Information Security Management System Research Articles

Redesigning the HR processes for scaling up ISOQAR (India) Private Limited

Learning outcomes Post analysis of the case study, students will be able to comprehend the significance of Six Sigma and its integration with the human resources (HR) processes in the service sector. Post case study discussion, students will be able to: examine the HR processes of ISOQAR (India) and deduce the reasons to seek change in their approach; validate the importance of integrating Six Sigma in the human resource management (HRM) framework of an organization; and categorize the difficulties encountered while implementing Six Sigma in the service sector compared to those in a manufacturing environment. Case overview/synopsis In September 2006, four senior employees of an audit firm made the decision to start their own venture. They identified a gap in a sizable and fiercely competitive auditing industry. Nishid Shivdas, Suhas Risbood, Shiv Prakash Bhutra and Burgis Bulsara, co-founders of ISOQAR (India), had distinct leadership experiences that drove the organization to concentrate on developing a broad range of services, with a focus on management consulting, training and audit services. They created a distinctive positioning in market in a short span and reported growth by building strong customer relationships, providing high-quality service and personalized attention to individual clients and meeting deadlines. The wide gamut of services included areas such as the payment card industry, data security standard, information security management systems, business continuity management, service management systems, food safety management system, Responsible Jewellery Council certification services, retail audit services and risk assessment services. They concentrated on collaborating with UKAS for their accreditations. The focus on offering great services with faster response times, a varied array of services and the expertise of its founders let them to price their services at par with some of its competitors, and even higher in few cases. It did not have a large support staff; however, the ones they had were multifaceted, both full time and contractual. Being in the service industry, the founders realized that to maintain growth as the firm aims to grow geographically, their heavy engagement in the existing operations would have to give way to more standardized processes in general and HR in particular. Ensuring the integration of the current workforce to the Six Sigma framework presented challenges. Complexity academic level This case is designed for second-year students enrolled in Master of Business Administration/Post Graduate Diploma in Management (MBA/PGDM) or equivalent postgraduate-level programmes, in the domain of “Human Resource.” It will enable the students to engage with the significance of “Six Sigma” being used in various processes in the HRM framework. It can also be taught to students in the domain of Marketing because of its relevance to the service sector. Supplementary materials Teaching notes are available for educators only. Subject code CSS 6: Human Resource Management.

Information Security and Privacy Management in Intelligent Transportation Systems

With the global digitalization of services, passenger Intelligent Transportation Systems (ITSs) have emerged as transformative components, yet the practical implementation of state-of-the-art measures to ensure information security and privacy presents substantial challenges. In this article, we propose a framework for information security and privacy management. The framework is validated through two empirical studies. First, the framework is used to extract data during the literature review defining state-of-the-art aspects and measures. Second, a survey-based analysis of running passenger ITSs in selected regions of the European Union provides insights into real-life ITS implementations, enabling a thorough comparison with the proposed state-of-the-art measures. The study also showed that the proposed framework depicts some dependencies between measures, and, thus, using its matrix structure for the state of information security and privacy management in the organization helps to cross-check the usage of policies or methodologies by the organization departments. Our findings resulted in recommendations for organizations developing ITSs to enhance their information security and privacy management systems and bridge the gap between research proposals and practical implementation.

Implementing SIEM(Security Information and Environment Management) in Microsoft Azure

Abstract: In an increasingly interconnected and digital world, the need for robust cybersecurity measures is paramount. Cyberattacks can therefore occur upon any device at any moment of time in order to steal the sensitive information of the user or can result in identity theft and cyberbullying. There are varieties of attacks that may occur without the user being aware about the same that their computer has been attacked and the hacker has overall access of their data. Also, a user cannot sit in front of their device throughout their life to monitor and protect any type of cyberattack. Therefore, in order to solve the following problems and to enhance the overall security and accuracy of safeguarding the device and its data, we implement our project Security Information and Environment Management (SIEM) system within the Microsoft Azure cloud ecosystem. SIEM plays a critical role in monitoring, detecting, and responding to security threats, making it a crucial component of any organization's cybersecurity strategy. To view the notification of the attack for a user and all its details, we therefore connect the SIEM implementations and logs over Microsoft Azure platform, and generate the same with the help of a command-shell Windows PowerShell.

