Information Security Framework Research Articles

Determinants of Blockchain Technology Adoption in the Australian Agricultural Supply Chain: A Systematic Literature Review

Blockchain technology (BCT) is emerging as a key enabler of sustainability in various sectors, including agriculture. This study explores the impact of BCT adoption on sustainability within the Australian agriculture sector. Through a systematic literature review (SLR) of studies published between 2015 and 2021, ten key themes influencing BCT adoption were identified: transparency, traceability, contract exchange, transaction efficiency, trade finance management, quality control, real-time information dissemination, security, trust, and legislative frameworks. The findings suggest that BCT adoption in agriculture can lead to improved sustainability outcomes. By enhancing transparency and traceability, BCT enables stakeholders to track the provenance of products, reducing the risk of fraud and ensuring compliance with environmental standards. The automation and efficiency gains afforded by BCT streamline supply chain processes, reducing waste and resource consumption. BCT enhances trust among stakeholders, fostering collaboration and information sharing to address sustainability challenges. This study contributes to the literature by highlighting how BCT can drive sustainability in agriculture through improved transparency, efficiency, and collaboration.

Climate, nuclear weapons control and cyber threats: three problems or one?

The article analyzes a set of problems related to the mutual influence of three global challenges ofour time, which will determine the configuration of modern society in the medium and long term: climate change, nuclear arms control and cyber threats. The study reveals the role of each of the components and the prospects for their transformation for Russia, the United States and European states. Priority scenarios of state policy within the framework of nuclear deterrence and information security are substantiated. The experience of recent decades reveals that the rejection of security treaties, as a rule, weakens the security of States, rather than strengthens it. Thus, in the course of the study, strategic objectives, the content side and policy options of the Russian Federation in the current international situation were considered, conclusions were drawn regarding the optimality of the chosen strategies for interaction with European partners in the field of arms control, the climate agenda and cyber threats. The authors conclude that it is necessary to create a new generation security architecture through informal consultations on strategic stability, which determine the negotiation plan to be discussed at official negotiations between Russia and the United States. In addition, the authors prove that in the foreseeable future, climate change will have a negative impact on the activities of armies and increase the frequency of their deployment in crisis situations. For this reason, competitive advantages in the defense sector will be determined by the ability of the command to adapt to climate change,reduce damage to military infrastructure and minimise the risks of resource losses due to natural disasters and extreme weather conditions.

Information Security and Privacy Management in Intelligent Transportation Systems

With the global digitalization of services, passenger Intelligent Transportation Systems (ITSs) have emerged as transformative components, yet the practical implementation of state-of-the-art measures to ensure information security and privacy presents substantial challenges. In this article, we propose a framework for information security and privacy management. The framework is validated through two empirical studies. First, the framework is used to extract data during the literature review defining state-of-the-art aspects and measures. Second, a survey-based analysis of running passenger ITSs in selected regions of the European Union provides insights into real-life ITS implementations, enabling a thorough comparison with the proposed state-of-the-art measures. The study also showed that the proposed framework depicts some dependencies between measures, and, thus, using its matrix structure for the state of information security and privacy management in the organization helps to cross-check the usage of policies or methodologies by the organization departments. Our findings resulted in recommendations for organizations developing ITSs to enhance their information security and privacy management systems and bridge the gap between research proposals and practical implementation.

Comparative Analysis on Matters Affecting the Global Economy A Case Study of E-Commerce Business

Electronic commerce (e-commerce) is generally viewed as the buying and selling of products over the internet, however, any transaction that is concluded exclusively through electronic means can be regarded as e-commerce. E-commerce may have great economic impacts in subsequent times. Internet commerce will transform the physiognomy of business endlessly. Furthermore, it has impacted the information technology (IT), electronic, social, and e-commerce has increased the productivity development globally in the recent times. The effect of e- commerce on developing economies for curtailing in competencies for trading and to enhance productivity in terms of economies with competitors globally. There are several measures to expedite the increase of productivity by reducing costs, enhancing competencies, and curtailing time and distance, e- commerce could emerge as a significant device for growth and increase in all sectors. Frameworks for information security is clearly applied to the features that affect e- commerce that incorporates computer security, data security, and other broader compass of the information security framework. E-commerce security possess its own particular distinctions and is one of the topmost visible security features that affect the consumer through to acquire e- business finance and value investment, globetrotting, and its internet embodiment.

