Information Security Work Research Articles

Organisational culture and information security awareness of Chinese grassroots civil servants: A mediated moderation model

AbstractDigital information and data significantly improve the efficiency of government work in China. At the same time, in order to deal with information security and data leakage events, public departments have begun to pay attention to the information security awareness and behaviour of civil servants. Based on organisational culture and protection motivation theory, this study constructed a mediated moderation model to explore the influence mechanism of grassroots civil servants’ awareness of information security. This study collected 324 questionnaires from four regions of China. Results show that organisational culture has a significant positive impact on information security awareness. Professional identity has a significant positive effect on public service motivation and plays a negative moderating role in the relationship between organisational culture and information security awareness. Public service motivation mediates the moderating effect of professional identity on the relationship between organisational culture and information security awareness. The findings of this study offer practical implications and suggestions for further research.Points for practitioners The construction of organisational culture will effectively enhance the information security awareness of Chinese grassroots civil servants. Public departments should consider professional identity as an important factor when selecting grassroots civil servants engaged in information security work. In the implementation of information security management strategy planning, government departments can pay attention to and emphasise the public service motivation of grassroots civil servants.

Identification of SMEs in the Critical Factors of an IS Backup System Using a Three-Stage Advanced Hybrid MDM–AHP Model

Backup system work represents “the last mile” of information security (IS). To avoid data loss or damage, enterprises should execute data backup periodically to ensure the integrity and availability of such data. Additionally, due to the continuous emergence of IS incidents featuring malicious attacks in recent years, major firms in countries around the world have successively reported being under attack by ransomware viruses. In particular, small and medium enterprises (SMEs) became the potential targets of malicious attacks based on their different types of IS awareness and degrees of digitalization; therefore, IS work has become one of the essential topics with special significance for numerous SMEs. To this end, this paper studied the factors influencing SMEs’ adoption of IS backup systems in the hope that the critical decision-making behaviors of SMEs regarding the issue of IS could be learned. Practical suggestions can be made for the marketing schemes adopted by IS manufacturers concerning the planning of IS backup systems. Thus, this study used three methodological stages to address the exciting issue of IS backup systems for SMEs. In the first stage, 11 factors at two hierarchies involving three constructs influencing SMEs’ adoption of IS backup systems were summarized via a literature review. The constructs included financial consideration (FC), the IS incident, and business IS decision making (BISD-M). In the second stage, an expert questionnaire was applied; an advanced hybrid modified Delphi method (MDM) and analytic hierarchy process (AHP) with expert input were constructed to identify the sorting of overall weights based on the 11 factors included in the first stage. Following the empirical conclusions, the top three critical factors were “disaster loss amount”, “enterprise’s downtime”, and “supplier’s contractual requirements”. The conclusions of this study indicated that two factors were included in the FC construct; thus, the FC construct influenced IS the most, and the BISD-M construct took second place. In the final stage, through re-checking three actual cases, the results of this study were verified with specific respect to the FC. In conclusion, to popularize IS backup systems among SMEs and fully implement IS, manufacturers may start from the FC in the hope that the severe impact caused by IS incidents featuring malicious attacks can be slowed down and the losses encountered can be lowered. The empirical results and conclusions of this study can be used for reference by SMEs, and both theoretical and empirical foundations have been provided for further studies in academic circles; the results above also show a significant application contribution of this study.

Strategy to Improve Employee Security Awareness at Information Technology Directorate Bank XYZ

Bank handles private information like customer financial transactions and personal data. There was a 63% increase in cyberattacks attempted against Bank XYZ in 2021, and 1,323 attempted attacks on corporate email Bank XYZ. Therefore, implementing security awareness training for all employees is crucial for Bank XYZ. The information security awareness program must be assessed to determine the program's efficiency and the level of information security awareness among employees. Therefore, this study assesses the information security awareness at Bank XYZ, especially the Information Technology (IT) Directorate using the Human Aspect of Information Security Questionnaire (HAIS-Q) method. The findings of this study revealed that employees at Bank XYZ in the information security work unit had a "Good" level of awareness. In contrast, the results from other IT work units were “Medium”. Based on the assessment results, Bank XYZ's security awareness strategy recommendation is to align awareness content with information security policies and procedures, use a variety of media awareness, and focus on the "Internet Use" and "Information Handling" awareness areas. As a way of determining the achievement of information security Key Performance Indicators (KPI), security awareness measurement must be done regularly, for example, once a year.

