Effective Information Security Management Research Articles

Business Process Outsourcing 14 Cybersecurity KPIs Towards a Strategic Information Security

In today’s rapidly evolving digital landscape, the Business Process Outsourcing (BPO) industry faces an ever-increasing threat of cyber-attacks and data breaches, underscoring the critical importance of robust information security practices. To address these challenges, organizations must develop effective strategic information security, supported by reliable performance measurement tools such as Key Performance Indicators (KPIs). This research aims to investigate the information security implemented by BPO companies and their utilization of the 14 cybersecurity KPIs to track and enhance their information security measures. A mixed-methods strategy is used in the study, integrating qualitative and quantitative techniques. The qualitative component involves thematic analysis of key informant interviews, while the quantitative component entails the analysis of Likert-scale questionnaires and numerical data. The findings of this research provide valuable insights into the significance of strategic information security in achieving effective information security management within the BPO industry. The study reveals the specific elements incorporated in these plans, such as risk assessment methodologies, security controls implementation, employee training, incident response strategies, and compliance measures. The implications of this study offer valuable insights for BPO organizations to develop robust strategic information security tailored to their specific context, ensuring effective alignment with organizational objectives and risk management strategies. Moreover, the research contributes to the existing literature on information security management frameworks, emphasizing the role of cybersecurity KPIs in evaluating security performance. Keywords: cybersecurity, information security, KPI, business process outsourcing industry, information security management

Issues of formation of the organizational and functional structure of the information security management system of a significant object of critical information infrastructure

In the era of avalanche-like development of information technologies and their instant introduction into all spheres of human life, the issue of ensuring the security of these systems is acute. For organizations whose assets are scattered throughout the territory of the Russian Federation, as well as abroad, there is an urgent need to ensure effective information security management, in view of the large number of information assets, as well as means of protection, often inconsistent or poorly coordinated with each other. To solve this task, within the framework of this work, a model was developed for the implementation of the organizational and functional structure of the information security management system for significant CII facilities. This model is not the final point, it is necessary to work on the development of several possible options for building the system, as well as to evaluate the effectiveness of the results obtained.

The WIRELESS COMPUTER NETWORK MANAGEMENT SECURITY ANALYSIS

The use of a wireless computer network in some institutions has become a very flexible option to connect all users of the existing computer network in the institution. This flexibility also has the disadvantage that anyone with a network password can take advantage of the wireless network. The possibility of threats to information security is very large, such as the presence of intruders on the network. Therefore, it is necessary to manage wireless networks that pay attention to information security issues on the network. The Directorate General of New, Renewable Energy and Energy Conservation at the Ministry of Energy and the Human Resources Republic of Indonesia was chosen as the research location given that computer network users in this institution are diverse and have also used The Dude MikroTik application to manage wireless computer networks, which are instruments to analyze information security. in this institution. The analysis was conducted to identify the activities and effectiveness of information security management in this institution. This study concludes that the use of The Dude MikroTik application is quite helpful in analyzing information security on wireless computer networks in this institution.

Impact of Information Security Management System on Firm Financial Performance: Perspective of Corporate Reputation and Branding

The immense organizational emphasis on information technology (IT), combined with the growing impact of information security issues, has inflated information security to the top list of management’s priorities. The ISO 27001 standard defines the requirements for an effective information security management system (ISMS). However, the implementation of ISMS not only maximizes firm performance directly, but it can also have a significant impact in different contexts. We investigated whether ISMS implementation can benefit organizations financially by contributing to corporate reputation and branding in this study. With samples from 171 Pakistani firms, we examined firm performance after ISMS ISO 27001 certification. Compatible with our expectations, we discovered strong evidence that ISMS implementation benefited certified firms in terms of high corporate reputation, brand and branding, and financial performance.

