Information Security Procedures Research Articles

Prospects and challenges of mobile banking in Bangladesh: A case study

Mobile banking is a technology advancement that enables convenient, anytime, anywhere access to financial services. When using mobile banking, customers can access banking services via their phones without having to wait in line. It is a branchless kind of banking. The purpose of the study was to identify the prospects and challenges facing Bangladeshi mobile banking in the twenty-first century. Over 80 respondents were selected using Yaro Yamani formula from a sample of bank clients and bankers and given a standardized questionnaire. The study's goal has been perceived through the application of the descriptive research approach. Based on the study's findings, people's interest in mobile banking is growing daily due to its advantages. Certain banks do not presently offer all mobile banking services, and not all respondents are aware of all the mobile banking options available. Fast data transfer and cost-effective usage are two factors that entice customers. Some of the disadvantages of mobile banking are that it is very expensive, private, complex, etc. Lowering operational risks and increasing consumer confidence in Bangladesh's mobile banking services can be achieved through robust technical information control and security procedures that ensure the integrity and confidentiality of financial transactions.

Cyber Security and Compliance Management through a Single Integrated Platform

Abstract: These days, any information security product or service used in an organization is a stand-alone solution. Examples include information risk management, data security, auditing, and incident management. Since different organizations use different services from different providers, there is currently no single platform or architecture that can address all of an organization's fundamental information security procedures in one easy step. Because of this, businesses must spend a significant amount of money on separate services in order to meet the information security standards that are necessary for their businesses. These dispersed services lead to an increase in physical and manual labor, disorganized processes, and a lack of clarity regarding all information security-related business issues. To solve these issues, the approach covered in this article combines information security as a service with end-to-end platform/framework to give organizations a single framework for all information security-related organizational aspects. A single service that can handle every information security-related work for the company, including risk assessment, mitigation, vulnerability assessment, incident management, threat analytics, risk response management, and auditing. This will assist the company in spending less money on a wider range of security-related services.

Enforcing Information System Security

Every year brings numerous security breaches that lead to highly destructive ransomware attacks, data leaks, and reputational damage to governments, companies, and other organizations around the world. As a result, there is a growing need to ensure that workers comply with critical policies put in place to avoid such incidents. This study investigated how factors from social bond theory and involvement theory affected compliance with information security policies and procedures. All of the factors examined were found to have a significant influence on attitudes about compliance, and attitude had a significant impact on intention to comply. The findings of this study revealed that it is vital to raise employees' awareness about compliance with security policies by improving their information security behavior. Moreover, all the factors were found to have a significant influence on the attitude of employees towards compliance with their organizational information security policies and procedures.

HUMAN RESOURCES MANAGEMENT AS A COMPONENT OF ORGANIZATION INFORMATION SECURITY

The cyber threat landscape has undergone major changes in recent years. Compared to any period since the beginning of the information age, it is more diverse and broad. First, the Covid-19 pandemic, namely the resulting transition of organizations to remote work and then the full-scale invasion of Ukraine by the Russian Federation, made adjustments to the information security strategy. Today, most organizations are aware of security threats and the need to create a reliable information security management system to ensure their effective operation in an information environment that is aggressive both technically and socially. An important area of information security in an organization is human resource management since, according to statistics from a number of reputable analytical centers, employees are the weakest link in any data security system. The organization's human resources management includes a thorough recruitment process, fostering a responsible attitude to work in compliance with the requirements for protecting restricted information, developing a corporate culture of information security and dismissal procedures. The article provides a list of documents of the regulatory framework, namely, international security standards, regulatory documents of public authorities, and internal documents of an organization regulating the rules and methods of work with personnel. The main motives for the unlawful behavior of an internal attacker are highlighted, and the organizational measures recommended in the context of ensuring information security at all three stages of interaction between a person and an organization: employment, employment, and dismissal are described. There is also indicated the expediency of using psychoanalysis, psychology, management ethics and conflictology methods in the field of personnel management for forecasting and prevention of informational threats.