A Novel Framework for Information Security During the SDLC Implementation Stage: A Systematic Literature Review

A Novel Framework for Information Security During the SDLC Implementation Stage: A Systematic Literature Review

Exploring the level of information security in the South African banking industry

The purpose of this study is to explore the level of information security among South African banks with the aim of determining the level of their resilience to cyberattacks and intrusions. The study employs a mixed approach that involves both quantitative and qualitative analyses of the responses obtained from a structured questionnaire used as the survey instrument. The questionnaire was distributed to some selected members of staff of the 17 licensed banks in South Africa saddled with the responsibilities of operation, customer service, management, and administration. In addition, non-parametric statistical analyses such as Fischer’s Exact and Chi-square tests, as well as Spearman’s correlation, were carried out. The outcome of this study indicated that the effectiveness of information security on customers’ service in the South African banking industry is assumed to be high. South African banks are deploying different anti-fraud technologies to strengthen the level of information security; however, there are still substantial cases of cyberfraud and unauthorised intrusions. The findings also indicate that the integration of forensic accounting and management control systems may promote information security in the banking industry. This study provided an insight into the impact of information security framework development to reduce systems’ vulnerability and intrusions.

ISO 27001 IN BANKING: AN EVALUATION OF ITS IMPLEMENTATION AND EFFECTIVENESS IN ENHANCING INFORMATION SECURITY

As the banking industry becomes increasingly reliant on digital technologies and faces evolving cyber threats, the adoption of robust information security frameworks is imperative. ISO 27001, a globally recognized standard for information security management systems, has gained prominence as a comprehensive framework for safeguarding sensitive data. This study explores the implementation and effectiveness of ISO 27001 within the banking sector, evaluating its impact on enhancing information security. It delves into the specific challenges and considerations unique to the banking industry, where the confidentiality, integrity, and availability of financial information are paramount. It examines the motivations behind adopting ISO 27001, the process of implementation, and the associated organizational changes required to align with the standard's principles. A critical aspect of the evaluation involves assessing the tangible benefits and outcomes resulting from ISO 27001 implementation. This includes improvements in risk management, incident response capabilities, and the overall resilience of information security controls within banking environments. The study also investigates the role of ISO 27001 in fostering a culture of security awareness among banking employees and stakeholders. Ethical considerations, compliance challenges, and the balance between security and operational efficiency are examined to provide a holistic perspective on the standard's impact. It concludes with insights into the future of ISO 27001 adoption in the banking sector, considering emerging technologies, regulatory developments, and the evolving nature of cyber threats. This research contributes valuable insights into the effectiveness of ISO 27001 as a strategic framework for information security in banking, offering practical implications for industry practitioners, policymakers, and stakeholders invested in fortifying the digital resilience of financial institutions
 Keywords: ISO 27001, Banking, Information Security, Ethical, Financial Institution.

Leveraging Taxonomical Engineering for Security Baseline Compliance in International Regulatory Frameworks

A surge in successful Information Security (IS) breaches targeting Research and Education (R&E) institutions highlights a pressing need for enhanced protection. Addressing this, a consortium of European National Research and Education Network (NREN) organizations has developed a unified IS framework. This paper aims to introduce the Security Baseline for NRENs and a security maturity model tailored for R&E entities, derived from established security best practices to meet the specific needs of NRENs, universities, and various research institutions. The models currently in existence do not possess a system to smoothly correlate varying requirement tiers with distinct user groups or scenarios, baseline standards, and existing legislative actions. This segmentation poses a significant hurdle to the community’s capacity to guarantee consistency, congruency, and thorough compliance with a cohesive array of security standards and regulations. By employing taxonomical engineering principles, a mapping of baseline requirements to other security frameworks and regulations has been established. This reveals a correlation across most regulations impacting R&E institutions and uncovers an overlap in the high-level requirements, which is beneficial for the implementation of multiple standards. Consequently, organizations can systematically compare diverse security requirements, pinpoint gaps in their strategy, and formulate a roadmap to bolster their security initiatives.

