Information Security Controls Research Articles

Managing Inherent IT Business Risk against Cyber Threats: a Decision Analysis Case Study of an Oil and Gas Company

XYZ, an anonymized oil and gas company, aims to enhance cyber resilience by strategically managing inherent risk profiles in cybersecurity, aligned with business needs and stakeholder expectations. This research addresses challenges including Information Security Control determination, proficiency improvement in risk management, and ISMS preparedness. Additionally, it tackles procurement strategy for Security Operations Control across XYZ Group, operating under PSC Gross Split, Cost Recovery, and Non-PSC statuses. Utilizing diverse frameworks such as problem tree analysis, stakeholders’ power-interest matrix, MITRE ATT&CK, NIST 800-53, COBIT 2019, ISO 27005:2022, KAMI 5.0, and SMART, data analysis includes risk documents, interviews, and cyber-attack data. The research establishes effective IS Control for risk mitigation, readiness for Information Security Management System ISMS implementation, strategic programs enhancing risk management capability, and refined Security Operations Control procurement. These outcomes, incorporated into a collaborative contract structure, significantly mitigate cyber threats and potential impacts, such as disruptions to operations, revenue reduction, increased costs, data theft, and non-compliance.

ОБЛІК І ВНУТРІШНІЙ КОНТРОЛЬ ЗОБОВ’ЯЗАНЬ ПІДПРИЄМСТВА ЗА РОЗРАХУНКАМИ З КОНТРАГЕНТАМИ

Accounting for a company's obligations in settlements with counterparties is an important and complex part of accounting that affects the company's material interests. This area of accounting is mandatory for any company and requires great attention and accuracy to ensure timely settlements. The article concludes that inventorying a company's obligations in settlements with counterparties is an effective tool that can be used in various cases depending on the circumstances and purpose of the operation. Additionally, inventorying is an effective tool for verifying the accuracy of debt accounting with suppliers and determining the actual state of settlements. It can also be a useful tool for reconciling debts with suppliers and reducing potential misunderstandings or conflicts. During inventorying, opportunities for cost optimization and negotiations with suppliers to reduce costs or revise payment terms can be identified. Furthermore, inventorying can be used as a basis for discussing new delivery terms or expanding credit lines with suppliers if the company plans to negotiate. It is also a useful tool for identifying overdue payments and developing strategies to reduce them. Digitizing the internal control of a company's obligations in settlements with counterparties through a digital platform contributes to increasing the efficiency of the procurement process. The proposed methodology aims to create an integrated internal control system that includes the following aspects: ensuring the availability of information channels, system interfaces, their accuracy, timeliness, and security; ensuring the accuracy, timeliness, completeness, and security of transaction processing within business processes, information channels, and system interfaces; ensuring information security and confidentiality control in accordance with legal requirements and internal standards, etc. The methodology aims to create a comprehensive internal control system that includes ensuring the proper functioning of information channels, system interfaces, transaction processing, information security, and confidentiality control, as well as risk management and ensuring the continuity of organizational activities.

ISO 27001 IN BANKING: AN EVALUATION OF ITS IMPLEMENTATION AND EFFECTIVENESS IN ENHANCING INFORMATION SECURITY

As the banking industry becomes increasingly reliant on digital technologies and faces evolving cyber threats, the adoption of robust information security frameworks is imperative. ISO 27001, a globally recognized standard for information security management systems, has gained prominence as a comprehensive framework for safeguarding sensitive data. This study explores the implementation and effectiveness of ISO 27001 within the banking sector, evaluating its impact on enhancing information security. It delves into the specific challenges and considerations unique to the banking industry, where the confidentiality, integrity, and availability of financial information are paramount. It examines the motivations behind adopting ISO 27001, the process of implementation, and the associated organizational changes required to align with the standard's principles. A critical aspect of the evaluation involves assessing the tangible benefits and outcomes resulting from ISO 27001 implementation. This includes improvements in risk management, incident response capabilities, and the overall resilience of information security controls within banking environments. The study also investigates the role of ISO 27001 in fostering a culture of security awareness among banking employees and stakeholders. Ethical considerations, compliance challenges, and the balance between security and operational efficiency are examined to provide a holistic perspective on the standard's impact. It concludes with insights into the future of ISO 27001 adoption in the banking sector, considering emerging technologies, regulatory developments, and the evolving nature of cyber threats. This research contributes valuable insights into the effectiveness of ISO 27001 as a strategic framework for information security in banking, offering practical implications for industry practitioners, policymakers, and stakeholders invested in fortifying the digital resilience of financial institutions
 Keywords: ISO 27001, Banking, Information Security, Ethical, Financial Institution.

