TY - JOUR
T1 - Opportunities for computer crime
T2 - Considering systems risk from a criminological perspective
AU - Willison, Robert
AU - Backhouse, James
PY - 2006/8
Y1 - 2006/8
N2 - Systems risk refers to the likelihood that an Information System (IS) is inadequately protected against certain types of damage or loss. While risks are posed by acts of God, hackers and viruses, consideration should also be given to the insider threat of dishonest employees, intent on undertaking some form of computer crime. Against this backdrop, a number of researchers have addressed the extent to which security managers are cognizant of the very nature of systems risk. In particular, they note how security practitioners' knowledge of local threats, which form part of such risk, is often fragmented. This shortcoming contributes to situations where risk reducing efforts are often less than effective. Security efforts are further complicated given that the task of managing systems risk requires input from a number of departments including, for example, HR, compliance, ISIT and physical security. To complement existing research, and also to offer a fresh perspective, this paper addresses systems risk from the offender's perspective. If systems risk entails the likelihood that an IS is inadequately protected, this text considers those conditions, within the organisational context, which offer a criminal opportunity for the offender. To achieve this goal a model known as the Crime-Specific Opportunity Structure is advanced. Focusing on the opportunities for computer crime, the model addresses the nature of such opportunities with regards to the organisational context and the threats posed by rogue employees. Drawing on a number of criminological theories, it is believed the model may help inform managers about local threats and, by so doing, enhance safeguard implementation.
AB - Systems risk refers to the likelihood that an Information System (IS) is inadequately protected against certain types of damage or loss. While risks are posed by acts of God, hackers and viruses, consideration should also be given to the insider threat of dishonest employees, intent on undertaking some form of computer crime. Against this backdrop, a number of researchers have addressed the extent to which security managers are cognizant of the very nature of systems risk. In particular, they note how security practitioners' knowledge of local threats, which form part of such risk, is often fragmented. This shortcoming contributes to situations where risk reducing efforts are often less than effective. Security efforts are further complicated given that the task of managing systems risk requires input from a number of departments including, for example, HR, compliance, ISIT and physical security. To complement existing research, and also to offer a fresh perspective, this paper addresses systems risk from the offender's perspective. If systems risk entails the likelihood that an IS is inadequately protected, this text considers those conditions, within the organisational context, which offer a criminal opportunity for the offender. To achieve this goal a model known as the Crime-Specific Opportunity Structure is advanced. Focusing on the opportunities for computer crime, the model addresses the nature of such opportunities with regards to the organisational context and the threats posed by rogue employees. Drawing on a number of criminological theories, it is believed the model may help inform managers about local threats and, by so doing, enhance safeguard implementation.
KW - Computer crime
KW - Criminology
KW - IS security
UR - http://www.scopus.com/inward/record.url?scp=33749351964&partnerID=8YFLogxK
U2 - 10.1057/palgrave.ejis.3000592
DO - 10.1057/palgrave.ejis.3000592
M3 - Article
AN - SCOPUS:33749351964
SN - 0960-085X
VL - 15
SP - 403
EP - 414
JO - European Journal of Information Systems
JF - European Journal of Information Systems
IS - 4
ER -