Enterprise Information Security Management Research Articles

The impact of information security management guide utilization on technological and institutional information security measures in university libraries in Türkiye

The study examined whether the levels of technological and institutional information security measures implemented in university libraries in Türkiye differ based on the usage of a corporate information security management guide. The study was conducted through a literature review and survey method in a total of 199 university libraries in Turkey actively operating in 2023, comprising 124 state universities and 75 private universities. To ensure the contributions of all university libraries population was obtained in a homogeneous manner, a purposive sampling method was used, collecting data from one staff member from each university library.The findings reveal that there are significant differences (p < 0.05) in the levels of both technological and institutional information security measures, depending on the presence and utilization of a corporate information security management guide in university libraries. These findings demonstrated that an enterprise information security management tool is effective in influencing information security practices in university libraries. This result confirmed the hypothesis that there are significant differences in the implementation levels of technological and institutional information security measures based on the presence and usage of an enterprise information security management tool in university libraries in Turkey.Considering the lack of comprehensive studies on information security management in university libraries in Turkey, this research demonstrates its uniqueness by approaching the topic with a holistic approach.

The Application of Big Data and Artificial Intelligence Technology in Enterprise Information Security Management and Risk Assessment

With the development of digitalization and Internet technology, enterprise information security is facing more and more challenges. Many enterprises have begun to adopt big data (BD) and artificial intelligence (AI) technology for risk assessment (RA) and prediction to effectively manage information security risks. This article discusses the application of BD and AI technology in enterprise information security management (ISM) and RA from two aspects. Firstly, the mobile payment signature scheme based on number theory research unit is used to improve the security of the mobile payment system. This scheme uses lattice algorithms to achieve fast key generation, signing, and verification and can resist traditional cryptographic attacks. Secondly, a set of enterprise ISM and RA system is established, including risk identification, RA, monitoring and early warning, emergency response, and other links. BD and AI technology is used to analyze internal and external data to provide accurate RA results to achieve automated RA.

Application of Big Data Technology in Enterprise Information Security Management and Risk Assessment

Nowadays, the application of enterprise management information has been deeply rooted in daily business activities, and the management risk of enterprise information security (EIS) has also increased. The use of advanced means to provide security protection for it has become the top priority. To optimize the EIS management system, and carry on the risk assessment (RA), firstly, this study analyzes the current situation of the enterprise's internal information management and summarizes the shortcomings and security risks faced by the system. In the era of big data (BD), the security risks of database information systems show a diversified trend. Secondly, to explore the application of BD technology in EIS management, the characteristics of this technology and security control measures for risks are summarized to strengthen the enterprise's information management innovation and implement the application of data security technology.

Peculiarities of the Functional Approach to the Management of Information Security of Enterprises in Crisis Conditions

The paper identifies the relevance of the problem under study with regard to the development of information security management systems for enterprises and organizations. This issue is of particular importance in the context of economic crisis. With the active development of the latest information and communication technologies, general computerization, information security is becoming a key characteristic of enterprise information systems The problems of using a functional approach in the formation of information security management systems for enterprises in crisis conditions are considered. The essence of the information danger of enterprises in crisis conditions is analyzed. It is proposed that the process of forming an integrated information security management system should be carried out on the basis of a comprehensive functional approach. A conceptual model of enterprise information security management in crisis conditions based on the functional approach is built. This model will help to increase the level of information and economic security of enterprise. This model will help to increase the level of information and economic security of an enterprise. The proposed methodology for building enterprise information security management systems, which is formed on the basis of a functional approach, should provide a reliable level of protection of information and communications of an enterprise. This will be achieved through continuous monitoring of the information environment (threats, dangers, challenges, etc.), constant monitoring of the information and communication activities of an enterprise, forecasting of information security (in particular, the risks that will affect it), etc. The result of the formation and application of the enterprise information security management system based on the functional approach is the formation of a comprehensive, balanced, effective and flexible information security system that will take into account all the features of the application of measures to protect the enterprise from negative information and communication influences, protect information arrays (data), information and intellectual rights, and provide open access to information resources of employees.

Risk Assessment of Insider Threats Based on IHFACS-BN

Insider threats, as one of the pressing challenges that threaten an organization’s information assets, usually result in considerable losses to the business. It is necessary to explore the key human factors that enterprise information security management should focus on preventing to reduce the probability of insider threats effectively. This paper first puts forward the improved Human Factors Analysis and Classification System (IHFACS) based on actual enterprise management. Then, the enterprise internal threat risk assessment model is constructed using the Bayesian network, expert evaluation, and fuzzy set theory. Forty-three classic insider threat cases from China, the United States, and Israel during 2009–2021 are selected as samples. Then, reasoning and sensitivity analysis recognizes the top 10 most critical human factors of the accident and the most likely causal chain of unsafe acts. The result shows that the most unsafe behavior was not assessing employees’ familiarity with the company’s internal security policies. In addition, improving the organizational impact of information security can effectively reduce internal threats and promote the sustainable development of enterprises.

