Organizational Information Security Research Articles

The Effect of Organizational Information Security Climate on Information Security Policy Compliance: The Mediating Effect of Social Bonding towards Healthcare Nurses

The advancement of information communication technology in healthcare institutions has increased information security breaches. Scholars and industry practitioners have reported that most security breaches are due to negligence towards organizational information security policy compliance (ISPC) by healthcare employees such as nurses. There is, however, a lack of understanding of the factors that ensure ISPC among nurses, especially in developing countries such as Malaysia. This paper develops and examines a research framework that draws upon the factors of organizational climate of information security (OCIS) and social bond theory to enhance ISPC among nurses. A questionnaire was adopted in which responses were obtained from 241 nurses employed in 30 hospitals in Malaysia. The findings from the study demonstrated that the ISPC among nurses is enhanced through OCIS factors. The influence on ISPC was even more significant when examined by the mediating effect of the social bond. It implies that influential OCIS factors reinforce social bonds among nurses and eventually increase the ISPC. For information security practitioners, the study findings emphasize the prevalence of socio-active information security culture in healthcare organizations to enhance ISP compliance among nurses.

Human factor, a critical weak point in the information security of an organization's Internet of things

Internet of Things (IoT) presents opportunities for designing new technologies for organizations. Many organizations are beginning to accept these technologies for their daily work, where employees can be connected, both on the organization's premises and the “outside”, for business continuity. However, organizations continue to experience data breach incidents. Even though there is a plethora of researches in Information Security, there “seems” to be little or lack of interest from the research community, when it comes to human factors and its relationship to data breach incidents. The focus is usually on the technological component of Information Technology systems. Regardless of any technological solutions introduced, human factors continue to be an area that lacks the required attention. Making the assumption that people will follow expected secure behavioral patterns and therefore system security expectations will be satisfied, may not necessarily be true. Security is not something that can simply be purchased; human factors will always prove to be an important space to explore. Hence, human factors are without a doubt a critical point in Information Security. In this study, we propose an Organizational Information Security Framework For Human Factors applicable to the Internet of Things, which includes countermeasures that can help prevent or reduce data breach incidents as a result of human factors. Using linear regression on data breach incidents reported in the United States of America from 2009 to 2017, the study validates human factors as a weak-point in information security that can be extended to Internet of Things by predicting the relationship between human factors and data breach incidents, and the strength of these relationships. Our results show that five breach incidents out of the seven typified human factors to statistically and significantly predict data breach incidents. Furthermore, the results also show a positive correlation between human factors and these data breach incidents.

A Deep Learning Model for Information Loss Prevention From Multi-Page Digital Documents

World Wide Web has redefined almost all the business models in the past twenty-five to thirty years. IoT, Big Data, AI are some of the comparatively recent technologies which brought in a revolution in the digitization and management of data. Along with the revolution arose the need for data security and consumer privacy protection, primarily concerning financial institutions. The data breach of Equifax in 2017 and personal information leaks from Facebook in 2021 led to general skepticism among the customers of large corporations. The GLBA, 1999, also known as the Financial Modernization Act, was implemented by US federal law to enforce the financial institutions to protect their private information. Built upon the GLBA, guidelines are paved by FTC for all financial institutions of the United States of America, including TI companies. In this paper, an ANN-based content classification technique using MLP architecture in combination with n-gram TF-IDF feature descriptor is proposed to detect and protect the customers' sensitive information of a reputed TI company securing it's one of the digital image-document stores. The proposed technique is compared with other state-of-the-art strategies. Data samples from the digital document store of the company have been taken into consideration in the study, and the prediction accuracy metrics obtained are found to be substantially better and within the acceptable range defined by the organization's information security monitoring team.

