Business Information Security Research Articles

Understanding strategies for digital government transformation: A strategic action fields perspective

Digital technologies are transforming public service provision by affecting governments, technology vendors, and citizens, as well as their interactions. However, digital government transformation (DGT) is complex and challenging, with governments often lacking clear strategic adjustments during their digital journeys. This study discusses six strategic factors, including business environment, digital infrastructure, financial capability, innovation capability, information security, and public demand, and identifies the configurations that lead to a significant increase in digital government performance. Based on the theory of strategic action fields, we developed a theoretical framework to understand the DGT process and changes in configurations. Based on a novel Multiple Time Differencing Qualitative Comparative Analysis (MTD/QCA) method, the analysis of 31 provincial regions in Chinese mainland over four years derived 13 distinct solutions in the three basic stages of DGT: exploration, concentration, and complementation. These findings reveal the complexity of DGT from an evolutionary perspective and indicate that these factors do not work in isolation, but in combination with others to promote DGT. Understanding the configurational relationships of these factors can help governments adjust their strategies across the three stages of DGT.

Costs and benefits of business information security

The article considers the process of information security from the position of cost-benefit assessment that allows to understand economic aspects of feasibility study of measures in the field of business information protection. In the practice of Russian business, the issues of information security are focused on compliance with regulatory requirements of the legislation. This leads to the fact that business entities neglect the procedure of comprehensive assessment of measures effectiveness that should consider the costs and benefits of legal, organizational, and technical information protection implementation. At the same time, in order to meet the new conditions of technological development of society, it is necessary to revise the concept of information protection of business entities and to fix in the policy of information security of activities the approaches to risk assessment based on assets value. The study contains a description of the cost/ benefit approach to the constituent components of ensuring information security of business process. To understand the economic aspects of information security, the research focuses on business entities of the market type of economic activity (the enterprise makes profit in its activity). The composition of components of the ensuring information security process has been defined. On the example of risk management costs and benefits of information security have been considered in detail.

OVERCOMING THE BARRIERS TO THE DIGITAL TRANSFORMATION OF INDUSTRIAL ENTERPRISES THROUGH THE BUSINESS MODEL SELECTION MECHANISM

The article describes the main barriers to digital transformation faced by industrial enterprises in various industries, such as: lack of appropriate funding, information security risks, insufficient digital skills of employees, insufficient maturity of current processes, internal resistance to change, insufficient awareness of managers, lack of certainty over the future of digital standards. To analyse the barriers, the author used a three-step approach, including a literature review, a primary research with representatives of the companies, and a qualitative comparative analysis that are based on the Kruskal – Wallis test and used to identify differences between groups of enterprises. To overcome the barriers identified by the author it was offered to use a mechanism of a business model selection, which takes into account the assessment of obtained competitive advantages (improvement of operational, financial and technical efficiency), digital maturity (digital culture level, staff qualifications, the quality of business process organisation and access to digital infrastructure) and risks (non-receipt of expected income from business model implementation, information security, reputational and personnel). The novelty of the proposed business model selection mechanism for an industrial enterprise is to improve the classification and develop a multi-criteria mechanism for choosing a business model, which would be implemented using a knowledge-based system incorporating a fuzzy inference mechanism.

BLOCKCHAIN TECHNOLOGY AND APPLICATION – SMEs ASPECT

<em>This review article is designed for SME owners and directors to understand better what blockchains are and how they work and to support them to start an entirely new blockchain or fork an existing one and create a new token. The article presents technology bases and how blockchains can serve SMEs and foreseeable challenges that could jeopardize the achieved results. Particular attention the authors paid to blockchain applications, transaction cost reduction, and sensitive business information security. <em>Even more attention the authors gave to the challenges</em> connected with digital infrastructures and business practices, investments, lack of interoperability, lack of skills, and legal aspects. <em>Chapter four discusses the creation of blockchains for SMEs </em>from the aspects of choosing a type of blockchain, choosing of consensus mechanism, a platform selection, nodes design, operating systems, instances design, application programming interfaces, and user interfaces, and the blockchain finalizing. In chapter five, Conclusions, the authors draw conclusions based on the work presented in the article.</em>

State and Problems Encountered by Postal Service Providers in The Republic of Bulgaria

Digital transformation, the migration of product exchange to an online environment and the uncertainty of the economic system are forming new challenges for operators providing postal and logistics services. Their key role in the exchange economy brings to the fore the problems of the level and complexity of the service offered. In the present work, the current dimensions of the offer of postal services in Bulgaria are investigated, which allows to locate main problems and their possible solutions, which are defined in the dimensions of innovative adaptation of the achievements of scientific progress, investments in new equipment and technologies and provision of business information security.

