Information Security Risk Management Research Articles

An Empirical Examination of the Effects of CTO Leadership on the Alignment of the Governance of Big Data and Information Security Risk Management Effectiveness

Aim/Purpose: Board of Directors seek to use their big data as a competitive advantage. Still, scholars note the complexities of corporate governance in practice related to information security risk management (ISRM) effectiveness. Background: While the interest in ISRM and its relationship to organizational success has grown, the scholarly literature is unclear about the effects of Chief Technology Officers (CTOs) leadership styles, the alignment of the governance of big data, and ISRM effectiveness in organizations in the West-ern United States. Methodology: The research method selected for this study was a quantitative, correlational research design. Data from 139 participant survey responses from Chief Technology Officers (CTOs) in the Western United States were analyzed using 3 regression models to test for mediation following Baron and Kenny’s methodology. Contribution: Previous scholarship has established the importance of leadership styles, big data governance, and ISRM effectiveness, but not in a combined understanding of the relationship between all three variables. The researchers’ primary objective was to contribute valuable knowledge to the practical field of computer science by empirically validating the relationships between the CTOs leadership styles, the alignment of the governance of big data, and ISRM effectiveness. Findings: The results of the first regression model between CTOs leadership styles and ISRM effectiveness were statistically significant. The second regression model results between CTOs leadership styles and the alignment of the governance of big data were not statistically significant. The results of the third regression model between CTOs leadership styles, the alignment of the governance of big data, and ISRM effectiveness were statistically significant. The alignment of the governance of big data was a significant predictor in the model. At the same time, the predictive strength of all 3 CTOs leadership styles was diminished between the first regression model and the third regression model. The regression models indicated that the alignment of the governance of big data was a partial mediator of the relationship between CTOs leadership styles and ISRM effectiveness. Recommendations for Practitioners: With big data growing at an exponential rate, this research may be useful in helping other practitioners think about how to test mediation with other interconnected variables related to the alignment of the governance of big data. Overall, the alignment of governance of big data being a partial mediator of the relationship between CTOs leadership styles and ISRM effectiveness suggests the significant role that the alignment of the governance of big data plays within an organization. Recommendations for Researchers: While this exact study has not been previously conducted with these three variables with CTOs in the Western United States, overall, these results are in agreement with the literature that information security governance does not significantly mediate the relationship between IT leadership styles and ISRM. However, some of the overall findings did vary from the literature, including the predictive relationship between transactional leadership and ISRM effectiveness. With the finding of partial mediation indicated in this study, this also suggests that the alignment of the governance of big data provides a partial intervention between CTOs leadership styles and ISRM effectiveness. Impact on Society: Big data breaches are increasing year after year, exposing sensitive information that can lead to harm to citizens. This study supports the broader scholarly consensus that to achieve ISRM effectiveness, better alignment of governance policies is essential. This research highlights the importance of higher-level governance as it relates to ISRM effectiveness, implying that ineffective governance could negatively impact both leadership and ISRM effectiveness, which could potentially cause reputational harm. Future Research: This study raised questions about CTO leadership styles, the specific governance structures involved related to the alignment of big data and ISRM effectiveness. While the research around these variables independently is mature, there is an overall lack of mediation studies as it relates to the impact of the alignment of the governance of big data. With the lack of alignment around a universal framework, evolving frameworks could be tested in future research to see if similar results are obtained.

Approach of the information properties destruction risks assessing based on the color scale

One of the urgent tasks of today is information protection as defined by the regulations of our state in the field of information security and cybersecurity. The protection of information is to ensure the preservation of its properties such as confidentiality, integrity, and accessibility. In the process of assessing the information security, the priorities of its protection are determined, taking into account the degree of restriction of access to it. Information security risks are assessed to select effective measures and remedies. The existing assessment methods are analyzed, based on estimates of the magnitude of possible damage from the occurrence of an information security incident and the probability or probability of its occurrence. However, none of the forms of formalizing the risk level reflects which properties may be violated within the incident. That is, the general presentation of the risk does not allow its prompt processing. With the use of modern computer technology, it has become possible to create dynamic images of the level of risk. The basis of computer graphics is an additive model of the transfer of red, green, and blue. With this in mind, a method has been developed to assess the risks of violating the properties of information. Its use will distinguish the properties of information by the set color. With the advent of information about new vulnerabilities in information and telecommunications systems, the color may change, which will signal a change in the level of risk for a particular property of information. This approach to information security risk management facilitates prompt decision-making on risk management and maintains the information security process at the appropriate level. At the same time, the use of the proposed method will allow to record changes in the numerical values of colors and, as a consequence, to find the rate of change of the level of information security risk. Its average value can be used to predict the resilience of the protection system to information security incidents. Therefore, the speed of change in the level of information security risk can expand the list of parameters for determining the index of information system development and the basis for updating the planned costs of the organization to ensure information security.