Dynamic Risk Assessment in Cybersecurity: A Systematic Literature Review

Traditional information security risk assessment (RA) methodologies and standards, adopted by information security management systems and frameworks as a foundation stone towards robust environments, face many difficulties in modern environments where the threat landscape changes rapidly and new vulnerabilities are being discovered. In order to overcome this problem, dynamic risk assessment (DRA) models have been proposed to continuously and dynamically assess risks to organisational operations in (near) real time. The aim of this work is to analyse the current state of DRA models that have been proposed for cybersecurity, through a systematic literature review. The screening process led us to study 50 DRA models, categorised based on the respective primary analysis methods they used. The study provides insights into the key characteristics of these models, including the maturity level of the examined models, the domain or application area in which these models flourish, and the information they utilise in order to produce results. The aim of this work is to answer critical research questions regarding the development of dynamic risk assessment methodologies and provide insights on the already developed methods as well as future research directions.

COBIT 2019 INFORMATION SECURITY FOCUS AREA IMPLEMENTATION FOR REINSURCO DIGITAL TRANSFORMATION

As information technology (IT) advancement evolves in Indonesia's insurance sector, organizations like ReinsurCo must accelerate their digital transformation (DT) to remain competitively viable. Although DT paves the way for new business models and operational improvements, the implementation often fails due to poor IT governance. Under the supervision of the State-Owned Enterprises Agency (SOE) and the Financial Services Authority (FSA), ReinsurCo must comply with regulations stating that SOEs must independently assess IT maturity to ensure information security. This research utilizes the five stages of Design Science Research (DSR): problem explication, requirement specification, design and development, demonstration, and evaluation. Data was collected through semi-structured interviews and both internal and external document triangulation. The data were then analyzed using the COBIT 2019 Information Security framework, implementing design factors prioritizing information technology governance and management (ITGM) objectives: APO13 Managed Security, DSS05 Managed Security Services, and BAI06 Managed IT Changes. Further analysis and identification were conducted to discover gaps against the seven component capabilities. These identified gaps were mapped into people, process, and technology aspects, which led to the creation of essential improvement recommendations. These recommendations were compiled into an implementation roadmap that can serve as a priority guide for ReinsurCo. This research is expected to provide a knowledge base for prioritizing information security management in supporting DT by implementing the COBIT 2019 Information Security framework. In a practical context, it aids ReinsurCo in controlling its strategic plans to face information security challenges. Furthermore, this study also offers extensive benefits to the insurance industry.

Recommendations for designing information security framework in government procurement of goods/services certification systems based on ISO 27001:2022

Certification Government Procurement of Goods/Services has applied since 2008 and switched to certification-based computers in 2015. However, technology information has raised problems with the security of necessary information fixed, like illegal access and practice jockeying through access remotely against application exam-based computers. To overcome the challenge, a framework Works security comprehensive information is required. In a study, the researcher compares System Certification Quality Management with Standard ISO 27001:2022 and observes Suite implementation certification procurement to develop a framework special can implement in system certification. Analysis results show that LKPP requires framework Work security information on the system certification procurement goods/services government based on the ISO 27001: 2022 standard. The proposed framework aims to facilitate application Certification Procurement by LKPP as institution-maker regulation and implementation system certification procurement.

Designing An Information Security Framework For The Indonesia Water Industry Sector

The majority of Indonesia's water industry sectors have implemented smart water management systems as part of their business development, which has an indirect impact on enterprise information security. However, in general, water sector enterprises continue to place a low priority on information security, and the development of information system frameworks is based on generic norms employed by financial firms. There has been no research on information security frameworks especially built for water firms in Indonesia that use information security standards in the utilities sector. This article proposes a solution in the form of a new framework for Indonesian water firms that combines international information security requirements in the utilities sector with Indonesian government rules. This approach of development combines worldwide standards with national rules. The Cybersecurity Capability Maturity Model (C2M2) and ISO 27019 are two international standards commonly used by utility businesses globally. Government Regulation or Peraturan Pemerintah (PP) Number 71 of 2019 on the Implementation of Electronic Systems and Transactions is the relevant national regulation. The framework addresses information technology, telecommunications, and operational technology, with four approach categories: governance and ecosystem, protection, defense, and resilience. According to the research findings, the newly integrated framework can be applied and is worthy of recommendation. This framework also meets the standards for information security and can be used by Indonesian water corporations.