ДЕТЕРМІНАНТИ УСПІХУ МЕНЕДЖМЕНТУ ІНФОРМАЦІЙНОЇ БЕЗПЕКИ МАЛОГО ТА СЕРЕДНЬОГО БІЗНЕСУ

Today poses new challenges in the field of information security for businesses, including E CO N O MI CS AND MA NA G E M E NT OF E NT E RPR IS ES Issue III (83), 2021 81 small and medium. Intangible assets are becoming increasingly important, and new information threats are emerging. Building an information security management system allows businesses be prepared for threats and develop successfully. The purpose of the study is to study and substantiate the success factors of the information security management system of small and medium-sized enterprises (SMEs) in Ukraine. Constructing the logic and structure of the article, we used the method of structural- logical analysis. Methods of grouping and systematization, analysis and synthesis are used to generalize approaches to determining the key success factors of the management system. A systematic method of research and observation was used to form a list of problems, needs and threats of the information environment of SMEs. Study has shown that there is an urgent need for small and medium-sized businesses to use an effective information security management system in their activities, which should be an integral part of overall management. The need for information security management is dictated by two types of threats: the threat of actually dangerous information and the threat of using (influencing) dangerous information technologies. The general and specific needs and problems in information security management at domestic enterprises are substantiated, including protection of business functionality, safe operation of programs and applications, data protection, protection of technological assets of the business. Rapid overcoming of these problems by building an information security management system is possible only if one understands and takes into account the key success factors of such a system. Success factors should reveal the classic functions of management: the success of planning, the success of the organization, the success of motivation, the success of control. Another key success factor can be taking into account the factors significantly influencing the information security culture formation and adoption by the SMEs. Building an information security system in the enterprise based on key success factors allows the entity to achieve a dynamic balance with the external environment and be prepared for possible potentially negative events. A further direction of the research should be the search for and substantiating specific components of these success factors, their detailing and study of the mechanisms of implementation in the SME management practice.

The impact of information security initiatives on supply chain robustness and performance: an empirical study

PurposeInformation security is an essential element in all business activities. The damage to businesses from information security breaches has become pervasive. The scope of information security has widened as information has become a critical supply chain asset, making it more important to protect the organization’s data. Today’s global supply chains rely upon the speedy and robust dissemination of information among supply chain partners. Hence, processing of accurate supply chain information is quintessential to ensure the robustness and performance of supply chains. An effective information security management (ISM) is deemed to ensure the robustness of supply chains. The purpose of the paper is to examine the impact of information security initiatives on supply chain robustness and performance.Design/methodology/approachBased on extant literature, a research model was developed and validated using a questionnaire survey instrument administered among information systems/information technology managers. Data collected were analyzed using exploratory and confirmatory factor analysis. Further, to test the hypotheses and to fit the theoretical model, Structural equation modeling techniques were used.FindingsResults of this study indicated that information security initiatives are positively associated with supply chain robustness and performance. These initiatives are likely to enhance the robustness and performance of the supply chains.Originality/valueWith the advancements in internet technologies and capabilities as well as considering the dynamic environment of supply chains, this study is relevant in terms of the capability that an organization needs to acquire with regards to ISM. Benefiting from the resource dependency theory, information security initiatives could be considered as a critical resource having an influence on the internal and external environment of supply chains.

Determining the Probability of Cyberattacks

Abstract The use of information is inextricably linked with its security. The presence of vulnerabilities enables a third party to breach the security of information. Threat modeling helps to identify those infrastructures, which would be most likely exposed to cyberattacks. In some cases, however, threat modeling can not be classified as sufficient method of protection. This paper entitled “Determining the probability of cyberattacks” presents an analysis of different techniques with an attempt to identify the most informative parameters and cyberattack prediction markers, which would lay the foundation for the development of cyberattack probability functions. Next, it would be relevant to design such cyberattack probability functions, which would be used upon the initial identification of a cyberattack. The findings of this research could be applied during the future assessment of risk levels of information systems to ensure more effective information security management.