Human factor aspects in information security management in the traditional IT and cloud computing models

This paper attempts to classify the main areas of threats occurring in enterprises in the information management processes. Particular attention was attracted to the effect of the human factor which is present in virtually every area of information security management. The author specifies the threats due to the IT techniques and technologies used and the models of information systems present in business entities. The empirical part of the paper presents and describes the research conducted by the author on information security in business organisations using the traditional IT model and the cloud computing model. The results obtained for both IT models are compared.

ИССЛЕДОВАНИЕ IRP-СИСТЕМ НА ОСНОВЕ АНАЛИЗА МЕХАНИЗМОВ РЕАГИРОВАНИЯ НА ИНЦИДЕНТЫ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ

The article discusses the features and functions of information security incident response systems. The analysis of modern IRP solutions is presented and the process of responding to typical incidents in systems of this class is described. Based on expert opinions, a list of criteria was formed, which were divided into groups by areas of functional responsibility for further comparison of the work of IRP systems. The assessment of the main and additional characteristics of IRP-systems was carried out using the formed criterion groups. The analysis of the comparison results showed that the most promising solutions are R-Vision IRP, IBM Resilient IRP and open-source solution - The Hive. The algorithm of the module for preventing phishing attacks was developed and presented, the software implementation of which was made using the Python language. As part of the integration capabilities of The Hive, a custom response function was implemented that not only potentially improved the system's performance in preventing phishing attacks, but also increased employee awareness of this threat. The result is an IRP system with personal flexible customization of individual elements and is the basis for the formation of the Security Center (SOC), which will bring the information security of organizations to a new level.

ERP-SYSTEM RISK ASSESSMENT METHODS AND MODELS

Context. Because assessing information security risks is a complex and complete uncertainty process, and non-appearance is a major factor influencing the effectiveness of the assessment, is advisable use vague methods and models that are adaptive to noncomputed data. The formation of vague assessments of risk factors is subjective, and risk assessment depends on the practical results obtained in the process of processing the risks of threats that have already arisen during the functioning of the organization and experience of information security professionals.Objective. The object of the study are neural models that combine methods of fuzzy logic and artificial neural net-works and systems, that is, human-like style considerations of fuzzy systems with training and simulation of mental phi novena of neural networks.Method. The paper analyzes modern areas of research in the field of information protection in information systems, methods and technologies of information security risk Assessments, use of vague models to solve problems of information security risk assessment, as well as concept and con-struction of ERP systems and analyze problems of their security and vulnerability.Results. Identified factors influencing risk assessment suggest the use of linguistic variables to describe them and use fuzzy variables to assess their qualities, as well as a system of qualitative assessments. The choice of parameters for the development of the structure of a fuzzy product model of risk assessment and the basis of the rules of fuzzy logical conclusion justified.Conclusions. A vague risk assessment model of ERP systems is considered. You have selected a list of factors that affect information security risk. The methods of assessment of risks of information resources and ERP-systems in general, assessment of financial losses from the implementation of threats, determination of the type of risk according to its assessment for the formation of recommendations for their processing in order to maintain the level of protection of the ERP-system are considered. The list of linguistic variable models is considered. The structure of the database of fuzzy product rules – MISO-structure is selected. Fuzzy variable models are considered.

О роли виктимологической профилактики в предупреждении преступлений с использованием информационных технологий

Purpose. To study the role of victimological prevention in crime prevention using information technologies. Methodology: comparative legal, historical, statistical, logical methods. Conclusion. In assessing the importance of crime prevention measures using information technology, it is important to pay attention to measures of victimological prevention. Scientific and practical significance. The conclusions presented in the article are of practical importance when implemented in the activities of law enforcement agencies interested in the information security of organizations.