Strategy to Improve Employee Security Awareness at Information Technology Directorate Bank XYZ

Bank handles private information like customer financial transactions and personal data. There was a 63% increase in cyberattacks attempted against Bank XYZ in 2021, and 1,323 attempted attacks on corporate email Bank XYZ. Therefore, implementing security awareness training for all employees is crucial for Bank XYZ. The information security awareness program must be assessed to determine the program's efficiency and the level of information security awareness among employees. Therefore, this study assesses the information security awareness at Bank XYZ, especially the Information Technology (IT) Directorate using the Human Aspect of Information Security Questionnaire (HAIS-Q) method. The findings of this study revealed that employees at Bank XYZ in the information security work unit had a "Good" level of awareness. In contrast, the results from other IT work units were “Medium”. Based on the assessment results, Bank XYZ's security awareness strategy recommendation is to align awareness content with information security policies and procedures, use a variety of media awareness, and focus on the "Internet Use" and "Information Handling" awareness areas. As a way of determining the achievement of information security Key Performance Indicators (KPI), security awareness measurement must be done regularly, for example, once a year.

دور ممارسة العاملين في حقل المعلومات لأخلاقيات المهنة في تعزيز أمن المعلومات بوزارة الداخلية والأمن الوطني - الشق المدني بغزة (The Role of Practicing Profession Ethics by Workers in The Field of Information in Enhancing The Information Security in The Ministry of Interior and National Security – Civil Department in Gaza Strip)

Arabic Abstract: هدفت الدراسة التعرف إلى دور ممارسة العاملين في حقل المعلومات لأخلاقيات المهنة في تعزيز أمن المعلومات، وذلك في وزارة الداخلية والأمن الوطني الشق المدني بقطاع غزة، ولتحقيق الهدف من الدراسة استخدم الباحثان المنهج الوصفي التحليلي، واعتمدا الاستبانة كأداة للدراسة، مستخدمان أسلوب الحصر الشامل وقد تكون مجتمع الدراسة من جميع الموظفين العاملين في الوزارة ذوي المستويات الإشرافية المختلفة وعددهم (256) موظفا، وقد تم استرداد (247) استبانة بنسبة استرداد (96.5%). وتوصلت الدراسة إلى العديد من النتائج من أهمها: - توفر أخلاقيات مهنة المعلومات في وزارة الداخلية والأمن الوطني – الشق المدني بقطاع غزة بنسبة كبيرة تقدر بــ (71.93%). - توفر إجراءات أمن المعلومات في وزارة الداخلية والأمن الوطني – الشق المدني بقطاع غزة بنسبة كبيرة تقدر بــ (68.06%). وقدمت الدراسة مجموعة من التوصيات من أهمها: - سن وتطبيق التشريعات القانونية اللازمة، التي توفر البيئة والحاضنة المناسبة لحماية الأنظمة المعلوماتية التي يتم العمل عليها، إضافة لسن التشريعات التي تجرم من يخالف تلك القوانين ومرتكبي تلك الجرائم، وذلك لمواجهة الجرائم المعلوماتية. English Abstract: The study aimed to identify the role of practising profession ethics by workers in the field of information, in enhancing the information security, in the Ministry of Interior and National Security – Civil department, in Gaza Strip. To achieve this aim, the researchers used descriptive-analytical approach, and adopted the questionnaire as a tool for the study, using the methodology of comprehensive enumeration to explore the study sample views, and the community of the study is all the staff working in the ministry with different supervisory levels, (256) questionnaires were distributed, (247) questionnaire has been retrieved by recovery rate (96.5%). The study concludes several results, most important are the following: - Availability of the information profession ethics at the Ministry of Interior and National Security - Civil department in the Gaza Strip by a large proportion estimated (71.93%). - Availability of information security procedures at the Ministry of Interior and National Security - Civil department in the Gaza Strip by a large proportion estimated (68.06%). The study recommends promoting the following: - Enactment and enforcement of necessary legislation, which provides the environment and appropriate foster to protect the informational systems that used for working on it, in addition, to enact legislation that criminalizing the violation of such laws and the perpetrators of such crimes, to face the IT crimes.

Transformative and cognitive approaches to information retrieval and security procedures

SummaryTransformative computing is a new area of computer technologies. It is also a new paradigm, which allows to join wireless communication with sensor networks and artificial intelligence technologies. It considerably enhances computing possibilities, increases efficiency of data exploration and analysis, as well as information retrieval using sensors or augmented cognition. In this article, we describe possible applications of cognitive security protocols for such computing application, especially focused on security, and data exploration in distributed systems. Also will be presented the impact of cognitive protocols for securing wireless systems and sensors infrastructures.