Identification of SMEs in the Critical Factors of an IS Backup System Using a Three-Stage Advanced Hybrid MDM–AHP Model

Backup system work represents “the last mile” of information security (IS). To avoid data loss or damage, enterprises should execute data backup periodically to ensure the integrity and availability of such data. Additionally, due to the continuous emergence of IS incidents featuring malicious attacks in recent years, major firms in countries around the world have successively reported being under attack by ransomware viruses. In particular, small and medium enterprises (SMEs) became the potential targets of malicious attacks based on their different types of IS awareness and degrees of digitalization; therefore, IS work has become one of the essential topics with special significance for numerous SMEs. To this end, this paper studied the factors influencing SMEs’ adoption of IS backup systems in the hope that the critical decision-making behaviors of SMEs regarding the issue of IS could be learned. Practical suggestions can be made for the marketing schemes adopted by IS manufacturers concerning the planning of IS backup systems. Thus, this study used three methodological stages to address the exciting issue of IS backup systems for SMEs. In the first stage, 11 factors at two hierarchies involving three constructs influencing SMEs’ adoption of IS backup systems were summarized via a literature review. The constructs included financial consideration (FC), the IS incident, and business IS decision making (BISD-M). In the second stage, an expert questionnaire was applied; an advanced hybrid modified Delphi method (MDM) and analytic hierarchy process (AHP) with expert input were constructed to identify the sorting of overall weights based on the 11 factors included in the first stage. Following the empirical conclusions, the top three critical factors were “disaster loss amount”, “enterprise’s downtime”, and “supplier’s contractual requirements”. The conclusions of this study indicated that two factors were included in the FC construct; thus, the FC construct influenced IS the most, and the BISD-M construct took second place. In the final stage, through re-checking three actual cases, the results of this study were verified with specific respect to the FC. In conclusion, to popularize IS backup systems among SMEs and fully implement IS, manufacturers may start from the FC in the hope that the severe impact caused by IS incidents featuring malicious attacks can be slowed down and the losses encountered can be lowered. The empirical results and conclusions of this study can be used for reference by SMEs, and both theoretical and empirical foundations have been provided for further studies in academic circles; the results above also show a significant application contribution of this study.

A Key Business Node Identification Model for Internet of Things Security

Based on the research of business continuity and information security of the Internet of Things (IoT), a key business node identification model for the Internet of Things security is proposed. First, the business nodes are obtained based on the business process, and the importance decision matrix of business nodes is constructed by quantifying the evaluation attributes of nodes. Second, the attribute weights are improved by the analytic hierarchy process (AHP) and entropy weighting method from subjective and objective dimensions to form the combination weight decision matrix, and the analytic hierarchy process and entropy weighting VIKOR (AE-VIKOR) method are used to calculate the business node importance coefficient to identify the key nodes. Finally, according to the NSL-KDD dataset, the network security events of IoT network intrusion detection based on machine learning are monitored purposefully, and after the information security event occurs in the smart mobile phone, which impacts through IoT on the business system, the impact of the key business node on business continuity is analyzed, and the business continuity risk value is calculated to evaluate the business risk to prove the effectiveness of the model. The experimental results of the civil aviation departure business show that the AE-VIKOR method can effectively identify key business node, and the impact of the key business node on business continuity is analyzed, which further proves the efficiency and accuracy of the model in identifying the key business node.

Research on the current status and transformation strategy of digitalization at the State Grid Jibei Electric Power Company

Developing the digital economy and promoting the digital transformation of enterprises has been an important direction for the development of enterprises in various countries. This article systematically analyzes the information organization, communication network, digital platform, business application system, information security and information operation and maintenance status of the company in Jibei Electric Power Company. Based on the analysis of the development environment and advantages and disadvantages of digital transformation in Jibei Electric Power Company, the development strategy of establishing unified digital development committee, improving the digitalization ability of power transmission and distribution business, improving the digitalization capability of internal operation and building the toB terminal service platform of integrated energy services are put forward.