Capability Level Assessments of Information Security Controls: An Empirical Analysis of Practitioners Assessment Capabilities

Integrasi teknologi informasi memainkan peran penting dalam mendukung operasional bisnis di sektor properti. Namun, tantangan signifikan muncul dalam bentuk kebocoran data, terutama terkait dengan informasi pelanggan. Untuk mengatasi masalah ini, penelitian menggunakan kerangka kerja COBIT 2019 untuk menilai kemampuan tata kelola TI perusahaan. Ini melibatkan pendekatan kualitatif dengan memanfaatkan data yang dikumpulkan melalui wawancara dan studi literatur. Penelitian berfokus pada tujuan utama, yaitu APO12 (Managed Risk), APO13 (Managed Security), dan DSS02 (Managed Service Requests and Incidents), semua berkaitan dengan risiko keamanan. Temuan menunjukkan tingkat kemampuan saat ini berada pada level 2, dengan tingkat yang diharapkan mencapai level 4, menandakan adanya kesenjangan sebanyak 2 level. Rekomendasi melibatkan manajemen yang cermat terhadap catatan risiko yang terkait dengan proses bisnis dan sumber daya TI, memastikan pemahaman karyawan terhadap peran mereka dalam manajemen keamanan informasi, serta penyusunan laporan untuk pemantauan permintaan layanan dan penyelesaian insiden.

RİSK MANAGEMENT IN İNFORMATİON EXCHANGE

The field of risk management is one of today's most main fields. Risk-free business is not possible. It is necessary to calculate the risks that arise in every business so that it does not create any problems for us later. Although it is not possible to reduce the risk to zero, it is possible to reduce the risk. One of the most utilised areas of the risk term is the risk of informatisation. Ensuring the confidentiality, integrity and transparency of information is one of today's main problems. For this purpose, some standards and standards have been prepared. Some of these standards are ISO 27001 and ISO 31000. With the widespread use of computer networks and the Internet, Information Security has become very important. Since organisations are mostly dependent on information, technology and systems, Information Security is of vital importance and the need to protect information assets from damage arises from this. On the other hand, many companies still do not take adequate and necessary measures in information security. As a result, many companies, including many large and international organisations, are under serious threat. In order to be able to recognise these threats in advance and to reduce the severity of threats, it is necessary to comply with the Risk Management and the whole of the ISO 27001:2022 standard. Today, organisations face a risk in almost every transaction. It is necessary to identify and evaluate the risks that may arise during the functions of the institutions carefully and in detail in advance and to take measures to minimise or completely eliminate these risks. In this article, the steps to be taken to meet the requirements of ISO 27001:2022 Information Security Management System Risk Management are analysed step by step and a software has been developed to enter the data containing these requirements and receive the relevant reports. In this context, the ISO 27000:2018 family referenced by the ISO 27001:2022 Standard has been examined. The ways in which risk analyses can be performed and how risk improvement can be achieved have been investigated. As a result of the study, all these have been brought together in a software and made reportable. The security structure should be established by taking into account the differences of the organisation and the system. Afterwards information security risk management and methods that are not fully detailed in the standard. A documentation by analysing assets under a corporate information processing structure has been created. To create this structure and at the same time to create a dynamic a basic level of information security control software has been produced to provide control. Keywords: Information, information security, risk, risk management, risk analysis.

