Information Security Management Practices Research Articles

CyberFusion Protocols: Strategic Integration of Enterprise Risk Management, ISO 27001, and Mobile Forensics for Advanced Digital Security in the Modern Business Ecosystem

This research paper explores the integration of Enterprise Risk Management (ERM), the ISO 27001 standard, and mobile forensics methodologies as a comprehensive framework for enhancing digital security measures within modern business ecosystems. Employing a quantitative research design, this paper utilized a survey methodology, gathering data from 372 professionals across various sectors including risk management, IT/security, and forensic analysis. The analysis was conducted using Partial Least Squares Structural Equation Modeling (PLS-SEM) to test the research hypotheses and assess the impact of the integrated approach on organizational digital security capabilities. The findings reveal a significant positive effect of integrating ERM, ISO 27001, and mobile forensics on an organization’s ability to manage digital risks effectively. Specifically, the integrated approach was found to enhance strategic digital security management, improve the identification, assessment, and mitigation of digital risks, strengthen information security management practices, and elevate the effectiveness and efficiency of digital crime investigation processes. These outcomes underscore the value of a cohesive strategy that leverages the strengths of ERM, ISO 27001, and mobile forensics in addressing the complex and interconnected digital threat landscape. Based on the results, the study recommends adopting a holistic security framework, investing in continuous professional development, leveraging technological advancements for proactive security management, and fostering a culture of security and collaboration. Such measures are crucial for organizations aiming to enhance their resilience against cyber threats and protect their digital assets in the face of sophisticated cyber-attacks. This research contributes to the field of cybersecurity by providing empirical evidence on the benefits of an integrated approach to digital security, offering practical guidelines for organizations seeking to improve their digital security measures, and highlighting the need for continuous adaptation and collaboration in the fight against cyber threats.

Beyond Conventional Threat Defense: Implementing Advanced Threat Modeling Techniques, Risk Modeling Frameworks and Contingency Planning in the Healthcare Sector for Enhanced Data Security

This research study explores the integration of advanced threat and risk modeling with scenario and contingency planning to enhance security and resilience within healthcare organizations. Given the escalating complexity and frequency of cyber threats targeting the healthcare sector, the study assesses the efficacy of a synergistic cybersecurity approach. Utilizing a quantitative research methodology, data were collected through a survey administered to 452 healthcare practitioners, focusing on their perceptions and experiences with cybersecurity threats, risk modeling techniques, and the effectiveness of scenario and contingency planning. The survey incorporated a structured questionnaire utilizing Likert scale closed-ended questions, analyzed using Partial Least Squares Structural Equation Modeling (PLS-SEM) to test the proposed four hypotheses related to the impact of advanced threat and risk modeling and scenario and contingency planning on the cybersecurity posture and operational resilience of healthcare organizations. Results indicated a significant positive relationship between advanced threat modeling and scenario planning with the cybersecurity posture of healthcare organizations, which, in turn, notably enhances organizational resilience. Specifically, the study found that integrating advanced threat and risk modeling with scenario and contingency planning significantly improves the ability of healthcare organizations to identify, assess, and mitigate cyber threats effectively. Furthermore, the findings suggest that such integration contributes to more informed decision-making, improved information security management practices, and more effective and efficient digital crime investigation processes. The research study concludes that a comprehensive approach integrating advanced threat and risk modeling with scenario and contingency planning significantly enhances healthcare organizations' cybersecurity posture and operational resilience. The study recommends adopting an integrated cybersecurity strategy, continuous cybersecurity education for all organizational members,regular cybersecurity assessments, and fostering collaboration for enhanced cybersecurity intelligence.

