Information Security Risk Management Research Articles

Module for expected losses assessing in the information security risk management system of a construction company

The article examines the problem of the expected losses effective assessment in a construction company upon materialization of information security threats. One of the ways to partially solve this problem is proposed. It is suggested to improve the capabilities of the respective module of the risk management system, which provides the user with a human-machine toolkit for expert assessment of expected losses. This toolkit consists of several stages. The toolkit considers the most effective evaluation scenario given the existing situational decision-making conditions. In order to ensure the operation of the module, the informational and logical connections between the evaluation stages are also defined and the apparatus for the formation of various evaluation scenarios is designed. In addition, to increase the accuracy of the results and increase the flexibility of the proposed algorithm, the possibility of selecting the evaluation scenario by the user with the appropriate role is provided. Since the paper considers the problem of multi-criteria evaluation, the hierarchy of criteria is formalized, and the weight of their influence on the calculation results is also taken into account. When building a logical-mathematical apparatus, the possibility of realizing various types of threats to various information assets (IA) of the enterprise is also considered. The assessment of the consequences of information security threats can be carried out at different levels: general and distributed, taking into account various indicators such as violations of confidentiality, integrity and availability of information. The methods of direct expert evaluation, analytic hierarchy process (AHP), Delphi, linear convolution of criteria, probabilistic modeling are used in the development of the logico-mathematical apparatus. A qualitative-quantitative scale is used to formalize expert judgments. The necessary roles of experts for effective evaluation have been defined. Summarization of experts' assessments is carried out with control of the adequacy of the degree of logic and dispersion of the opinions of each expert, in accordance with the established requirements for the degree of agreement of the opinions of a group of experts. Competence of the experts is also taken into account during assessment.

Impact of Implementation of Information Security Risk Management and Security Controls on Cyber Security Maturity (A Case Study at Data Management Applications of XYZ Institute)

Information security is an important concern for governments and industry due to the increase in cyber attacks during Covid-19. The government is obliged to maintain information security in implementing an Electronic-Based Government System following Presidential Regulation of the Republic of Indonesia Number 95 of 2018. To overcome this problem, the XYZ Institute needs an approach to implementing information security risk management and information security controls. This study aims to risk identification, risk analysis, risk evaluation, risk treatment, risk acceptance, risk control, and analysis of cyber security maturity gaps in the domain of governance, identification, protection, detection, and response. ISO/IEC 27005:2018 as guidance for conducting risk assessments. The code of practice for information security control uses the ISO/IEC 27002:2013 standard and assessing maturity using the cyber security maturity model version 1.10 developed by the National Cyber and Crypto Agency of the Republic of Indonesia. The results show that the cyber maturity value increased from 3.19 to 4.06 after implementing 12 new security controls.

CAESAR8: An agile enterprise architecture approach to managing information security risks

In theory, implementing an Enterprise Architecture (EA) should enable organizations to increase the accuracy of information security risk assessments. In reality, however, organizations struggle to fully implement EA frameworks because the requirements for implementing an EA and the benefits of commercial frameworks are unclear, and the overhead of maintaining EA artifacts is unacceptable, especially for smaller organizations. In this paper, we describe a novel approach called CAESAR8 (Continuous Agile Enterprise Security Architecture Review in 8 domains) that supports dynamic and holistic reviews of information security risks in IT projects. CAESAR8’s nonlinear design supports continuous reassessment of information security risks, based on a checklist that assesses the maturity of security considerations in eight domains that often cause information security failures. CAESAR8 assessments can be completed by multiple stakeholders independently, thus ensuring consideration of their tacit knowledge while preventing groupthink. Our evaluation with experienced industry professionals showed that CAESAR8 successfully addresses real-world problems in information security risk management, with significant benefits particularly for smaller organizations.

