Data Leakage in ICT Outsourcing: Risks and Countermeasures

Authors

  • Yap May Lin Faculty of Computer & Mathematical Sciences Universiti Teknologi MARA, Malaysia
  • Mas Idayu Zakariah Faculty of Computer & Mathematical Sciences Universiti Teknologi MARA, Malaysia
  • Azlinah Mohamed Faculty of Computer & Mathematical Sciences Universiti Teknologi MARA, Malaysia

DOI:

https://doi.org/10.32890/jict2010.9.5

Keywords:

ICT Outsourcing, Data Leakage, Risks, Countermeasures

Abstract

Having been among the top ranks of worldwide ICT outsourcing indices for a number of years, Malaysia is familiar with the role outsourcing has played in changing today’s business landscape. However, concerns of data privacy and security, and the risks of data leakage arise during the course of outsourcing as the process may involve the exposure or handling of sensitive and confidential client and organization information to outsource providers since the company has little control over its outsourced data when it is in the provider’s possession. Empirical findings on the risks and countermeasures of data leakage are presented, in the context of outsourcing in Malaysia. From the findings, it was apparent that the inherent risks were signifi cant and that the countermeasures were positively correlated to reducing the risks. This study contributes to the limited pool of knowledge on data leakage issues in outsourcing. Organizations engaging in or contemplating outsourcing will find the results beneficial not only in understanding the data leakage concerns but also in supporting the high priority for these concerns to be addressed. However, more effort is required to enforce the countermeasures as prudent precautionary routines to reduce data leakage risks.

 

References

Arshad, N. H, Yap, M. L., & Mohamed, A. (2007). ICT outsourcing: Inherent risks, issues and challenges. World Scientific & Engineering Academy & Society (WSEAS) Journal on Business and Economics, 4(8), 117–125.

Badri, M. (1992). Critical issues in information systems management: An international perspective. International Journal of Information Management, 12, 179–191.

Bakalov, R., & Nanji, F. (2005). Offshore application development done right. Information Systems Control Journal, 5. Barthe´lemy, J. (2001). The hidden cost of IT outsourcing. MIT Sloan Management Review, 42(3), 60–9.

Benvenuto, N. A., & Brand, D. (2005). Outsourcing - A risk management perspective. Information Systems Control Journal, 5.

Bernama. (2010, February 4). Outsourcing sector revenue to grow by 20–25 percent this year. Bernama.com. Retrieved from www.bernama.com

Bernama. (2005, July 13). Not all companies following proper data destruction procedures. Bernama.com. Retrieved February 25, 2010 from www. bernama.com Journal of ICT, 9, pp: 87–

Beulen, E., Ribbers, P., & Roos, J. (2006). Managing IT outsourcing. Routledge. Taylor & Francis Group.

Carmel, E., & Nicholson, B. (2005). Small firms and offshore software outsourcing: High transaction cost and their migration. Journal of Global Information Management, 13(3), 33–54. http://jict.uum.edu.my/

Claver, E., Gonzalez, R., Gasco, J., & Llopis, J. (2002). IT outsourcing: Reasons, reservations and success factors. Logistic Information Management, 15(4), 294–308.

Collett, S. (2004, March 15). Outsourcing: Losing control. Computerworld. Retrieved from http://www.computerworld.com/

Costa, C. (2001). Information technology outsourcing in Australia: A literature review. Information Management & Computer Security, 9(5), 213–224.

Dhar, S., & Balakrishnan, B. (2006). Risks, benefits and challenges in IT outsourcing: Perspectives and practices. Journal of Global Information Management, 14(3), 39–69.

Erber, G., & Sayed-Ahmed, A. (2005). Offshore outsourcing: A global shift in the present IT industry. Intereconomics, 40(2), 100–12.

Fernandez, C. (2010, April 5). Tasked to destroy old government data. The Star: StarMetro, pp. M5 and CyberSecurity Malaysia (News). Retrieved from www.cybersecurity.my.

Foley, M. F. (2007, August). Board oversight of information technology, data privacy & data security: The New Imperative. IBLS Internet Law - News Portal. Wisconsin Lawyer Magazine.