E-Commerce Application Security Issues and Various Security Enhancement Techniques

Abstract: A part of the information security framework, e-commerce security is used in areas like data security and computer security, among others. It covers safeguarding electronic commerce assets from unauthorized access, use, modification, or destruction of data. However, due to heightened awareness of attacks, the attackers use phoney websites and apps to circumvent the security of payment-related online activities. This article provides an overview of the many security issues that arise in ecommerce applications and discusses solutions. The study offers a survey of some methods used by different researchers. Due to the growth of e-commerce, most financial transactions now take place online.. They use websites or apps that are offered by businesses, making them more vulnerable to attacks and increasing the probability that attackers may use fake websites and apps. There are several methods that can be employed to defend against vulnerabilities. We have given a survey of the security measures used to protect banking transactions in this paper

A Systematic Review of Risk Management Methodologies for Complex Organizations in Industry 4.0 and 5.0

The large amount of information handled by organizations has increased their dependance on information technologies, which has made information security management a complex task. This is mainly because they cover areas such as physical and environmental security, organization structure, human resources and the technologies used. Information security frameworks can minimize the complexity through the different documents that contain guidelines, standards, and requirements to establish the procedures, policies, and processes for every organization. However, the selection of an appropriate framework is by itself a critical and important task, as the framework must adapt to the characteristics of an organization. In this paper, a general vision of the newest versions of the NIST CSF, ISO/IEC 27001:2022, and MAGERIT frameworks is provided by comparing their characteristics in terms of their approaches to the identification, assessment, and treatment of risks. Furthermore, their key characteristics are analyzed and discussed, which should facilitate the consideration of any of these frameworks for the risk management of complex manufacturing organizations.

Security Challenges and various methods for Increasing Security in E-Commerce Applications

Abstract: E-Commerce security is a component of information security framework and applied to avenues including data security, computer security etc. It includes protection of E-Commerce assets against illegal access, use modification or demolishing of data. However, due to increase in sensitivity to assaults, the attackers employ phony websites and apps to breach the security of payment related activities over the internet. This paper presents the review of various security challenges encountered in e-commerce applications and the methods to avoid or overcome them. The paper provides a survey of some techniques employed by various researchers. The majority of banking transactions now take place online due to the expansion of e-commerce. They use merchant-provided websites or pay-per-use apps which increases their sensitivity to assaults and increases the likelihood that attackers will employ phony websites and apps. There are numerous strategies for protecting against vulnerabilities that can be used. In this paper, we have provided a survey of the Security methods employed for safeguarding the banking transactions.

ISO 27001: ANALYSIS OF CHANGES AND COMPLIANCE FEATURES OF THE NEW VERSION OF THE STANDARD

Managing information security in the organization may be a daunting task, especially considering that it may encompass many areas from physical and network security to human resources security and management of suppliers. This is where security frameworks come in handy and put formality into the process of the design and implementation of the security strategy. While there are a bunch of different information security frameworks out in the wild, the most commonly-found and preferred by security professionals worldwide is ISO/IEC 27001. It combines both the quite comprehensive set of security controls to cover the most important security areas and wide applicability which allows applying this framework to all kinds of organizations. While cyberspace is constantly changing, companies should also adapt their approaches to the organization of information security processes. In order to respond to new challenges and threats to cyber security, the International Organization for Standardization (ISO) at the end of 2022 has published an updated version of the ISO/IEC 27001:2022 standard, which from now on should be taken into account by all organizations that aim to implement and certify its information security management system (ISMS). The purpose of this article is to provide a brief overview of the new edition of the popular standard, фтв describe the key changes in the structure and description of security controls; as well as develop recommendations for achieving compliance with the requirements of the updated version of the standard.

AUDIT KEAMANAN SISTEM INFORMASI PERPUSTAKAAN: STUDI KASUS DI UNIVERSITAS NAHDLATUL ULAMA AL GHAZALI CILACAP

Nahdlatul Ulama University Al Ghazali Cilacap began to utilize Information and Communication Technology (ICT) to support existing processes so as to produce accurate and fast information. In the implementation of Information and Communication Technology (ICT) governance, information is a very important asset for a company, both information related to management, finance, reports and other information. Leaks, damage, inaccuracies. The aim is to find out the extent of the completeness and maturity of Information Technology at Nahdlatul Ulama Al Ghazali University, Cilacap. However, they do not yet know whether their framework has met the requirements for the level of completeness and maturity of the application of the ISO 27001 standard. For this reason, it is necessary to carry out an information system security audit to determine the current condition compared to the expected condition. In the process, the audit is carried out based on the ISO 27001 Standard which is applied in the form of an evaluation of the KAMI Index. A thorough assessment was carried out on five areas of information security using the US Index version 2.3 template from the Ministry of Communications and Information Technology (Kominfo). The audit results are in the form of recommendations for evaluating the completeness and maturity of the information security framework based on the ISO 27001 standard.