Empirical Study on the Influence of Security Control Management and Social Factors in Deterring Information Security Misbehaviour

Complying with the security rules and standard is important to safeguard valuable information in the organisation. Failure to prevent security breaches costs the organisation huge losses and bad reputation. Technical solutions are abundant but nonetheless still unsuccessful to deter information security incidents. The root cause of incompliance is humans as they are the weakest link of security chain. This paper examines the information security control management particularly on information security awareness, training and education, risk analysis and management, information security policies and procedures as well as physical security monitoring, and cognitive factors which give impact towards the employees’ information security compliant behaviour in the organization. Based on convenient sampling, a survey was conducted to employees of public and private sectors in Malaysia who are the Software as a Service (SaaS) cloud users. Data was collected online and was analysed using PLS-SEM. Result shows that information security control management and cognitive factors have high significant impact in deterring information security misbehaviour in the context of cloud users.

Enhancing Data Base Security in Cloud Computing

Information security has reliably been a significant issue in data innovation. In the distributed computing condition, it turns out to be especially genuine in light of the fact that the distributed is suitable in better places even in all the globe. Distributed and security insurance are the two fundamental components of client's worries about the cloud innovation. Despite the fact that numerous procedures on the themes in distributed computing have been researched in the two ventures, information security and security assurance are getting progressively significant for the future improvement of distributed computing innovation in government, industry, and business. Information security and protection assurance issues are significant to both equipment and programming in the cloud design. This examination is to survey diverse security methods and difficulties from both programming and equipment angles for ensuring information in the cloud and targets upgrading the information security and protection assurance for the dependable cloud condition. In this paper, we make a relative research examination of the current research work with respect to the information security and security assurance procedures utilized in the distributed computing.

The Effect of Rational Based Beliefs and Awareness on Employee Compliance with Information Security Procedures: A Case Study of a Financial Corporation in Israel

Aim/Purpose: This paper examines the behavior of financial firm employees with regard to information security procedures instituted within their organization. Furthermore, the effect of information security awareness and its importance within a firm is explored. Background: The study focuses on employees’ attitude toward compliance with information security policies (ISP), combined with various norms and personal abilities. Methodology: A self-reported questionnaire was distributed among 202 employees of a large financial Corporation Contribution: As far as we know, this is the first paper to thoroughly explore employees’ awareness of information system procedures, among financial organizations in Israel, and also the first to develop operative recommendations for these organizations aimed at increasing ISP compliance behavior. The main contribution of this study is that it investigates compliance with information security practices among employees of a defined financial corporation operating under rigid regulatory governance, confidentiality and privacy of data, and stringent requirements for compliance with information security procedures. Findings: Our results indicate that employees’ attitudes, normative beliefs and personal capabilities to comply with firm’s ISP, have positive effects on the firm’s ISP compliance. Also, employees’ general awareness of IS, as well as awareness to ISP within the firm, positively affect employees’ ISP compliance. Recommendations for Practitioners: This study can help information security managers identify the motivating factors for employee behavior to maintain information security procedures, properly channel information security resources, and manage appropriate information security behavior. Recommendation for Researchers: Researchers can see that corporate rewards and sanctions have significant effects on employee security behavior, but other motivational factors also reinforce the ISP’s compliance behavior. Distinguishing between types of corporations and organizations is essential to understanding employee compliance with information security procedures. Impact on Society: This study offers another level of understanding of employee behavior with regard to information security in organizations and comprises a significant contribution to the growing knowledge in this area. The research results form an important basis for IS policymakers, culture designers, managers, and those directly responsible for IS in the organization. Future Research: Future work should sample employees from another type of corporation from other fields and should apply qualitative analysis to explore other aspects of behavioral patterns related to the subject matter.

Information Security Behavior: A Cross-Cultural Comparison of Irish and US Employees

ABSTRACTThis study explores how aspects of perceived national culture affect the information security attitudes and behavior of employees. Data was collected using 19 semi-structured interviews in Ireland and the United States of America (US). The main findings are that US employees in the observed organizations are more inclined to adopt formalized information security policies and procedures than Irish employees, and are also more likely to have higher levels of compliance and lower levels of non-compliance.

Information security climate and the assessment of information security risk among healthcare employees.

