Information Security Management Standards Research Articles

SUBSTANTIATION OF THE NEED TO IMPLEMENT A CONTINUOUS INFORMATION SECURITY PROCESS AT ENTERPRISES

The article discusses information security in the system of an industrial enterprise. Attention is focused on the need to implement a continuous information security process to protect all information assets from leaks, theft and unauthorized disclosure, the main provisions of information security management standards are analyzed. Objective: To optimize the methods of software protection of modern industrial enterprises, as well as to reduce threats and vulnerabilities related to information security at enterprises. Method or methodology of the work: In the process of investigating the problem, analytical methods of analysis were used. Results: The need to use ISO/IEC 27001 standards and the PDCA (Plan-Do-Check-Act) model at industrial enterprises of high-tech sectors of the economy in order to reduce threats and losses of information security, identify critical factors that negatively affect business processes and the enterprises themselves. Practical implications: The results obtained can be used as a theoretical basis for existing assessments of information security tools and automated security systems at high-tech industrial enterprises in modern economic conditions.

A Client-Centered Information Security and Cybersecurity Auditing Framework

Information security and cybersecurity management play a key role in modern enterprises. There is a plethora of standards, frameworks, and tools, ISO 27000 and the NIST Cybersecurity Framework being two relevant families of international Information Security Management Standards (ISMSs). Globally, these standards are implemented by dedicated tools to collect and further analyze the information security auditing that is carried out in an enterprise. The overall goal of the auditing is to evaluate and mitigate the information security risk. The risk assessment is grounded by auditing processes, which examine and assess a list of predefined controls in a wide variety of subjects regarding cybersecurity and information security. For each control, a checklist of actions is applied and a set of corrective measures is proposed, in order to mitigate the flaws and to increase the level of compliance with the standard being used. The auditing process can apply different ISMSs in the same time frame. However, as these processes are time-consuming, involve on-site interventions, and imply specialized consulting teams, the methodology usually adopted by enterprises consists of applying a single ISMS and its existing tools and frameworks. This strategy brings overall less flexibility and diversity to the auditing process and, consequently, to the assessment results of the audited enterprise. In a broad sense, the auditing needs of Small and Medium-sized Enterprises (SMEs) are different from large companies and do not fit with all the existing ISMSs’ frameworks, that is a set of controls of a particular ISMS is not suitable to be applied in an auditing process, in an SME. In this paper, we propose a generic and client-centered web-integrated cybersecurity auditing information system. The proposed system can be widely used in a myriad of auditing processes, as it is flexible and it can load a set of predefined controls’ checklist assessment and their corresponding mitigation tasks’ list. It was designed to meet both SMEs’ and large enterprises’ requirements and stores auditing and intervention-related data in a relational database. The information system was tested within an ISO 27001:2013 information security auditing project, in which fifty SMEs participated. The overall architecture and design are depicted and the global results are detailed in this paper.

Developing Cost-effective Cybersecurity Management System for Academic Institutions in Saudi Arabia

Technology in the recent years has dramatically invaded the education system and profoundly changed the classroom landscape, especially in modern universities. Internet of Things (IoT) devices, such as automated attendance tracker, interactive whiteboards, etc., are significantly utilized to create a positive and engaging classroom atmosphere. Unfortunately, some emerging universities deploy these smart tools before establishing an effective cybersecurity management system to protect critical characteristics of information, i.e., confidentiality, integrity, and availability. The cybersecurity management system in academic institutions is the most-targeted system for cyberattacks, which is growing rapidly and hits businesses worldwide every day. To shed lights on the impact of this critical problem, we introduce a cybersecurity management system designed specifically for academic institutions based on Saudi Arabia. The paper also looks closely at the best practices and the adoption of international information security management standards deployed in worldwide academic institutions.

