Information Security Function Research Articles

Comparing Information Security Compliance Between New Zealand, USA, and Vietnam

ABSTRACT The number of employees working remotely has grown significantly in recent years, creating new challenges for information security functions within organizations. The increasing threat surface and lack of control over personal employee networks and devices pose a significant risk, especially when it comes to information handling and incident reporting. We built upon prior work on the human aspects of information security and conducted a quantitative study to compare behaviors, attitudes, and knowledge of employees from New Zealand, the USA, and Vietnam. Our findings suggest that although information security best practices are universal, some of them are understood and applied differently across the globe. Our study offers valuable practical and theoretical implications and can serve as a foundation for organizations to revise their security education, awareness, and training (SETA) programs to reflect more accurately the nuanced nature of the diverse workforce of the 21st century.

Implementing Converged Security Risk Management: Drivers, Barriers, and Facilitators

Converged security risk management is an approach that addresses interdependencies between security-related business functions that have traditionally been managed by separate departments within organizations. It is a more effective means of addressing organizational security risks and threats than tackling physical and information security challenges separately, given that the boundaries between the two are frequently blurred. However, fully converged security remains the exception rather than the rule, leaving organizations increasingly vulnerable as their adoption and reliance on digital technologies accelerates. Through interviews with eight senior security professionals, this research identified key factors critical to effective converged security risk management, expressed as ‘drivers,’ ‘barriers,’ and ‘facilitators.’ The practitioners’ accounts illuminated how the modern threat landscape continues to drive further the need for such an approach, while the traditional separation of corporate security departments from the information security function in organizations remains a barrier. A greater focus on training and education, as well as soft skills, were identified as key priorities in the drive for an effective converged approach.

Osnovi informaciono-bezbednosne kulture u organizaciji

The mass application of information and communication technologies (ICT) has facilitated the functioning of organizations, but has also increased their vulnerability and conditioned the development of the information security function. Attacks on ICT systems involve people as potential targets of vulnerability, highlighting the importance of paying close attention to an employee's behavior in interactions with elements of the ICT system and its environment, as well as developing an information security culture (ISC) as an integrative component of organizational culture and an important factor in the organization's information security. The paper attempts to set a comprehensive concept of ISC based on the unity of knowledge, perceptions, beliefs and attitudes of employees and their coordinated actions in the application of security measures, which emphasize the role of the organization and its management in creating, building and maintaining ISC. The focus of determining ISC is on understanding and applying information security policy measures, but it also includes the behavior of employees in situations that are not or could not be predicted, when employees are expected to protect the information assets of the organization. The paper identifies the most important external factors that are mostly objective, determined by the situation in the country in which the organization operates and contained in the elements of general social (national) culture and country's economic and technological development. As a specific impact on ISC, the activities of malicious individuals, groups and organizations in cyberspace - stand out, manifested through threats and endangerment to the integrity of the ICT system. Internal factors are mostly subjective and dependent on general organization; the knowledge, vision and actions of management in the field of information security; individual characteristics of people, their values, needs, knowledge, understanding and application of information security policy measures. Among the factors, the highest level of management stands out for its role and importance due to the greatest responsibility for organization's information security, but also as the creator of its strategy and policy, the holder of resource engagement policy, shaper of professional security teams, decisionmaker on hardware and software protection, and supporter, creator and implementer of programs for ISC level raising.

Применение цифровой адаптивной платформы для обучения программированию с функцией формирования навыков командной работы

Research is carried out on approaches for the digital adaptive platform for learning programming with the teamwork skills forming function application. The work environment interface and key components that make the platform adaptable are demonstrated. The platform services responsible for information security functions are detailed. An example of the presented task is given.