Information Security Risk Management Model for Big Data

In the current society of rapid expansion of information, big data have achieved vigorous development in all walks of life, considerably promoting data transmission and information sharing. Meanwhile, individuals are becoming increasingly reliant on big data and the Internet, but at the same time, the threat of information security posed by big data is becoming increasingly visible. As a result, how to protect the information security of big data has piqued the interest of both government and businesses. The essence of information security management is risk management, which is closely related to each other. Therefore, this study focuses on the following two aspects of research work. On the one hand, most existing risk management models merely describe risk management in the abstract from a macro-level, and they lack research on risk assessment, making them ineffective. This research builds a novel information security risk management model on the basis of existing risk management models based on the concept of multidimensional risk management. To achieve multidimensional dynamic management of big data risks and to keep them within an acceptable range as much as possible, the model is divided into five levels and two dimensions. On the other hand, this research also optimizes and improves the fuzzy mathematical analysis method and proposes a fuzzy comprehensive assessment method as the core algorithm for the risk assessment layer in the model. As a post-event risk assessment method, the advantage of this method is that it can comprehensively consider factors affecting risk and can quantify some assessment factors in the real network to achieve an effective combination of qualitative and quantitative, thereby providing a basis for decision-making in risk analysis and risk control. Finally, the effectiveness of the risk model in the real application is verified by example analysis, and it is intended that the study work would provide assistance and assurance for big data information security management.

Design of Information Security Risk Management Framework Based on a Risk Profiling Study in the Healthcare Sector

Saat ini, sektor kesehatan merupakan salah satu sektor yang menjadi target utama serangan siber. Penggunaan teknologi informasi pada sektor kesehatan menyebabkan munculnya berbagai kerentanan dalam sektor kesehatan. Pengelolaan risiko keamanan informasi merupakan salah satu hal yang harus dilakukan oleh organisasi sektor kesehatan. Penelitian ini bertujuan untuk menghasilkan kerangka kerja manajemen risiko keamanan informasi pada sektor kesehatan berdasarkan kajian terhadap profil risiko yang ada pada sektor kesehatan. Penelitian dilakukan dengan metode kualitatif. Berdasarkan hasil risk profiling, sektor kesehatan mempunyai dua aset kritikal, yaitu electronic health record dan perangkat medis yang saling terhubung atau Internet of Medical Things. Aset tersebut mempunyai sensitivitas yang tinggi namun mempunyai berbagai kerentanan yang rawan dieksploitasi. Untuk mengatasi hal tersebut, diajukan kerangka kerja manajemen risiko keamanan informasi yang terdiri atas empat tahap, yaitu Risk Profiling, Pengukuran Level Risiko, Perlakuan Risiko, dan Pemantauan. Risk Profiling merupakan tahap yang penting dalam proses manajemen risiko. Pada tahap tersebut dilakukan analisis untuk menghasilkan gambaran profil risiko keamanan informasi berdasarkan aset kritikal yang dimiliki organisasi dan kondisi ruang siber dalam konteks keamanan informasi di sektor kesehatan. Kerangka yang diajukan bersifat siklis karena profil risiko pada sektor kesehatan sifatnya dinamis sehingga perlu dilakukan pemantauan terhadap perubahan profil risiko organisasi.

Issues of formation of risk management of significant objects of critical information infrastructure

With the increasing number of attacks related to information security, enterprises need to review the principles of risk management, to maintain the relevance and increase the reliability of information security management system. The article considers topical issues of risk management of significant objects of critical information infrastructure. International standards on information security ISO/IEC27001-2021, ISO/IEC 27005-2010 and requirements of the Federal Law of July 26, 2017. № 187-FL "On the security of critical information infrastructure of the Russian Federation". In particular, the rules of categorization of critical information infrastructure objects approved by the Government Decree of February 8, 2018. № 127 «On approving the rules of categorizing objects of critical information infrastructure of the Russian Federation, as well as the list of indicators of criteria for the significance objects of critical information infrastructure of the Russian Federation and their values were analyzed» regarding information security risk management are analyzed. A comparative table of the risk management process for an organization that has significant critical information infrastructure facilities and the categorization process for critical information infrastructure facilities is presenting. Developed recommendations for maintaining the relevance of risk management of critical information infrastructure entities.