The ISO/IEC 27001 information security management standard: literature review and theory-based research agenda

PurposeAfter 15 years of research, this paper aims to present a review of the academic literature on the ISO/IEC 27001, the most renowned standard for information security and the third most widespread ISO certification. Emerging issues are reframed through the lenses of social systems thinking, deriving a theory-based research agenda to inspire interdisciplinary studies in the field.Design/methodology/approachThe study is structured as a systematic literature review.FindingsResearch themes and sub-themes are identified on five broad research foci: relation with other standards, motivations, issues in the implementation, possible outcomes and contextual factors.Originality/valueThe study presents a structured overview of the academic body of knowledge on ISO/IEC 27001, providing solid foundations for future research on the topic. A set of research opportunities is outlined, with the aim to inspire future interdisciplinary studies at the crossroad between information security and quality management. Managers interested in the implementation of the standard and policymakers can find an overview of academic knowledge useful to inform their decisions related to implementation and regulatory activities.

Understanding Human Aspects for an Effective Information Security Management Implementation

In today's world, information security is a trending as well as a crucial topic for both individuals and organisations. Cyber attacks cause financial loss for businesses with data breaches and production loss. Data breaches can result in loss of reputation, reduced customer loyalty, and fines. Also due to cyber attacks, business continuity is affected so that organisations cannot provide continuous production. Therefore, organisations should reduce cyber risks by managing their information security. For this purpose, they may use ISO/IEC 27001 information security management standard. ISO/IEC 27001:2013 includes 114 controls that are in both technical and organisational level. However, in the practice of security management, individuals' information security behaviour could be underestimated. Herein, technology alone cannot guarantee the safety of information assets in organisations, thereby a range of human aspects should be taken into consideration. In this study, the importance of security behaviour with respect to ISO/IEC 27001 information security management implementation is presented. The present study extensively analyses the data collected from a survey of 630 people. The results of reliability measures and confirmatory factor analysis support the scale of the study.

DEVELOPMENT OF SMART CITIES IN TAIWAN FROM THE PERSPECTIVE OF CLOUD COMPUTING SECURITY

Abstract. Cloud computing is an important part of the development of smart cities and also the focus of the information and communication technology (ICT) industry. From the concept of cloud computing, people and objects in cities are organized based on their application needs and computed in real time. It is a comprehensive utilization of the new generation of information and communication technology. This paper first introduces the concept of cloud computing, smart city construction in Taiwan, and the information security management standard of cloud computing, then describes the cloud computing security framework from three areas,and summarizes the implementation status of cloud computing in Taiwan, government policies, and measures, reaching the conclusion that information transmission must be fast and reliable and ensure personal privacy and security. Any type of information security problem will bring catastrophic consequences. Therefore, cloud computing also brings severe challenges to the traditional information security system.

An information security behavioural model for the bring-your-own-device trend

Background: Organisations have found themselves in a race to embrace bringing your own device (BYOD) in their day-to-day business operations, while at the same time needing to maintain their information security management standards. BYOD is convenient for employees as it allows them to conduct business anywhere and at any time. However, this has resulted in organisations having to rethink their information security management, as BYOD now extends the information security management boundaries to wherever the employees takes their device and wherever there is a network access point.Objective: While technical solutions are offered by various BYOD solution providers, the theme of this article is to propose employee behavioural change for organisations to mitigate the risks that are associated with the BYOD phenomenon.Methods: For this purpose, a literature review was conducted, culminating in the identification of six key traits for the development of a behavioural intention model towards information security. Using the six traits, a questionnaire was developed and loaded on SurveyMonkey, and a survey was subsequently conducted among 270 employees of a selected bank in Zimbabwe.Results: A total of 205 employees responded to the survey, with 179 of the responses being deemed usable (i.e. a response rate of 87%). Data obtained from the survey were subjected to statistical tests, the conclusions of which were used to create the BYOD information security behavioural (BISB) model.Conclusion: The article concludes by proposing the BISB model as an effective option for mitigating the information security challenges in BYOD.

Information security management: policies and standards

Standards and policies are the foundation of information security management. Information security management standards must become more dynamic in reaction to the rapidly evolving threat landscape and policies must be brief but understandable and comprehensive. Both should be measured for compliance and constantly developed and improved.