Since 2009, over 176 million patients in the United States have been adversely impacted by data breaches affecting Health Insurance Portability and Accountability Act-covered institutions. While the popular press often attributes data breaches to external hackers, most breaches are the result of employee carelessness and/or failure to comply with information security policies and procedures. To change employee behavior, we borrow from the organizational climate literature and introduce the Information Security Climate Index, developed and validated using two pilot samples. In this study, four categories of healthcare professionals (certified nursing assistants, dentists, pharmacists, and physician assistants) were surveyed. Likert-type items were used to assess the Information Security Climate Index, information security motivation, and information security behaviors. Study results indicated that the Information Security Climate Index was related to better employee information security motivation and information security behaviors. In addition, there were observed differences between occupational groups with pharmacists reporting a more favorable climate and behaviors than physician assistants.

Factors Contributing to the Success of Information Security Management Implementation

Information Security Management (ISM) concerns shielding the integrity, confidentiality, availability, authenticity, reliability and accountability of the organisation’s information from unauthorised access in order to ensure business continuity and customers’ confidence. The importance of information security (IS) in today’s situation should be given due attention. Recognising its importance, organisations nowadays have devoted wide efforts in protecting their information. They establish information security policy, processes, and procedures as well as reengineer their organisational structures to align with ISM principles. Regardless of the efforts, security incidents continue to occur in many organisations. This phenomenon shows that the current implementation of ISM is still ineffective due to unaware of the factors contributing to the success of ISM. Thus, the objective of this paper is to identify ISM success factors and their elements through a large-scale survey. The survey involves 243 practitioners from statutory bodies, public and private organisations in Malaysia. The results of the survey indicate that top management, IS coordinator team, ISM team, IS audit team, employees, third parties, IS policy, IS procedures, resource planning, competency development and awareness, risk management, business continuity management, IS audit and IT infrastructure are the factors that contribute to the success of ISM implementation. These factors shall guide practitioners in planning and refining ISM implementation in their organisations.

Estudo de caso de limites no emprego de computação na educação básica

Vivemos em tempos de muita informação considerado como sendo os tempos líquidos por Bauman. Nas escolas da Educação Básica, em geral, há o uso de computação nos processos de ensino e aprendizagem, porém nem sempre as Tecnologias Digitais de Informação e Comunicação (TDIC) são bem usadas. Este artigo tem como objetivo, apresentar um estudo de caso de uso inadequado de recursos das TDIC por alunos do nono ano da educação básica. Realizou-se uma pesquisa social, qualitativa, do tipo estudo de caso do fenômeno do mau uso da TDIC em uma escola particular da região sudeste. Observa-se que a resolução do problema envolveu a família com sucesso e a melhoria nos procedimentos de segurança da informação da escola.

Investigating the impact of cybersecurity policy awareness on employees’ cybersecurity behavior

As internet technology and mobile applications increase in volume and complexity, malicious cyber-attacks are evolving, and as a result society is facing greater security risks in cyberspace more than ever before. This study has extended the published literature on cybersecurity by theoretically defining the conceptual domains of employees’ security behavior, and developed and tested operational measures to advance information security behavior research in the workplace. A conceptual framework is proposed and tested using survey results from 579 business managers and professionals. Structural equation modeling and ANOVA procedures are employed to test the proposed hypotheses. The results show that when employees are aware of their company’s information security policy and procedures, they are more competent to manage cybersecurity tasks than those who are not aware of their companies’ cybersecurity policies. The study also indicates that an organizational information security environment positively influences employees’ threat appraisal and coping appraisal abilities, which in turn, positively contribute to their cybersecurity compliance behavior.

The impact of audit firms’ characteristics on audit fees following information security breaches

Given the importance of auditors’ assessing business risks and evaluating internal controls, we investigate whether an audit firm’s industry expertise, tenure, and size can help its auditors better understand external and internal threats faced by the client with less effort. Using reported information security breach incidents from 2004 to 2013, we find that, consistent with prior studies, audit fees are higher after the occurrence of an information security breach. However, such an association is negatively moderated when the audit firm has industry-specific expertise, longer experience with the client, and is one of the Big 4 firms. Our results suggest that because of their better knowledge about a specific industry, increased familiarity with the client’s operations, and more resources to understand a client’s vulnerabilities and/or information security policies and procedures, these auditors are more capable of assessing the potentially changing information security risks implied by the occurrence of information security breach incidents. Our results are robust to a variety of sensitivity checks.