The Saudi Information System Law and its Effectiveness (A Study of the Degree to Which Major Saudi Organizations Apply the Best Practices of Information Systems)

Information Security Law is the body of legal rules, codes, and standards that require companies to protect that information and the information systems that process it from unauthorized access. The government's development, issuance, and maintenance of law requirements help to ensure that standards are met, which, in turn, supports the country's safety, productivity, and economic development. The purpose of this paper is to assess the adequacy of the current Saudi laws and regulations related to information security and the extent to which information security laws impacted companies' application of information security best practices. The Saudi laws related to information security were studied and compared with the American information security regulations in the first part of the research. Then the experimental setting was used to perform the search by designing an electronic questionnaire to reveal the impact of Saudi information security laws on the reality of information security in companies. The questionnaire consists of 3 general questions and 11 questions regarding corporate practices that support the application of information security laws. The questionnaire was distributed to a random sample of information security workers in a number of major Saudi companies, and forty participants responded, and the largest proportion of respondents were executives, and the respondents' years of experience ranged between 1 and 40 years. It is concluded from the research that having stricter and flawless information security laws provides a strong foundation for corporate policies, and a safe investment environment.

Factors affecting information security compliance intention of military officer

The purpose of this study is to analyze the factors that influence the information security compliance intention of Korean military officers. For this purpose, a research model was constructed focusing on information security compliance attitude and perceived control, which are the main variables of the theory of planned behavior. In addition, security sensitivity, organization trust, information security work impediment, and sanction, were selected as independent variables. The research model was analyzed through a survey targeting Korean army officers, and the results are as follows. First, security sensitivity, organization trust, and sanctions had a significant effect on information security compliance attitude. However, the effect of information security work impediment had not been identified. Second, it was analyzed that security sensitivity and organization trust had a positive effect on perceived information security compliance control, but the effect of information security work impediment and sanction had not been verified. Third, it was confirmed that the information security compliance attitude and perceived control affect the information security compliance intention, which reconfirmed the results of previous studies. This study is meaningful in that it can improve the information security level of the military organization by suggesting a way to manage these factors.

공공부문 정보보호 적정인력 산정에 관한 연구

By developing an appropriate manpower calculation model differentiated from the existing model through standardization of information security work in the public sector and actual work load survey and standardization, objectivity in the calculation of civil servants can be secured. This model uses the workload survey method that is already widely used in calculating the appropriate manpower, and it is easy to secure objectivity as it reflects various qualitative factors that reflect the characteristics of information protection work. This model is mainly based on ① the utilization method of calculating the appropriate manpower based on the amount of work of the institution by conducting a research on the unit work load for each function of the institution and the calculation factors for each institution, and ② the appropriate standard based on the standard unit work amount derived through the calculation of the average value of the unit work load of the investigated institutions. There are two application options, such as an application method for calculating manpower. It is judged that it will be possible to contribute to the creation of information protection jobs in the public sector by providing the basis for securing insufficient human resources in the public sector through the objective and appropriate manpower calculation model. It is expected that the expansion of information security personnel and strengthening of capabilities will lead to a decrease in security incidents, which will increase the public's trust in information protection in the public sector.

Mesto informacione bezbednosti u velikim organizacijama

The need to organize information security work in organizations is no longer a controversial concept, especially in the age of digitalization. How to organize these jobs, what place in the organization to determine, what are the previous experiences of applying certain models in practice, are issues that should be discussed and result in providing different opportunities for organizations to apply the model that suits them best at the same time. Set business goals, characteristics of the environment in which they operate, as well as the type of security threats they face, and the total resources at their disposal for this purpose.

정보보안 업무장애 및 준수 걱정이 정보보안 준수의도에 미치는 영향: 정보보안 관여도와 개인조직 적합성의 조절효과 분석

Information resource management is recognized as a core value of an organization, and investments in information security policies and technologies are increasing. However, the adoption of strict information security causes works impediments and anxiety to employees of the organization. The purpose of this study is to present the negative effects of work impediments and anxiety concerns on compliance intentions through the adoption of information security policies.BR The subjects of this study are employees working in organizations with information security policies, and the research hypothesizes were verified through structural equation modeling. As a result, information security work impediment negatively affected the compliance intention through anxiety about compliance. Also, information security involvement and person-organization fit positively influenced compliance intention. In particular, security involvement moderated the relationship between work impediment and anxiety, and person-organization fit moderated the relationship between anxiety and compliance intentions. The study presented the negative aspects of the adoption of information security and has implications in the aspect of presenting a strategic direction for improving the level of internal information security.

