Information Security Risk Management Process Research Articles

Problems of risk management in the field of information security

Objective. The purpose of the study is to collect publicly available information to identify the main problems that hinder the effective management of information security risks in the business sector.Method. The following research methods are used: systematization, description and analysis. The necessary data are formed on the basis of information obtained from the analysis of the regulatory framework and research in the field.Result. In this paper, the relevance of the issue under consideration was substantiated; the significant effectiveness of the risk-based approach in information security management was noted. The key stages of the information security risk management process were described. Next, the main problems of information security risk management for all stages of the holistic process are identified.Conclusion. The conducted research is of an overview nature. The materials presented in the paper can serve as a basis for further research on the topic, as well as for the formation of recommendations for resolving the identified problems.

E-Government Risk Optimization Capability Measurement

Bureau XYZ strived to facilitate the realization of good governance through electronic government (e-government). There were various information systems that were implemented as part of this effort, one of which was the mail management information system. Bureau XYZ has implemented an Information Security Management System (ISMS) using ISO 27001:2013 standards. Nevertheless, optimization and management of information technology risks were necessary to ensure that the implementation of the software was in accordance with the capabilities and objectives of the organization. Therefore, it was necessary to measure the capability level to determine the actions that need to be taken to improve information security risk management in implementing the software. This study aimed to obtain the capability level of the mail management information system's information security risk management process, find out the gap between the actual and desired capability level and provide recommendations for improvement according to COBIT 5. This study measured the EDM03-Ensure Risk Optimization process. The assessment results showed that the EDM03 process was at Level 1 (Performed) and had a gap value of 2 from the desired capability level, Level 3 (Established). Recommendations for improvement were also included in this study to help the organization achieve the desired level based on the assessment results, list of findings, and validation of work products.

Information Security Management Maturity Models

Several maturity models for organizations, their subsystems and processes, for example, information security (IS) incident management are known. Continuing our earlier analysis of the most common maturity models (MMs), models and approaches to assessing the maturity level (ML) of organization's IS management (ISM) maturity, namely The Bank of Russia's ISM MM, ISMS Maturity Capability Model, NIST's IS MM, Open Group's ISM MM, Gartner's Security and Risk Management ML assessment, IS Risk Management Process MM, Security Incident Management Models, and IS Monitoring MM, are selected for consideration within the framework of this research.

Dynamic interplay in the information security risk management process

In this paper, the formal processes so often assumed in information security risk management and its activities are investigated. For instance, information classification, risk analysis, and security controls are often presented in a predominantly instrumental progression. This approach, however, has received scholarly criticism, as it omits social and organisational aspects, creating a gap between formal and actual processes. This study argues that there is an incomplete understanding of how the activities within these processes actually interplay in practice. For this study, senior information security managers from four major Swedish government agencies were interviewed. As a result, 12 characteristics are presented that reflect an interplay between activities and that have implications for research, as well as for developers of standards and guidelines. The study's conclusions suggest that the information security risk management process should be seen more as an emerging process, where each activity interplays dynamically in response to new requirements and organisational and social challenges.

Dynamic interplay in the information security risk management process

In this paper, the formal processes so often assumed in information security risk management and its activities are investigated. For instance, information classification, risk analysis, and security controls are often presented in a predominantly instrumental progression. This approach, however, has received scholarly criticism, as it omits social and organisational aspects, creating a gap between formal and actual processes. This study argues that there is an incomplete understanding of how the activities within these processes actually interplay in practice. For this study, senior information security managers from four major Swedish government agencies were interviewed. As a result, 12 characteristics are presented that reflect an interplay between activities and that have implications for research, as well as for developers of standards and guidelines. The study's conclusions suggest that the information security risk management process should be seen more as an emerging process, where each activity interplays dynamically in response to new requirements and organisational and social challenges.

Effects of Information Security Management Systems on Firm Performance

The purpose of this paper is to determine the aspects of the information security management system (ISMS) on which decision-makers must act to achieve the performance targets. Information assets as core of any Information systems (IS) should be taken seriously by a custom security. In this research, we conduct a case study specially using the Delone and McLean’s IS success model. The hypotheses were tested by PLS-SEM of theSmartPLS software using survey data collected among 136 IS and IT professionals. We found that the ISMS (system, service and information qualities, maturity level of information security risk management process) and performance are directly related on one hand, and indirectly by the IT capabilities of the company in the other hand. This shows that mastering security information management risks process is crucial for an enterprise because it greatly contributes to organizational performance, improve the IS’ support such as IT management, IT personal skills and IT infrastructure. This work has explored the feasibility of using the IS success model on ISMS, a key world know element, where Africa is both the target of the informational mobility, hackers and especially in the global economy. We consider the IS success model with 4 dependent variables including maturity level of process.

Information Security Risk Management: An Intelligence-Driven Approach

Three deficiencies exist in the organisational practice of information security risk management: risk assessments are commonly perfunctory, security risks are estimated without investigation; risk is assessed on an occasional (as opposed to continuous) basis. These tendencies indicate that important data is being missed and that the situation awareness of decision-makers in many organisations is currently inadequate. This research-in-progress paper uses Endsley's situation awareness theory, and examines how the structure and functions of the US national security intelligence enterprise—a revelatory case of enterprise situation awareness development in security and risk management—correspond with Endsley’s theoretical model, and how facets of the US enterprise might be adapted to improve situation awareness in the information security risk management process of organisations.

A situation awareness model for information security risk management

Information security risk management (ISRM) is the primary means by which organizations preserve the confidentiality, integrity and availability of information resources. A review of ISRM literature identified deficiencies in the practice of information security risk assessment that inevitably lead to poor decision-making and inadequate or inappropriate security strategies. In this conceptual paper, we propose a situation aware ISRM (SA-ISRM) process model to complement the information security risk management process. Our argument is that the model addresses the aforementioned deficiencies through an enterprise-wide collection, analysis and reporting of risk-related information. The SA-ISRM model is adapted from Endsley's situation awareness model and has been refined using our findings from a case study of the US national security intelligence enterprise.

A new comprehensive framework for enterprise information security risk management

With the wide spread use of e-transactions in enterprises, information security risk management (ISRM) is becoming essential for establishing a safe environment for their activities. This paper is concerned with presenting a comprehensive ISRM framework that enables the effective establishment of the target safe environment. The framework has two structural dimensions; and two procedural dimensions. The structural dimensions include: ISRM “scope” and ISRM “assessment criteria”, while the procedural dimensions include: ISRM “process” and ISRM “assessment tools”. The framework uses the comprehensive STOPE (strategy, technology, organization, people, and environment) view for the ISRM scope; while its assessment criteria is considered to be open to various standards. For the procedural dimensions, the framework uses the widely known six-sigma DMAIC (define, measure, analyze, improve, and control) cycle for the ISRM process; and it considers the use of various assessment tools. It is hoped that the framework would be widely used in the future as an open reference for ISRM.