Information Security Planning Research Articles

Organizational Determinants and Compliance Behavior to Shape Information Security Plan

In the advanced field of Information and Communication Technology (ICT) within modern corporate frameworks, the pressing issue of non-compliance becomes increasingly crucial. Achieving the ideal balance—where one fosters consistent employee commitment without resorting to overly harsh penalties for possible violations—presents a complex problem. Such a nuanced relationship calls for a synchronized coordination among the company’s underlying factors, the principles of the Information Security Plan (ISP), and overarching compliance mandates. As companies step into a period where digital environments are in constant flux, the importance of securing information systems rises to a critical level. Against this backdrop, compliance stands out as a vital component, functioning as a stringent safeguard in the ongoing mission to protect precious digital assets—a mission comprehensively detailed within the ISP. This in-depth academic study sets out to rigorously explore and scrutinize the diverse opinions and beliefs of committed employees and insightful management concerning unwavering company alignment with the ISP. This is accomplished by defining a construct that centers on key dimensions: Organizational Culture, Personal Attitudes, Actors, Behavioral Intentions, and Motivational Dynamics. Eleven Hypotheses are outlined and represent the materialisation of the model. This model form a starting point from which future empirical exploration will be able to take place, propelling us towards a deeper understanding of the phenomena under scrutiny.
 
 Received: 15 September 2023 / Accepted: 23 October 2023 / Published: 5 November 2023

Effectiveness of the contingency plan for social and health care during the COVID-19 pandemic in a health district in northwestern Spain

IntroductionDuring the COVID-19 pandemic, healthcare facilities have implemented contingency plans to minimize the consequences of this pathology however, the deployment and results of these contingency plans are scarcely shared. ObjectivesTo describe the implementation of the contingency plan in the social and health care in the COVID-19 pandemic in the Public Hospital of Monforte (Lugo, Spain) and to evaluate the effectiveness of the measures included in this plan. MethodPhenomenological sampling conducted between March 10 and May 15, 2020. Evaluation qualitative assessment by an external quality improvement team of the Galician Health Service (SERGAS), based on the Practicum Direct rapid structured checklist in risk management, organizational management, and evaluation of decision making. As outcome indicators, we assessed the number of hospital admissions, number of PCRs performed, telephone attention to social and health social-healthcare patients, number of hospitalizations avoided and estimation of their direct cost. ResultsAfter assessing and managing the risks, an information security plan was developed and solutions to minimize complications in our patients derived from this pandemic. An emergency decision making team was created, as well as an employee communication mechanism for employees through standardized documents and documentation channels. ConclusionsThe adaptation of the Practicum Direct rapid model to the healthcare setting is a useful and easy-to-apply tool that allows us to identify weak points and areas for improvement in our Service and thus to strengthen patient care in all clinical areas, improving the quality of care.

Hybrid-AI-Based iBeacon Indoor Positioning Cybersecurity: Attacks and Defenses.

iBeacon systems have been increasingly established in public areas to assist users in terms of indoor location navigation and positioning. People receive the services through the Bluetooth Low Energy (BLE) installed on their mobile phones. However, the positioning and navigation functions of an iBeacon system may be compromised when faced with cyberattacks issued by hackers. In other words, its security needs to be further considered and enhanced. This study took the iBeacon system of Taipei Main Station, the major transportation hub with daily traffic of at least three hundred thousand passengers, as an example for exploring its potential attacks and further studying the defense technologies, with the assistance of AI techniques and human participation. Our experiments demonstrate that in the early stage of iBeacon system information security planning, information security technology and a rolling coding encryption should be included, representing the best defense methods at present. In addition, we believe that the adoption of rolling coding is the most cost-effective defense. However, if the security of critical infrastructure is involved, the most secure defense method should be adopted, namely a predictable and encrypted rolling coding method.