사이버 보안 체계와 전망: 미국, 영국, 일본, 한국을 중심으로

The purpose of this study began to discuss Korea"s national cybersecurity system after the 1.25 Great Depression, but still the laws and government organizations related to cybersecurity are responding individually. Therefore, it is to examine the national cybersecurity response system of Japan, which is ahead of us in the U.S., the U.K., and Asia, the major advanced countries in cybersecurity, and suggest suggestions and improvement measures for the domestic cybersecurity system. This research was conducted based on the analysis of the Cybersecurity Developed Countries Analysis Report and the Cybersecurity-related Journal published by domestic organizations. We looked at the Global Cybersecurity Index(GCI) issued annually by the ITU to look at advanced countries in cybersecurity. The first and second most advanced countries in cyber security in GCI and Japan, which has a higher level of cyber security than Korea in Asia, were selected for comparison. We compared and analyzed the major roles of government organizations and departments related to cybersecurity with Korea. Through this, I wanted to present the cyber security-related system that Korea needs to move forward and the four implications that need to be developed. According to the results of comparative analysis, this study confirmed that there are problems such as the inability to establish a system of cyber security due to the lack of unified cyber security laws and control towers in Korea compared to the major advanced countries in cyber security. In addition, this study confirmed that information security and cyber security functions are caused by distribution to various ministries.

ANALYSIS OF SYSTEMS OF MODELING OF MICROCONTROLLERS WITH ADDITIONAL MODULES OF CRYPTOGRAPHIC INFORMATION PROTECTION

The field of application of the protected microprocessor systems includes information security functions: authentication of subjects and objects of information interaction, information encryption, integrity control, access control, key management. Today, the urgent task is to establish the security of microprocessor-based systems using a variety of computer simulation software environments. The work analyzes the most effective and affordable computer simulation programs for microprocessor systems and gives practical recommendations for their use. It has been shown that the most powerful computer-aided design system is the Proteus software suite which allows simulating virtually the operation of various microprocessor devices with support for several microcontroller families from different manufacturers. The main advantages include: performing all stages of development in a single environment; the ability to write, debug, and test firmware, generate diagnostic messages to find programming errors; accelerating the development of a microprocessor device; support for interoperation of hardware devices that are connected through a computer port. Using Multisim in the educational process makes it possible to: review and change the status of the register content, program memory and data, stack cells and bit configuration; visualize the result of the execution of a single command or a program as a whole; demonstrate the practice of joint use of languages C and Assembler in one project in order to optimize the program; to study the basics of operation and features of peripheral devices functioning. However, the limited set of microcontrollers in the Multisim program imposes significant restrictions on the possibility of using it for development of real projects. The computer simulation program TINA has a russified interface that is much easier compared to the Proteus with an ability to enter all the information about the created project into one file. Compared to Multisim, the TINA library contains significantly more microcontroller models, and the built-in programmer allows modifying programs and observing the results.

Research Of Modeling Environments For Microprocessor Systems With Additional Modules Of Cryptographic Information Protection

The field of application of the protected microprocessor systems includes information security functions: authentication of subjects and objects of information interaction, information encryption, integrity control, access control,key management. Today, the urgent task is to establish the security of microprocessor-based systems using a variety ofcomputer simulation software environments. The work analyzes the most effective and affordable computer simulation programs for microprocessor systems and gives practical recommendations for their use. It has been shown thatthe most powerful computer-aided design system is the Proteus software suite which allows simulating the operationof various microprocessor devices with support for several microcontroller families from different manufacturers. Themain advantages include: performing all stages of development in a single environment; the ability to write, debug, andtest firmware, generate diagnostic messages to find programming errors. Using Multisim in the educational processmakes it possible to: review and change the status of the register content, program memory and data, stack cells andbit configuration; visualize the result of the execution of a single command or a program as a whole; demonstrate thepractice of joint use of languages C and Assembler in one project in order to optimize the program; to study the basics ofoperation and features of peripheral devices functioning. However, the limited set of microcontrollers in the Multisimprogram imposes significant restrictions on the possibility of using it for development of real projects. The computersimulation program TINA has a russified interface that is much easier compared to the Proteus with an ability to enter allthe information about the created project into one file. Compared to Multisim, the TINA library contains significantlymore microcontroller models, and the built-in programmer allows modifying programs and observing the results. Beingable to use the free version of TINA-TI and having an online version of TINACloud using cloud technologies makes thisprogram very useful for education. Web service offers many educational resources and the ability to perform research onthe design of microprocessor systems.