Comparative Study of a Cybersecurity Curriculum To Support Digital Transformation in The Public Sector

The Covid 19 pandemic that has occurred in all parts of the world since early 2020 has forced all humans to follow digital transformation. This momentum is considered good for the acceleration of digital transformation, which since the issuance of Presidential Decree Number 95 of 2018 has begun to be initiated. Digital transformation marks a radical rethinking of how an organization uses technology, people and processes to fundamentally change business performance. Digital transformation occurs in the economic, social and public sphere with the aim of creating innovation, encouraging inclusiveness and increasing efficiency and productivity. Although it is absolutely related to digital technology, digital transformation is not just technology but also takes into account other elements such as infrastructure, policies, leadership, digital literacy, mindset, data, research and cybersecurity. Cybersecurity is a crucial prerequisite because interconnection in the digital world demands data privacy and information security. In fact, the demands of cybersecurity in digital transformation are not matched by human resources who are experts in the cyber field. APTIKOM states that each year in Indonesia it only manages to produce 40 thousand - 50 thousand bachelors of information technology competence, while the need is predicted to reach 600 thousand people per year. At the higher education level, the curriculum in cybersecurity study programs tends to focus on technical areas only. Even though. Cybersecurity is a complex matter that requires a multidisciplinary approach such as experts in regulation and policy, governance and information security risk management, and so on. This research is a qualitative descriptive study. The author uses a comparative method to compare the cybersecurity curriculum in Indonesia with the Netherlands, which has a multi- disciplinary cybersecurity curriculum. So that we get multidisciplinary curriculum recommendations that can be applied in the cybersecurity curriculum in Indonesia.

The Validity of Information Security Risk Assessment Methods for Organizations

Based on statistical data, a contradiction is shown between an increase in financial investments in the information security (IS) of organizations and a steady increase in the number of IS incidents caused by internal users. A conclusion is made about the cognitive vulnerability and low degree of validity of modern IS risk assessment methods. Stereotypes have been identified, the result of which are cognitive errors in assessing IS risks: the priority of technical protection of information from external threats of IS over organizational and technical protection from internal threats; distrust of the internal client, perception of it exclusively as an object of tough managerial influence, ignoring its subjective role in IS management; restriction of work with personnel within the IS management system with one-time measures and static criteria for assessing human risks and inattention to systemic measures and dynamic, situational criteria. The necessity of updating standards for IS risk management, as well as the development of new methods and tools for assessing, IS risks based on rejecting outdated stereotypes, is substantiated.

Adopting ISO/IEC 27005:2011-based Risk Treatment Plan to Prevent Patients Data Theft

The concern raised in late 2017 regarding 46.2 million mobile device subscribers’ data breach had the Malaysian police started an investigation looking for the source of the leak. Data security is fundamental to protect the assets or information by providing its confidentiality, integrity and availability not only in the telecommunication industry but also in other sectors. This paper attempts to protect the data of a patient-based clinical system by producing a risk treatment plan for its software products. The existing system is vulnerable to information theft, insecure databases, needy audit login and password management. The information security risk assessment consisting of identifying risks, analyzing and evaluating them were conducted before a risk assessment report is written down. A risk management framework was applied to the software development unit of the organization to countermeasure these risks. ISO/IEC 27005:2011 standard was used as the basis for the information security risk management framework. The controls from Annex A of ISO/IEC 27001:2013 were used to reduce the risks. Thirty risks have been identified and 7 high-level risks for the product have been recognized. A risk treatment plan focusing on the risks and controls has been developed for the system to reduce these risks in order to secure the patients’ data. This will eventually enhance the information security in the software development unit and at the same time, increase awareness among the team members concerning risks and the means to handle them.