ZARZĄDZANIE BEZPIECZEŃSTWEM INFORMACJI GOSPODARCZYCH NA PRZYKŁADZIE KRAJOWEGO REJESTRU DŁUGÓW BIURA INFORMACJI GOSPODARCZEJ SA

The aim of the article is to characterize the specificity of business information and issues related to ensuring their security on the example of the Business Information Bureau. The analysis covered the National Debt Register of Business Information Bureau S.A., which is the first and one of the largest entities of this type operating in Poland. The article first discusses the specific nature of business information as a special type of information regulated by the Act dedicated to it. The following part analyses the functioning of information security systems and procedures in the company’s business information security. This analysis is to illustrate how the requirements imposed on business information offices were implemented in practice in the scope of an information security management system.

Policies, Regulations and Procedures and their Effects on Mobile Money Systems in Uganda

AbstractThe introduction of mobile money systems in emerging economies has enabled the would‐be unbanked population to gain access to financial services. The number of mobile money users and value of transactions is on the increase. This rapid growth of mobile money services and value transactions in emerging economies is attributed to the light‐touch regulatory framework which allows minimal limitations on who should operate mobile money system and few restrictions on who can function as an agent. These increases both in services and transactions indicate that mobile money systems hold a lot of valuable customer financial information that needs to be jealously protected against information breaches and abuse by the various stakeholders in the mobile money ecosystem.Taking an interpretive qualitative approach, Activity Theory (AT) has been used to analyse the mobile money management activities focusing on information security policies, regulations and procedures. In order to comprehend the aspects revealed by the Activity Theory analysis that raise information security management concerns in mobile money operations, Mobile Network Operator (MNO) management issues, in terms of the security of mobile money operations, are detailed.Our findings look at the reasons given by various stakeholders for information security management gaps in mobile money operations in emerging economies. Our findings disclose the roles of MNO staff, who are not information security experts, in the development and compliance monitoring of policies, regulations and procedures related to the safety of financial information in mobile money systems.

An Empirical Study of Information Security Management Success Factors

Information security management (ISM) is a continuous, structured and systematic security approach to manage and protect the organisation’s information from being compromised by irresponsible parties. To ensure the information remains secure, many organisations have implemented ISM by establishing and reviewing information security (IS) policy, processes, procedures and organisational structures. Regardless of the efforts, security threats, incidents, vulnerabilities and risks are still plaguing many organisations. Lack of awareness of ISM effectiveness due to low understanding of the success factors is one of the major factors that cause this phenomenon. This study aimed to address this subject by firstly identifying the ISM key factors from existing literature and then by confirming the factors and discovering other related factors from practitioners’ perspective. This study used qualitative method where it adopted semi-structured interviews involving nine practitioners. The data were analysed using content analysis technique. Through the analysis, the study validated several ISM factors and their elements that contribute to the success of ISM. The findings provide practitioners with the high understanding of ISM key factors and could guide practitioners in implementing proper ISM.

Information security risk management for computerized health information systems in hospitals: a case study of Iran

BackgroundIn recent years, hospitals in Iran – similar to those in other countries – have experienced growing use of computerized health information systems (CHISs), which play a significant role in the operations of hospitals. But, the major challenge of CHIS use is information security. This study attempts to evaluate CHIS information security risk management at hospitals of Iran.Materials and methodsThis applied study is a descriptive and cross-sectional research that has been conducted in 2015. The data were collected from 551 hospitals of Iran. Based on literature review, experts’ opinion, and observations at five hospitals, our intensive questionnaire was designed to assess security risk management for CHISs at the concerned hospitals, which was then sent to all hospitals in Iran by the Ministry of Health.ResultsSixty-nine percent of the studied hospitals pursue information security policies and procedures in conformity with Iran Hospitals Accreditation Standards. At some hospitals, risk identification, risk evaluation, and risk estimation, as well as risk treatment, are unstructured without any specified approach or methodology. There is no significant structured approach to risk management at the studied hospitals.ConclusionInformation security risk management is not followed by Iran’s hospitals and their information security policies. This problem can cause a large number of challenges for their CHIS security in future. Therefore, Iran’s Ministry of Health should develop practical policies to improve information security risk management in the hospitals of Iran.