Accounting Information Security Control and Satisfaction of Accountants Regarding Accounting Information Systems

This study analyzes the factors affecting accountants’ satisfaction with the accounting information system in Vietnamese enterprises. The research results of this study show that the factors affecting user satisfaction with the accounting information system are directly influenced by four factors: the quality of the accounting workforce, perception of usefulness, system quality, and information quality. The quality of the accounting workforce is the factor that has the greatest direct impact on the accountant’s satisfaction. The second is the perceived usefulness factor. The third is the system quality factor, and the last is the information quality factor. In particular, the results of this study indicate that humans are an important factor. Knowledge of accounting information security control is directly proportional to accountants’ satisfaction with the accounting information system. The results can be used to recommend enterprises improve accountants’ satisfaction, helping to increase work efficiency. Objectives: The main objectives of this study include: (1) Identifying the factors influencing the satisfaction of accountants with the accounting information system in enterprises in Vietnam. (2) Determining the relationship between accounting information security and the satisfaction of accountants with the accounting information system. (3) Providing recommendations to enhance the satisfaction of accountants with the accounting information system in enterprises in Vietnam. Methods: This study uses qualitative and quantitative research. During the qualitative process, this study analyzed related works. Group discussions are used to provide initial assessments of measurement scales, concepts, and research hypotheses and to adjust, supplement, and explore influencing factors. The questionnaire and the research model are reviewed by the experts. Quantitative research involved data collection through survey investigations based on a designed questionnaire via Google Forms. The formal research survey was conducted using a stratified sampling method, encompassing businesses from various sectors. The quantitative research employed the Cronbach Alpha reliability test for the measurement scales, exploratory factor analysis (EFA), confirmatory factor analysis (CFA), and the use of structural equation modeling (SEM) to assess the structural relationships. Descriptive statistics and tests of significance were also utilized. Findings: The results of the study on the factors affecting user satisfaction with an accounting information system are directly influenced by four factors: system quality, information quality, quality of accountants, and perceived usefulness. The quality of the accounting workforce has the greatest direct impact on the accountant’s satisfaction, followed by perceived usefulness, system quality, and information quality factors. Novelty:This study discovered a relationship between knowledge of accounting information security and the level of satisfaction among accountants regarding information technology systems in enterprises in Vietnam. This finding can assist enterprises in implementing strategies to provide more training on accounting information security for their employees. Doi: 10.28991/ESJ-2023-07-05-06 Full Text: PDF

Approaches to the intellectualization of information and telecommunication networks security control in transport

The specifics of modern information and telecommunication networks in transport, as an object of information security control, are investigated. The main trends in the development of information and telecommunication network protection technologies (TNPT) have been identified. The presence of the interrelation of the main integrative properties: readiness, mobility, throughput, stealth, accessibility, manageability, which is a consequence of the convergence of information transmission and processing technologies, is noted. A new integrative property of ITCS has become the presence and characteristics of distributed system memory, which allows storing transmitted messages for a certain time. An important feature of modern TNPT is the presence of artificial intelligence, which is formed on the basis of information and algorithmic support of modern TNPT, providing flexibility of the system behavior. These trends indicate the transformation of TNPT into a supersystem, the management tasks of which are insufficiently investigated at present. The purpose of this work is to study new approaches to ensuring the safety management of modern TNPT critical infrastructure, which includes modern systems of sea and river transport, taking into account their features. The object of the study is the information security control system of modern TNPT. The subject of the study is the scientific and methodological support of the TNPT critical infrastructure control. The research objectives are to analyze existing and develop new conceptual frameworks, as well as approaches to improving the TNPT information security control system based on intellectualization methods. The analysis of the existing methodology for managing complex organizational and technical systems and information security control technologies is carried out. The concept of TNPT information security control is formalized schematically. The analysis of the existing approach to the organization of the TNPT information security control process is carried out. The tasks of control intellectualization are defined. The problem of ensuring the efficiency and reliability of the TNPT control is formulated. The main scientific tasks of the development of the TNPT information security control methodology are defined.