Key challenges facing metropolitan cities or municipalities in managing competitive advantage through technology and innovation

Background: Technology and innovation have become a worldwide feature of business. Virtually, no organisation can survive without technology and innovation. When it comes to developing technology and innovation strategies, managers are often left alone to decide which technology and innovation types to pursue.Aim: This article investigates the various key challenges faced by metropolitan cities or municipalities in managing competitive advantage through technology and innovation in Kaohsiung Government City, Taiwan.Setting: The study focused on key challenges faced by metropolitan cities or municipalities in managing competitive advantage through technology and innovation at Kaohsiung City Government in Taiwan.Methods: The methodology used in this study is mainly the secondary data analysis. A complete and thoroughly secondary data analysis process has been utilised as a research design and approach to complete this research work. This study collected secondary data through comprehensive analysis about various aspects such as document analysis or desktop study, technical reports, scholarly journals, government documents, research institutions.Results: The result shows that there are various key challenges including research and development and innovation, information security or contingency planning, rapidly advancing technologies, ageing technology and under-investment and the change in residents’ expectations.Conclusion: This article has identified various challenges affecting businesses or organisations, particularly City Governments in competitive advantage through managing technology and innovation. This include inter alias: manpower training and recruiting, organisational transformation, rapidly advancing technologies, ageing technology and underinvestment, the change in residents’ expectations.

Psychological Defence and Cyber Security

Disruptive developments in the field of information and communication technology have enabled malicious actors to turn elements of the digital ecosystem into information weapons in hybrid conflict. Estonia has tackled the new security realm with comprehensive national defence that is built upon understanding that the society itself is object of security and should provide appropriate safeguards and responses. Estonian conceptualisations of national cybersecurity, cyber psychological defence, strategic communications are elaborated in the light of actual seminal threat situations. Analysis of evolvement of the strategic documents guides the recommendations for even deeper blend of the technical cybersecurity culture with value-centric psychological defence and internationalisation of information security situational awareness and planning.

Planificación Informática en la seguridad de información del Distrito de Salud 23D03

Objetivo: Analizar la planificación Informática en la seguridad de información del Distrito de Salud 23D03. Método: De tipo descriptiva con diseño no experimental observacional en una muestra poblacional de 196 trabajadores del Distrito de Salud 23D03. Resultados: La administración interna del departamento de tecnología se basa en el soporte técnico y administración de los servicios de red. Conclusión: La planificación ha permitido una mejora en el cumplimiento y ordenamiento de la gestión, cumpliendo necesidades como la de garantizar la disponibilidad de los datos, mejorar el uso de equipo TIC por parte de los usuarios internos y se evita que los terminales sean dispositivos vulnerables para el robo de información.

Forewarned is forearmed

PurposeInternet of Things (IoT) interconnects many heterogeneous devices to each other, collecting and processing large volumes of data for decision making without human intervention. However, the information security concern it brings has attracted quite a lot of attention, and, at this stage, the smart step would be to analyze the security issues of IoT platform and get to the state of readiness before embarking upon this attractive technology. The purpose of this paper is to address these issues.Design/methodology/approachIoT risk assessment through the application of the analytical hierarchy process (AHP), a favorite multi-criteria decision making technique, is proposed. The IoT risks are prioritized and ranked at different layers, before which a well-defined IoT risk taxonomy is defined comprising of 25 risks across six layers of the IoT model for developing control and mitigation plans for information security of IoT.FindingsPeople and processes layer, network layer and applications layer are the top three critical layers with risks like the lack of awareness, malware injection, malicious code injection, denial of service and inefficient policies for IoT practice get the highest priority and rank. Pareto analysis of the overall risk factors revealed that the top ten factors contribute to 80 percent of the risks perceived by information security experts.Research limitations/implicationsThe study focuses only on certain predefined constructs or layers of the IoT model traced from legacy studies. It is essential to re-look these constructs on a timely basis to prolong the results’ validity. The study’s empirical scope is confined only to the risk perception of select IoT experts and does not encompass a broader segment of the IoT ecosystem. Therefore, the risks assessment may not be sweeping to a bigger audience.Practical implicationsThe study implications are two-fold: one it consolidates the earlier siloed works to intensify the need for risk assessment in the IoT domain, and second the study brings yet another contextual avenue of extending the application AHP and Pareto principle combination. The paper also draws specific critical organizational interventions about IoT risks. A comprehensive approach to prioritizing and ranking IoT risks are present in this research paper.Originality/valueThe contribution of this study to the benchmarking of IoT risk assessment is two-fold. One, a comprehensive risk assessment taxonomy is proposed, and two, the risks are prioritized and ranked to give a convincing reference for the organizations while making information security plans for IoT technology.