Professionalizing the information security of family firms: A family essence perspective

ABSTRACT Family firm leaders are often faced with conflicting pressures and goals. One such situation occurs when deciding whether to pursue professionalized management of a business function as opposed to retaining family control. In this study we examine the decision to professionalize the information security function of the firm while also seeking to maintain the family essence of the business. The results show that traditional institutional pressures encourage professionalism, but the move may be inhibited by family essence.

ЗАБЕЗПЕЧЕННЯ ЕКОНОМІЧНОЇ БЕЗПЕКИ ПІДПРИЄМСТВА: СУТНІСТЬ, ПРИНЦИПИ, ФУНКЦІЇ, МЕТОДИ, ЗАСОБИ

The results of theoretical studies and generalizations about the essence of ensuring the economic security of the enterprise, as well as the principles, functions, methods and means of this process have been presented in the article. It is proposed to consider the economic security of the enterprise as a process of creating conditions for achieving a sufficient level of economic security through protection against threats, based on principles, functions, methods and tools aimed at improving the efficiency, innovation and competitiveness of the enterprise. The principles of ensuring the economic security of the enterprise are systematized according to groups of principles of construction of ensuring the economic security of the enterprise (systematicity, continuity, complexity, legality, innovation, efficiency) and the principles of realization of ensuring the economic security of the enterprise (variability, balance, adequacy, involvement). The study of theoretical approaches to defining the economic security functions of an enterprise as specialized types of tasks aimed at guaranteeing economic security, allowed these functions to systematize and provide them with the following list: information function, identification function, preventive, protective and security functions, evaluation function. Considering the logical relationship between the principles, functions, methods and means of ensuring the economic security of the enterprise, it is proposed to systematize the methods of ensuring economic security in relation to the established functions, namely: monitoring methods; statistical and analytical methods for identifying threats; forecasting and planning methods; analytical methods; administrative and organizational methods; methods of protection against threats. In accordance with the considered principles, functions and methods, a list of means is offered as a constructive, organizational, material embodiment (implementation) of these principles, functions and methods. The means of ensuring the economic security of the enterprise include: information and analytical; organizational and institutional; economic; ideological; technical and technological; legal; social and psychological; power.

The influence of a good relationship between the internal audit and information security functions on information security outcomes

Given the increasing financial impact of cybercrime, it has become critical for companies to manage information security risk. The practitioner literature has long argued that the internal audit function (IAF) can play an important role both in providing assurance with respect to information security and in generating insights about how to improve the organization's information security. Nevertheless, there is scant empirical evidence to support this belief. Using a unique data set, this study examines how the quality of the relationship between the internal audit and the information security functions affects objective measures of the overall effectiveness of an organization's information security efforts. The quality of this relationship has a positive effect on the number of reported internal control weaknesses and incidents of noncompliance, as well as on the numbers of security incidents detected, both before and after they caused material harm to the organization. In addition, we find that higher levels of management support for information security and having the chief information security officer (CISO) report independently of the IT function have a positive effect on the quality of the relationship between the internal audit and information security functions.