Information security aspects of business continuity management

Most of modern enterprises use information infrastructure and corporate information systems to organize their businesses. Continuity of business processes, availability and integrity of data and the activity of the organization as a whole depend directly on the reliability and security of their functioning. The article deals with the issues of ensuring the sustainability of basic business processes and information security of organizations to the negative impacts of natural, man-made, economic, social nature emergencies, as well as the issue of recovery of business and the necessary level of continuity in information security during and after situations that hindered the regular functioning of the organization, taking into account the nature and extent of their impact. In the first case, the task of managing business continuity is preventing a risky event, developing and implementing preventative measures. In the second case, the task of managing business continuity is reducing the impact of negative consequences, that caused interruption of activity of organization, reducing the time it takes to replace assets, and reducing the costs related to the replacement. The evolution of approaches to ensure the continuity of the business is described. An overview of standards and other regulations, where best practices in building business continuity management systems are reflected, are done. In the context of the process model of management, the main stages of business continuity management, which consist in the sequential implementation of the closed cycle “Plan – Do – Check – Act”, namely: the processes of planning, implementation, maintenance, monitoring, analyzing and improving the performance of business continuity management system, are considered. Attention is drawn to the fact that organizations within this system must develop, document, implement and maintain security procedures and security measures to ensure the necessary level of information security continuity in the face of threats and destabilizing factors of various nature. Conclusions have been made regarding the benefits that organizations gained due to developed and implemented a business continuity management system that has measures for information security.

УЧЕБНО-ЛАБОРАТОРНЫЙ КОМПЛЕКС ПО ИЗУЧЕНИЮ АТАК ТИПА «ЧЕЛОВЕК ПОСЕРЕДИНЕ» И СПОСОБОВ ЗАЩИТЫ ОТ НИХ

For the implementation of the Master’s program “Business Continuity and Information Security Maintenance” in the field of specialty 10.04.01 “Information Security”, a software shell of the educational laboratory complex (ELC) designed to study the “Man in the middle” network attacks has been developed in the NRNU MEPhI. In the framework of the ELC four basic attacks of this type are modeled: UDP Hijacking, Session Hijacking, TCP Hijacking and Bucket brigade attack. The paper presents two ELC applications: the instructor’s application and the student’s application. To assess the students’ knowledge after performing laboratory work, the “Testing” module for assessing progress testing has been created, which includes questions for testing using the ELC software shell. Methodical instructions on performance of laboratory work have been written. Within the framework of the “Protected Information Systems” discipline of the Information Security of Banking Systems Department of the NNIU MEPhI, implementing the above-mentioned Mastre’s program, a successful approbation of the developed ELC has been carried out. In conclusion the ways to further improvement of the ELC are suggested.

Research on information security and privacy protection model based on consumer behavior in big data environment

SummaryIn the big data era, information security is becoming more and more important. The recent scandal of the data privacy on Facebook sounded the warning bell for us. Based on the utility theory, this paper proposes that the disclosure behavior of consumer personal information is mainly influenced by two factors, which are perceived risk and perceived benefit, respectively. When consumers make decisions, they weigh the risks and benefits. If the income is greater than the risk, the consumer is willing to provide the information on the website and vice versa. This paper analyzes the serious threats to the safety and privacy of commercial big data and proposes a multi‐level security protection theoretical model for business information security and privacy protection from the perspective of business big data security. The security functions and core technologies of each layer are described in detail, which provide a useful and in‐depth theoretical exploration for practical engineering. Finally, based on the privacy protection of large data and the principle of RBAC, a model of user privacy information security system is proposed.

ZARZĄDZANIE BEZPIECZEŃSTWEM INFORMACJI GOSPODARCZYCH NA PRZYKŁADZIE KRAJOWEGO REJESTRU DŁUGÓW BIURA INFORMACJI GOSPODARCZEJ SA

The aim of the article is to characterize the specificity of business information and issues related to ensuring their security on the example of the Business Information Bureau. The analysis covered the National Debt Register of Business Information Bureau S.A., which is the first and one of the largest entities of this type operating in Poland. The article first discusses the specific nature of business information as a special type of information regulated by the Act dedicated to it. The following part analyses the functioning of information security systems and procedures in the company’s business information security. This analysis is to illustrate how the requirements imposed on business information offices were implemented in practice in the scope of an information security management system.