Особенности оперативной оценки защищенности критически важных ресурсов на основе адаптивной нейросетевой фильтрации

The object of research is a new methodological approach to adaptive neural network filtering as a mathematical tool for improving the accuracy and efficiency of evaluating some properties of complex technical systems. This approach is one of the options for the practical application of adaptive (hybrid) filtering methods. The analysis 
 of the features of this approach determining the rationality of its application for the operational assessment of the security of critical resources is carried out. The theoretical aspects of the application of a hybrid adaptive approach to the operational assessment of the security of critical resources, combining traditional methods of Kalman filtering with the capabilities of artificial neural networks with training, are considered. The analysis of the features of this approach is carried out, which allows learning and adjusting the weighting coefficients of filtering to the statistical characteristics of the indicators of the security of critical resources, measured and observed both linearly and non-linearly. A sequence of calculations and analytical expressions are proposed for calculating the estimated values of auxiliary indicators of the state of security indicators based on an adaptive hybrid filter containing a trainable artificial neural network. The approach assumes the practical possibility of operational assessment of the security of critical resources using adaptive hybrid filtering of random processes that characterize the dynamics of changes in the state variables (indicators) of the security of such resources at a certain time interval. It takes into account the uncertainty of the initial data, incompleteness and vagueness of a priori information about the statistics of security indicators and surveillance noise. At the same time, the proposed approach makes it possible to obtain estimates adequate to the tasks of operational security control and, ultimately, works out to increase the reliability of information security control of modern critical resources.

Assessment of information protection level against unauthorized access

The object of research. The study considers an effective method of assessing the information protection level in a computer network against unauthorized access based on the security graph.
 Investigated problem. Existing approaches to assessing the information protection level against unauthorized access have certain shortcomings: the real structure of computer networks is not taken into account, losses from unauthorized access are estimated in a monetary unit, which may not always be appropriate, the variability of modern cyber-attack scenarios and dynamic characteristics are not fully taken into account .
 The main scientific results. The results of the study showed that the proposed method of assessing the information protection level against unauthorized access in computer networks based on the security graph allows for a more accurate description of information resources due to their characteristic vulnerabilities. Based on the calculations of the security indicators of individual resources and the security of all information in the computer network, the ranking of risks and, accordingly, information resources according to the degree of criticality for the organization's activities is carried out. Recommendations have been developed to ensure the necessary information protection level against unauthorized access in the computer network.
 The area of practical use of research results. The results of the research can be used in practice in corporate computer networks of any organizations, since the proposed method for assessing the information protection level against unauthorized access is easily adapted to the specific needs of the organization, taking into account the specifics of its activities and business.
 Innovative technological product. The results of the study created an innovative strategy for assessing the information protection level against unauthorized access, which increases the control of information security and the compliance of computer networks with existing eligibility criteria.
 Scope of the innovative technological product. The results of the research and the created innovative strategies relate to the information security of computer networks of any organizations.

Перспективы использования интеллектуального капитала как главного фактора экономической безопасности России при переходе к цифровой экономике

The article reveals the problems of the development of intellectual capital as one of the relevant aspects of the economic security of the state, in modern conditions of sanctions pressure and priority areas of import substitution. This problem involves the creation of an uninterrupted unified data information system (ISOD) that unites and systematizes the interaction of government, commercial and public structures. At the same time, information security control is provided at all stages of the movement of information flows. In Russia’s transition to digitalization of economic processes, it is important to introduce intellectual capital into commercial organizations of all areas of activity. In the public sector of the economy, the use of intellectual capital is the first necessity to ensure the economic security of the state. The expansion of the use of intellectual capital in the engineering infrastructure of the commercial and public sectors of the economy is possible only if the necessary number of qualified specialists is available. The scientific article proposes the author’s formula for determining the annual need for personnel for the development and implementation of intellectual capital in organizations of various forms of ownership. Currently, it is necessary not only to retain the already existing intellectual capital, but also to reproduce a new one based on fundamental education systems that take into account the modern realities of the changing world.