Управління інформаційною безпекою виробництва

The article actualizes the problem of reliability of enterprise information. The methodological bases of construction and implementation of the information security management system of the company are considered. In accordance with the established purpose of this work, approaches to ensure safe management of information system mechanisms are identified. Solutions have been identified that make it possible to protect information transmitted in domestic and foreign markets. The systems that help automate the functioning of the organization's processes are considered. Based on international standards and the analysis of modern approaches to defining the essence of the information system management model, the key stages of creating an effective information security management system for business processes are proposed.

Understanding human aspects for an effective information security management implementation

Understanding human aspects for an effective information security management implementation

Information security management frameworks and strategies in higher education institutions: a systematic review

Effective information security management (ISM) practices to protect the information assets of organizations from security intrusions and attacks is imperative. In that sense, a systematic literature review of academic articles focused on ISM in higher education institutions (HEIs) is conducted. For this purpose, an empirical study was performed. Studies carried out from 2012 onward reporting results from HEIs data that perform the ISM through various means, such as a set of framework functions, implementation phases, infrastructure services, and securities to their assets, have been explored. The articles found were then analyzed following a methodological procedure consisting of a systematic mapping study with their research questions, inclusion and exclusion criteria, selection of digital libraries, and analysis of the respective search strings. A set of competencies, resources, directives, and strategies that contribute to designing and to developing an ISM framework (ISMF) for HEIs is identified based on standards such as ISO 27000, COBIT, ITIL, NIST, and EDUCAUSE. This study introduces a strategic reference that guides HEIs on the development of an ISMF and provides recommendations that should be considered for its implementation in an era of ever-evolving security threats.

Improvement of the Regulatory Framework of Information Security for Terminal Access Devices of the State Information System

The aim of the study is to increase the effectiveness of information security management for state information systems (SIS) with terminal access devices by improving regulatory legal acts that should be logically interconnected and not contradict each other, as well as use a single professional thesaurus that allows understanding and describe information security processes.Currently, state information systems with terminal access devices are used to ensure the realization of the legitimate interests of citizens in information interaction with public authorities [1].One of the types of such systems are public systems [2]. They are designed to provide electronic services to citizens, such as paying taxes, obtaining certificates, filing of applications and other information. The processed personal data may belong to special, biometric, publicly available and other categories [3]. Various categories of personal data, concentrated in a large volume about a large number of citizens, can lead to significant damage as a result of their leakage, which means that this creates information risks.There are several basic types of architectures of state information systems: systems based on the “thin clientpeer-to-peer network systems; file server systems; data processing centers; systems with remote user access; the use of different types of operating systems (heterogeneity of the environment); use of applications independent of operating systems; use of dedicated communication channels [4]. Such diversity and heterogeneity of state information systems, on the one hand, and the need for high-quality state regulation in the field of information security in these systems, on the other hand, require the study and development of legal acts that take into account primarily the features of systems that have a typical modern architecture of “thin customer". Materials and research methods. The protection of the state information system is regulated by a large number of legal acts that are constantly being improved with changes and additions to the content. At the substantive level, it includes many stages, such as the formation of SIS requirements, the development of a security system, its implementation, and certification. The protected information is processed in order to enforce the law and ensure the functioning of the authorities. The need to protect confidential information is determined by the legislation of the Russian Federation [5, 6]. Therefore, to assess the quality of the regulatory framework of information security for terminal access devices of the state information system, the analysis of the main regulatory legal acts is carried out and on the basis of it, proposals are developed by analogy to improve existing regulatory documents in the field of information security.Results. The paper has developed proposals for improving the regulatory framework of information security for terminal access devices of the state information system- for uniformity and unification, the terms with corresponding definitions are justified for their establishment in the documents of the Federal Service for Technical and Export Control (FSTEC) or Rosstandart;- rules for the formation of requirements for terminals, which should be equivalent requirements for computer equipment in the “Concept for the protection of computer equipment and automated systems from unauthorized access to information ".Conclusion. General recommendations on information protection in state information systems using the “thin client" architecture are proposed, specific threats that are absent in the FSTEC threat bank are justified, and directions for further information security for the class of state information systems under consideration are identified. Due to the large number of stakeholders involved in the coordination and development of unified solutions, a more specific consideration of the problems and issues raised is possible only with the participation of representatives of authorized federal executive bodies and business representatives for discussion.