Information Security Monitoring and Management Method Based on Big Data in the Internet of Things Environment

As an important part of the new generation of information technology, the Internet of Things (IoT), with its ubiquitous connection and service characteristics, has penetrated into various fields of application and played an important role. In this paper, based on the study of the basic technology of the environmental Internet of Things, combined with the service-oriented technology architecture SOA, J2EE, multi-level system architecture MVC, real-time database and other technologies and project practice experience, summarized and proposed a kind of environmental quality monitoring integrated management platform design and implementation feasibility scheme. Firstly, the background of the era of big data is described in detail, the urgency and necessity of information security monitoring under the background of big data is clarified, and the three elements of information security monitoring mechanism, namely network monitoring personnel, environment and technology, are proposed, and the three elements as the starting point to establish the information security monitoring mechanism; Starting from the relevant monitoring strategies and safety monitoring technologies, this paper explains the basic principles of constructing the evaluation index system, and establishes the evaluation index system according to the key influencing factors of enterprise information security level in the environment of big data. AHP fuzzy comprehensive evaluation method is chosen on the basis of analyzing various comprehensive evaluation methods, and the weight of each evaluation index is determined and the comprehensive evaluation model is constructed. The establishment of information security monitoring and evaluation system, the use of information security monitoring and evaluation system, for information security monitoring work to provide reference standards. Finally, on the basis of the foregoing, relevant strategies for information security monitoring are proposed, and necessary suggestions are provided for information security work.

Evaluasi Internal Keamanan Informasi pada Dinas Komunikasi dan Informatika Kota Palembang

This article aims to provide an overview of the conditions of readiness (completeness and maturity) of information security at Diskominfo Palembang which is carried out internally. The research instrument used was a questionnaire taken from the guidelines of Indeks KAMI version 3.1. The research method used in this article is descriptive quantitative. The answers for each area are collected, then with the calculations that have been available in the guidelines of Indeks KAMI version 3.1, the results will be obtained from the completeness of the work program that has been carried out and the maturity level of information security at Diskominfo Palembang. The assessment result of the completeness of the information security work program is 338, based on the provisions of Indeks KAMI, so this means that the readiness status of Diskominfo Palembang still needs improvement. Meanwhile, the assessment of the maturity level of information security at Diskominfo Palembang is at level I-II. This means that the maturity level of information security is still in its initial condition and is implementing an information security framework in the activities of using information technology.

ANALYSIS OF GOVERNANCE SECURITY MANAGEMENT INFORMATION SYSTEM USING INDEX KAMI IN CENTRAL GOVERNMENT INSTITUTION

Information security is very vulnerable to institutions if there is interference from other parties outside the organization or institution as a supply chain of services that can pose an information security risk. Based on the Regulation of the Minister of Communication and Information Technology number 4 of 2016, the Electronic System organizers that operate Low Electronic Systems must apply the Information Security Index guidelines. Index KAMI are a tool in analyzing and evaluating the level of information security based on the criteria in organizations or in government institutions. The research objective is to measure the level of information security readiness that meets the requirements of the ISO/IEC27001: 2013 standard at the Central Government Institution Unit X. The results of the assessment with the index KAMI obtained an electronic system category score of 30, for the assessment of governance the score is 84, the risk management score is 35, the framework information security work value is 61, asset management 128, and the application of security and information technology has a value of 100, the level of information security maturity is level II+ with a value of 408, the results obtained up to the Compliance of the Basic Framework.