Maturity Framework Analysis ISO 27001: 2013 on Indonesian Higher Education

Information Security Management System (ISMS) implementation in Institution is an effort to minimize information security risks and threats such as information leakage, application damage, data loss and declining IT network performance. The several incidents related to information security have occurred in the implementation of the Academic System application in Indonesian higher education. This research was conducted to determine the maturity level of information security practices in Academic Information Systems at universities in Indonesia. The number of universities used as research samples were 35 institutions. Compliance with the application of ISO 27001:2013 standard is used as a reference to determine the maturity level of information system security practices. Meanwhile, to measure and calculate the level of maturity using the SSE-CMM model. In this research, the Information System Security Index obtained from the analysis results can be used as a tool to measure the maturity of information security that has been applied. There are six key areas examined in this study, namely the role and importance of ICT, information security governance, information security risk management, information security management framework, information asset management, and information security technology. The results showed the level of information security maturity at 35 universities was at level 2 Managed Process and level 3 Established Process. The composition is that 40% of universities are at level 3, and 60% are out of level 3. The value of the gap between the value of the current maturity level and the expected level of maturity is varied for each clause (domain). The smallest gap (1 level) is in clause A5: Information Security Policy, clause A9: Access Control, and clause A11: Physical and environmental security. The biggest gap (4 levels) is in clause A14: System acquisition, development and maintenance and clause A18: compliance.  Â

Risk management practices in information security: Exploring the status quo in the DACH region

Information security management aims at ensuring proper protection of information values and information processing systems (i.e. assets). Information security risk management techniques are incorporated to deal with threats and vulnerabilities that impose risks to information security properties of these assets. This paper investigates the current state of risk management practices being used in information security management in the DACH region (Germany, Austria, Switzerland). We used an anonymous online survey targeting strategic and operative information security and risk managers and collected data from 26 organizations. We analyzed general practices, documentation artifacts, patterns of stakeholder collaboration as well as tool types and data sources used by enterprises to conduct information security management activities. Our findings show that the state of practice of information security risk management is in need of improvement. Current industrial practice heavily relies on manual data collection and complex potentially subjective decision processes with multiple stakeholders involved. Dedicated risk management tools and methods are used selectively and neglected in favor of general-purpose documentation tools and direct communication between stakeholders. In light of our results we propose guidelines for the development of risk management practices that are better aligned with the current operational situation in information security management.

МЕТОД АНАЛІЗУВАННЯ ВИМОГ ДО СИСТЕМ УПРАВЛІННЯ ІНФОРМАЦІЙНОЮ БЕЗПЕКОЮ.

The process of analyzing the requirements for information security management systems is considered. The obligation to comply with the requirements of the international standard ISO/IEC 27001 is shown. This provides confidence to stakeholders in the proper management of information security risks with an acceptable level. This is due to the internal and external circumstances of influencing the goal and achieving the expected results of organizations. In addition, the identification of stakeholders, their needs and expectations from the development of information security management systems are also considered. It is established that now the main focus is on taking into account the requirements for the process of developing these systems or to ensure information security in organizations. The transformation of the needs, expectations and related constraints of stakeholders into an appropriate systemic solution has been overlooked. These limitations have been overcome through the method of analyzing the requirements for information security management systems. Its use allows, based on the needs, expectations and related constraints of stakeholders, to identify relevant statements in established syntactic forms. There is need to check each of them for correctness of formulation and compliance with the characteristics of both the individual requirement and the set of requirements. For their systematization, establishment of relations the graphic notation SysML is applied. In view of this, the requirement is considered as a stereotype of a class with properties and constraints. Relationships are used to establish relationships between requirements. Their combination is represented by a diagram in the graphical notation SysML and, as a result, allows you to specify the requirements for information security management systems. In the prospects of further research, it is planned to develop its logical structure on the basis of the proposed method.

Rethinking capabilities in information security risk management: a systematic literature review

Rethinking capabilities in information security risk management: a systematic literature review

Analysis and identification of ways to reduce critical information security risks

One of the key requirements for the protection of an organization's information assets is to ensure proper information security risk management. In the process of risk management, they should be identified, assessed, analyzed and processed in order to change the value of risk to an acceptable level. The article proposes to consider ways to reduce information risks that may be caused by critical categories of threats and vulnerabilities.