An Investigation of Employees’ Intention to Comply with Information Security System—A Mixed Approach Based on Regression Analysis and fsQCA

Employee security compliance behavior has become an important safeguard to protect the security of corporate information assets. Focusing on human factors, this paper discusses how to regulate and guide employees' compliance with information security systems through effective methods. Based on protection motivation theory (PMT), a model of employees' intention to comply with the information security system was constructed. A questionnaire survey was adopted to obtain 224 valid data points, and SPSS 26.0 was applied to verify the hypotheses underlying the research model. Then, based on the results of a regression analysis, fuzzy set qualitative comparative analysis (fsQCA) was used to explore the conditional configurations that affect employees' intention to comply with the information security system from a holistic perspective. The empirical results demonstrated that perceived severity, perceived vulnerability, response efficacy, and self-efficacy all positively influenced the employees' intention to comply with the information security system; while rewards and response costs had a negative effect. Threat appraisal had a greater effect on employees' intention to comply with the information security system compared to response appraisal. The fsQCA results showed that individual antecedent conditions are not necessary to influence employees' intention to comply with an information security system. Seven pathways exist that influence an employees' intention to comply with an information security system, with reward, self-efficacy, and response cost being the core conditions having the highest probability of occurring in each configuration of pathways, and with perceived severity and self-efficacy appearing in the core conditions of configurations with an original coverage greater than 40%. Theoretically, this study discusses the influence of the elements of PMT on employees' intention to comply with an information security system, reveals the mechanism of influence of the combination of the influencing factors on the outcome variables, and identifies the core factors and auxiliary factors in the condition configurations, providing a new broader perspective for the study of information security compliance behavior and providing some theoretical support for strengthening enterprise security management. Practically, targeted suggestions are proposed based on the research results, to increase the intention of enterprise employees to comply with information security systems, thereby improving the effectiveness of enterprise information security management and the degree of information security in enterprises.

Networked Organizational Structure of Enterprise Information Security Management Based on Digital Transformation and Genetic Algorithm.

With the rapid development of society and economy, enterprises have also started digital transformation in order to follow the pace. Now-a-days, the development of enterprises is also faced with the risk of improper management of enterprise information security, so it is very necessary to study the networked organizational structure of enterprise information security management. The purpose of this paper is to study how to analyze the network organization structure of enterprise information security management based on genetic algorithm. This paper puts forward the difficult problems faced by enterprise information security, and how to prevent and solve the risks encountered in information security. In the experimental part of this paper, it can be seen that with the increase of the number of experiments, the work efficiency of the traditional network organization structure has increased from about 4.6 to about 17%. The work efficiency of the network organization structure based on genetic algorithm has risen from about 10 to about 50%. It shows that the work efficiency of the network organization structure based on genetic algorithm is much higher than that of the traditional network organization structure. It can be seen that the advantage percentage of enterprise information security management networked organizational structure with strong room for growth is 79–84%, and the percentage of cost savings is 75–82%. It can be seen that there are still many advantages of the networked organizational structure of enterprise information security management. The network organization structure based on genetic algorithm can not only improve the work efficiency of enterprises, but also improve the information security. Therefore, the network organization structure based on genetic algorithm is of great significance to the enterprise information security.

Enterprise Information Security Management Using Internet of Things Combined with Artificial Intelligence Technology

This work is conducted to deal with the information security of enterprise management under the background of current global informatization, popularize the modern Internet of Things (IoT) management technology of enterprises, and maintain the information security of enterprises and provide modern upgrading means for enterprise management. In this work, it firstly introduces the application scenarios of current Internet and Artificial Intelligence (AI) technology and expounds the IoT technology. Secondly, the enterprise management platform is designed, the requirements of enterprise modern management are analyzed, and then the design requirements of system functions and the design of the information security architecture of the IoT are proposed. Furthermore, an enterprise information security management platform is designed, which covers four parts: IoT data mining management, equipment management, key management, and database management. In addition, the performance of the security management platform is tested from four parts: concurrency testing, stress testing, large data volume testing, and security testing. The research results show that the IoT-based enterprise information security management platform designed in this work under the background of AI has perfect functions and stable performance of each module. Concurrency testing, stress testing, large data volume testing, and stability testing are performed on it, and the success rate of the platform in each task reaches 100%. The average response time of concurrent testing and stress testing is about 0.13 seconds, and that of the event entry events is 0.25 seconds. The central processing unit (CPU) occupancy rate in each monitoring task is always lower than 20%. Therefore, it is determined that the performance of the IoT-based enterprise information security management platform designed in this work is sufficient to meet the daily management of enterprises. This work can provide a guarantee for enterprise information security management using AI technology, setting an example for future related research.