A Client-Centered Information Security and Cybersecurity Auditing Framework

Information security and cybersecurity management play a key role in modern enterprises. There is a plethora of standards, frameworks, and tools, ISO 27000 and the NIST Cybersecurity Framework being two relevant families of international Information Security Management Standards (ISMSs). Globally, these standards are implemented by dedicated tools to collect and further analyze the information security auditing that is carried out in an enterprise. The overall goal of the auditing is to evaluate and mitigate the information security risk. The risk assessment is grounded by auditing processes, which examine and assess a list of predefined controls in a wide variety of subjects regarding cybersecurity and information security. For each control, a checklist of actions is applied and a set of corrective measures is proposed, in order to mitigate the flaws and to increase the level of compliance with the standard being used. The auditing process can apply different ISMSs in the same time frame. However, as these processes are time-consuming, involve on-site interventions, and imply specialized consulting teams, the methodology usually adopted by enterprises consists of applying a single ISMS and its existing tools and frameworks. This strategy brings overall less flexibility and diversity to the auditing process and, consequently, to the assessment results of the audited enterprise. In a broad sense, the auditing needs of Small and Medium-sized Enterprises (SMEs) are different from large companies and do not fit with all the existing ISMSs’ frameworks, that is a set of controls of a particular ISMS is not suitable to be applied in an auditing process, in an SME. In this paper, we propose a generic and client-centered web-integrated cybersecurity auditing information system. The proposed system can be widely used in a myriad of auditing processes, as it is flexible and it can load a set of predefined controls’ checklist assessment and their corresponding mitigation tasks’ list. It was designed to meet both SMEs’ and large enterprises’ requirements and stores auditing and intervention-related data in a relational database. The information system was tested within an ISO 27001:2013 information security auditing project, in which fifty SMEs participated. The overall architecture and design are depicted and the global results are detailed in this paper.

Legal Analysis on Ransomware Attack from Personal Information Protection Act, Company Act and Civil Code: Based on Information Security and Law Framework

Legal Analysis on Ransomware Attack from Personal Information Protection Act, Company Act and Civil Code: Based on Information Security and Law Framework

Науково-методичні засади оцінки ефективності процесу управління інформаційною безпекою підприємств малого та середнього бізнесу: кібербезпека та інтелектуальна власність

The aim of the article is to study the scientific and methodological foundations of assessing the efficiency of the information security management process of small and medium-sized businesses and develop recommendations for improving its efficiency in the face of growing challenges and threats to cybersecurity and intellectual property. The main research methods were: analysis, synthesis, generalization, tabular, graphical, and integrated approach. The importance and necessity of timely assessment of the efficiency of the information security management process of small and medium-sized businesses due to the growing cyberthreats to their intellectual property as a basis for innovative development in a pandemic, war, digitalization was highlighted. The process of information security management for the protection of intellectual property (IPR) was substantiated as a reliable basis for innovative development of small and medium-sized businesses. Emphasis is placed on the growing importance, role and importance of cybersecurity for the functioning and development of small and medium-sized businesses in the face of new challenges and threats. A scientific and methodological approach to assessing the efficiency of the information security management process in the context of IPR protection of small and medium-sized enterprises in the conditions of a growing number of challenges and threats has been developed and proposed for use. Emphasis was placed on the expediency of a detailed study of directions for improving the regulatory framework for information security to protect the IPR of small and medium-sized businesses in the face of countering the cyber threats. Prospective directions of research on this issue were highlighted: development of information security strategy for IPR protection in the context of prevention of new challenges and threats; improving the organizational aspects of information security management for the protection of IPR; development of digital culture of small and medium-sized businesses as a factor in improving the efficiency of the information security management process in the face of digitalization challenges.