Understanding employees' responses to information security management practices: a person-environment fit perspective

ABSTRACT This study tests the person–environment fit theory in information security (ISec), which describes situations in which the extent of ISec management is linked to positive or negative employee outcomes. We hypothesise that employees appraise their organisational ISec depending on the mismatch or match perception between their needs and organisational supplies. We define a mismatch as ISec misfit and a match as ISec fit and develop hypotheses framing the relationship between ISec fit (vs. misfit), employees’ emotional reactions (anxiety and attentiveness), and, subsequently, ISec behaviours (ISec in-role, extra-role, and violation behaviours). We conduct quadratic polynomial regressions and apply response surface methodology to test our hypotheses and obtain two findings. First, ISec management are proactively needed by employees instead of prior enforcement perspective. The results show that ISec management practices are appraised negatively when they either exceed or fail to meet employees’ preferences. Second, in expounding on a theoretical construction and empirical test of ISec fit and misfit and their relationships with employee outcomes, we find that attentiveness is greater with ISec fit, whereas anxiety is higher and attentiveness is lesser with ISec misfit. We also find that emotion mediates employees’ ISec behaviours, while only anxiety does not mediate extra-role behaviour.

The Institutionalisation of Information Security Management Practices in selected Organisations in Uganda

The study aimed at examining the extent to which information security management practices were institutionalised in corporate organisations. Evidence shows that failure by organisations to entrench the information security management practices (ISMPs) into organisations’ structures opens the gateway for attacks, threat actors and information breaches to cause harm to information assets with ease. The study explored the phenomenon in its social setting hence the adoption of descriptive research design as the research methodology. The institutional theory was adopted as a new dimension in examining information security management in organisations. This theory suggests that control gears like coercive, normative, mimetic and management commitment could be used to effectively entrench security guidelines in organisations. Methodical scrutiny of the institutionalisation process: development, implementation and maintenance, and evaluation were also carried out. The researcher relied on human experience to make sense of the institutionalised processes. Extant literature was reviewed, and survey questionnaires were developed based on the eleven ISMPs and administered to purposively selected respondents from the two organisations. The eleven ISMPs covered include state of information security policy, asset management, secure information sharing, supply chain security, access management, network security controls, portable and removable media security, remote access security, protective monitoring of information systems, implementation of information security back-ups, and security accreditation by professional bodies. Data analysis was done using SPSS. Findings indicate that organisations have not fully incorporated all the eleven ISMPs covered as best practices and standards. Based on the results from the field, answers to the research questions were partly realised. Recommendations like the implementation of ISMPs to check deficiencies identified, customisation of security guidelines to protect information assets and institutionalisation of security practices at all levels were suggested. Overall, the study was a positive step towards the institutionalisation process of ISMPs in organisations

A conceptual framework for assessing information security management practices in selected universities in Uganda

The purpose of this paper is to present a conceptual framework for assessing managerial level information security practices, governance, and activities in selected university institutions in Uganda. Extant literature was drawn from existing information security management practices in different organizations. The proposed conceptual framework consisted of four manageable areas, namely, information security governance practices, information security practices, personnel management practices, and physical security practices. These areas are further subdivided into 25 categories that provide a formal checklist for assessing existing information security management practices in university institutions in Uganda.

Organisational Information Security Management Maturity Model

Information Security Management (ISM) is a systematic initiative in managing the organisation’s information security. ISM can also be defined as a strategic approach to addressing information security (IS) risks, breaches, and incidents that could threaten the confidentiality, integrity, and availability of information. Although organisations have complied with ISM requirements, security incidents are still afflicting numerous organisations. This issue shows that the current implementation of ISM is still ineffective. The ineffective ISM implementation illustrates the low maturity level. To achieve a higher level of maturity, organisations should always evaluate their ISM practices. Several maturity models have been developed by international organisations, consultants, and researchers to assist organisations in assessing their ISM practices. However, the current models do not evaluate ISM practices holistically. The measurement dimensions in current models are more focused on assessing certain factors only. This caused the maturity assessment to be not executed comprehensively. Therefore, this study aims to address this shortcoming by proposing a comprehensive maturity assessment model that takes into account ISM success factors to evaluate the effectiveness of the implementation. This study adopted a mixed-method approach, which comprises qualitative and quantitative studies to strengthen the research finding. The qualitative study analyses the existing literature and conducts interviews with nine industry practitioners and six experts while the quantitative study involves a questionnaire survey. The data obtained from the qualitative study were analysed using content analysis while the quantitative data employed statistics analysis. The study identified fourteen success factors and fifty-seven maturity dimensions, which each contains five maturity levels. The proposed model was evaluated through experts’ reviews to ensure its accuracy and suitability. The evaluation shows that the model can identify the ISM maturity level systematically and comprehensively. This model will ultimately help the organisations to improve the weaknesses in the implementations thus diminishing security incidents.