Automated vehicles risk assessment and evaluation

Statistics show that the number of passenger cars is increasing significantly, which will have a negative impact on social, economic and environmental sustainability, and it will cause severe problems for the next generations. Automated Vehicles (AVs) represent an innovation in automotive technology. They have become a global concern because of their importance in smart traffic systems as well as their significant impact on safety, supposing that traffic will be more efficient and longer travel distance will not be a problem. They will become more acceptable since they will encourage living in suburbs and leaving noisy and polluted cities behind. Drivers will be more relaxed and in comfort while enjoying travel time and some extra privileges that they may have, for example, the chance for spending time more productively and efficiently at non-driving times inside the vehicle. Automated Vehicles are also beneficial for the environment. In fact, it is expected that in the next few years these cars in general will provide a solution for many problems. Researchers and planners of transportation systems are facing many challenges in the field of autonomous vehicles, as the level of safety and mobility involves such elements and circumstances which may cause that the operated travel will be less efficient than expected. The aim of the article is to discuss the challenges, threats, vulnerability, impacts and likelihood of failure faced in the development of AVs by studying information security risk management standard process, and explaining how to apply the process of International Organization for Standardization. The concept of applying ISO to AVs will be discussed here through certain processes.

РАЗВИТИЕ ЦИФРОВЫХ КОМПЕТЕНЦИЙ БУДУЩИХ СПЕЦИАЛИСТОВ ПО ЗАЩИТЕ ИНФОРМАЦИИ В ВУЗЕ

Digital transformation of modern society causes higher education to develop both universal and professional digital competencies of students. This is critical for the future specialists in the field of information security, as their training has some specific features, which determine the relevance of this article. The goal of the research is to justify the development of digital competencies of information security students in the context of Education 4.0 paradigm and the national program for the development of digital economy. The theoretical significance of the study is the clarification of the concept of digital competencies, trends and the possible consequences of their development in Russian and foreign practice. The scientific novelty is in identifying the features and problems of the development of digital competencies of information security specialists, as well as in substantiating the prospective possibilities of these problems overcoming in training information security students at university. The effectiveness of new approaches to the organization of digital skills training of students in the course called information security risk management is shown.

Strategic Dimensions of Information Security Risk Management

Information security is thus a big threat to the survival of enterprises. In all context and forms, it is an imperative to provide adequate safeguards and measures to management the risk arising from flow of information and data. The business models of organizations are highly dependent on flow of information during the business processes. The management of information security has several perspectives. In this paper, the legal, quality and human resource perspectives have been discussed. The Information Security Risk Management Model must balance these perspectives to optimize for best value derived out of it.

Information Security Risk Management of Research Information Systems: A hybrid approach of Fuzzy FMEA, AHP, TOPSIS and Shannon Entropy

Information Security Risk Management of Research Information Systems: A hybrid approach of Fuzzy FMEA, AHP, TOPSIS and Shannon Entropy

Information Security Risk Management for BIDUK System

The use of digital technology nowadays makes data and information become vital part of any organization. Non-profit organization, such as Archdiocese of Jakarta, also relies on system to do their work and services for Catholic people under their jurisdiction. BIDUK system is used by Archdiocese of Jakarta as information system to administrate and provide service to people. Its information also used as tools for decision making. Currently, there is no proper information security risk management method used for BIDUK system, which is important system for Archdiocese of Jakarta. This study’s objective is to propose a IS risk management method that can be used to manage risks for BIDUK system. This study proposes OCTAVE Allegro method because of its simplicity and suitable for small organization. After following every IS risk management phases of OCTAVE Allegro, we found that this method is suitable to be used to manage risks of BIDUK system.