Managing Inherent IT Business Risk against Cyber Threats: a Decision Analysis Case Study of an Oil and Gas Company

XYZ, an anonymized oil and gas company, aims to enhance cyber resilience by strategically managing inherent risk profiles in cybersecurity, aligned with business needs and stakeholder expectations. This research addresses challenges including Information Security Control determination, proficiency improvement in risk management, and ISMS preparedness. Additionally, it tackles procurement strategy for Security Operations Control across XYZ Group, operating under PSC Gross Split, Cost Recovery, and Non-PSC statuses. Utilizing diverse frameworks such as problem tree analysis, stakeholders’ power-interest matrix, MITRE ATT&CK, NIST 800-53, COBIT 2019, ISO 27005:2022, KAMI 5.0, and SMART, data analysis includes risk documents, interviews, and cyber-attack data. The research establishes effective IS Control for risk mitigation, readiness for Information Security Management System ISMS implementation, strategic programs enhancing risk management capability, and refined Security Operations Control procurement. These outcomes, incorporated into a collaborative contract structure, significantly mitigate cyber threats and potential impacts, such as disruptions to operations, revenue reduction, increased costs, data theft, and non-compliance.

ВЫЯВЛЕНИЕ ПРОБЛЕМ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ МЕТОДОМ СИСТЕМАТИЧЕСКОГО ОБЗОРА ЛИТЕРАТУРЫ

The field of information security covers a wide range of technical, organizational and social aspects, requiring information security specialists to take a unique and comprehensive approach to the development, support, operation, evaluation and improvement of information security management systems. An important element of successful information protection is the accurate identification and assessment of risks and vulnerabilities that may become a source of threats. In existing publications, as a rule, it is assumed that specialists have the necessary experience and knowledge to conduct risk analysis. However, in the dynamic world of information technology and threats, an information security specialist faces a huge amount of information and potential risks that are constantly evolving. Because of this, it is an impossible task to keep in mind all kinds of threats to information security. 
 The purpose is to identify actual problems of information security, potentially acting as sources of information security risk, based on the method of systematic review of the literature. Results: 73 actual problems of information security have been identified, which an information security specialist should take into account in his activities. Understanding these issues makes it possible to develop more effective protection strategies, as well as to make informed and informed decisions when developing and applying security measures.

Overview of Security Information and Event Management Systems

Overview of Security Information and Event Management Systems

Cybersecurity on a budget: Evaluating security and performance of open-source SIEM solutions for SMEs.

The proliferation of cyber threats necessitates robust security measures to safeguard critical assets and data in today's evolving digital landscape. Small and Medium Enterprises (SMEs), which are the backbone of the global economy are particularly vulnerable to these threats due to inadequate protection for critical and sensitive information, budgetary constraints, and lack of cybersecurity expertise and personnel. Security Information and Event Management (SIEM) systems have emerged as pivotal tools for monitoring, detecting, and responding to security incidents. While proprietary SIEM solutions have historically dominated the market, open-source SIEM systems have gained prominence for their accessibility and cost-effectiveness for SMEs. This article presents a comprehensive study focusing on the evaluation of open-source SIEM systems. The research investigates the capabilities of these open-source solutions in addressing modern security challenges and compliance with regulatory requirements. Performance aspects are explored through empirical testing in simulated enterprise-grade SME network environments to assess resource utilization, and real-time data processing capabilities. By providing a rigorous assessment of the security and performance features of open-source SIEM systems, this research offers valuable insights to cybersecurity practitioners, organizations seeking cost-effective security solutions, and the broader academic community. The findings shed light on the strengths and limitations of these systems, aiding decision-makers in selecting the most suitable SIEM solution for their specific requirements while enhancing the cybersecurity posture of SMEs.