PERANCANGAN SISTEM PRODUKSI DENGAN VERIFIKASI KEAMANAN DATA DI PT DYNALITE INVESTMEN MANDIRI INDONESIA BERBASIS WEB

Currently, high-speed technology, especially computers based on internet technology, and after reviewing the results of PT. Dynalite Investment Mandiri Indonesia found that companies often lose data because the existing file system still uses written media which is then entered into Microsoft Excel, so the data we receive is sometimes inaccurate and not real-time. Based on the problems that have been described, the authors are interested in conducting research on designing production systems with information security controls at PT. Web-based Dynalite Investment Mandiri Indonesia. The design of this system is based on observations, interviews, literature research, SDLC (System Development Life Cycle) analysis methods, and UML (Unified Modeling Language). The results of the author's research are archive websites using PHP (Hypertext Preprocessor) and MySQL as the database and Bootstrap (HTML, CSS, JavaScript) as the user interface. Users of this website include administrators, managers, and directors. We hope that this website can help system administrators in the documentation process.

Разработка системы сбора, обработки, анализа, идентификации корреляции событий информационной инфраструктуры предприятия

A system for collecting, processing, analyzing, and identifying correlation of events of the enterprise information infrastructure known as SIEM, is proposed for consideration. With the development of corporate information systems, the number of threats related to the violation of accessibility, integrity, and confidentiality in them has increased tenfold. Ensuring information security is a complex task of responding, investigating, and eliminating the consequences of information security incidents (IS). The paper proposes a formalized description of the data that the proposed system uses. In addition, the general architecture and algorithm of functioning are highlighted. Special attention is paid to a detailed description of one of the main parts of the system (data collection agents). The information collection subsystem is characterized by the type of information collected: data on the operation of the application, host, and network or on inter-network interactions. A subsystem of this class accumulates heterogeneous data on a system or network to further analyze them for signs of computer attacks. To collect data, special modules -sensors and agents -are used, Tthe former are usually used to monitor network activity, and the latter are used to monitor and analyze actions in a particular system. The practical application of the improved model is possible both in the framework of research work and in automated information security control systems. The results obtained will be used in the further design of a complex system of continuous monitoring of the enterprise infrastructure. It is planned to consider the data storage subsystem. Subsequent work on the topic will allow us to specify the architecture and algorithm of functioning.

Characteristics and Components of the Cyber Hygiene as a Subclass of Cyber Security in Military Environment and Educational Issues

In the present study based on the main characteristics and components of the cyber hygiene as a subclass of the cyber security, educational challenges on the cyber hygiene in military area are considered. Based on institutional experience in the scope of the cyber security in the digital environment, a sequence of activities to keep resilient and reliable cyber hygiene in army organizations are analyzed and recommended. Definitions of basic cyber hygiene characteristics are suggested. Cyber hygiene software issues and institutional information security controls are discussed. A malware infection as main cyber hygiene concern is analyzed. Fundamental cyber hygiene instructions to ensure military Internet users and institutions stay protected are defined. Exemplary curriculum for education of military staff with basic themes is presented.

Assessing Information Security Risks in Clinical Laboratory in Accordance With ISO/IEC 27001 Standard

Purpose This study aims to assess the information security risks that still arise in a clinical laboratory accredited to ISO 15189 and certified to ISO 9001, as a preparation for digital-based services. Design/methodology/approach Using the ISO/IEC 27001 approach which is embedded in the qualitative method in this study, risk assessment is carried out by identification, analysis and evaluation through interviews with process owners at clinical laboratories in Jakarta. Findings As a result, it was found that the Busdev&IT Department had the most information security risks (35 risks out of 384 total risks), which required further treatment based on the established risk appetite. Therefore, vigilance on the use of information systems in the laboratory needs to be increased in terms of information security. Research limitations/implications The research object was in the preparation stage for ISO 27001 certification, but the risk assessment is not only to comply with requirements, that also to have effective information security control among their process to ensure the sensitive information is secured. Originality/value This study answers the need for establishment of information security risk control in clinical laboratory.