On Exploring Research Methods for Business Information Security Alignment and Artefact Engineering

This paper examines research methods for designing and engineering a Business Information Security (BIS) artefact. Preventing and responding to cybercrime is becoming an integral part of management practices which are supervised by the Board of Directors (BoD), and it can no longer be perceived as just traditional IT. In order to improve the maturity of business information security a transformation is needed and this requires adequate reporting and dashboarding. Dashboard functions such as the current versus the desired state of the Maturity of Business Information Security (MBIS) reflect certain parameters that boards can influence. Determining the key dashboard functions that reflect these parameters of control was the main motivation for this research paper and the ultimate goal was to engineer a BIS artefact. We propose a research and design method that could be used to establish an experimental dashboard with initial parameters of control based on a Group Support System (GSS) approach. Finally, GSS is evaluated as a method for a) examining which parameters are effective for BIS, from multiple perspectives and b) helping to implement the artefact (make it fit the purpose) as well as the associated business alignment and decision-making.

자원 제약하의 중소기업 정보보안계획 수립방안 연구

정보는 기업의 규모와 무관하게 소중한 자산이며 정보보안은 기업의 생존과 번영을 위해 필수적인 요소이다. 하지만 대기업의 경우 정보보안경영시스템(ISMS)의 신속한 도입을 통해 안전을 확보해 나가지만, 중소기업의 경우는 예산 제약, 보안 지침의 미흡, 보안에 대한 인식 부족 등, 복합적인 요인들로 인해 보안시스템이 구축되지 않거나구축이 지체되고 있다. 본 논문에서는 중소기업의 정보보안 관리 실태를 설문조사를 통하여 문제점을 분석하고, 중소기업을 위한 무료 또는 저렴한 방법으로 종합적인 보안계획 수립 방안을 제시하고자 한다. 본 논문이 제시하는 방법을 적용해 중소기업들은 최저 비용의 기본적인 정보보안을 구현할 수 있을 것이며, 정보보안 계획을 수립하고자 하는 중소기업들에 도움이 될 것이라고 믿는다.

Business Process and Information Security: A Cross-Listing Perspective

Sensitive data are often handled in business processes. As an important component of industry systems, information system (IS) plays a vital role in business processes. However, data and information may leak in business processes. The damages caused by information security breaches (ISBs) on firms are increasing in recent years. Previous studies have consistently found that the announcements of ISBs are negatively associated with the market values of the announcing firms during the days surrounding the breach announcements. Globalization drives firms in diverse industries to cross-list their stocks. With the benefits of cross-listing, firms are able to perform entrepreneurship and industry integration is improved as well. Because cross-listing improves information environments and provides better investor protection, this paper argues that cross-listing help firms to reduce the negative impacts caused by their announcements of ISBs. From the perspective of ISs engineering, this paper conducts an event study of 120 publicly traded firms and finds that cross-listing does not mitigate the impact of ISB announcements on a firm’s stock prices.

Exploring the supply of pirate software for mobile devices

PurposeSoftware piracy is an ongoing problem for software producers. At the same time, mobile devices such as personal digital assistants and smart phones are increasing in popularity. This paper seeks to examine the supply of pirate software for mobile devices, against a backdrop of conventional desktop piracy theory.Design/methodology/approachUsing a novel data set of pirate software releases, the paper reviews 18,000 entries from a pirate software database to examine the type and origin of this software.FindingsThe paper finds that more popular platforms are not necessarily subject to greater levels of software piracy. For mobile devices, productivity software was more popular than game software. Many piracy groups were involved, but only four groups were responsible for over half of all releases. Some popular devices, such as the Blackberry and Apple iPhone, showed little to no piracy levels.Research limitations/implicationsAs with empirical research into any criminal or deviant behaviour, there may be intention to deceive. The findings regarding device popularity and availability of pirate software have implications for demand‐side research.Practical implicationsThe findings provide insights for business managers and information security professionals in the telecommunications and mobile applications industries.Originality/valuePrior research work has focused on software for desktop computers. This study contributes by being some of the first published work on piracy for mobile devices. The work is also original in that most prior research has focused on the demand for pirate software. This paper provides insight into the supply of this software.