Синкретичність менеджменту цифрових ризиків та інформаційної безпеки

The role of business digitalization in the context of permanent changes in the marketing environment is determined. The key blocks of business digitalization that allow us quickly and timely respond to market requests, the needs of online shoppers are identified and interpreted. The satisfaction of market requests and needs of online shoppers is an important component of successful activity in the online space. The dependence between the digital business competitiveness and the ability of rational innovative technological approaches implementation in practice is proved. The significance of the correct implementation of innovative technological business approaches for the digital business stable development in modern realities is justified. In sampling acceptable alternative administrative decisions, the author proposes five contours of adaptation and/or sequestering of the complex of marketing programs and activities. The author provides recommendations on how to take into account relevant references when arguing and justifying digital business, which will contribute to the design of the digital endogenous ecosystem and ensure long-term business development. It is determined that the information protection provision is a participatory priority in the digital business development. It is substantiated that the digital business complementarily considers the use of heterogeneous methods of implementing innovative technologies, which determine the different directions of IT flows. The author formulates the guidelines for digital risk and information security management that are unified for implementation in the unstable conditions of digital transformation. The implementation in practice of these directives provides for the readiness of the digital business to adapt to the changing marketing environment, and contributes not only to the internal transformation of the digital business, but also to attract new investments for effective digital risk and information security management.

Review the implementation of information security management system requirements in hospitals of Tabriz in East Azarbaijan

The purpose of this study was to investigate and analyze the assumptions and requirements for the implementation of Information Security Management System (ISMS). Methodology: To check assumptions security management system implementation is the population of Tabriz hospitals. Review the requirements and assumptions are based on the standard ISO / IEC 27001, ISO / IEC 27002 test target setting and ISO 27001 standard questionnaire containing 33 questions in 11 control is used. The data were analyzed using descriptive and inferential statistical method that factors in the implementation of information security management system was confirmed. As well as to identify factors contributing to the implementation of information security management system and factor analysis, structural equation model was used PLS smart software that based on its findings to impact and indirect aspects of implementation effectiveness of the system. Results: Using the software, smart-PLS and using structural equation modeling confirmatory factor analysis was performed to measure the test of convergent validity, divergent validity, reliability Security and reliability of observable variables and quality test and measurement model of the 101 comments experts, all the prerequisites and requirements, including information security policy, the organization of information security, asset management, human resources in terms of security, physical and environmental security, communications and operations management, access control, use, development and maintenance, incident management information security, business continuity management and compliance with laws in secure level at %99 is forecast in Tabriz hospitals are effective information security management system. Conclusion: According to prioritize the factors affecting information security management system, operating (after) the most monitors and agents (after) the supply and implementation of information security management system least affected are in Tabriz hospitals.

Check assumptions and requirements for the implementation of Information Security Management System hospital in Tabriz

the purpose of this study was to investigate and analyze the assumptions and requirements for the implementation of Information Security Management System (ISMS). Methodology: To check assumptions security management system implementation is the population of Tabriz hospitals. Because information security, is considered most hospitals cooperate and only 8 hospitals of Tabriz, as the population of the study. Review the requirements and assumptions are based on the standard ISO / IEC 27001, ISO / IEC 27002 test target setting and ISO 27001 standard questionnaire containing 33 questions in 11 control is used. To analyze the data descriptive and inferential statistical methods were used that implementation of information security management system was confirmed. As well as to identify factors affecting the implementation of information security management system and factor analysis, structural equation model was used PLS smart software that based on its findings indirectly relates to impact the four dimensions of implementation effectiveness of the system. The study findings were presented. Results: Using the software, smart-PLS and using structural equation modeling confirmatory factor analysis was performed to measure the test of convergent validity, divergent validity, reliability Security and reliability of observable variables and quality test and measurement model of the 101 comments experts, all the prerequisites and requirements, including information security policy, the organization of information security, asset management, human resources in terms of security, physical and environmental security, communications and operations management, access control, use, development and maintenance, incident management information security, business continuity management and compliance with laws Brpyadh at 99 per cent is forecast in Tabriz hospitals are effective information security management system. Conclusion: According to prioritize the factors affecting Brpyadh information security management system, operating (after) the most monitors and agents (after) the supply and implementation of information security management system Brpyadh least affected are in Tabriz hospitals.