Maturity of information systems' security in Ethiopian banks: case of selected private banks

PurposeInformation systems' security is more critical than ever before since security threats are rapidly growing. Before putting in place information systems' security measures, organizations are required to determine the maturity level of their information security governance. Literature review reveals that there is no recent study on information systems' security maturity level of banks in Ethiopia. This study thus seeks to measure the existing maturity level and examine the security gaps in order to propose possible changes in Ethiopian private banking industry's information system security maturity indicators.Design/methodology/approachFour private banks are selected as a representative sample. The system security engineering capability maturity model (SSE-CMM) is used as the maturity measurement criteria, and the measurement was based on ISO/IEC 27001 information security control areas. The data for the study were gathered using a questionnaire.FindingsA total of 93 valid questionnaires were gathered from 110 participants in the study. Based on the SSE-CMM maturity model assessment criteria the private banking industry's current maturity level is level 2 (repeatable but intuitive). Institutions have a pattern that is repeated when completing information security operations but its existence was not thoroughly proven and institutional inconsistency still exists.Originality/valueThis study seeks to measure the existing maturity level and examine the security gaps in order to propose possible changes in Ethiopian private banking industry's information system security maturity indicators. This topic has not been attempted previously in the context of Ethiopian financial sector.

How Information Security Management Systems Influence the Healthcare Professionals’ Security Behavior in a Public Hospital in Indonesia

Aim/Purpose: This study analyzes health professionals’ information security behavior (ISB) as health information system (HIS) users concerning associated information security controls and risks established in a public hospital. This work measures ISB using a complete measuring scale and explains the relevant influential factors from the perspectives of Protection Motivation Theory (PMT) and General Deterrence Theory (GDT) Background: Internal users are the primary source of security concerns in hospitals, with malware and social engineering becoming common attack vectors in the health industry. This study focuses on HIS user behavior in developing countries with limited information security policies and resources. Methodology: The research was carried out in three stages. First, a semi-structured interview was conducted with three hospital administrators in charge of HIS implementation to investigate information security controls and threats. Second, a survey of 144 HIS users to determine ISB based on hospital security risk. Third, a semi-structured interview was conducted with 11 HIS users to discuss the elements influencing behavior and current information security implementation. Contribution: This study contributes to ISB practices in hospitals. It discusses how HIS managers could build information security programs to enhance health professionals’ behavior by considering PMT and GDT elements. Findings: According to the findings of this study, the hospital has implemented particular information security management system (ISMS) controls based on international standards, but there is still room for improvement. Insiders are the most prevalent information security dangers discovered, with certain working practices requiring HIS users to disclose passwords with others. The top three most common ISBs HIS users practice include appropriately disposing of printouts, validating link sources, and using a password to unlock the device. Meanwhile, the top three least commonly seen ISBs include transferring sensitive information online, leaving a password in an unsupervised area, and revealing sensitive information via social media. Recommendations for Practitioners: Hospital managers should create work practices that align with information security requirements. HIS managers should provide incentives to improve workers’ perceptions of the benefit of robust information security measures. Recommendation for Researchers: This study suggests more research into the components that influence ISB utilizing diverse theoretical foundations such as Regulatory Focus Theory to compare preventive and promotion motivation to enhance ISB. Impact on Society: This study can potentially improve information security in the healthcare industry, which has substantial risks to human life but still lags behind other vital sector implementations. Future Research: Future research could look into the best content and format for an information security education and training program to promote the behaviors of healthcare professionals that need to be improved based on this ISB measurement and other influential factors.

An Improved Absolute-Cosine Chaotification Model and Its Simple Application in PRNG

Chaotic systems are widely used in various aspects such as information security, signal processing, and synchronous control. The structural complexity and the chaotic behavior of chaotic systems are two significant factors affecting their practical applications. In this paper, we propose a universal two-dimensional (2D) absolute-cosine chaotic model (ACCM). The 2D-ACCM is composed of a nonlinear bounded cosine function and an absolute value function. It can construct new chaotic maps with simple structures and complex chaotic behaviors on the basis of existing chaotic systems. To verify the effectiveness of the proposed system, we first choose two existing one-dimensional (1D) chaotic maps and one existing 2D chaotic map as the seed maps of the 2D-ACCM to generate two new maps, respectively. The results of chaotic behavior analysis show that these two new maps have more complex chaotic behavior and wider chaotic ranges than seed maps and some advanced chaotic maps. Then a hardware experiment platform based on a field-programmable gate array (FPGA) is used for the hardware implementation of the new maps. Finally, a simple chaos-based pseudo-random number generator (PRNG) is introduced to show the practical application. The experimental results show that the new maps can be easily implemented on the FPGA and the chaos-PRNGs can generate pseudo-random numbers with excellent randomness.