The Staff of the St. Petersburg Office of the State Bank and Their Salaries

The article deals with the problems of staffing of the St. Petersburg office of the State Bank and their employees’ salaries. This topic has not been researched in the national and foreign historiography, which excluded the possibility of referencing previously published works. The article is based on the record keeping documents from the Russian State Historical Archive. St. Petersburg office of the State Bank was established in 1894, being a part of the Corporate Administration of the main credit institution of the country. It was one of the largest local branches of the bank that executed the largest credit operations in the country. For this reason, the staff of this office was the most numerous and the most compensated in terms of pay. At the end of 1896 it comprised 463 full-time employees, while 54 more candidates were on the wait list for possible vacancies. Meanwhile the remaining branches and offices of the bank together had a staff of slightly less than 700 people. In addition to full-time employees, there were in the capital branch of the State Bank numerous support staff, including information security workers, brochure makers, janitors, security guards, laundresses and others. Salaries of officials of this unit were the highest. Although formally the official payment in the bank was established by law and in general was the same for all employees of the bank in all its branches; the corporate office of this institution paid their employees more generously by means of bonuses.

Revisiting information security risk management challenges: a practice perspective

PurposeThe study aims to revisit six previously defined challenges in information security risk management to provide insights into new challenges based on current practices.Design/methodology/approachThe study is based on an empirical study consisting of in-depth interviews with representatives from public sector organisations. The data were analysed by applying a practice-based view, i.e. the lens of knowing (or knowings). The results were validated by an expert panel.FindingsManagerial and organisational concerns that go beyond a technical perspective have been found, which affect the ongoing social build-up of knowledge in everyday information security work..Research limitations/implicationsThe study has delimitation as it consists of data from four public sector organisations, i.e. statistical analyses have not been in focus, while implying a better understanding of what and why certain actions are practised in their security work.Practical implicationsThe new challenges that have been identified offer a refined set of actionable advice to practitioners, which, for example, can support cost-efficient decisions and avoid unnecessary security trade-offs.Originality/valueInformation security is increasingly relevant for organisations, yet little is still known about how related risks are handled in practice. Recent studies have indicated a gap between the espoused and the actual actions. Insights from actual, situated enactment of practice can advise on process adaption and suggest more fit approaches.

Value conflicts and non-compliance

PurposeThe purpose of the study is to explore potential value conflicts between information security work and whistleblowing activities by analysing attitudes to whistleblowing among white-collar workers in Swedish organisations.Design/methodology/approachThe study is conducted using survey data among (n = 674) Swedish white-collar workers. Statistical analyses are conducted to explore variations in acceptance of whistleblowing and analyse the relationship between acceptance for whistleblowing and information security attitudes and behaviours.FindingsThe study finds strong support for whistleblowing in both public and private spheres, and by both private and public sector employees. The study also finds stronger acceptance for intra-organisational whistleblowing, while support for external whistleblowing is low. Finally, the study shows that the whistleblowing activities might be perceived as coming in conflict with information security work, even as the support for including whistleblowing functions in information security practices is high.Research limitations/implicationsWith a focus on one country, the study is limited in terms of empirical scope. It is also limited by a relatively small number of respondents and survey items relating to whistleblowing, which in turn affects its explanatory value. However, the study does provide unique new insight into a specific form of “non-compliance”, i.e. whistleblowing, which merits further investigation.Originality/valueFew studies exist that combine insights from the fields of whistleblowing and information security research. Thus, this study provides a basis for further investigation into attitudes and behaviours linked to whistleblowing in public and private organisations, as well as attendant value conflicts related to information security management and practice.

Identifying Traits and Values of Top-Performing Information Security Personnel

ABSTRACTEnterprise information security is a talent-centric proposition. Information assurance is a product of the combined expertise, attention-to-detail, and creativity of an information security team. A competitive edge can be obtained by hiring the top information security professionals. Therefore, identifying the right people is a mission-critical task. To assist in the candidate selection process, this research analyzes the enduring traits and values of top security performers. It identifies the personality traits and values which distinguish high-performing information security workers. In a laboratory study, a series of simulations were administered to 61 subjects to assess their ability to solve various information security problems. The characteristics of top information security performers were contrasted against the rest of the cohort. In terms of personality, the top performers have higher levels of conscientiousness and openness. With respect to values, the top performers have stronger theoretical and economic values.