EVALUATION OF THE EFFECTS OF INFORMATION SECURITY TRAINING ON EMPLOYEES: A STUDY FROM A PRIVATE HOSPITAL

Aim: Human error is known as the biggest threat to information security in healthcare organizations. Training on the information security is important to the mission of establishing sustainable information security. The aim of the study was to evaluate the effect of a training program for information security in a private hospital. 
 Materials and Methods: In this cross-sectional study, 66 medical unit employees (M/F: 53/13, mean age: 30,27±11,12 years) and 34 administrative unit employees (M/F: 11/23, mean age: 31,5±10,84 years) using the Hospital Information Management System (HIMS) were included. Data were collected by a questionnaire regarding the validated Information Security Scale before and after the training program. 
 Results: Scores of three subgroups of the scale (Security Policy, Access and Authorization, Security Applications) were used in the study. Scores of them were significantly improved by the training program in both medical and administrative staff (p0.05). In addition, there was no positive effect of HIMS training on scores of these subgroups (p>0.05). 
 Conclusion: Well-designed training programs are necessary for improving information security culture in hospitals. Since ensuring the appropriate protection of organizational assets, it is essential to design an effective training program regarding information security and privacy in the perspective of health managers.

Organizational Governance, Social Bonds and Information Security Policy Compliance: A Perspective towards Oil and Gas Employees

Information security attacks on oil and gas (O&G) organizations have increased since the last decade. From 2015 to 2019, almost 70 percent of O&G organizations faced at least one significant security breach worldwide. Research has shown that 43 percent of security attacks on O&G organizations occur due to the non-compliant behavior of O&G employees towards information security policy. The existing literature provides multiple solutions for technical security controls of O&G organizations. However, there are very few studies available that address behavioral security controls, specifically for O&G organizations of developing countries. The purpose of this study is to provide a comprehensive framework for information security policy compliance (ISPC) for the O&G sector. A mixed-method approach is used to develop the research framework. Semi-structured interviews from O&G specialists refined the developed framework. Based on qualitative study a survey questionnaire was developed. To evaluate the research framework, structural equation modeling was applied to a sample of 254 managers/executives from 150 Malaysian O&G organizations. The obtained test results confirmed the proposed research model, according to which good social bonding among employees plays a critical role in improving ISPC. However, there was less support for the notion that all organizational governance factors significantly improve the social bonding of Malaysian O&G organizations employees. This paper contributes to the current information system (IS) literature by exploring the interrelationships among organizational governance, social bonding, and information security policy compliance (ISPC) in Malaysian O&G organizations.

The influence of organisational culture and information security culture on employee compliance behaviour

PurposeOrganisational culture plays an important role in influencing employee compliance with information security policies. Creating a subculture of information security can assist in facilitating compliance. The purpose of this paper is to explain the nature of the combined influence of organisational culture and information security culture on employee information security compliance. This study also aims to explain the influence of organisational culture on information security culture.Design/methodology/approachA theoretical model was developed showing the relationships between organisational culture, information security culture and employee compliance. Using an online survey, data was collected from a sample of individuals who work in organisations having information security policies. The data was analysed with Partial Least Square Structural Equation Modelling (PLS-SEM) to test the model.FindingsOrganisational culture and information security culture have significant, yet similar influences on employee compliance. In addition, organisational culture has a strong causal influence on information security culture.Practical implicationsControl-oriented organisational cultures are conducive to information security compliant behaviour. For an information security subculture to be effectively embedded in an organisation's culture, the dominant organisational culture would have to be considered first.Originality/valueThis research provides empirical evidence that information security subculture is influenced by organisational culture. Compliance is best explained by their joint influence.

The Validity of Information Security Risk Assessment Methods for Organizations

Based on statistical data, a contradiction is shown between an increase in financial investments in the information security (IS) of organizations and a steady increase in the number of IS incidents caused by internal users. A conclusion is made about the cognitive vulnerability and low degree of validity of modern IS risk assessment methods. Stereotypes have been identified, the result of which are cognitive errors in assessing IS risks: the priority of technical protection of information from external threats of IS over organizational and technical protection from internal threats; distrust of the internal client, perception of it exclusively as an object of tough managerial influence, ignoring its subjective role in IS management; restriction of work with personnel within the IS management system with one-time measures and static criteria for assessing human risks and inattention to systemic measures and dynamic, situational criteria. The necessity of updating standards for IS risk management, as well as the development of new methods and tools for assessing, IS risks based on rejecting outdated stereotypes, is substantiated.