A Research Journey into Maturing the Business Information Security of Mid Market Organizations

Most information security methodologies are aimed at large enterprise organizations with a top-down structure, while relatively smaller organizations have insufficient knowledge to adopt this methodology. Most of the frameworks used by enterprises focus on high-level policy-making and the overwhelming amount of controls might suffocate practitioners in smaller organizations. This article examines the results of an exploratory study, performed in the Netherlands in Q1&Q2 of 2010. The study used expert panel research followed by a survey. The research found essential interventions to easily and effectively increase security maturity for mid market organizations. The research also found barriers for not implementing these interventions by the midmarket. This paper provides a minimum core set of practices for organizations. It shows that mid market organizations struggle with implementing relevant interventions. This research contributes a new pragmatic approach to assist mid market organizations’ practitioners with more guidance on how to effectively establish the desired state of security maturity.

Using human resource functions to improve enterprise information security

The function of human resources (HR) has become critical key source of competitive advantages. HR management activities can provide the preventive mechanism in business information security and enhance the information security concepts of employees. The purpose of this research is to use HR's functions to improve companies' information security. Content analysis and the analytic hierarchy process methods were adopted to collect and analyse data. According to the results, this study divides HR's functions into four main parts by system approach. The priority of sequence is: corporate policy, staffing, training and performance appraisal. The results show that measures and prioritisation of different roles' emphasise and provide companies and HR managers with references to improve companies' information security and operating effectiveness.

Consumer motivations in taking action against spyware: an empirical investigation

PurposeThe purpose of this paper is to develop a research framework and empirically analyze the factors that motivate the consumers to adopt and use anti‐spyware tools when they are faced with security threats.Design/methodology/approachThe research model was tested with data obtained through online survey questionnaires. A pre‐ and a pilot‐test of the survey instrument are conducted. Then, a final five‐point Likert scale instrument is created. The solicitation for participants is done through e‐mail invitations. Survey results are analyzed using factor analysis and logistic regression.FindingsThe results do not find statistically significant relationships for hypotheses related to perceived vulnerability and response cost with the dependent variable. Perceived severity, self‐efficacy, and response efficacy are significantly related to use of anti‐spyware tools.Research limitations/implicationsThe empirical findings suggest that protection motivation theory (PMT) may possibly provide a new avenue in the domain of IS adoption. In addition to the usefulness and ease of use in the classical IT adoption models, the threat appeal factors are added in this study to provide a different perspective in understanding technology adoption behavior.Practical implicationsThe findings provide insights for business managers and information security professionals attempting to deliver to and implement security mechanisms like anti‐spyware among end‐users who are faced with security threats.Originality/valueWhile theories such as technology acceptance model, theory of planned behavior and theory of reasoned action are insufficient to gauge consumers' attitude and behavioral change toward the adoption of anti‐spyware tools when consumers are confronted with threats, this paper provides theoretical support and contributions to the research based on applying PMT in the arena of information systems.

Information security management objectives and practices: a parsimonious framework

PurposeAs part of their continuing efforts to establish effective information security management (ISM) practices, information security researchers and practitioners have proposed and developed many different information security standards and guidelines. Building on these previous efforts, the purpose of this study is to put forth a framework for ISM.Design/methodology/approachThis framework is derived from the development of an a priori set of objectives and practices as suggested by literature, standards, and reports found in academia and practice; the refinement of these objectives and practices based on survey data obtained from 354 certified information security professionals; and the examination of interrelationships between the objectives and practices.FindingsThe empirical analysis suggests: four factors (information integrity, confidentiality, accountability, and availability) serve as critical information security objectives; most of the security areas and items covered under ISO 17799 are valid with one new area – “external” or “inter‐organizational information security”; and for moderately information‐sensitive organizations, “confidentiality” has the highest correlation with ISM practices; for highly information‐sensitive organizations, “confidentiality”, “accountability”, and “integrity” are the major ISM objectives. The most important contributor to information security objectives is “access control”.Research limitations/implicationsThis study contributes to the domain of information security research by developing a parsimonious set of security objectives and practices grounded in the findings of previous works in academia and practical literature.Practical implicationsThese findings provide insights for business managers and information security professionals attempting to implement ISM programs within their respective organizational settings.Originality/valueThis paper fulfills a need in the information security community for a parsimonious set of objectives and practices based on the many guidelines and standards available in both academia and practice.