Medical Organization Information Security Management Based on ISO27001 Information Security Standard

Most of the information security events in medical organizations are due to improper management. This is a clear indication that the security of information is an issue related to information and communication technology and a management issue as well. In a review of literature, most research on information security has focused on information and communication technology issues, such as network security and access control; rarely addressing issues at the management-level. The main purpose of this study is to construct a mechanism for the management of information with regard to security as it applies to medical organizations. This mechanism is based on the eleven control items and one hundred thirty-three control objectives of the ISO27001 information security management standard. This study analyzes and identifies the most common events related to information security in medical organizations and categorizes these events as high risk, transferable-risk, and controlled-risk to facilitate the management of such risk.

Risk Management Model of Information Security in IC Manufacturing Industry

I nformation system has become the indispensable support platform required by daily operations in modern enterprises. IC manufacturing industry is the most important base of advanced information products . Its rich knowledge innovation, complex production process , and high degree of cooperation require particular risk management on i nformation security. On the basis of referencing to latest information security management standards, PDCA risk management and best practices, this paper propose d an dynamic risk management model for the information security management in IC manufacturing industry. A fter an in-depth analysis of the actual current situation of IC manufacturing in China , that model has been successfully applied to guide the information security management practices in IC manufacturing compan ies, and offers a comprehensive and practical solution .

Information security management system “Matrix” based on system approach

The new information security management system is presented in the aspect of introduction of international information security management standards. Scientific novelty of the development is stated. The solutions to problems of analogous products are listed. Structure and operation of the system are briefly described. Application of the product at enterprises is mentioned дуктов. Кратко описаны структура и функционирование системы. Упомянуто применение продукта на предприятиях

Implementing international standards for Information Security Management in China and Europe: a comparative multi-case study

The leading international standards for information security management, ISO/IEC 27001 and ISO/IEC 27002 originate from the UK, but are applied worldwide. This paper explores whether the processes of selection, implementation and use of these interrelated standards differ between China and Europe by studying cases of Chinese and European companies. Chinese companies face some additional problems with the standards but manage to get them successfully implemented in a short period of time. Main differences relate to governance and management of standard adoption. This study is innovative in the method used for standardisation research (comparative multi-case study), and the topic: implementation and impact of information security management standards.

Information security management standards: Problems and solutions

International information security management guidelines play a key role in managing and certifying organizational IS. We analyzed BS7799, BS ISO/IEC17799: 2000, GASPP/GAISP, and the SSE-CMM to determine and compare how these guidelines are validated, and how widely they can be applied. First, we found that BS7799, BS ISO/IEC17799: 2000, GASPP/GAISP and the SSE-CMM were generic or universal in scope; consequently they do not pay enough attention to the differences between organizations and the fact that their security requirements are different. Second, we noted that these guidelines were validated by appeal to common practice and authority and that this was not a sound basis for important international information security guidelines. To address these shortcomings, we believe that information security management guidelines should be seen as a library of material on information security management for practitioners.

Information security management standards: Compliance, governance and risk management

Managing information security as opposed to the IT security is an area that is now eventually coming of age. For many years the focus has been mainly on IT security and with the implementation of such security left to the IT department and technical experts. Early in the 90s things started to change with the first draft of an information security management standard BS 7799 focusing in on security related to people, processes, information as well as IT. Since then there has been many developments taking us to where we are today with these early security management standards being transformed in international standards published by ISO/IEC. These standards are being used by hundreds of thousands of organisations using these standards worldwide. Based on the authors previously copyrighted writings, this article explores what these standards have got to offer organisations, what benefits are to be gained and how such standards have helped with compliance. In particular it focuses in on the insider threat as an example of one of the growing problems that organisations need to deal with and how these international standards are useful in helping to solve the insider threat problem.

A STOPE model for the investigation of compliance with ISO 17799‐2005

PurposeWith the widespread of e‐services, provided by different organizations at the internal intranet level, the business extranet level, and the public internet level, compliance with international information security management standards is becoming of increasing importance for establishing a common and safe environment for such services. The purpose of this paper is to examine the development of a mathematical model that enables the investigation of compliance of organizations with the widely acknowledged international information security management standard ISO 17799‐2005.Design/methodology/approachThe model is based on the strategy, technology, organization, people and environment – STOPE – framework that provides an integrated well‐structured view of the various factors involved. The paper addresses the use of the model for practical investigations; it describes a practical example illustrating possible practical results.FindingsThe results show the strengths and the weaknesses of compliance, with the standard, at different levels: from the level of the measures associated with each of the “131” standard protection controls, up to the level of the STOPE domains.Originality/valueThe paper addresses the use of a mathematical model for practical investigations of compliance with the international information security management standard.