QISS: Quantum-Enhanced Sustainable Security Incident Handling in the IoT

As the Internet of Things (IoT) becomes more integral across diverse sectors, including healthcare, energy provision and industrial automation, the exposure to cyber vulnerabilities and potential attacks increases accordingly. Facing these challenges, the essential function of an Information Security Management System (ISMS) in safeguarding vital information assets comes to the fore. Within this framework, risk management is key, tasked with the responsibility of adequately restoring the system in the event of a cybersecurity incident and evaluating potential response options. To achieve this, the ISMS must evaluate what is the best response. The time to implement a course of action must be considered, as the period required to restore the ISMS is a crucial factor. However, in an environmentally conscious world, the sustainability dimension should also be considered to choose more sustainable responses. This paper marks a notable advancement in the fields of risk management and incident response, integrating security measures with the wider goals of sustainability and corporate responsibility. It introduces a strategy for handling cybersecurity incidents that considers both the response time and sustainability. This approach provides the flexibility to prioritize either the response time, sustainability or a balanced mix of both, according to specific preferences, and subsequently identifies the most suitable actions to re-secure the system. Employing a quantum methodology, it guarantees reliable and consistent response times, independent of the incident volume. The practical application of this novel method through our framework, MARISMA, is demonstrated in real-world scenarios, underscoring its efficacy and significance in the contemporary landscape of risk management.

Behavioural Biometrics as a User Authentication Mechanism in ISMS

Securing sensitive data and mitigating cyber threats necessitates robust user authentication mechanisms within Information Security Management Systems (ISMS). Conventional authentication approaches, such as passwords and static biometric identifiers, exhibit vulnerabilities, urging the adoption of more sophisticated solutions. Behavioral biometrics, which analyzes unique behavioral patterns like typing rhythm and mouse movements, offers a promising avenue for enhancing authentication security while optimizing user experience. This paper examines the integration of behavioral biometrics into ISMS for user verification, emphasizing its advantages including continuous, multimodal, risk-based, and adaptive authentication. Additionally, it addresses considerations like data privacy, regulatory compliance, user experience enhancement, and monitoring and analysis to ensure successful implementation and efficacy. By leveraging behavioral biometrics as part of a holistic authentication strategy, organizations can fortify their security posture, mitigate threats, and adapt to evolving cybersecurity challenges.

Information Security Management System Assessment Model by Integrating ISO 27002 and 27004

The rapid development of information and communication technology has also led to a significant increase in cybercrime activities. According to the Annual Cybersecurity Monitoring Report by the National Cyber and Cryptography Agency, there were 495 million instances of traffic anomalies or attempted attacks in 2020, which rose to 1.6 billion in 2021 in Indonesia. Implementing the ISO 27001 standard for information security management system (ISMS) can help mitigate these cyber-attack attempts. However, with various levels of resources and organizational commitment, different levels of ISMS maturity can be achieved. Therefore, there is a need for an ISMS assessment model. This is crucial, considering cyber incidents such as data breaches in organizations that have implemented or are certified with ISO 27001. This research proposed a concept of ISMS assessment model by integrating ISO 27002 and 27004 to a case study (Directorate XYZ), where the guidance function of ISO 27002 is transformed into assessment parameters and ISO 27004 for measuring performance. Using this model, the score of the case study’s ISMS was found to be 53.925, which is still below the established standard of 80.

Analysis Server Security Assessment of Staffing Management Information System Using the NIST SP 800-115 Method at UIN Ar-Raniry Banda Aceh

Ar-Raniry State Islamic University management information system has been implemented based on technology. It becomes vulnerable to attacks brought on by weaknesses (vulnerabilities). The degree to which institutions are able to improve their access to authority inside the system is gauged by this research. To evaluate the server's dependability based on confidentiality, integrity, and availability, penetration testing is necessary. The NIST SP 800-115 approach, which comprises of four testing stages—planning, discovery, attack, and reporting—is used to conduct the server security assessment. The findings demonstrate the Security Management Information System contains nine vulnerabilities in various ways with varying improvements. Two of these vulnerabilities are classified as high threat: DNS Server Spoofed Request Amplification DDoS by blocking access from the public network or rejecting the query; and Interception Attack by enhancing the SSL/TLS protocol through a stunnel. The remaining seven vulnerabilities are classified as medium threat. However, Ar-Raniry's campus server vulnerability level is categorized as medium threat

Evaluation of Governance in Information Systems Security to Minimize Information Technology Risks

Information system security within XYZ University constitutes a vital component of its IT framework, exerting significant influence over security levels across all facets of the information systems. Among the numerous implemented information system services at the university, a considerable portion lacks active security measures within operational systems. In pursuit of achieving uniform governance, this study adopts the most recent COBIT 2019 framework. The primary objective of this research is to evaluate the degree to which current information system security management aligns with the process achievement values stipulated in the COBIT 2019 standard. This evaluation entails the calculation of maturity level values that gauge performance levels in managing information system security. Findings from the COBIT 2019 Design assessment conducted at XYZ University's LTIK reveal that individuals scoring above 80 or those requiring Capability Level 4 include APO12 and BAI10. Moreover, the calculation outcomes for each subdomain reveal the presence of 2 subdomains at Level 4, 4 subdomains at Level 3, 15 subdomains at Level 2, and 19 subdomains at Level 1. The identification outcomes underscore the existence of gaps within each domain. Particularly, the APO12 and BAI10 domains exhibit a gap spanning 2 levels.