Cyber security assurance process from the internal audit perspective

PurposeThe purpose of this study is to analyze the cybersecurity assurance approaches to determine the key issues and weaknesses within the internal audit and risk management perspective. Organizations increasingly rely on digital data to drive their growth and they are interconnected in a complex web to a multitude of stakeholders.Design/methodology/approachIn this paper, cybersecurity is defined, and cybersecurity assurance model is explained based on the relevant literature. In addition, the role of internal auditing is introduced within this new business landscape. Finally, recommendations are made to provide best practices for stakeholders.FindingsThere are four major cyber-focused standards and frameworks in the current literature, namely, Control Objectives for Information and Related Technology, International Organization for Standardization, The American Institute of Certified Public Accountants and National Institute of Standards and Technology. In addition, there are many mechanisms in existence and operation currently which support cybersecurity assurance to prevent major threats. These include risk assessment, risk treatment, risk management, security assurance and auditing.Research limitations/implicationsCyber risk is not something that can be avoided; instead, it must be managed. Hence, it is very important to maintain formal documentation on related cyber controls. Internal audit should be an integral part of cybersecurity assurance process, as internal audit have a unique position to look across organizations. The contribution of internal audit also provides comfort to the Board and Audit Committee.Practical implicationsA model is introduced how the internal audit and information security functions could work together to support organizations accomplish a cost-effective level of information security. The key issues and approaches are explained for how to become a trusted cybersecurity advisor and a sample cybersecurity awareness program checklist is provided at Appendix 1.Social implicationsConsidering cybersecurity threats grow with speed, complexity, and impact, organizations are no longer satisfied with an answer to a question like “are we secure?” instead, they need the answer for such a question like “how to give a reasonable assurance that our business will be secure enough?”. In that respect, the role of internal audit is discussed based on the relevant literature and the current condition of the business environment.Originality/valueA model is introduced how the internal audit and information security functions could work together to support organizations accomplish a cost-effective level of information security. The key issues and approaches are explained for how to become a trusted cybersecurity advisor and a sample cybersecurity awareness program checklist is provided at Appendix 1.

Information security function: Optimum reporting and organization structure

This article addresses two common questions on the mind of most organizations. One is where the information security function should report within the organization and the second is what the right title of a person who is leading the information security program should be. This article also discusses typical activities performed by a security organization and links these activities to the Institute of Internal Auditor’s model of three lines of defense.

Multi-vector threats and the argument for greater convergence

Due to technological innovations and priorities to manage risk at the enterprise level, convergence is occurring between physical and information security functions, responsibilities and missions. In order to adapt to this evolving security environment and protect the organisation from multi-vector threats, information technology (IT), operational technology (OT), and physical security groups must develop trust, enhance communications and information sharing, and engage in cross-domain adaption. As the convergence occurs, organisations are experiencing more multi-vector threats from diverse actors. One area with a high potential for convergence is the security operations centre (SOC). If done properly, the combined joint security operations centre (JSOC) is the most effective way to manage security risks. This paper will address how organisations can best integrate these disparate functions, situations where this cohesion is most effective, and best practices to increase the effectiveness of this integration.

소셜 네트워크 서비스의 보안기능 사용의도에 영향을 미치는 요인 : Facebook을 중심으로

논문투고일:2014년 01월 24일 논문수정완료일:2014년 04월 01일 논문게재확정일:2014년 04월 04일 * 연세대학교 정보대학원 석사 ** 연세대학교 정보대학원 교수, 교신저자 *** 연세대학교 정보대학원 박사 Social networking service (SNS) is a service that allows people to share information, manage relationships with others, and express themselves on the Internet. The number of SNS users have increased explosively with the growth of mobile devices such as smartphones. As the influence of SNS has grown extensively, potential threats to privacy have also become pervasive. The purpose of this study is to empirically examine the main factors that affect users' intentions to use security functions provided by their SNS. The main theories for this study include the rational choice theory and the theory of planned behavior. This study has identified the factors that affect intention to use security functions. In addition, security function awareness and information security awareness are found to be important antecedents for intention to use security functions. The results of this study implies that when SNS providers develop security policies, they should consider the ways to improve users information security awareness and security function awareness simultaneously. Keyword:Social Networking Service, Facebook, Safety of Information, Privacy Concern, Security Vulnerability, Information Security Awareness, Security Function Awareness 韓國IT서비스學會誌 第13卷 第2號 2014年 6月, pp.1-17

