Information Security Goals in a Swedish Hospital
Ella Kolkowska, Karin Hedström, Fredrik Karlsson · KTH Publication Database DiVA (KTH Royal Institute of Technology) · 2008
One of the problems highlighted within the area of information security is that internatonal standards are implemented in organisations without adopting them to special organisational settings. This paper presents findings of information security goals found in policies, guidelines, and routines at a Swedish hospital. The purpose of the paper is to analyze the information security goals and relate them to confidentiality, integrity and availability (CIA) that are traditional objectives for managing information security in organisations. A critical view on the CIA-triad has been taken in the study, to see how it is related to a hospital setting. Seven main information security goals and 63 sub-goals supporting the main goals were identified. We found that the CIA-triad covers three of these main-goals. Confidentiality and integrity, however, have a broader definition in the hospital-setting than the traditional definitions. In addition, we found four main information security goals that the CIA-triad fails to cover. These are ‘Follow information security laws, rules and standards,’ ‘Traceability,’ ‘Standardized formation’ and ‘Informed patients and/or family.’ These findings shows that there is a need to adopt the traditional information security objective to special organisational settings.