The study of promising secure information systems based on signal modeling

The aim of the study is to increase the effectiveness of information security management through the use of 5G networks. The transition to the fifth-generation network does not solve the existing problems of information security and leads to the emergence of new threats. The main objective of each modulation method of signals is to ensure high bandwidth, proper transmission quality in a noisy communication channel, using the minimum amount of energy. One of the most effective indicators of increasing the level of information security in wireless networks is quadrature modulation, which is used in such networks as: LTE, WiMAX, McWill, DVB-T (T2), Wi-Fi and other radio access networks [1].One of the promising directions for the development of 5G networks is the use of higher frequency ranges, such as the range of millimeter waves (from 30 to 300 GHz) [2, 3]. A feature of the millimeter wave range is that they provide much wider spectral bands, making it possible to significantly increase the bandwidth in the channels. Thus, when studying prospective protected information systems based on the use of 5G network technology, it is advisable to use a simulation of the signals of the channel-level interaction of subscribers, which allows you to evaluate the basic security parameters at the physical level.Materials and research methods. Fifth generation networks will simultaneously look like any previous generation of mobile networks, and at the same time they will differ significantly from them – and there are a number of explanations that become more obvious if you think about how these changes affect the principles of user and equipment safety networks of the fifth generation.Widespread in the field of digital information transmission, including 5G networks, has received combinational modulation, called quadrature amplitude modulation.Multiposition signals have the greatest spectral efficiency, of which four-position phase modulation and sixteen-position quadrature amplitude modulation are most often used.The quadrature amplitude modulation is a kind of multi-position amplitude-phase modulation, in addition to the phase, the amplitude of the signal for a given type of modulation will also carry information. This leads to the fact that for a given frequency band the amount of transmitted information increases.A brief overview of the existing modulation approaches is presented OFDM (english. Orthogonal frequency-division multiplexing) [4, 5] systems and methods for forming solutions of signal modulation problems for building such systems/Results. Currently, OFDM technology is widely used in modern wireless Internet systems. High data transfer rates in OFDM systems are achieved using parallel information transfer over a large number of orthogonal frequency subchannels (subcarriers) [6].The method of synthesizing signal-code constructions with orthogonal frequency multiplexing provides for different scenarios for the use of semi-square modulation depending on the requirements for interception protection, as well as balancing between spectral and energy efficiency. This method can be used in two cases: with alternative and consistent transmission of signals. In the case of alternative transmission, only one of the four subcarriers is used during one channel interval. For efficient use of bandwidth, the proposed method involves the use of the spectrum of three other subcarriers for data transmission in D2D channels (this creates a connection between two user devices that are in close proximity), which allows you to further avoid interference between fixed channels and D2D communication channels.Findings. At present, 5G networks can be considered as one of the necessary components of the digital transformation and digital economy, while the main task in ensuring security in cellular communications is protection against eavesdropping. However, in the future world of smartphones and the Internet of things, in environments with a large number of mechanisms, the probability of listening is likely to fade into the background. Instead, you have to think about such things as data manipulation attacks, which, for example, can be used to command the mechanisms to perform certain actions (for example, open the door or take control of an unmanned vehicle). Mobile network operators, like consumer electronics manufacturers, will be able to offer “security as a service,” with the result that application providers will be able to apply additional levels of security over existing secure cellular network channels when transferring certain types of data. [7] Due to the better spectral density, the proposed signal conditioning method makes it possible to use prototypes of window functions with the best spatial localization properties without violating the orthogonality condition of the signal bases, and accordingly does not require the use of cyclic prefixes when generating the OFDM signal.