A state of the art fuzzy based healthcare risk management for health information exchange

The Today health-care organizations and physicians use several processes and instruments to exchange data about the private health of patients electronically. The main aims of the different methods of information (HIE) exchange on health are to reduce healthcare costs, to minimize medical errors and to better coordinate health services. Risks of information assets have a complex nature and different approaches address risk management of information security in medial field. The objective of this paper is to create the state-of - the-art information security risk management. In order to accomplish this, a Fuzzy based Healthcare Risk Management is suggested. This research aimed at exploring the core importance of the Fuzzy based Healthcare Risk Management (FHRM) from the views of health care consumers in the health sector. The result shows that the views of patients on multiple mechanisms for exchanging data about patient privacy, trust in competence and integrity and readiness to share data are significantly different.

University Information System Security Risk Assessment using NIST 800-30

A good and fast information system is supported by good information technology. To achieve its business goals, optimal and integrated information technology will support good quality services. The XYZ University Information System (UIS) provides a variety of information needed by students, lecturers, and all staff. But the system that is running is still experiencing problems in its use that can pose various risks. To prevent that, a risk assessment is carried out on the UIS to identify various possible risks and prevent them by forming a risk management. This research will be conducted using NIST 800-30. This standard is used with the aim of anticipating risks so that the organization does not experience losses. The preparation of UIS information security risk management carried out in this study has succeeded in identifying 32 risk scenarios, prioritizing risks, providing direction in managing risks and accepting processes whether risks are acceptable or should be mitigated.

Revisiting information security risk management challenges: a practice perspective

PurposeThe study aims to revisit six previously defined challenges in information security risk management to provide insights into new challenges based on current practices.Design/methodology/approachThe study is based on an empirical study consisting of in-depth interviews with representatives from public sector organisations. The data were analysed by applying a practice-based view, i.e. the lens of knowing (or knowings). The results were validated by an expert panel.FindingsManagerial and organisational concerns that go beyond a technical perspective have been found, which affect the ongoing social build-up of knowledge in everyday information security work..Research limitations/implicationsThe study has delimitation as it consists of data from four public sector organisations, i.e. statistical analyses have not been in focus, while implying a better understanding of what and why certain actions are practised in their security work.Practical implicationsThe new challenges that have been identified offer a refined set of actionable advice to practitioners, which, for example, can support cost-efficient decisions and avoid unnecessary security trade-offs.Originality/valueInformation security is increasingly relevant for organisations, yet little is still known about how related risks are handled in practice. Recent studies have indicated a gap between the espoused and the actual actions. Insights from actual, situated enactment of practice can advise on process adaption and suggest more fit approaches.

ANALISIS TINGKAT KESIAPAN PENGAMANAN SISTEM INFORMASI

The University has a number of data relating to Academic and Higher Education Governance. The large amount of data that requires security, especially in terms of readiness to secure information systems. Maintaining information system security in the university environment aims to maintain confidentiality, fulfill the availability of the system for those who have authority for those who use it and the integrity of the system. The University of National Development "Veteran" Jakarta has work units such as the Faculty, UPT and Bureau where each has the task and function to manage data. The problem is the need to measure the level of information system security to see the maturity of an information system at UPN Veteran Jakarta. OUR Index stands for Information Security Index which is used as a tool to analyze and measure and evaluate the maturity level of information security with the application of SNI ISO / IEC 27001: 2009 standards that can be applied within government agencies. As for the KAMi index version used, namely version 3.1. The method used to solve the problems in OUR index is through six stages, namely the first stage of electronic systems, both information security governance, third information security risk management, the four information security management frameworks, the five asset information management and the six information security technologies. The results obtained after taking measurements using the US Index need improvement in system security in managing information security risks and governance.

Rethinking capabilities in information security risk management: a systematic literature review

Information security risk management capabilities have predominantly focused on instrumental onsets, while largely ignoring the underlying intentions and knowledge these management practices entail. This article aims to study what capabilities are embedded in information security risk management. A theoretical framework is proposed, namely rethinking capability as the alignment between intent and knowing. The framework is situated around four general risk management practices. A systematic literature review utilising the framework was conducted, resulting in the identification of eight identified capabilities. These capabilities were grouped into respective practices: integrating various perspectives and values to reach a risk perception aligned with the intended outcome (identify); adapting to varying perspectives of risks and prioritising them in accordance with the intended outcome (prioritise); security controls to enable resources, and integrate/reconfigure beliefs held by various stakeholders (implement); and sustaining the integrated resources and competences held by stakeholders to continue the alignment with the intended outcome (monitor).