Implementation of Information Security Management Systems for Data Protection in Organizations: A systematic literature review

Implementation of Information Security Management Systems for Data Protection in Organizations: A systematic literature review

ISO 27001 IN BANKING: AN EVALUATION OF ITS IMPLEMENTATION AND EFFECTIVENESS IN ENHANCING INFORMATION SECURITY

As the banking industry becomes increasingly reliant on digital technologies and faces evolving cyber threats, the adoption of robust information security frameworks is imperative. ISO 27001, a globally recognized standard for information security management systems, has gained prominence as a comprehensive framework for safeguarding sensitive data. This study explores the implementation and effectiveness of ISO 27001 within the banking sector, evaluating its impact on enhancing information security. It delves into the specific challenges and considerations unique to the banking industry, where the confidentiality, integrity, and availability of financial information are paramount. It examines the motivations behind adopting ISO 27001, the process of implementation, and the associated organizational changes required to align with the standard's principles. A critical aspect of the evaluation involves assessing the tangible benefits and outcomes resulting from ISO 27001 implementation. This includes improvements in risk management, incident response capabilities, and the overall resilience of information security controls within banking environments. The study also investigates the role of ISO 27001 in fostering a culture of security awareness among banking employees and stakeholders. Ethical considerations, compliance challenges, and the balance between security and operational efficiency are examined to provide a holistic perspective on the standard's impact. It concludes with insights into the future of ISO 27001 adoption in the banking sector, considering emerging technologies, regulatory developments, and the evolving nature of cyber threats. This research contributes valuable insights into the effectiveness of ISO 27001 as a strategic framework for information security in banking, offering practical implications for industry practitioners, policymakers, and stakeholders invested in fortifying the digital resilience of financial institutions
 Keywords: ISO 27001, Banking, Information Security, Ethical, Financial Institution.

Selection of efficiency criterion on information security management system creation proccess in point if data processing networks

This article is directed to discuss one of the urgent information security problems in communications systems, computer systems and networkingfields. After what it suggests the most objective way of evaluating the criteria of information security management creation process in point of communication technologies which could be used regarding to any branch of the national economy. The variety of main facilities of information security is also reviewed.

MEASURING AND ANALYZING THE REALITY OF IMPLEMENTING THE INFORMATION SECURITY MANAGEMENT SYSTEM IN ACCORDANCE WITH ISO 27001:2022- CASE STUDY AT THE VEHICLE REGISTRATION SITE IN BAGHDAD AL-HUSSEINIYAH

The research addresses the possibility of organizations implementing an information security system in accordance with standard specification (ISO 27001:2022). The standard is important in enhanc-ing the reputation of organizations and generating competition to ob-tain accreditation from granting bodies. The research aims to Assess the actual reality of information security management system requirements by (ISO 27001:2022), In addition to diagnosing the size of gap in General Traffic Directorate- vehicle registration site in Bagh-dad al-husseiniyah. The research reveals weaknesses in the application of the information security management system and identifies aspects of documentation in a way that contributes to the possibility of developing an improvement plan. The research relied on a case study through carefully collecting data by the author based on a checklist designed based on the requirements of (ISO 27001:2022), in addition to conducting personal interviews with several administrative leaders in the General Traffic Directorate- vehicle registration site in Baghdad al-husseiniyah. The research problem included weak implementation of the information security management system and failure to meet the requirements of (ISO 27001:2022) which negatively affected the work of the information security system. The results of research show a total non- conformity rate of (68%).The most prominent recommendations are the need to pay attention to implementing, maintaining, and improving the information management system.

