Company's Information Security Research Articles

ОРГАНІЗАЦІЯ ОБЛІКУ БІЗНЕС-СУБ’ЄКТІВ АГАРНОГО СЕКТОРУ НА ЗАСАДАХ СТАЛОГО РОЗВИТКУ

The concept of sustainable development is one of the most vital for the domestic agricultural sector. Achieving the goals and objectives of sustainable development of agriculture and rural areas requires improving the accounting and analytical support of agricultural management; the leading role is the organization of accounting. The article examines the essence of accounting for sustainable development and the place of organization in the accounting system of business entities in the context of sustainable development. At the expense of the principle of transparency is supplemented by a set of accounting principles, based on which the system of accounting and analytical support of agricultural management should be organized. The main shortcomings of the organization of accounting of agricultural formations at the present stage have been identified. The key advantages of the transition to the accounting model for sustainable development in agriculture are outlined. Among them are better opportunities for resource recovery, risk management, improved management, and increasing the investment attractiveness of agribusiness. A set of the main tasks of accounting for sustainable development in business entities of the agricultural sector has been substantiated. The priorities and composition of reporting prepared by the requirements of sustainable development standards and integrated reporting of enterprises (IR) are studied. The key features of corporate governance inherent in structures that use the principles of sustainable accounting and information support in their practice are defined. The directions of improvement of the organization of accounting based on the concept of sustainable agricultural management are substantiated, among which the following should be highlighted: supplementing the information and analytical basis with ESG data; supplementing methodological and practical provisions related to the recognition, valuation, and features of accounting for assets, liabilities, and financial results; supplementing internal management reporting with data on the social responsibility of agricultural business; increasing the agricultural company's information security, transparency, and openness. It is concluded that the organization of accounting based on sustainable development is an effective tool for improving management practices in the context of long-term social values.

Research Review on Measuring Information Security Awareness

One of the factors that contributes to unauthorized parties releasing confidential company information, including employee personal information, is a lack of awareness of employee information security. This is a critical concern that needs to be addressed immediately by strengthening the company's information security culture and raising employee awareness of security. To enhance the clarity and emphasis of the reform policy, it is crucial to evaluate employee awareness of information security. This paper discusses several approaches that have been employed, either as models or frameworks, to evaluate an organization's level of information security awareness. With the aid of inclusion and exclusion criteria, we chose 16 papers out of the 842 that were included in the systematic literature review. Three components are commonly used to assess information security awareness: knowledge (what is already known), attitude (what is thought to be appropriate to do), and habit (what is usually done). Measurements that encompass these three aspects employ the Knowledge, Attitude, and Behavior (KAB) paradigm. This study might be a reference for organizations to measure their employees’ security awareness. Several findings are also discussed in this paper.

Designing an incentive mechanism for information security policy compliance: An experiment

Much information security research focuses on policies firms could adopt to reduce or eliminate employees’ violation behavior. However, current information security policies are based on increasingly outmoded models of compliance behavior. This paper proposes a novel behavioral-based mechanism that offers rewards and punishments to incentivize employees to take the time to protect a company's information assets. This new mechanism is grounded in insights from externality taxes and subsidies, as well as from behavioral economics, that specific incentives operationalized as monetary rewards and punishments effectively improve information security compliance. We also consider the importance of detection in implementing our mechanism. We conduct a set of laboratory experiments to study the impact of the rewards and punishments, as well as the importance of the probability of detection.Our results show clearly that rewards alone or a combination of rewards and punishments are effective in improving information security policy compliance in both high and low-detection environments, but punishments alone are not effective in either of our environments. In addition, a company's information security compensation plan is more likely to be effective in improving compliance if the company can more reliably detect violations. Overall, our study suggests that a compensation structure based on small and predictable financial rewards and punishments is likely more effective than the current punishment-focused approach.

УПРАВЛЕНИЕ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТЬЮ В КОМПАНИЯХ

In the modern world, the problem of infor-mation security in companies is most acute, as the number of cyberattack attempts on company websites and domains has in-creased many times. There are many pro-grams and developments that can solve this problem quite effectively. The article dis-cusses an algorithm aimed at creating an information product aimed at ensuring infor-mation security at different levels.