Botching Human Factors in Cybersecurity in Business Organizations

Abstract Human factors remained unexplored and underappreciated in information security. The mounting cyber-attacks, data breaches, and ransomware attacks are a result of human-enabled errors, in fact, 95% of all cyber incidents are human-enabled. Research indicates that existing information security plans do not account for human factors in risk management or auditing. Corporate executives, managers, and cybersecurity professionals rely extensively on technology to avert cybersecurity incidents. Managers fallaciously believe that technology is the key to improving security defenses even though research indicates that new technologies create unintended consequences; nonetheless, technological induced errors are human-enabled. Managers’ current perspective on the human factors problem information security is too narrow in scope and more than a training problem. The management of complex cybersecurity operations accompanied by mounting human factor challenges exceeds the expertise of most information security professionals; yet, managers are reluctant to seek the expertise of human factors specialists, cognitive scientists, and behavioral analysts to implement effective strategies and objectives to reduce human-enabled error in information security.

An Evaluation Model of Information Security Management Maturity

In the process of the enterprise information security management in large enterprises, they have been produced the study requirement for information security maturity management evaluation. Here we propose an evaluating model of information security management maturity level, including information security rules, information security planning, information security organization, information security execution results as four aspects of evaluation elements, and a evaluating process with definite responsibility, well-designed rules, clear process and effective implementation, good reviews, the model has been applied in large enterprises and will improve the information security management level.

자원 제약하의 중소기업 정보보안계획 수립방안 연구

정보는 기업의 규모와 무관하게 소중한 자산이며 정보보안은 기업의 생존과 번영을 위해 필수적인 요소이다. 하지만 대기업의 경우 정보보안경영시스템(ISMS)의 신속한 도입을 통해 안전을 확보해 나가지만, 중소기업의 경우는 예산 제약, 보안 지침의 미흡, 보안에 대한 인식 부족 등, 복합적인 요인들로 인해 보안시스템이 구축되지 않거나구축이 지체되고 있다. 본 논문에서는 중소기업의 정보보안 관리 실태를 설문조사를 통하여 문제점을 분석하고, 중소기업을 위한 무료 또는 저렴한 방법으로 종합적인 보안계획 수립 방안을 제시하고자 한다. 본 논문이 제시하는 방법을 적용해 중소기업들은 최저 비용의 기본적인 정보보안을 구현할 수 있을 것이며, 정보보안 계획을 수립하고자 하는 중소기업들에 도움이 될 것이라고 믿는다.

Information security knowledge sharing in organizations: Investigating the effect of behavioral information security governance and national culture

This paper presents an empirical investigation on what behavioral information security governance factors drives the establishment of information security knowledge sharing in organizations. Data was collected from organizations located in different geographic regions of the world, and the amount of data collected from two countries – namely, USA and Sweden – allowed us to investigate if the effect of behavioral information security governance factors on the establishment of security knowledge sharing differs based on national culture.The study followed a mixed methods research design, wherein qualitative data was collected to both establish the study's research model and develop a survey instrument that was distributed to 578 information security executives. The results suggest that processes to coordinate implemented security knowledge sharing mechanisms have a major direct influence on the establishment of security knowledge sharing in organizations; the effect of organizational structure (e.g., centralized security function to develop and deploy uniform firm-wide policies, and use of steering committees to facilitate information security planning) is slightly weaker, while business-based information security management has no significant direct effect on security knowledge sharing. A mediation analysis revealed that the reason for the nonsignificant direct relation between business-based information security management and security knowledge sharing is the fully mediating effect of coordinating information security processes. Thus, the results disentangles the interrelated influences of behavioral information security governance factors on security knowledge sharing by showing that information security governance sets the platform to establish security knowledge sharing, and coordinating processes realize the effect of both the structure of the information security function and the alignment of information security management with business needs.A multigroup analysis identified that national culture had a significant moderating effect on the association between four of the six proposed relations. In Sweden – which is seen as a less individualist, feminine country – managers tend to focus their efforts on implementing controls that are aligned with business activities and employees' need; monitoring the effectiveness of the implemented controls, and assuring that the controls are not too obtrusive to the end-user. On the contrary, US organizations establish security knowledge sharing in their organization through formal arrangements and structures. These results imply that Swedish managers perceive it to be important to involve, or at least know how their employees cope with the decisions that have been made, thus favoring local participation in information security management, while US managers may feel the need to have more central control when running their information security function.The findings suggest that national culture should be taken into consideration in future studies – in particular when investigating organizations operating in a global environment – and understand how it affects behaviors and decision-making.