Information security knowledge sharing in organizations: Investigating the effect of behavioral information security governance and national culture

This paper presents an empirical investigation on what behavioral information security governance factors drives the establishment of information security knowledge sharing in organizations. Data was collected from organizations located in different geographic regions of the world, and the amount of data collected from two countries – namely, USA and Sweden – allowed us to investigate if the effect of behavioral information security governance factors on the establishment of security knowledge sharing differs based on national culture.The study followed a mixed methods research design, wherein qualitative data was collected to both establish the study's research model and develop a survey instrument that was distributed to 578 information security executives. The results suggest that processes to coordinate implemented security knowledge sharing mechanisms have a major direct influence on the establishment of security knowledge sharing in organizations; the effect of organizational structure (e.g., centralized security function to develop and deploy uniform firm-wide policies, and use of steering committees to facilitate information security planning) is slightly weaker, while business-based information security management has no significant direct effect on security knowledge sharing. A mediation analysis revealed that the reason for the nonsignificant direct relation between business-based information security management and security knowledge sharing is the fully mediating effect of coordinating information security processes. Thus, the results disentangles the interrelated influences of behavioral information security governance factors on security knowledge sharing by showing that information security governance sets the platform to establish security knowledge sharing, and coordinating processes realize the effect of both the structure of the information security function and the alignment of information security management with business needs.A multigroup analysis identified that national culture had a significant moderating effect on the association between four of the six proposed relations. In Sweden – which is seen as a less individualist, feminine country – managers tend to focus their efforts on implementing controls that are aligned with business activities and employees' need; monitoring the effectiveness of the implemented controls, and assuring that the controls are not too obtrusive to the end-user. On the contrary, US organizations establish security knowledge sharing in their organization through formal arrangements and structures. These results imply that Swedish managers perceive it to be important to involve, or at least know how their employees cope with the decisions that have been made, thus favoring local participation in information security management, while US managers may feel the need to have more central control when running their information security function.The findings suggest that national culture should be taken into consideration in future studies – in particular when investigating organizations operating in a global environment – and understand how it affects behaviors and decision-making.

Information Security Professionals' Perceptions about the Relationship between the Information Security and Internal Audit Functions

ABSTRACTInternal auditors and information security professionals both play important roles in protecting an organization's assets. Indeed, there are potential synergistic benefits if they work together. The relationship between the two functions, however, is not always supportive. This paper presents the results of a survey of information security professionals' perceptions about the nature of the relationship between the information security and internal audit functions in their organization. We find that information security professionals' perceptions about the level of technical expertise possessed by internal auditors and the extent of internal audit review of information security are positively related to their assessment about the quality of the relationship between the two functions. We also find that the quality of the relationship between the internal audit and information security functions is positively associated with perceptions about the value provided by internal audit and, most important, with measures of overall effectiveness of the organization's information security endeavors. We discuss the implications of our findings for both research and practice.

The relationship between internal audit and information security: An exploratory investigation

The internal audit and information security functions should work together synergistically: the information security staff designs, implements, and operates various procedures and technologies to protect the organization's information resources, and internal audit provides periodic feedback concerning effectiveness of those activities along with suggestions for improvement. Anecdotal reports in the professional literature, however, suggest that the two functions do not always have a harmonious relationship. This paper presents the first stage of a research program designed to investigate the nature of the relationship between the information security and internal audit functions. It reports the results of a series of semi-structured interviews with both internal auditors and information systems professionals. We develop an exploratory model of the factors that influence the nature of the relationship between the internal audit and information security functions, describe the potential benefits organizations can derive from that relationship, and present propositions to guide future research.