The impact of information security management practices on organisational agility

PurposeThis study aims to determine the extent to which information security management (ISM) practices impact the organisational agility by examining the relationship between both concepts.Design/methodology/approachA quantitative method research design has been used in this study. This study was conducted throughout Malaysia with a total of 250 valid questionnaires obtained from managers and executives from the Multimedia Super Corridor (MSC)-status companies. Structural equation modelling (SEM) using partial least square was used to analyse the data and to test all nine hypotheses developed in this study.FindingsFindings from this study indicate that operational agility (OA) is significantly related to ISM practices in MSC-status companies. The validation of the structural model of nine hypotheses developed for this study has demonstrated satisfactory results, exhibited six significant direct relationships and three insignificant relationships.Research limitations/implicationsThis study has addressed the needs for a comprehensive, coherent and empirically tested ISM practices and organisational agility framework. The current theoretical framework used in this study emphasised on the ISM–organisational agility dimensions that are predominantly important to ascertain high level of ISM practices and perceived agility level among the information technology (IT) business companies in Malaysia. With the application of SEM for powerful analysis, the empirical-based framework established in this study was validated by the empirical findings, thus contributing significantly to the field of information security (InfoSec).Originality/valueThis study has filled the research gap between different constructs of ISM practices and OA. The model put forth in this study contributes in several ways to the InfoSec research community. The recognition of InfoSec practices that could facilitate organisational agility in the IT industry in Malaysia is vital and contributes to more value creation for the organisations.

Information security management practices: study of the influencing factors in a Brazilian Air Force institution

This article aims at analyzing the factors which influence the staff of the Air Force In-formation Technology Board – DTI in relation to the understanding of the application of the Information Security Management practices. This attempt was based on the hypothetical-deductive method and, as to its objective, it was descriptive in nature. As to the approach of the research problem, it was quantitative in nature. In order to achieve the proposed objective, an adaptation of the Theoretical Technology Acceptance Model – TAM, which allowed the analysis of the relation between sociodemographic profile, perceived ease of use, perceived usefulness, attitude and behavior of the users, and the level of understanding of the Information Security practices. The survey was conducted with 59 military servants and civilians which are part of the Brazilian Air Force Information Technology Board, to whom a questionnaire was applied, submitted and approved by the Committee of Ethics in Research (CAAE: 62636016.7.0000.5111), which was based on the precepts of ISO/IEC 27001 (2013) and 27002, which deal, respectively, with the Information Security Management system and with the code of practice for Information Security controls. Once the data were gathered, they were tabu-lated and statistically analyzed, which enabled the demonstration of the influence of sociodemographic and behavioral factors and of the precepts of the TAM in the perception of the Information Security practices by the DTI staff.

A utilitarian re-examination of enterprise-scale information security management

Purpose An action is utilitarian when it is both useful and practical. This paper aims to examine a number of traditional information security management practices to ascertain their utility. That analysis is performed according to the particular set of challenges and requirements experienced by very large organizations. Examples of such organizations include multinational corporations, the governments of large nations and global investment banks. Design/methodology/approach The author performs a gap analysis of a number of security management practices. The examination is focused on the question of whether these practices are both useful and practical when used within very large organizations. Findings The author identifies a number of information security management practices that are considered to be “best practice” in the general case but that are suboptimal at the margin represented by very large organizations. A number of alternative management practices are proposed that compensate for the identified weaknesses. Originality/value Quoting from the conclusion of the paper: We have seen in our analysis within this paper that some best practices can experience what economists refer to as diminishing marginal utility. As the target organization drifts from the typical use-case the amount of value-added declines and can potentially enter negative territory. We have also examined the degree of innovation in the practice of security management and the extent to which the literature can support practical, real-world activities. In both the areas, we have identified a number of opportunities to perform further work.