Network threat detection technology using Zabbix software

The article analyzes the problem of ensuring the company's information security and the need to use monitoring systems. Modern existing monitoring systems and the principle of threat detection are analyzed. It has been proven that it is important to use Zabbix software to detect threats and improve information security. The purpose, characteristics and main capabilities of Zabbix are defined. Examples of application of software for detecting attacks are given. Based on the research carried out in the article, a threat detection technology using Zabbix and a plug-in for it has been developed. The effectiveness of the application of the developed technology for detecting threats is shown.

The Saudi Information System Law and its Effectiveness (A Study of the Degree to Which Major Saudi Organizations Apply the Best Practices of Information Systems)

Information Security Law is the body of legal rules, codes, and standards that require companies to protect that information and the information systems that process it from unauthorized access. The government's development, issuance, and maintenance of law requirements help to ensure that standards are met, which, in turn, supports the country's safety, productivity, and economic development. The purpose of this paper is to assess the adequacy of the current Saudi laws and regulations related to information security and the extent to which information security laws impacted companies' application of information security best practices. The Saudi laws related to information security were studied and compared with the American information security regulations in the first part of the research. Then the experimental setting was used to perform the search by designing an electronic questionnaire to reveal the impact of Saudi information security laws on the reality of information security in companies. The questionnaire consists of 3 general questions and 11 questions regarding corporate practices that support the application of information security laws. The questionnaire was distributed to a random sample of information security workers in a number of major Saudi companies, and forty participants responded, and the largest proportion of respondents were executives, and the respondents' years of experience ranged between 1 and 40 years. It is concluded from the research that having stricter and flawless information security laws provides a strong foundation for corporate policies, and a safe investment environment.

The dynamics of changes in security systems during the development of a company from small to large

The article is devoted to the study of the peculiarities of the company's information security management in the process of its development from small to large. General definitions and theoretical provisions of information security were studied; the current state and trends in the development of ISMS of small, medium and large businesses in Ukraine were investigated; IT support models for small, medium and large companies were developed and sound recommendations for their implementation were given. The results of the research can be used at enterprises and organizations of small, medium and large businesses in the process of solving IS problems, preventing the occurrence of critical errors, incidents and unnecessary costs in the process of growth and development of business from small to large.

Influence of Information Security Culture on the Information Security Governance Capabilities (Case Study: PT XYZ)

Objective – To analyze the relationship between a company’s information security approach/culture with its information security governance capabilities based on COBIT 5 framework and provide recommendations that can be used to improve the company's information security capabilities per COBIT 5 standard.
 Methodology – The research uses qualitative and quantitative methods by conducting interviews and distributing questionnaires to 3 members of the IT Department at PT XYZ.
 Findings – The research found that the measured COBIT 5 processes (APO13 and DSS05) failed to reach the expected target (level 4), with each DSS05 and APO13 can only reach level 1 and 2 respectively. In addition, several flaws were also found in the company’s information security culturethat may have contributed directly or indirectly to the current state of the company’s information security capabilities.
 Novelty – In this study, the researchers expand the previous study on information security culture conducted in 2010 by performing a security audit on a company's IT department to analyze the connection between corporate culture, especially information security culture and the capability level of information security governance. The company thus can make improvements or corrections to its information security approach/culture based on the recommendations provided with COBIT 5 framework.
 Keywords: Capability Level; COBIT; Governance; Information Security Culture.

Social engineering attacks life cycle and types

Today, social engineering attacks are one of the most common methods for hackers to hack computer networks and information systems of organizations, steal credentials and other confidential information of users, and commit various cybercrimes. Socio-engineering attacks pose a particular threat to companies with large numbers of employees. Without proper training and education of staff, an attack on an employee who is not related to information security is more likely to be successful, but even such an employee may not be the main cause of a company's information security incident, but become one of the links in the attack chain. which the attacker created to achieve his ultimate goal. Given this, the need to raise awareness about socio-engineering attacks, namely how they are implemented and what types of them exist. This article describes the life cycle of social engineering attacks and the main methods that are used by attackers to implement such attacks. Company employees should be familiar with the signs and examples of various types of social engineering attacks in practice, the principles and rules for working with information, as well as the responsibility for violating these rules. To ensure data security, regulations and instructions should be created and communicated to the personnel, which should clearly spell out the rules for storing, processing, distributing and transferring information to third parties. Raising the awareness of the company's employees about the types of social engineering attacks will reduce the number of incidents implemented as a result of their occurrence.