Case Study of Cloud Computing Security Issues and confidentiality Challenges

Cloud computing is a term, which involves virtualization, distributed computing, networking, software and web services. A cloud consists of several elements such as clients, data center and distributed servers. It includes fault tolerance, high availability, scalability, flexibility, reduced overhead for users, reduced cost of ownership, on demand services etc.Cloud Computing offers better computing through improved utilization and reduced administration and infrastructure costs. Cloud Computing is the sum of Software as a Service (SaaS) and Utility Computing. Cloud Computing is still at its infant stage and a very new technology. Therefore, most of the users are not very confident to adopt it.The main issue that faced the cloud computing is “security”. In this paper, we try to find out what countermeasures best strengthen the confidentiality, integrity and availability (CIA) of the implementation of cloud computing within the DOD This will be done by analyzing threats and countermeasures within the context of the ten domains comprising the Certified Information System Security Professional (CISSP) Common Body of Knowledge (CBK). The ten domains include access control; telecommunications and network security; information security governance and risk management; application security; cryptography; security architecture and design; operations security; business continuity planning and disaster planning; legal regulations, compliance, and investigation; and physical security. The results will provide a comprehensive guide for any Department of DefenseDoD entity attempting to secure its cloud solution.

E-Government Risk Optimization Capability Measurement

Bureau XYZ strived to facilitate the realization of good governance through electronic government (e-government). There were various information systems that were implemented as part of this effort, one of which was the mail management information system. Bureau XYZ has implemented an Information Security Management System (ISMS) using ISO 27001:2013 standards. Nevertheless, optimization and management of information technology risks were necessary to ensure that the implementation of the software was in accordance with the capabilities and objectives of the organization. Therefore, it was necessary to measure the capability level to determine the actions that need to be taken to improve information security risk management in implementing the software. This study aimed to obtain the capability level of the mail management information system's information security risk management process, find out the gap between the actual and desired capability level and provide recommendations for improvement according to COBIT 5. This study measured the EDM03-Ensure Risk Optimization process. The assessment results showed that the EDM03 process was at Level 1 (Performed) and had a gap value of 2 from the desired capability level, Level 3 (Established). Recommendations for improvement were also included in this study to help the organization achieve the desired level based on the assessment results, list of findings, and validation of work products.

Information security risk management in the electronics industry

Information security risk management in the electronics industry

Information Security Management Maturity Models

Several maturity models for organizations, their subsystems and processes, for example, information security (IS) incident management are known. Continuing our earlier analysis of the most common maturity models (MMs), models and approaches to assessing the maturity level (ML) of organization's IS management (ISM) maturity, namely The Bank of Russia's ISM MM, ISMS Maturity Capability Model, NIST's IS MM, Open Group's ISM MM, Gartner's Security and Risk Management ML assessment, IS Risk Management Process MM, Security Incident Management Models, and IS Monitoring MM, are selected for consideration within the framework of this research.

Information security risk management models for cloud hosted systems: A comparative study

Cloud hosting approach is becoming a popular choice for management. Having the information hosted in the cloud increase the risks and threats. A strong Security Model is required to maximize the security and treat risks efficiently. This research aims to analysis the most popular Security Model Methodologies and provide recommendation on the best fit methodology for cloud hosting approach. This research used a comparison model to compare the Security Model methodologies, which are ISO27005, NIST SP 800-30, CRAMM, CORAS, OCTAVE Allegro, and COBIT 5, based on three areas: Applicability, adaptability, and Involvement of the models for a cloud-based hosting approach. The research recommends OCTAVE Allegro as the preferred model for cloud hosting approach, as well as COBIT 5 and CORAS with some tuning. The previous models handle the CIA Triad and focus on the information storage, Processing, and transmission. The ISO27005, NIST SP 800-30, and CRAMM are all describing the risk management and assessment as an abstract and might not provide clear guidelines for cloud risks evaluation and assessment. There are more than 200 security models in the management studies, few are suitable for fast growing and continuously changing environment like the cloud approach, the research value on highlighting the best fit approaches to consider when using a cloud hosting platform, securing the information with a proper model.

Sports Enterprise Marketing and Financial Risk Management Based on Decision Tree and Data Mining.