Towards Changes in Information Security Education

Information Security Education Overview Non-availability of skilled staff has been identified as the third most significant cause of the failure of users of information technology to ensure the security of their physical assets and information (Furnell & Clarke, 2005). Organizations employing ISA professionals generally base their assessment of an individual's skill level on the following indicators: * Academic qualifications leading to a diploma and/or degree. * Professional Certifications (CISSP, SSCP, CISA, GISEC, etc.). * Vendor-Specific Certifications (MCSE, CCSP, Comp TIA, Security +, TISIA, etc.). Professional and vendor certifications in Information Security validate competencies and skills, but they are not replacing experience or education. While academic qualifications support broad knowledge and skills in general, professional certifications may be effective in a limited area of operations. Academic programs exposing the students to theoretical concepts and problem solving experience are critical for preparing graduates for jobs in the information security. The critical importance of information security curriculum at universities was stressed in (Irvine, Chin, & Fruickle, 1998) as follows: An educational system that cultivates an appropriate knowledge of computer security will increase the likelihood that the next generation of Information Technology (IT) workers will have the background needed to design and develop systems that are engineered to be reliable and secure. Many educational institutions defined the educational model and curricula based on standards and guidelines promoted by government or other organizations, resulting in numerous ISA education models and curricula. Despite a variety of ISA curricula and diverse educational models, universities often fail to graduate students with skills demanded by employers. Therefore, it is necessary to identify the issues and suggest changes in the curricula to ensure that undergraduates and graduates have gained required skills after completing their studies. We primarily focus on Information Security curricula issues in US, and outline a few distinctions from other parts of the world. We recognize that the international aspects of the Information Security curricula are too broad for a single paper to cover comprehensively. The remainder of the paper is organized in sections that review the ISA programs in US and evaluate the quality of academic information security programs including the requirements for an effective information security curricula implementation as well as future directions for more responsive curricula. In this paper, we suggest the actions that should make the ISA curricula in the universities responsive to the needs of the general population and the industry in which graduates with ISA skills and specialization will be employed. Information Security Education in US The National Institute of Standards and Technology (NIST) and the National Security Telecommunications and Information Systems Security Committee (NSTISSC), along with others, contributed to the guidelines for training and education. In addition, ISO 17799 Information Security Management standard of 2000 with additions in 2002 includes requirements for Information security education and training. NSTISSC directive established the requirement for all federal agencies to develop and implement education, training, and awareness programs for national security systems. The required knowledge areas known as Common Body Knowledge (CBK) were defined by International Systems Security Certification Consortium [(ISC).sup.2]. However, the focus is on practical, low level skills which are identified in various standards. In addition, Electronic Develop-A-Curriculum (EDACUM) program supports the development of a curriculum based on NSTISSI standards. Some colleges and universities have been certified to meet one or more NSTISSI standards. …

Towards maturity of information security maturity criteria: six lessons learned from software maturity criteria

Traditionally, information security management standards listing generic means of protection have received a lot of attention in the field of information security management. In the background a few information security management‐oriented maturity criteria have been laid down. These criteria can be regarded as the latest promising innovations on the information security checklist‐standard family tree. Whereas information security maturity criteria have so far received inadequate attention in information security circles, software maturity endeavours have been the focus of constructive debate in software engineering circles. Aims to analyze what the alternative maturity criteria for developing secure information systems (IS) and software can learn from these debates on software engineering maturity criteria. First, advances a framework synthesized from the information systems (IS) and software engineering literatures, including six lessons that information security maturity criteria can learn from. Second, pores over the existing information security maturity criteria in the light of this framework. Third, presents, on the basis of results of this analysis, implications for practice and research.

Information security management: why standards are important

Information security is no longer a domestic issue. In this age of electronic commerce, one company’s information security certainly affects their business partners. For this reason it became imperative that business partners demand an acceptable level of information security from one another. Information security management standards should certainly play a major role in this regard. In this paper, some information security management standards and their applicability will be discussed and put into context.