Information Security Management Practices: Case Studies from India

In recent years, information security has gained attention in organizations across diverse businesses and sectors. Primary reasons of this can be the new and innovative ways of information handling (during generation, processing, storage and distribution), and dependence of business processes on new and emerging IT/ICT mediums in organizations to carry out daily business activities. This has made organizations agile in terms of functioning and, at the same time, has posed new challenges. In this direction, the present study aims to explore and examine information security management (ISM) practices of two IT development and services organizations in India. In case study design, the study adopts qualitative research route to understand the current ISM practices of the case organizations. The observations derived from semi-structured interviews are presented using descriptive analysis methodology. Further, SAP-LAP (Situation, Actor, Process—Learning, Action, Performance) method of inquiry is used to analyse the findings from case studies. Results highlight the importance of consistent top management support, organizational information security culture and a proper monitoring system for ISM effectiveness in organizations. Insights derived from the study can be helpful for managers and decision makers in managing organizational information security practices.

Information Security Management (ISM) Practices: Lessons from Select Cases from India and Germany

The increasing dependence of businesses over information and the changing ways of information usage with modern IT/ICT tools and mediums, have created an unavoidable need of information security in organizations. Earlier, the technical measures were used to fulfill this need; however, it has been realized that technology alone is unable to address the challenges of information security management (ISM) in organizations. Management and behavioral aspects are pivotal to build an ISM system in organizations. This paper makes an attempt to understand and examine the current ISM practices of two large size, global IT and management services and consulting orga- nizations, one from India and another from Germany. In a case design, the study adopts qualitative research route and semi-structured interviews were conducted across hierarchy in both the organizations. Observations from interviews are portrayed using descriptive analysis meth- odology. Further, to draw learning from the cases, SAP- LAP method of inquiry was used to understand the present status of ISM practices in both the organizations. Finally, the paper discusses the implications of the findings and scope for the future research.

Risk Management Model of Information Security in IC Manufacturing Industry

I nformation system has become the indispensable support platform required by daily operations in modern enterprises. IC manufacturing industry is the most important base of advanced information products . Its rich knowledge innovation, complex production process , and high degree of cooperation require particular risk management on i nformation security. On the basis of referencing to latest information security management standards, PDCA risk management and best practices, this paper propose d an dynamic risk management model for the information security management in IC manufacturing industry. A fter an in-depth analysis of the actual current situation of IC manufacturing in China , that model has been successfully applied to guide the information security management practices in IC manufacturing compan ies, and offers a comprehensive and practical solution .

Applying an extended model of deterrence across cultures: An investigation of information systems misuse in the U.S. and South Korea

Intentional employee misuse of IS is a global problem. Research suggests that security countermeasures can deter misuse by increasing the perceived certainty and severity of punishment for such behavior. However, the value of generalizing this work beyond Western cultures is open to question. In our study, we examined whether national culture influenced the deterrent capabilities of security policies, security education, training, and awareness programs and computer monitoring. Using U.S. and Korean samples, we found evidence that the deterrent effect of certain security countermeasures varied between the two countries, as did the influence of age and gender. The results have implications for information security management practices in global businesses.

Security excellence from a total quality management approach

This paper focuses on the synergy of business and security requirements to create a holistic methodology or approach. The integration revolves around the concept of total quality management to measure the security posture and is based on the premise that security requirements must be aligned and fused with the business' objectives. The postulated security methodology has extended the total quality management and business excellence philosophies to create a new security excellence approach. The American National Institute of Standards and Technology's metrics are used as benchmarks to determine the security areas that should be addressed while the European Framework for Quality Management is used to reflect the integration with the National Institute of Standards and Technology's metrics and to represent the domains in a business excellence approach. The fusion is then extended to the Control Objectives for Information and Related Technology and, finally, to the international Standard ISO/IEC 17799 (Information technology – security techniques – Code of practice for information security management) to depict the merger between security and business domains along a TQM approach and to be transferable to any standard or regulation by being able to incorporate acceptable security requirements into the underlying framework.

Collaborative risk method for information security management practices: A case context within Turkey

In this case study, a collaborative risk method for information security management has been analyzed considering the common problems encountered during the implementation of ISO standards in eight Turkish public organizations. This proposed risk method has been applied within different public organizations and it has been demonstrated to be effective and problem-free. The fundamental issue is that there is no legislation that regulates the information security liabilities of the public organizations in Turkey. The findings and lessons learned presented in this case provide useful insights for practitioners when implementing information security management projects in other international public sector organizations.