The ISO/IEC 27001 standard provides a systematic approach to information security management

The company's information security is not only compliance with a set of IT security measures, but also the correct choice of the appropriate standard. Let's look at what standards are aimed at ensuring the information security of the company.

Suggestion of applicability of ISO for the improvement of data security in companies

Suggestion of applicability of ISO to improve the security of company information. Elaborated through a bibliographic research to understand the concepts applied in the present work, adopting a quantitative research through a questionnaire. Research directed to professionals and university students of information technology, and to a random audience. A documentary research was also carried out to collect data in informal *institutions*. The following technical standards were adopted: NBR-ISO-27001, NBR-ISO-27002, NBR-ISO-27008, NBR-ISO-27036, with distinct characteristics and with the intention of being useful in suggesting the applicability of ISO in company procedures. It was possible to evaluate the reliability of the companies in relation to the security of their employee data. With the suggestion of applying the ISO to companies, it is possible to obtain a greater security, as well as a greater availability, with more efficient data exchange. The information security policy is established through rules, standards, and procedures, which must be used internally and externally, providing more reliability. Company employees will begin to carry out processes more efficiently within the organizations. Therefore, the suggestion of using the ISO for information security in companies becomes significantly important because it is one more contribution so that they can have rules to protect both their data and those of their employees.

Designing an Information Security System in Smart Factories of the Industry 4.0

The problem of designing an information security system in smart factories of Industry 4.0 is investigated. Information security system is a company infrastructure component to provide the company information security. In the example of typical smart factory structure cyber and physical components are defined which are mostly susceptible to the malicious software components implementations. Such components could be components with their own means of calculations and engaged in the production technological operations. Smart factory information security risks can be explained with program and technical means for the operator to control the cyber and physical configuration remotely and other components of the production infrastructure into a single digital space of the company. Measures are proposed to increase the information security level of the Industry 4.0 smart factory based on technical, organization and program solutions.

A Case Study Examining Trends in Company Information Security Attacks and Their Implication for the Future of Computer Science

A Case Study Examining Trends in Company Information Security Attacks and Their Implication for the Future of Computer Science

Identification of Attributes of Information as an Element of Management Security of Information in the Company

Abstract Information is a special type of resource in an enterprise. is an indispensable element of every action taken. The article presents the essence of resources subject to special protection, affecting the company's information security. This allowed to identify the information attributes in the area of security of the surveyed enterprises. The article analyzes the attributes of information affecting the activities of the surveyed enterprises, the pace of work, information chaos. The research confirmed the importance of the information features, which will help the employer and superiors to evaluate the manner, frequency of providing information and making a screening to whom the information is provided.

Impact of Deterrence and Inertia on Information Security Policy Changes

ABSTRACT This study examines the impact of deterrence and inertia on information security policy changes. Corporations recognize the need to prioritize information security, which sometimes involves designing and implementing new security measures or policies. Using an online survey, we investigate the effect of deterrent sanctions and inertia on respondents' intentions to comply with modifications to company information security policies. We find that certainty and celerity associated with deterrent sanctions increase compliance intentions, while inertia decreases respondents' compliance intentions related to modified information security policies. Therefore, organizations must work to overcome employees' reluctance to change in order to improve compliance with security policy modifications. They may also consider implementing certain and timely sanctions for noncompliance.

The effect of personal information security attitude and perceived company information security policy on mobile banking acceptance

The effect of personal information security attitude and perceived company information security policy on mobile banking acceptance

Toward a better understanding of SMB CEOs' Information Security Behavior: Insights from Threat or Coping appraisal

This study presents an empirical investigation of factors affecting SMB CEOs decision to improve or not their company's information security (ISS). We developed a research model by adopting the protection motivation theory (PMT) to investigate the effect of threat and coping appraisal on protective actions. We conducted a questionnaire-based survey with SMB CEOs. Prior studies using PMT have never been focused on SMB CEOs behavior, and we postulate that in SMBs where there is no CIO or even IT people, CEO’s actions are of utmost importance for achieving a satisfying ISS.