With the development of modern economy, traditional sports industry enterprises have also been further developed in the financial business. How to ensure information security and financial risk management is the problem faced by sports companies. Risk assessment is the use of mathematical models to calculate the risk factors established in the previous step to predict possible risks. In response to the above problems, we developed a sports enterprise marketing and financial risk management model based on decision trees and data mining. First, we have established a relevant evaluation index system and data samples through in-depth understanding of the actual marketing and financial problems of sports companies. Second, we use the decision tree algorithm to mine and explore related data samples and conduct risk assessment through related indicators. By using the model to calculate the probability of occurrence of the risk, analyze the degree of damage. Finally, the algorithm of this paper is analyzed and discussed through simulation experiments.

Information Security Risk Management in IT Outsourcing – A Quarter-century Systematic Literature Review

ABSTRACT Information Security Risk Management (ISRM) in Information Technology Outsourcing (ITO) is among the most critical and under-studied areas of ITO research. This study investigates the body of knowledge focusing on ISRM in ITO by conducting a systematic literature review (SLR) and analyzes 63 papers published between 1994 and 2020. The findings suggest that developing conceptual models or providing commentary is the most popular methodology. Most studies collect data from secondary sources instead of industry. A majority of the studies neither investigate any specific industry nor ITO orientation, i.e., client or service providers. Information security risks (ISRs) from the literature are categorized into 27 types. Most ISRs belong to operations practice, while lack of staff loyalty is the least investigated type of ISRs. Theories, frameworks and models discussed in the literature are explored. A critical analysis of the findings is conducted to identify the gaps and future directions. Since most of the literature is based on conceptual work, it is hard for practitioners to apply this knowledge in the industry unless validated by further research. Specialized literature from the perspectives of ITO orientation, industry type and demographics is required to investigate focused issues and develop accurate knowledge of ISRM in ITO.

Evaluasi Tingkat Kesiapan Keamanan Informasi Menggunakan Indeks Keamanan Informasi (Indeks KAMI) Versi 4.0 pada Dinas Komunikasi dan Informatika Kota Bogor

Communications and Informatics Office of Bogor Municipality is a government agency that has the task of assisting the Mayor of Bogor in carrying out Government Affairs in the field of Communication, Informatics, Statistics, and Encryption management that has implemented e-Government in its public services. The impact of the e-Government’s implementation in public services with the increasing communication and exchange of data electronically causes vulnerabilities in information and communication system transactions which greatly affect the quality and security of information, so that the management of information security becomes very important for the Communications and Informatics Office of Bogor Municipality. This research was conducted to determine the level of readiness of information security management at the Communications and Informatics Office of Bogor Municipality using the Information Security Index (KAMI Index) Version 4.0 according to the security aspects defined by the ISO/IEC 27001:2013 standard made by the National Cyber and Crypto Board (BSSN). by evaluating various areas that are the target of the application of information security through the interview process. The evaluation result of the Electronic System Category obtained value of 35 and included in the Strategic Category illustrating that the use of electronic systems is an integral strategic part in supporting ongoing work processes. The evaluation result of the five areas of information security obtained a total score of 395 at the Basic Framework stage with Maturity Levels I+ to II. Based on the evaluation results, recommendations are prioritized at the lowest maturity level, namely the Information Security Risk Management area so that in the next evaluation there can be an increase in the level of information security maturity until it reaches the expected maturity level according to ISO 27001 compliance standards, which is at level III.

From rationale to lessons learned in the cloud information security risk assessment: a study of organizations in Sweden

PurposeThis study aims to address the issue of practicing information security risk assessment (ISRA) on cloud solutions by studying municipalities and large organizations in Sweden.Design/methodology/approachFour large organizations and five municipalities that use cloud services and conduct ISRA to adhere to their information security risk management practices were studied. Data were gathered qualitatively to answer the study’s research question: How is ISRA practiced on the cloud? The Coat Hanger model was used as a theoretical lens to study and theorize the practices.FindingsThe results showed that the organizations aimed to follow the guidelines, in the form of frameworks or their own experience, to conduct ISRA; furthermore, the frameworks were altered to fit the organizations’ needs. The results further indicated that one of the main concerns with the cloud ISRA was the absence of a culture that integrates risk management. Finally, the findings also stressed the importance of a good understanding and a well-written legal contract between the cloud providers and the organizations using the cloud services.Originality/valueAs opposed to the previous research, which was more inclined to try out and evaluate various cloud ISRA, the study provides insights into the practice of cloud ISRA experienced by the organizations. This study represents the first attempt to investigate cloud ISRA that organizations practice in managing their information security.