Threats and Risks of Information Security Work Team

Threats and Risks of Information Security Work Team

Inter-organisational information security: a systematic literature review

PurposeThe purpose of this paper is to survey existing inter-organisational information security research to scrutinise the kind of knowledge that is currently available and the way in which this knowledge has been brought about.Design/methodology/approachThe results are based on a literature review of inter-organisational information security research published between 1990 and 2014.FindingsThe authors conclude that existing research has focused on a limited set of research topics. A majority of the research has focused management issues, while employees’/non-staffs’ actual information security work in inter-organisational settings is an understudied area. In addition, the majority of the studies have used a subjective/argumentative method, and few studies combine theoretical work and empirical data.Research limitations/implicationsThe findings suggest that future research should address a broader set of research topics, focusing especially on employees/non-staff and their use of processes and technology in inter-organisational settings, as well as on cultural aspects, which are lacking currently; focus more on theory generation or theory testing to increase the maturity of this sub-field; and use a broader set of research methods.Practical implicationsThe authors conclude that existing research is to a large extent descriptive, philosophical or theoretical. Thus, it is difficult for practitioners to adopt existing research results, such as governance frameworks, which have not been empirically validated.Originality/valueFew systematic reviews have assessed the maturity of existing inter-organisational information security research. Findings of authors on research topics, maturity and research methods extend beyond the existing knowledge base, which allow for a critical discussion about existing research in this sub-field of information security.

Specific characteristics of physical fitness at work anaerobic endurance type of rowers in canoe

Purpose: to determine the effect of the reactive properties cardiorespiratory system to a special performance by canoe paddlers who specialize in the 200 m. Material : The study involved 22 paddler aged 18 - 29 years. Results : there were significant indicators of the reaction due to pulmonary performance and efficiency of anaerobic metabolism. The range of correlation coefficients (r) was -0.54 - 0.77 (T 50 V E) and 0,55-0,71 (V E). Conclusions : It was found that the optimization of the reactive properties of the cardiorespiratory system to realize the potential impact endurance rowers when using anaerobic nature. The greatest number of significant connections were indicators of efficiency and response of pulmonary ventilation. This allowed the evaluation of the functional improve information security work and increase specialized training sessions focus in the development of anaerobic endurance while working character in canoeing.

The professionalisation of information security: Perspectives of UK practitioners

In response to the increased “cyber” threats to business, the UK and US Governments are taking steps to develop the training and professional identity of information security practitioners. The ambition of the UK Government is to drive the creation of a recognised profession, in order to attract technology graduates and others into the practice of cyber-security. Although much has been written by state bodies and industry commentators alike on this topic, we believe this qualitative study is the first empirical academic work investigating attitudes to that professionalisation amongst information security workers. The results are contextualised using concepts from the literature in the fields of professionalisation and social topics in information security.Despite the movement to establish professional status for their industry, these practitioners showed mixed levels of support for further professionalisation, with a distinctly wary attitude towards full regulation and licensing and an explicit rejection of elitist and exclusive models of profession. Whereas the UK Government looks to establish “professional” status in order to attract entrants, such status in itself was seen to be of little import to those already working in the area. In addition there are significant tensions between managers embracing business- and human-centred security and those more interested in the technical practice of executing policy.While these tensions continue, the results suggest that state attempts artificially to catalyse the professionalisation process for this group would be precipitate. Historically such projects have risen from the front line; ambitions to move the industry in that direction might see more success by identifying and delegating control to a single regulatory body, founded and respected by the people it aims eventually to regulate.

Information security – Professional perceptions of knowledge-sharing intention under self-efficacy, trust, reciprocity, and shared-language

Knowledge sharing is an important component of knowledge management systems. Security knowledge sharing substantially reduces risk and investment in information security. Despite the importance of information security, little research based on knowledge sharing has focused on the security profession. Therefore, this study analyses key factors, containing attitude, self-efficacy, trust, norm of reciprocity, and shared language, in respect of the information security workers intention to share knowledge. Information security professionals in virtual communities, including the Information Security Professional Association (ISPA), Information Systems Security Association (ISSA), Society of Information Risk Analysts (SIRA), and LinkedIn security groups, were surveyed to test the proposed research model. Confirmatory factor analysis (CFA) and the structural equation modelling (SEM) technique were used to analyse the data and evaluate the research model. The results showed that the research model fit the data well and the structural model suggests a strong relationship between attitude, trust, and norms of reciprocity to knowledge sharing intention. Hypotheses regarding the influence of self-efficacy and reciprocity, to knowledge sharing attitude were upheld. Shared language did not influence either the attitude or intention to share knowledge.