Assessment of confidentiality risks of information security of projects based on fuzzy logic

One of the main components of enterprise information security management is its risk assessment. This is especially true for critical infrastructure enterprises and their business partners, including construction companies. However, measuring cybersecurity, even with the current skyrocketing costs of cybersecurity, remains an underdeveloped topic, so developing and agreeing on reliable ways to measure its risks and effectiveness is relevant for research. In many industries, the activities of enterprises are of a design nature and information security management must also be implemented within the framework of the project, which requires further research in this area. Given the incompleteness and vagueness of information about the components of information security, fuzzy logic is actively used in risk assessment models. The article proposes an approach for assessing the risks of violating the confidentiality of documents when solving information security problems of projects. The set of project documents is formalized in the form of a generalized hierarchical structure and the relationship of documents with operations and information systems that are used during operations with documents is determined. Based on the formalized structure of documents, a model has been developed for assessing the risk of violating the confidentiality of a document based on fuzzy logic, which allows one to take into account the incompleteness and blurring of data. The results of the work can be used when making decisions on information security measures for projects at enterprises with project activities, including at critical infrastructure enterprises, IT enterprises, construction companies and others. The proposed approaches can serve as a basis for the development of information technologies to automate the assessment of information security risks of projects.

State and enterprise information security management: legal and organizational aspects

The components of the state information policy on information security and the basic activities of public authorities in this field are reviewed in the article. The internal and external information challenges facing Ukraine and ways of ensuring information security are analyzed. Information security is seen as a component of national security, as well as a global problem of information security, information space, information sovereignty and information support decision-making. The article is devoted to the review of approaches to the essence of threats to information security and politico-juridical analysis of threats to information security of Ukraine at the present stage. The threats of information security are analysed in the context of the system of threats of national security. On base of the analysis of the condition normative-legal regulation to information safety of the Ukraine are determined main value and defect in normative field state on provision of information security. The definition of information security of the enterprise is given. The basic goals, objectives, principles and types of threats. At their core formed methodical approach to developing the information security systems of industrial enterprises. The proposed enterprise information security system is regarded as a model of information warfare with the factors of internal and external environment, based on the analysis of modern approaches to the definition of information security, and on a synthesis of theoretical positions and experience of functioning of the organizations. The use of the developed approach the Holy Practice of management of industrial enterprises will help to increase the efficiency of development, implementation and use of information security and prevent system or methodological errors at each stage.

An Evaluation Model of Information Security Management Maturity

In the process of the enterprise information security management in large enterprises, they have been produced the study requirement for information security maturity management evaluation. Here we propose an evaluating model of information security management maturity level, including information security rules, information security planning, information security organization, information security execution results as four aspects of evaluation elements, and a evaluating process with definite responsibility, well-designed rules, clear process and effective implementation, good reviews, the model has been applied in large enterprises and will improve the information security management level.

Data classification and sensitivity estimation for critical asset discovery

Many large-scale data breaches are due to inadequate perimeter protection measures. One way companies can reduce their risk is to build fine-grained perimeters to protect critical assets. To achieve this vision, all assets need to be assigned a sensitivity value that properly indicates their business value and criticality to the organization. Existing classification schemes based on confidentiality, integrity, and availability are not sufficient. To address this need, we have developed Enterprise Information Security Management (EISM), which aims to semi-automatically measure the sensitivity levels of enterprise assets including both data and non-data assets. For the assets for which we can access the data content, we measure the sensitivity of an asset based on the sensitivity of the data by applying content analysis and data classification technologies. For the assets for which we cannot access data content, we score and rank the assets using external information such as the attributes of users and their usage patterns. We have piloted our solutions with a number of real-world cases, including the scanning of employees' laptops, classification of business documents, and sensitivity ranking of servers without relying on data content. The experiments showed promising results, confirming that highly accurate and scalable automatic sensitivity estimation is feasible.

Research on Enterprise Information Security of the ERP System

With the wide application of ERP system in manufacturing enterprises in China, Issues of enterprise information security are becoming increasingly influential. On the basis of elaborating information security and information risk, this article analysis systematically the enterprise information security management system, and explore the key information security problems in ERP environment, and proposed the corresponding countermeasures and suggestions.

Enterprise Information Security Management Based on Context-Aware RBAC and Communication Monitoring Technology

Information technology has an enormous influence in many enterprises. Computers have not only become important devices that people rely on in their daily lives and work, but have also become essential tools for enterprises. More and more enterprises have shifted their focus to how to prevent outer forces from invading and stealing from networks. However, many enterprises have disregarded the significance of internal leaking, which also plays a vital role in information management. This research proposes an information security management approach that is based on context-aware role-based access control (RBAC) and communication monitoring technology, in order to achieve enterprise information security management. In this work, it is suggested that an enterprise may, first, use an organizational chart to list job roles and corresponding permissions. RBAC is a model that focuses on different work tasks and duties. Subsequently, the enterprise may define a security policy to enforce the context-aware RBAC model. Finally, the enterprise may use communication monitoring technology in order to implement information security management. The main contribution of this work is the potential it provides to both reduce information security incidents, such as internal information leakage, and allow for effective cost control of information systems.