Australian Universities increasingly rely on Information Technology (IT) systems for essential business operations, including administration, teaching, learning and research. Applying information security to university IT systems is strategically important to maintaining overall business continuity in universities. However, the process of effectively implementing information security management in the university sector is challenging for security practitioners. University environments consist of a cultural mix of academic freedoms, student needs and compliance mandates. Consequently, unique and divergent demands are placed on securing and accessing university IT systems. This research undertook a qualitative based exploratory analysis of information security management in Australian universities. The aims and objectives of the research (represented as the research questions) were to determine: 1) What is the current status of information security management practices in the Australian university sector? 2) What are the key issues and influencing factors surrounding the effectiveness of information security management practices? 3) How could improvements in information security management be achieved? The findings from the research led to a comprehensive and insightful examination of the current status, issues and challenges facing information security practitioners in Australian universities. The research findings culminated in the development of a Security Practitioner's Management Model. An essential aim of the model is to assist security practitioners to successfully implement and progress information security in the Australian university environment. The research improves current understanding of information security issues and reinforces the pertinence of information security management as a strategically important business function for Australian universities.