Gay, C. L., & Essinger, J. (2000). Inside outsourcing: The insider’s guide to strategic sourcing. London.

Gonzalez, R., Gasco, J., & Llopis, J. (2005). Information systems outsourcing risks: A study of large firms. Industrial Management and Data Systems, 105(5), 45–62.

Grover, V., Cheon, M. J. & Teng, T. C. (1994). A descriptive study on the outsourcing of information systems functions. Information & Management, 27(1), 33–44. Journal of ICT, 9, pp: 87–

Hashim, M. K. (2000). SME’s in Malaysia: Past, present and future. Malaysia Management Review, 35(1), 22–30.

Henry, P. (2005). How to keep data safe when outsourcing offshore. ComputerWorld. Retrieved from http://www.computerworld.com/ http://jict.uum.edu.my/

Hoecht, A. & Trott, P. (2006). Outsourcing, information leakage and the risk of losing technology-based competencies. European Business Review, 18(5), 395–412.

Institute of Actuaries. (2009, September). Data security. DPB Compliance Bulletin No. 21.

Kakumanu, P. & Portanova, A. (2006). Outsourcing: Its benefits, drawback and other related issues. Journal of American Academy of Business, 9(2), 1–7.

Karyda, M., Mitou, E., & Quirchmayr, G. (2006), A framework for outsourcing IS/IT security services, Information Management & Computer Security, 14(5), 402–415.

Khalfan, A. (2004). Information security considerations in IS/IT outsourcing projects: A descriptive case study of two sectors, International Journal of Information Management, 24, 29–42.

Kim, S., & Chung, Y. (2003). Critical success factors for IS outsourcing implementation from an international relationship perspective. Journal of Computing Information Systems, 43(4), 81–90.

Kim, J. W., Meso, P., & Kim, D. G. (2005, December). Cultural effects on offshore-outsourced systems development. Paper presented at the 13th Annual Cross-cultural Meeting in Information Systems. Las Vegas, Nevada, U.S.A.

Klosek, J. (2005). Data privacy and security are a significant part of the outsourcing equation. Intellectual Property and Technology Law Journal, 17(6), 15–18.

KPMG (2004). Information risk management Asia Pacific outsourcing survey. Retrieved from www.kpmg.com.au.

Lacity, M. C. & Hirschheim, R. A. (1993). Implementing information systems outsourcing: Key issues and experiences of an early adopter. Journal of General Management, 19(1), 17–31. Journal of ICT, 9, pp: 87–

Lee, Y. C. (2010, June 10). Protecting personal data. The Star.

Lee, M. K. (2009, May 29). Malaysia keeps lofty spot for global services. ZDNet Asia.

Lee, M. K. O. (1996). IT outsourcing contracts: Practical issues for http://jict.uum.edu.my/ management. Industrial Management and Data Systems, 96(1), 15–20.

Leem, C., & Lee, H. (2004). Development of certification and audit processes of application service provider for it outsourcing. Technovation, 21(1), 63–72.

McKinney, C. (2005). Capability maturity models and outsourcing: A case for sourcing risk management. Information Systems Control Journal, 5.

Murphy, J. (2003). Ways to evaluate and address your outsourcing risk. Gartner Research.

Musaji, Y. (2005). Sarbanes-Oxley and business process outsourcing risk. Information Systems Control Journal, 5.

National Directors Institute (2007). Board oversight of data privacy and security. Foley & Lardner LLP.

Owens, R., & Van Nuuren, F. (2007, July). Privacy law and outsourcing in Canada. Blakes Bulletin on Privacy & Outsourcing, 1–12. Blake, Cassels & Graydon LLP.

Perrons, R. K., & Platts, K. (2004). The role of clockspeed in outsourcing decisions for new technologies: Insights from the prisoner’s dilemma. Industrial Management & Data Systems, 104(7), 624–32.

Peterson, B. L. (2002). Information security in outsourcing arrangements. Outsourcing Journal. Retrieved from http://www.outsourcing -journal. com/

PGP (2006). Affiliated computer services, inc. (ACS): Securing sensitive data in business process outsourcing. ACS Case Study. PGP Corporation.