Taming the cyber frontier

In the words of President Barack Obama, in his introduction to the cyber-security strategy document published recently by the White House: “The digital world is no longer a lawless frontier, nor the province of a small elite. It is a place where the norms of responsible, just and peaceful conduct among states and peoples have begun to take hold.” 1 In our increasingly connected society, organisations need to ensure that their information security function is doing all it can to protect corporate reputation. There is considerable risk to an organisation if it is perceived to be a poor cyber-citizen. It is vital that everyone in the organisation understands that he or she has the responsibility to behave in accordance with acceptable and expected behaviours in their online activity. And organisations need to do the same with their policies and actions. The risk of successful hacktivist attacks is greatly mitigated by well-implemented, regular information security measures. Greg Nowak, Principal Research Analyst at the Information Security Forum (ISF), explains how organisations can formulate effective policies.

Governing Information Security

Governance of the information security function is critical to effective security. In this paper, the authors present a conceptual model for security governance from the perspective of decision rights allocation. Based on Da Veiga and Eloff’s (2007) framework for security governance and two high-level information security documents published by the National Institute of Standards and Technology (NIST), the authors present seven domains of information security governance. For each of the governance domains, they propose a main decision type, using the taxonomy of information technology decisions defined by Weill and Ross (2004). This framework recommends the selection of decision rights allocation patterns that are proper to those decision types to ensure good security decisions. As a result, a balance can be achieved between decisional authority and responsibility for information security.

Evaluating the Perceived Impact of Collaborative Exchange and Formalization on Information Security

INTRODUCTION Today, in large part, information security is the implementation of controls and best practices suggested by consultants, standard governing bodies (i.e. National Institute of Standards & Technology) (NIST), International Organization for Standardization / International Electrotechnical Commission (ISO/IEC), etc.), the organization's information security department and, sometimes, the organization's employees. While the use of global standards of practice, top management and the information security department within the organization to guide information security planning and implementations may be useful, existing research consistently shows a positive relationship exists between user involvement in planning and the effectiveness of the information systems function within organizations (Gottschalk, 1999; Sambamurthy et al., 1994; Segars & Grover, 1998). A deliverable of the information security planning process is the organization's information security policies and procedures. Standard governing bodies (NIST, ISO/IEC) and researchers (Bidgoli, 2003; Garrison & Posey, 2006) stress the importance of creating information security policies and provide guidance on the different types of information security policies that an organization may need. This research attempts to examine the impact of end-user involvement and formalized information security policies on the effectiveness of the information security function within organizations. Specifically, this study focuses on two antecedent variables, collaborative exchange and formalization, and how it impacts the effective utilization of the information security strategies of deterrence, detection and recovery. Collaborative exchange is an assessment of the extent of collaboration between upper-level management, end users and the information security function. Formalization is an assessment of the extent of established formal information security policies within an organization. The purpose of this research is twofold. First, this research aims to examine the individual effects of formalization and collaborative exchange on the effectiveness of information security detection, deterrence, and recovery activities. Much of the effort expended in the management of information security is in developing and enforcing information security policies. By examining formalization separately, the impact of information security policy development on effective utilization of information security strategies can be assessed. The second aim of this research is to examine the impact of collaborative exchange and formalization in concert on the effectiveness of information security detection, deterrence, and recovery activities. Evaluating complementary effect of collaborative exchange and formalization on effective utilization of information security strategies provides evidence supporting the importance of establishing information security policies with input and effort from all major constituencies within the organization. This study makes several contributions to the literature and practice. First, this research provides insight into how management choices in regards to establishing formal communication channels and developing information security policies may impact the effectiveness of the information security function. Second, the presence of the dependent variable, effectiveness of detection, deterrence and recovery activities, gives academics and practitioners a success measure which can guide more effective decision making in the information security domain. The remainder of this manuscript is organized as follows. The next section discusses the literature supporting the constructs of interest in this study. The following two sections will present the methodological approach taken in this study and the results of data collection. The next section will present the efforts in data analysis. The last section will present a discussion of the important findings and limitations of this research. …