Contribution of corporate social responsibility to information security management

Contemporary societies develop scepticism about the social responsibility of businesses. There are expectations that firms/corporations/industries/companies make more than just economic contributions. In the area of information technology, more and more companies recognize their responsibility to promote information security management, above and beyond the level required by law, in order to achieve/build a secure information society for daily business operations. While concepts of Corporate Social Responsibility (CSR) have been applied to a plethora of sectors/industries, information security from the aspect of CSR is still behind in both theory and practice. The purpose of this paper is to apply the concept of CSR to the practice of information security management. The paper reviews and analyzes the theoretical background (definitions) of CSR from both practice and the literature and tries to explain what socially responsible management of information security actually is.

Information security management objectives and practices: a parsimonious framework

PurposeAs part of their continuing efforts to establish effective information security management (ISM) practices, information security researchers and practitioners have proposed and developed many different information security standards and guidelines. Building on these previous efforts, the purpose of this study is to put forth a framework for ISM.Design/methodology/approachThis framework is derived from the development of an a priori set of objectives and practices as suggested by literature, standards, and reports found in academia and practice; the refinement of these objectives and practices based on survey data obtained from 354 certified information security professionals; and the examination of interrelationships between the objectives and practices.FindingsThe empirical analysis suggests: four factors (information integrity, confidentiality, accountability, and availability) serve as critical information security objectives; most of the security areas and items covered under ISO 17799 are valid with one new area – “external” or “inter‐organizational information security”; and for moderately information‐sensitive organizations, “confidentiality” has the highest correlation with ISM practices; for highly information‐sensitive organizations, “confidentiality”, “accountability”, and “integrity” are the major ISM objectives. The most important contributor to information security objectives is “access control”.Research limitations/implicationsThis study contributes to the domain of information security research by developing a parsimonious set of security objectives and practices grounded in the findings of previous works in academia and practical literature.Practical implicationsThese findings provide insights for business managers and information security professionals attempting to implement ISM programs within their respective organizational settings.Originality/valueThis paper fulfills a need in the information security community for a parsimonious set of objectives and practices based on the many guidelines and standards available in both academia and practice.

Triggers of Change in Information Security Management Practices

Triggers of Change in Information Security Management Practices

Applying ISO 17799:2005 in information security management

In this paper, we discussed ISO 17799:2005 control, process, and security organisation structure. According to the results, the code of practice for information security management includes: capture the processes for implementing information security management in organisational Information Security Management System (ISMS), provide an organisational security structure to assess the extent information security management efforts, provide a comprehensive framework for ensuring the effectiveness of information security control over the information sources that support operations and assets. A case example (National Tax Administration Southern Taiwan Province) of an organisational security management, including organisational security structure, ISMS plan-do-check-act cycle, and information asset assessment management are discussed.

Information security architecture

To work best information security must be holistic and fit into a company seamlessly. The practice should take account of personnel security, user access control, network security and regulatory aspects. Holistic security should integrate technology, people and processes. Information security architecture is a concept that specialists have come up with to achieve this. It is a management process intertwined into the day-to-day business operations of a company. The big problem is that no standardised architecture exists. Different researchers and groups have tried their hand at defining a framework that includes: BS 7799 ISO Part 2 Multi-planes model. PFIRES Meta Security Group ISA by Tudor Some focus on technical issues, while others focus on security policy. Some are merely methodologies that do not mention technological issues or the importance of a security culture. An information security architecture should make suggestions on how different controls can be synchronised… Implementing information security is a complex, time-consuming and costly process. Codes of practice for information security management indicate that information security is a multidisciplinary concept cutting horizontally across an. All aspects regarding information security must be addressed in a well-structured and holistic manner, failure of which may result in information infrastructures that are far less secure, with far more frequent and damaging security breaches. Information security experts have responded to this demand for a holistic approach towards the implementation of information security by introducing the concept of an information security architecture. The problem, however, is that no standardised, comprehensive information security architecture currently exists. This paper presents a state-of-the-art overview of distinguishable approaches, all attempting to define an information security architecture. This is followed by a proposition of requirements for an integrated Information Security Architecture (ISA).