Exploring the Association between Board Structure and Information Security Breaches

Although the area of information security planning and manageme nt has gained an increased attention, not much discussion was available on the role and the impact of the board members towards a firm’s security management and governance decisions. In this research, we draw on corporate governance and the organizational demography literature to conduct an exploratory empirical study on the association between the board structure of a firm and the possibility of information security breaches. Our results show that the board size, the average age/tenure and the heterogeneity of age could reduce the possibility of security breaches while the proportion of independent directors and the heterogeneity of tenure could increase it. Our findings shed lights on the important role played by the board when managing information security risks in organizations.

Significance of Information Security Awareness in the Higher Education Sector

Information security awareness is an important contributing factor for a successful information security plan and should be properly assessed in order to suggest improvements. This explorative study directly investigated and assessed the employee information security awareness levels within a South Australian Higher Education Institution for the purpose of providing much needed insight into the extent of information awareness levels in Australian organizations. Using an online questionnaire, the study revealed that the organization’s employee information security awareness were generally lacking. The study also identified several problem areas which had plenty of room for improvements, thus paving the way for further research into how information security awareness levels can be improved. It is recommended that the organization include information security awareness as part of its overall risk assessment strategies in order to mitigate such risks. Finally, the adoption of programs which will enhance security awareness should also be explored in order to foster an organizational culture of security compliance, thereby minimizing any information security risks.

Law Enforcement's Ability to Deal with Digital Crime and the Implications for Business

ABSTRACT Much has been made of the capabilities to commit a crime that has a digital component, whether it is hacking, fraud, embezzlement, identity theft, organized crime, child pornography, or other criminal act. While the capabilities of the perpetrators and IT professionals' response are often discussed, what is often overlooked is the ability of law enforcement to investigate and prosecute digital crime. An information security plan that is not developed with prosecution as a possible outcome is short sighted. This article is a research report on Michigan's law enforcement capabilities, including training, staffing levels, and trends, and it provides information that will help IT professionals understand the challenges they may encounter when soliciting help from law enforcement agencies.

A web-based multi-perspective decision support system for information security planning

With the increasing exposure and vulnerability to cyber attacks, it becomes necessary to develop methodologies and systems that are capable of dealing with the complex and multifaceted nature of decision situations encountered in security planning and management. In this paper we present the theoretical basis, architecture and design of a web-based multi-perspective decision support system (DSS) and an underlying decision multi-criteria decision framework that is consistent with security and decision theory. The system is illustrated through a multi-stakeholder scenario that captures the complexity encountered in a multi-criteria security control selection decision problem.

Law Enforcement's Ability to Deal with Digital Crime and the Implications for Business

Much has been made of the capabilities to commit a crime that has a digital component, whether it is hacking, fraud, embezzlement, identity theft, organized crime, child pornography, or other criminal act. While the capabilities of the perpetrators and IT professionals' response are often discussed, what is often overlooked is the ability of law enforcement to investigate and prosecute digital crime. An information security plan that is not developed with prosecution as a possible outcome is short sighted. This article is a research report on Michigan's law enforcement capabilities, including training, staffing levels, and trends, and it provides information that will help IT professionals understand the challenges they may encounter when soliciting help from law enforcement agencies.