Rao, M. T. (2004). Key issues for global IT sourcing: Country and individual factors. Information Systems Management, 21(3), 16–21.

Ramanujan, S., & Jane, S. (2006). A legal perspective on outsourcing and offshoring. Journal of American Academy of Business, 8(2), 51. Journal of ICT, 9, pp: 87–

Rosenthal, B. E. (June, 2006). Booz Allen Hamilton Study: Data security is becoming a distinguishing factor when selecting a supplier. Outsourcing Journal. Retrieved from http://www.outsourcing-journal.com/jun2006-boozallen.html

Ross, J. W. & Westerman, G. (2003). Architecting new outsourcing solutions: http://jict.uum.edu.my/ The promise of utility computing, Massachusetts Institute of Technology Center for Information Systems Research, CISR WP 117 and Sloan WP No. 4458–01.

Sabherwal, R. (2003). The evolution of coordination in outsourced software development projects: A comparison of client and vendor perspectives. Information and Organization, 13, 153–202.

Saleh, A. S., & Ndubisi, N. O. (2006, August). An evaluation of SME development in Malaysia. International Review of Business Research Papers, 2(1), 1–14.

Salmela, H., & Turunen, P. (2003). Competitive implication of IT In the public sector: The case of a city GIS. International Journal Of Public Sector Management, 16(1), 8–26.

Sayana, S. A. (2005). Auditing IT service delivery. Information Systems Control Journal, 5.

Scott, Y. (1996). Audit and control of information services outsourcing. Information Systems Control Journal, 6.

Sullivan, W.E., & Ngwenyama, O. K. (2005). How are public sector organizations managing IS outsourcing risks? An analysis of outsourcing guidelines from three jurisdictions. Journal of Computer Information Systems, 45(3), 73–87.

Tafti, M. H. A. (2005). Risks factors associated with offshore it outsourcing. Industrial Management & Data Systems, 105(5), 549–560.

Taherzadeh, M. (2007). Worldwide: Privacy and outsourcing: Evolving concerns. Mayer Brown LLP. Retrieved from www.mondaq.com/

Tolle, S. (2006). Confidential data leaks during outsourcing tantamount to Bankruptcy. Infowatch. Retrieved from http://www.infowatch.biz/ Journal of ICT, 9, pp: 87–

Turban, E., King, D., & Lang, J. (2009). Introduction to electronic commerce (2nd ed.). International Edition. Pearson Education, Inc.

University of Utah. (2007, March). Standard for electronic media disposal. University of Utah. http://jict.uum.edu.my/

Victoria University. (2006, July). Policies and associated procedures for the disposal and cleansing of IT equipment. Victoria University.

Vijayan, J. (2006, June 1). Two more organizations report data breaches, Computerworld. Retrieved from http://www.computerworld.com/

Wang, E. T. G. (2002). Transaction attributes and software outsourcing success: An empirical investigation of transaction costs theory. Information Systems Journal, 12, 121–152. In Dhar, S. and Balakrishnan, B. (2006). Risks, benefits, and challenges in global IT outsourcing: Perspectives and practices. Journal of Global Information Management, 14(3), 39–69.

Weakland, T. (2004). 2005 Global IT outsourcing study. DiamondCluster International, Inc.

Weiss, T. R. (2005, July 20). Visa, Amex cut ties with processing firm hit by security breach. Computerworld. Retrieved from http://www. computerworld.com/

Downloads

Published

24-03-2010

Issue

Vol. 9 (2010): Journal of Information and Communication Technology (JICT) Vol. 9, 2010

Section

Articles

How to Cite

Lin, Y. M., Zakariah, M. I., & Mohamed, A. (2010). Data Leakage in ICT Outsourcing: Risks and Countermeasures. Journal of Information and Communication Technology, 9, 87-109. https://doi.org/10.32890/jict2010.9.5

Research impact

Harvested 2026-09-06
0 citations recorded so far

Counts differ between services because each indexes a different body of literature. None of them is the whole picture.

Identifiers DOI 10.32890/jict2010.9.5

Most read articles by the same author(s)