Threat Analysis for Wearable Health Devices and Environment Monitoring Internet of Things Integration System

With the rapid development of Internet of Things (IoT) applications, heterogeneous device management issues tend to arise in architecture security due to hardware computing power, types of software, data transmission interfaces, and networking protocols. Even during data exchange between devices and systems, traditional IoT devices are prone to the disclosure of personal information, which compromises privacy. Thus, planning an effective information security management strategy has become an essential part of application development. This paper presents a strategy to achieve information security verification and risk assessment for an IoT-based personal health information system. Using several interfaces of IoT devices, including Wi-Fi and Bluetooth, we simulate possible attack hypotheses and define test methods and evaluation methods suitable for each device. In our application systems for information security analysis, we also consider and integrate weaknesses of the system architecture to achieve a more complete information security threat analysis.

Seven Pieces of Advice to Improve Your Information Security

Establishing and operating an effective information security management system within an organization is never an easy job. Organizational culture, management support, budget restrictions and many other factors affect the security efforts of a company. Although the information security academic literature is growing, there is no clear guidance in several fields of the topic, therefore the life-tested best practices can be a useful aid in operating such systems. The aim of this paper is to provide a short guidance regarding the basic steps of a beginner information security manager, and maybe to give some useful thoughts to the experienced officers, as well.

Does CIO risk appetite matter? Evidence from information security breach incidents

After a series of recent high-profile information security breach incidents, practitioners have engaged in heated debates about the role of the chief information officer (CIO), particularly his/her role in information security risk management. However, little is known in the academic literature about how a CIO's appetite for risk affects the effectiveness of information security management. We address this gap by examining how a CIO's risk appetite is associated with information security breach incidents. We show that the level of CIO risk aversion is negatively associated with the likelihood of breach incidents. Furthermore, we find that this association is stronger if the company's chief executive officer (CEO) is also risk averse. In additional analyses, we show that the relationship between CIO risk aversion and breach incidents varies depending on breach type and the strategic position of the company and is moderated by the CIO's power.

Strategic value alignment for information security management: a critical success factor analysis

PurposeEffective information security management is a strategic issue for organizations to safeguard their information resources. Strategic value alignment is a proactive approach to manage value conflict in information security management. Applying a critical success factor (CSF) analysis approach, this paper aims to propose a CSF model based on a strategic alignment approach and test a model of the main factors that contributes to the success of information security management.Design/methodology/approachA theoretical model was proposed and empirically tested with data collected from a survey of managers who were involved in decision-making regarding their companies’ information security (N = 219). The research model was validated using partial least squares structural equation modeling approach.FindingsOverall, the model was successful in capturing the main antecedents of information security management performance. The results suggest that with business alignment, top management support and organizational awareness of security risks and controls, effective information security controls can be developed, resulting in successful information security management.Originality/valueFindings from this study provide several important contributions to both theory and practice. The theoretical model identifies and verifies key factors that impact the success of information security management at the organizational level from a strategic management perspective. It provides practical guidelines for organizations to make more effective information security management.

Considerations on the implementation steps for an information security management system

Abstract News about various information security attacks against companies appears almost every day. The sources of these attacks vary from cyber-criminals who want to steal companies’ data to demand a ransom, to current or former employees who want to create damage to the organization. The best way to defend organizational critical assets is to implement an Information Security Management System that secures all sensitive assets from confidentiality, availability and integrity perspective. An Information Security Management System offers top management a framework for sensitive information flow control. This framework includes with a risk assessment that considers the security threats and vulnerabilities of the company’s assets. Companies usually implement Information Security Management System only after they have a functional quality management system, which brings clarity and optimization to the company’s processes. Current approaches on creation and implementation of effective Information Security Management System are very theoretical and thus difficult to use in practice. The main objective of this paper is to present an Information Security Management System implementation method in the case of a small company by defining the basic steps in achieving a fully functional Information Security Management System. The proposed methodology considers the top management Information Security Management System objectives, organizational context, risks assessment and third parties expectations fulfillment.