Enabling remote working: protecting the network

Businesses in London, particularly those near to the Olympic Games in 2012, may need to look at alternative ways of working during this busy period. Remote working and flexible hours for employees may help to keep businesses productive but this should not be at the expense of the company's information security protection. So what do you need to take into consideration when looking for software solutions that will help accommodate remote working without compromising security?

국가 정보보호 지수 산출을 위한 OLAP 데이터베이스 시스템의 구축

UN, OECD, ITU 등 국제기구들은 정기적으로 정보 정책을 수립하고 평가하는데 활용하기 위한 목적으로 정보화 지수를 발표한다. 정보화 지수는 국가의 정보 정책의 수행능력을 평가하고 미래에 진행할 정부의 정보화 프로젝트를 선택하기 위한 기준으로서 활용된다. 정보 시스템이 고도화됨에 따라 이와 더불어 정보보안 역시 그 중요성이 부각되고 있는 실정이고, 이에 따라 국가 정보보호 지수의 산출이 필요하게 되었다. 정보 보안 지수는 특정 그룹의 정보 보안의 특성을 가장 명확하게 표현하는 공식 수치 값이며, 이는 정부의 정보 보안 정책을 결정하는데 이용된다. 국가 정보보호 지수를 산출하는 데에는 현재 설문지 조사방법이 사용되고 있는데, 이 방법으로는 충분한 통계 자료를 확보하기 어려우며 그 자료의 신뢰성 또한 높지 않다는 문제점이 존재한다. 본 연구에서는 이를 해결하기 위해 기존의 설문지 조사방법이 아닌 개별 기업의 정보보호 수준에 관한 원시데이터를 정확하게 수집할 수 있는 새로운 방법을 제시하고, 다음으로 원시데이터를 근간으로 하여 머크로 데이터를 얻어 정책 의사결정을 할 수 있는 OLAP 데이터베이스 시스템을 구축하는 것에 목적을 두고 있다. 현 OLAP 체제에서는 모든 계층구조 스키마가 분배적으로 되는 경우에만 제대로 집계데이터를 구할 수 있기 때문에 본 연구에서는 사례의 비 분배적 계층구조 스키마를 분배적 스키마로 변환하여 국가 정보보호 지수를 산출하는 OLAP 데이터베이스 시스템을 구축하였다. 본 연구에서 제안하는 방법은 구현의 관점과 스키마 설계의 관점에서 볼 때에 유용한 방법이 되리라 생각한다. UN, OECD, ITU and other international organizations regularly announce ISI (Information Society Index) to utilize in establishing and evaluating information policies. ISI is utilized as important data for countries to evaluate their information policy performance and select future projects. As the advancement of information systems, the importance of information security has been emerged. Accordingly, NISI (National Information Security Index) has been required. NISI number is the most clearly figure to express the characteristics of a particular group's information security. It can be utilized in determining information security policies. Currently, questionnaire method has been used to calculate NISI number. But there is an absolute lack of statistical data, and the reliability of surveyed statistical data is problematic. The objective of this paper is to show how to collect precise micro data of each company's information security index numbers, and to develop an OLAP database system which calculating NISI numbers by using those micro data. In this process of the survey, we presented the technique to collect the data more systematically, and to analyze the data without using questionnaire method. OLAP architecture performs only well on the facts that are summarizable along each dimension, where all hierarchy schemas are distributive. Therefore we transformed the non-distributive hierarchy schema into the distributive hierarchy schema to implement OLAP database system. It is thought that this approach will be useful one from an implementation and schema design point of view.

A practical guide to biometric security technology

As organizations search for more secure authentication methods for user access, e-commerce. and other security applications, biometrics is gaining increasing attention. But should your company use biometrics? And, if so, which ones should you use and how do you choose them? There is no one best biometric technology. Different applications require different biometrics. To select the right biometric for your situation, you will need to navigate through some complex vendor products and keep an eye on future developments in technology and standards. Your options have never been more diverse. After years of research and development, vendors now have several products to offer. Some are relatively immature, having only recently become commercially available, but even these can substantially improve your company's information security posture. We briefly describe some emerging biometric technologies to help guide your decision making.