Information Systems Security Risk Management Research Articles

Information System Security Risk Management E-Learning Using FMEA in University

The security of information systems in the learning process during the Covid-19 pandemic is very important for educational institutions today, which are based on government regulations that require learning to be done online In order to prevent the transmission of covid-19, people are advised to stay at home, but the learning process must continue In the process of learning system risk is a point that must be considered In online learning, information system security risk management can use the FMEA platform to analyze data security and minimize risks that occur © 2020, World Academy of Research in Science and Engineering All rights reserved

An integrated conceptual model for information system security risk management supported by enterprise architecture management

Risk management is today a major steering tool for any organisation wanting to deal with information system (IS) security. However, IS security risk management (ISSRM) remains a difficult process to establish and maintain, mainly in a context of multi-regulations with complex and inter-connected IS. We claim that a connection with enterprise architecture management (EAM) contributes to deal with these issues. A first step towards a better integration of both domains is to define an integrated EAM-ISSRM conceptual model. This paper is about the elaboration and validation of this model. To do so, we improve an existing ISSRM domain model, i.e. a conceptual model depicting the domain of ISSRM, with the concepts of EAM. The validation of the EAM-ISSRM integrated model is then performed with the help of a validation group assessing the utility and usability of the model.

Research of Information System Security Risk Management based on Probability Model and Security Entropy

Nowadays, there is a big challenge on the security risk of information system with the rapid development of network. Computer viruses have brought great intimidation on information systems, which made the loss of worldwide information security moving up. Therefore, more and more people focus on the security problem of information systems, which need our appropriate protection. At first, the principle approach from security risk identification to risk management is proposed. Secondly, an information system security risk management algorithm based on probability model and security entropy is described in detail. Thirdly, a particular system is selected as the example. The whole risk of information system security is modelled and computed according to the risk management computing formula. In accordance with the example, the applicability and feasibility of the probability model is verified. The method proposed in this paper provides some use of reference in the risk management of information system security and execution of security measures.

A Cooperative Model for IS Security Risk Management in Distributed Environment

Given the increasing cooperation between organizations, the flexible exchange of security information across the allied organizations is critical to effectively manage information systems (IS) security in a distributed environment. In this paper, we develop a cooperative model for IS security risk management in a distributed environment. In the proposed model, the exchange of security information among the interconnected IS under distributed environment is supported by Bayesian networks (BNs). In addition, for an organization's IS, a BN is utilized to represent its security environment and dynamically predict its security risk level, by which the security manager can select an optimal action to safeguard the firm's information resources. The actual case studied illustrates the cooperative model presented in this paper and how it can be exploited to manage the distributed IS security risk effectively.

A Data-driven Assessment Model for Information Systems Security Risk Management

In this paper, a data-driven assessment model for information systems security risk management is proposed based on the knowledge from observed cases and domain experts. In the model, genetic algorithm is applied to search the rules of security risk identification based on historical data. For identifying the causal relationships of risk factors and predict the occurrence probability of security risk, a Bayesian network (BN) is developed. Structure learning and parameter learning are utilized to integrate the database of observed cases with domain expert experience in the development of the BN. The significance of the work is that the model provides more objective and visible support for security risk assessment in the information systems.

E-banking security: A communication perspective

This research focuses on the communication of security risk messages among organizations and particularly on communication between IT employees and managers within a bank in Greece. An important aspect of any information systems (IS) security activity is about ensuring the security of its infrastructure, and in doing so, communication is a key necessity for present e-banking security managers. Two questions motivated this research. First, what is the experience of organizations following e-banking security measures and controls as part of security management procedures? Second, what are the communication standards and procedures that play an important role in the success of e-banking security adoption? The research findings aim to shed some light into new communication practices that can be of use to IS security risk management. A case study research approach was used to investigate security communication in e-banking adoption. The issues of communication found to play an important role in e-banking security included: organizational flexibility, availability of resources, e-banking project alignment, support from top management, information transparency and security knowledge and awareness. The article concludes that banks may need to eradicate security communication problems through the successful appliance and establishment of the previously mentioned communication issues in e-banking security adoption.

User participation in information systems security risk management

This paper examines user participation in information systems security risk management and its influence in the context of regulatory compliance via a multi-method study at the organizational level. First, eleven informants across five organizations were interviewed to gain an understanding of the types of activities and security controls in which users participated as part of Sarbanes-Oxley compliance, along with associated outcomes. A research model was developed based on the findings of the qualitative study and extant user participation theories in the systems development literature. Analysis of the data collected in a questionnaire survey of 228 members of ISACA, a professional association specialized in information technology governance, audit, and security, supported the research model. The findings of the two studies converged and indicated that user participation contributed to improved security control performance through greater awareness, greater alignment between IS security risk management and the business environment, and improved control development. While the IS security literature often portrays users as the weak link in security, the current study suggests that users may be an important resource to IS security by providing needed business knowledge that contributes to more effective security measures. User participation is also a means to engage users in protecting sensitive information in their business processes.

User Participation in Information Systems Security Risk Management

This paper examines user participation in information systems security risk management and its influence in the context of regulatory compliance via a multi-method study at the organizational level. First, eleven informants across five organizations were interviewed to gain an understanding of the types of activities and security controls in which users participated as part of Sarbanes-Oxley compliance, along with associated outcomes. A research model was developed based on the findings of the qualitative study and extant user participation theories in the systems development literature. Analysis of the data collected in a questionnaire survey of 228 members of ISACA, a professional association specialized in information technology governance, audit, and security, supported the research model. The findings of the two studies converged and indicated that user participation contributed to improved security control performance through greater awareness, greater alignment between IS security risk management and the business environment, and improved control development. While the IS security literature often portrays users as the weak link in security, the current study suggests that users may be an important resource to IS security by providing needed business knowledge that contributes to more effective security measures. User participation is also a means to engage users in protecting sensitive information in their business processes.

Défis de la sécurité de l'information. Support à la gestion des risques de sécurité par les modèles

Within the organisations, information system security is more and more tackled with the help of risk management approaches. However these approaches are on one hand not well suited to be applied on information system development and on the other hand, products coming from the different risk management steps performed are generally not enough formal. Our research work proposes to improve the different risk management steps with models. In order to achieve this objective, we first define a conceptual model associated with the information system security risk management domain, and enriched with appropriate metrics for performing reasoning. We define then a modelling language for a more formal representation of risks analysis artefacts.

The four phases of security

This information system security risk management cycle model assists organisations in differentiating among possible security measures to determine those that should be implemented. The information system security risk management cycle is constructed around four phases. The four phases are prevention, detection, response and recovery.