Evaluating the Perceived Impact of Collaborative Exchange and Formalization on Information Security

INTRODUCTION Today, in large part, information security is the implementation of controls and best practices suggested by consultants, standard governing bodies (i.e. National Institute of Standards & Technology) (NIST), International Organization for Standardization / International Electrotechnical Commission (ISO/IEC), etc.), the organization's information security department and, sometimes, the organization's employees. While the use of global standards of practice, top management and the information security department within the organization to guide information security planning and implementations may be useful, existing research consistently shows a positive relationship exists between user involvement in planning and the effectiveness of the information systems function within organizations (Gottschalk, 1999; Sambamurthy et al., 1994; Segars & Grover, 1998). A deliverable of the information security planning process is the organization's information security policies and procedures. Standard governing bodies (NIST, ISO/IEC) and researchers (Bidgoli, 2003; Garrison & Posey, 2006) stress the importance of creating information security policies and provide guidance on the different types of information security policies that an organization may need. This research attempts to examine the impact of end-user involvement and formalized information security policies on the effectiveness of the information security function within organizations. Specifically, this study focuses on two antecedent variables, collaborative exchange and formalization, and how it impacts the effective utilization of the information security strategies of deterrence, detection and recovery. Collaborative exchange is an assessment of the extent of collaboration between upper-level management, end users and the information security function. Formalization is an assessment of the extent of established formal information security policies within an organization. The purpose of this research is twofold. First, this research aims to examine the individual effects of formalization and collaborative exchange on the effectiveness of information security detection, deterrence, and recovery activities. Much of the effort expended in the management of information security is in developing and enforcing information security policies. By examining formalization separately, the impact of information security policy development on effective utilization of information security strategies can be assessed. The second aim of this research is to examine the impact of collaborative exchange and formalization in concert on the effectiveness of information security detection, deterrence, and recovery activities. Evaluating complementary effect of collaborative exchange and formalization on effective utilization of information security strategies provides evidence supporting the importance of establishing information security policies with input and effort from all major constituencies within the organization. This study makes several contributions to the literature and practice. First, this research provides insight into how management choices in regards to establishing formal communication channels and developing information security policies may impact the effectiveness of the information security function. Second, the presence of the dependent variable, effectiveness of detection, deterrence and recovery activities, gives academics and practitioners a success measure which can guide more effective decision making in the information security domain. The remainder of this manuscript is organized as follows. The next section discusses the literature supporting the constructs of interest in this study. The following two sections will present the methodological approach taken in this study and the results of data collection. The next section will present the efforts in data analysis. The last section will present a discussion of the important findings and limitations of this research. …

Empirical Evaluation of Information Security Planning and Integration

Organizations can choose how to integrate information security through planning and structuring of the information security function. This study aims to examine how the planning and structuring choices of the organization impacts the effective utilization of information security strategies. This study examines information security planning integration through a stages of growth perspective and finds that more mature information security planning integration is positively correlated with more effective utilization of information security deterrence, detection, and recovery strategies. This study also finds that a decentralized structure of information security management activities has a positive effect on the maturity of information security planning integration. This study suggest the maturity of information security planning integration that has a direct effect on the utilization of information security strategies and mediates the relationship between structure of information security management activities and utilization of information security strategies.

Priority indexing model for evaluating and analysing organisations' information security systems

Information technology (IT) has come to play an important and vital role in any organisation. As a consequence, security has become an essential aspect of IT and the negative impacts of security threats will affect not only systems or individuals but also organisations and society. In this paper, a priority indexing model (PIM) was proposed to evaluate organisation's information security system and to calculate a development priority index that can be used as an indicator for development needs. To examine the validity of the proposed model, the information security system in Ministry of Education (MOE) in the State of Kuwait was evaluated to determine the overall development priority indexes. The results showed that the proposed model can assist decision makers to consider different criteria and indicators before committing to a particular choice of security system development or to evaluate any existing security system. Finally, the general development priority index derived in this work can be used as a reference for information security planning and management process improvements.

Computer security methodology: Risk analysis and project definition

A structured, progressive approach to the process of risk analysis, problem identification and project definition will contribute to the successful implementation of computer security in an organization. Potential losses of information technology assets need to be identified and quantified. It is critical for the senior management of an organization to be involved in the decision making process regarding the selection of computer security countermeasures. The objectives of this paper are to address the issue of risk analysis in view of an overall information security plan.