Information security implications of using NLP in IT outsourcing: a Diffusion of Innovation theory perspective.

Information technology outsourcing (ITO) is a USD multi-trillion industry. There is growing competition among ITO service providers to improve their service deliveries. Natural language processing (NLP) is a technique, which can be leveraged to gain a competitive advantage in the ITO industry. This paper explores the information security implications of using NLP in ITO. First, it explores the use of NLP to enhance information security risk management (ISRM) in ITO. Then, it delves into the information security risks (ISRs) that may arise from the use of NLP in ITO. Finally, it proposes possible ISRM approaches to address those ISRs in ITO from the use of NLP. The study follows a qualitative approach using the case study method. Nine participants from three organisations (an ITO client, service provider and sub-contractor) engaged in an ITO relationship in the ICT industry were interviewed through a semi-structured questionnaire. The research findings were verified through a focus group. Case study scenarios are provided for a clear understanding of the findings. To the best of our knowledge, it is the first study to investigate the information security implications of the use of NLP in ITO.

KAMI index as an evaluation of academic information system security at XYZ university

XYZ University is one of the universities that has used information technology to create quality service for students and the entire academic community. This Information technology service is managed by Information Technology and Communication Center (PUSTIK) which is responsible to carry out the development, management, service, and maintaining the security of information and communication technology. Good information technology governance should be able to maintain information security. Therefore, it is necessary to evaluate information system security especially the security of academic information systems. This information system security evaluation uses Keamanan Informasi (KAMI) Index which refers to the ISO/IEC 27001:2013 standard to be able to determine the maturity level of information security. An evaluation of five areas of the KAMI Index shows the Information Security Risk Management area gets the lowest score at 10 out of a total of 72. The result of the KAMI Index dashboard shows that the maturity level of each area of information security is at levels I and I+ with a total score of 166. This means that the level of completeness of implement ISO 27001:2013 standard is in the inadequate category.

Penilaian Risiko Keamanan Informasi Menggunakan Octave Allegro: Studi Kasus pada Perguruan Tinggi

Currently the need for the use of information systems has become important for institution and organizations. The use of information systems has also expanded to various fields, namely educational institutions. However, on the other hand information can be an important security gap. The important information that falls to other parties can result in loss to the owner of the information. This study aims to conduct an internal assessment of information security risks from the use of information systems, so that it can be seen what risks are very high and need to be mitigated. In this study, the Octave Allegro framework was used to conduct an internal assessment. The steps taken in conducting an information security risk assessment consist of 8 steps. Each step produces an output that is used as the basis for evaluating the next step. There are 2 areas that need attention and become the focus of improvement. Information security risk management needs to be carried out and monitored closely and regularly against risks that are determined to be important and have a high risk probability.

Risk and Compliance

Many organizations are facing complex risk management issues and are ill equipped to sufficiently mitigate risk in a focused manner. Studies have shown that an astonishing 57% of senior level executives label “risk and compliance” as the two top categories they feel least prepared to address (Quantivate, 2019, para. 1). Consequently, only 6% of directors maintain confidence that their organization is effectively managing risk (Guis, Mieszala, Panayiotou & Poppensieker, 2018, para. 4). With so many organizations facing an existential risk management crisis, this beckons the question how many organizations have implemented a mature information security risk management program through the use of a focused risk assessment to drive the creation and maintenance of the information security program and are enforced through IT auditing (Streff, 2019). The existence of assessing risk and using the results to create and maintain the information security program and enforcing through auditing are listed in order or relative importance. This paper will aim to discuss the importance of each pillar and explain the reasoning behind the priority between the three concepts.

Онтологическое обеспечение управления рисками информационной безопасности

As a result of the work focused on improving the efficiency of the information security system through the development of an ontological model and an approach based on it to ensure information security (IS) risk management, a flexible result was obtained, which is designed to ensure an increase in the efficiency of the information security system by reducing the time spent on managerial decision-making. At the end of the work, a comparative analysis of existing approaches and techniques to information security risk management and the described approach was carried out. Based on the developed ontology and approach, highly intelligent information security risk management systems and the information security system can be created on its basis.