ОБ ИТОГАХ VI ВСЕРОССИЙСКОЙ НАУЧНО-ПРАКТИЧЕСКОЙ КОНФЕРЕНЦИИ "ИНФОРМАЦИОННАЯ БЕЗОПАСНОСТЬ: ВЧЕРА, СЕГОДНЯ, ЗАВТРА"

The article analyzes results of the All-Russian Scientific and Practical Conference held in Moscow at the Russian State University for the Humanities (RGGU), at which more than 20 reports from various scientific and educational organizations were heard. The reports dealt with general issues of information security, software and hardware methods of the information protection; prospects for the development of various areas of the information security were also considered. The topics of the plenary reports included: trends in the development of the information warfare in the context of global informatization, the risks of outsourcing and attracting contractors to the implementation of an information security system, the import-independence of the national ICT infrastructure: an ethical and engineering view, software and algorithmic support for assessing the destructiveness of telegram channels, modeling the evaluation of the effectiveness of the information security control system of open sociotechnical systems, issues of building a reliable enterprise information security systems, etc. The reports in three sections considered: features of ensuring the information security of critical information infrastructure facilities in the field of electric power, analysis of methods of hacking and destruction of a steganographic container in an image file, analysis of the consequences of a breach of personal data security from the standpoint of the intruder’s interests, testing models of analysis and forecasting of the information warfare in society in the simulation environment of Anylogic, etc.

Information and Security Control Mechanisms Embraced for Effective Information Management in Colleges of Education in Nigeria

The study determined the Information, communication and logical environment security control mechanisms embraced by administrative officers for effective information management in Colleges of Education (CCOEs) in South-South Nigeria. The study embraced descriptive survey research design. The population was 1580 Administrative Officers.. 320 respondents using a proportional sampling technique was used to determine the number of administrative officers for each of the COEs studied. The instrument for data collection was a structured questionnaire developed by the researcher. The questionnaire was face-validated by five experts. The reliability of the instrument was tested using Cronbach Alpha method and yielded an overall coefficient of 0.93. Mean and Analysis of Variance were used to analyze data collected. The findings showed that the administrative officers moderately embraced the identified logical, information and communication control mechanisms for effective information management. The findings further showed that no significant difference existed among the opinions of the respondents on the level at which they embraced the Information, communication and logical environmental security control mechanisms for effective information management of their institutions. it was recommended among others, that the management of COEs in Nigeria should enact and implement effective policies and laws that support the adoption of information control mechanisms.

Impact of Implementation of Information Security Risk Management and Security Controls on Cyber Security Maturity (A Case Study at Data Management Applications of XYZ Institute)

Information security is an important concern for governments and industry due to the increase in cyber attacks during Covid-19. The government is obliged to maintain information security in implementing an Electronic-Based Government System following Presidential Regulation of the Republic of Indonesia Number 95 of 2018. To overcome this problem, the XYZ Institute needs an approach to implementing information security risk management and information security controls. This study aims to risk identification, risk analysis, risk evaluation, risk treatment, risk acceptance, risk control, and analysis of cyber security maturity gaps in the domain of governance, identification, protection, detection, and response. ISO/IEC 27005:2018 as guidance for conducting risk assessments. The code of practice for information security control uses the ISO/IEC 27002:2013 standard and assessing maturity using the cyber security maturity model version 1.10 developed by the National Cyber and Crypto Agency of the Republic of Indonesia. The results show that the cyber maturity value increased from 3.19 to 4.06 after implementing 12 new security controls.