Integrating elaboration likelihood model and herd theory in information security message persuasiveness

Determining how to design persuasive information security messages to increase employees’ engagement in protection-motivated behaviors is an important organizational objective. Information security messages that are argument-based have been shown to effectively elicit employees’ protection-motivated behaviors. The mechanism by which cue-based information security messages persuade employees to engage in protection-motivated behaviors is not clear. This paper applies the lenses of the elaboration likelihood model (ELM) and herd theory to propose a comprehensive conceptual model which explains how security argument persuasiveness and popularity cues influence individuals’ cognitive attitude and herd mentality and subsequently influence employees’ protection-motivated behaviors. The results have implications for designing effective information security messages for organizational information security management.

Internet of things, reality of a connected world

In recent years, the Internet has evolved till become the Internet of Things (IoT for its acronym). This is one of the most important and significant inventions of all humanity, generating a direct impact on the way of how people live, think and act. It is one of the most used terms by anyone who talks about intelligent connectivity. Internet of things changes everything, is the answer to connect to the network an incredible number of people and link everyday objects, which are equipped with sensors, actuators and communication technologies and they are used to exchange information from the physical world through the Internet, offering data in real time and monitored through the network. Thanks to IoT, more and more companies are integrating small sensors to real-world objects, which provide information about almost everything that can be measured, so the amount of information circulating through networks grows exponentially. Smart cities are a good example of the benefits that IoT brings, by improving the quality of life of people with the services that are offered in an efficient and sustainable way. The installation of IoT brings great challenges focused on information security in organizations, but also opportunities for development in all areas of daily life and excellent ideas for innovation.

Study the Methods of Internal Audit of Information Security in Organizations

Study the Methods of Internal Audit of Information Security in Organizations

Motivating information security policy compliance: The critical role of supervisor-subordinate guanxi and organizational commitment

Employees’ non-compliance with organizational information security policy (ISP) when using informational resources has become the main reason for continuous security incidents. Drawing upon technology threat avoidance theory (TTAT) and social exchange theory (SET), our study investigates the influence of supervisor-subordinate guanxi (SSG) and organizational commitment in the information security management. Our hypotheses were tested using survey data from 235 Chinese government employees. Results not only confirm the direct effect of SSG on government employees’ ISP compliance but also suggest that SSG indirectly influences compliance behavior via the mediation of organizational commitment. Organizational commitment weakens the negative influence of perceived costs on compliance behavior and also weakens the positive effect of self-efficacy on employees’ ISP compliance. For low-commitment employees, the negative influence of perceived costs on compliance behavior is more significant than that of those with strong organizational commitment, and self-efficacy exerts a stronger effect on ISP compliance for low-commitment employees than it does for high-commitment employees. This study contributes to current literature on information systems (IS) by confirming the critical roles of SSG and organizational commitment in motivating employees’ compliance behavior.

ANALYSIS OF THE SECURITY STATUS OF INFORMATION AND TELECOMMUNICATION SYSTEMS

At a time society constant informatization, the rapid information technology development, increasing the number of new software products and information systems, the question of protection against unauthorized intrusions into information systems and data protection is acute. It is determined that IT audit is a key component of achieving quality work of the information system and a problem with professionals who are able to effectively, correctly and quickly support the information system from malformations and data security. The dynamics of cyberattacks on state information resources and the legal component of Ukraine cyber defense are analyzed. The problem of protection is raised by a very narrow circle of scientists. But the foundation for the development and implementation of IT audit is laid. In accordance with the legal field of Ukraine, special state institutions not only establish requirements for the information protection, but also conduct inspections of the systems security. Consideration of the international standard ISO / IEC 27001 gives an opportunity to see how the standards system works to support security of information systems, how an enterprise / organization of any ownership form will have a quality information protection algorithm and how IT audit of information systems. ISO / IEC 27001 provides a number of perspectives for the management of the enterprise / organization information security – identifies risks and applies controls to managing or avoiding of information threats; enhances flexibility in the adaptation management to all or some subsystems of the enterprise / organization; provides an opportunity to gain the customers interest and trust that their data is protected; shows the modernity and reliability of information system protection. It is the system of international standards and examples of companies such as ISACA groups that logically lead to the conclusion that conducting an IT audit is necessary for the management of information systems. The issue of training IT auditors, which must be certified and meet international standards, is acute.

