information systems security policy and the self-reported loss in

selfreported loss in corporate earnings associated with the security breach as a percentage

H2a: There is a statistically significant correlation between the independent variable of the

level of information systems security policy and the dependent variable of the

selfreported loss in corporate earnings associated with the security breach as a percentage

of revenue.

The calculation revealed a significant correlation between information systems security

policy and a loss in corporate earnings due to security breaches via a score above +/- .7,

Summary and Conclusions

The research plan for the identified project was to ascertain the connection of

system vulnerabilities and attacks with constraints for public firms listed on the

performance for many years (Fonner & Stache, 2012; Offstein, Morwick, & Koskinen,

2010). An important challenge that stems from system vulnerabilities, attacks, and

inadequate training was confirmed to tie directly to a reduced interest in system

integration, new product development, and a lack of recommendations for creative

business solutions. In regard to effective system preparations and training, Watad and

Will (2003) posited system vulnerabilities and attacks promote negative consequences for

all stakeholders within an organization. Yahaya, Basir, and Deraman (2015) framed the

withdrawing of personnel from the utilization of existing and new systems as a direct

result of information systems security breaches. The withdrawing of personnel was seen

as a major event, because disengaged employees can continue a cycle of low

Chapter 4 provided the data, information, and calculations needed to reject the

null hypotheses for Research Question 1 and Research Question 2. The research

initiative was conducted to address the identified hypotheses; research questions; sample

size and population; data collection and instrumentation; procedures for data analysis;