PROTECTION OF INFORMATION RESOURCES OF SMALL ENTERPRISES, INCLUDING THE SUBSYSTEM FOR MANAGEMENT OF NON-TECHNICAL ASPECTS OF INFORMATION SECURITY

Information is one of the key resources of a modern economic organization. Companies with access to up-to-date, unique, useful and reliable information can compete effectively with other economic entities in today’s turbulent economic environment. Information management takes place in the space of the information system. An increasing part of this system now constitutes the information system which has largely become the primary storage and processing environment for information resources.Information, regardless of the size of the enterprise, is exposed to similar threats and risks of loss or destruction. However, the size of an enterprise, through its material resources, its capabilities in hiring qualified staff, very often determines the range of possibilities to counter potential threats and minimize the potential risk of loss of intangible resources. In this paper, the author attempts to classify, identify the risk areas for small entities which generally have the least potential to implement effective, modern information security management processes. The empirical part presents the original design of a subsystem of the Information Security Management System supporting the processes of mitigating the risk of threats to intangible resources of small enterprises.

Information Security Management in Small Public Sector Organizations: Requirements and Design of a Procedural Approach

The increasing digitalization of enterprises and public authorities has resulted in the growing importance of information technology in everyday operations. In this context, an information security management system (ISMS) has become an essential aspect for most organizations. The dependency on technology for almost every single process in an organization has put ISMS at the top of the corporate agenda of public sector organizations. For public organizations in particular, the NIS 2 Directive describes abstract requirements for the development of an ISMS. On the other hand, only a few public administrations operate an ISMS. In this context, this article analyses the requirements of the NIS-2 Directive and complements them with the obstacles and reasons for success in the introduction of ISMS in small public sector organizations (SPSO). At the same time, minimum requirements should be defined that help municipal administration set up an ISMS quickly and easily. This article summarizes the different requirements and generates a foundation for a rough procedural model, for implementing the upcoming requirements of the NIS 2 Directive in local governments. The article also presents the conceptual design of the procedural model.

Exploring and Acquiring Modern Human Resource Competencies in Cybersecurity Amidst State Digital Transformation

This paper validates the relevance of contemporary electronic communication systems, networks, and hardware and software suites and tools being particularly susceptible to cyber influences. The goal of the article is to concisely summarize international experience in modern human resource competencies within the cybersecurity domain and to identify their components according to specific directions. The paper examines current international trends regarding the formation of a minimal necessary package for creating, implementing, technical support, and enhancing an information security and cyber defense management system. This necessitates the development of a digitally aware society by the state, a crucial area of its internal policy. It emphasizes the undeniable fact that the demand for cybersecurity professionals will continually grow as high-technology society advances. In the context of the state’s total defense, the role of unified training for defense force personnel and the civilian sector in cybersecurity is beyond doubt. It is concluded that the main focus in forming Cybercom of partner countries is adequate funding, careful selection of personnel, quality professional training, and ensuring full interoperability of diverse structural units of subjects ensuring information protection and cybersecurity at the state level. The share of cyber threats is increasing, and this trend will intensify over the next decade as the internet technology sphere is developing rapidly, and digital solutions are being used in combination (e.g., artificial intelligence and blockchain). For instance, current Russia is one of the main threats to national and international cybersecurity, actively implementing the concept of information confrontation based on a combination of destructive actions in cyberspace. An increase in conflicts between states and the intensity of intelligence and subversive activities in cyberspace is expected. The number of states seeking to form their own cyber-intelligence, master the latest methods of destructive influence in cyberspace, and strengthen state control over the state segment of the Internet is growing. The technical level of cyber threats is increasing, and new tools and mechanisms for cyber attacks are constantly being improved and developed

Business Email Compromise (BEC) Fraud and How to Prevent it

Cybercrime is on the rise both at the national and cross-border levels. The latest mode of cybercrime is fraud using Business Email Compromise (BEC). A qualitive analysis method with literature study is applied to discuss two key questions of this paper. First, how does the BEC scheme occur?. Second, how an organization/company can prevent/mitigate the risk of BEC fraud. This paper concludes that BEC can be executed in the form of phishing emails sent by perpetrators (both internal and external actors of the organization) to the target victim (organization’s employees) in order to deceive and obtain financial gain. Various efforts can be made by an organization/company to prevent the risk of BEC fraud, among others in the form of implementing a risk management system, implementing an information security management system, and increasing the organization’s internal awareness.