Organizational Adoption of Information Security Solutions

Information systems literature has cast organizational information security practices as a form of innovation. Using the notions of innovation adoption and diffusion of innovations, this paper develops an integrative model grounded in two theoretical perspectives- diffusion of innovation theory and the technologyorganization- environment framework-to examine the adoption of information security solutions (ISS) in organizations. We specify four innovation characteristics that are specific to ISS (compatibility, complexity, costs, and perceived gain), two organizational factors (organizational readiness and top management support), and two environmental factors (external pressure and visibility) as influential toward ISS adoption. We tested our model using data collected through a survey of 368 information systems managers in North American organizations. Our findings are insightful and have important theoretical and practical implications. Overall, the results suggest that organizational and environmental factors contribute to the extent of ISS adoption above and beyond characteristics of ISS themselves. The results are consistent across two measures of ISS adoption- perceived and (self-reported) actual-thereby supporting the robustness of our findings.

Человеческий фактор в информационной безопасности организации: направления исследований, меры противодействия, перспективы изучения

Человеческий фактор в информационной безопасности организации: направления исследований, меры противодействия, перспективы изучения

Fear of Missing Out Predicts Employee Information Security Awareness Above Personality Traits, Age, and Gender.

The role of human factors in employee information security awareness (ISA) has garnered increased attention, with many researchers highlighting a potential link between problematic technology use and poorer online safety and security. This study aimed to present additional evidence for this by exploring the relationship between of Fear of Missing Out (FoMO) and ISA in employees. A total of 718 participants completed an online questionnaire that included a measure of FoMO, ISA, as well as the Big Five personality inventory. Participants who reported higher levels of FoMO had lower overall ISA, as well as having poorer knowledge, a more negative attitude, and engaged in riskier behaviors in relation to ISA. FoMO was also demonstrated to be the largest single negative predictor for ISA, above that of age, gender, and the key personality traits tested. The potential reasons for the influence of FoMO over ISA are discussed, as well as the implications for organizational information security.

Smart City Development in Taiwan: From the Perspective of the Information Security Policy

A smart city is developed through the Internet of Things (IoT), cloud computing, big data, mobile Internet, and other new generation technologies regarding information and communication, and data resources in various fields are integrated and applied. The issue of information security in the network era is the strategic focus, as well as the focus of people’s attention, during Taiwan’s smart city construction. Information security policies are the information security guidelines for organizations, and are key to the organization’s information security performance; moreover, such policies show the organization’s support and commitment to the information security of smart cities. This paper discusses the model of information security policy in Taiwan’s smart cities, uses Path Analysis to explore the characteristics of information security policy in smart cities, and examines the relationship between the formulation, implementation, maintenance, and effectiveness of information security policies. Furthermore, this study examines the impact on the effectiveness of organizational information security policies and information security performance from the following aspects: The length of information security policy publication time, policy review, policy advocacy, employee compliance, fair law enforcement, etc., which are all concrete manifestations of the formulation, implementation, and maintenance of information security policy models. Through a questionnaire survey, the correlation between various assumptions, as well as the relationship between organizational information security characteristics, information security policies, and the effectiveness of information security, are verified one by one during the implementation of information security policies. Finally, conclusions and implications are put forward.