Information Technology Risk Management Research Articles

A taxonomy for cybersecurity standards

Cybersecurity standards on a global scale are exhaustive, appealing to several types, such as glossaries, guidelines, methods, and objectives (e.g., Information Technology evaluation, requirement identification, risk management, and technical specifications). This chaotic range of standards towards the rapid pace of technological and threat evolution hinders stakeholders (e.g., security architects/developers, policymakers, testers, and auditors) from discovering which standards best meet their security needs. The paper analyzes this challenge and contributes to harmonizing standards by identifying relationships between the EU regulation and prominent cybersecurity standards. The current work develops a taxonomy that classifies cybersecurity standards according to their objective, usage, and sector, aiming to help stakeholders understand their purpose and decide which they should adopt to cover their organizational needs. The taxonomy is represented in a semantic ontology, following the Web Ontology Language Edition 2 knowledge engineering approach. A realistic scenario is described to illustrate the applicability of the taxonomy.

MART 23: A Tool to Audit Information Technology Risk Management Maturity

MART 23: A Tool to Audit Information Technology Risk Management Maturity

Systematic Literature Review: Analisis Implementasi Manajemen Risiko TI Menggunakan Framework COBIT di Sektor Industri Jasa

The use of Information Technology (IT) is an important part of all business activities, especially in the service sector. It is important to ensure the security, availability and integrity of their systems. The impact of failure in IT Risk Management greatly influences success. The implementation of IT Risk Management is needed to be able to help companies in the event of losses. In its use, a framework is needed that functions to identify, evaluate and manage existing risks. Therefore, this research will show the COBIT framework that is suitable for managing existing risk management. This research was carried out using the Systematic Literature Review method which started from the stages of formulating research questions, literature search, literature selection, data extraction and discussion aimed at answering Research Questions. In this research, 25 articles were found which were used as literature sources. The research results show that COBIT 2019 is the version of COBIT most often used in IT Risk Management in the industrial service sectors. In implementing COBIT, companies face various challenges such as lack of in-depth understanding of COBIT, lack of work process documentation and lack of operational standards for risk control and incompatibility of IT strategy with company strategy. This research also found that there are 8 points of COBIT implementation strategy to help service industry companies achieve organizational goals more effectively and efficiently through IT risk management.

Evaluation of IT Risk Management in DISKOMINFO of Magelang Regency using COBIT Framework 2019 Objectve EDM03 & APO12

Purpose: This research aims to measure the current condition level (capability level) of DISKOMINFO and then conduct a Gap analysis so that it can provide recommendations for improving IT governance related to IT risk management.Design/methodology/approach: The framework used is COBIT 2019, which will focus on 2 objectives: EDM03 (Evaluate, Direct, and Monitor) & APO12 (Align, Plan, and Organize). The data used in this study were obtained through interviews, observation, and distribution of questionnaires which had been mapped using the RACI Chart.Findings/result: The results of the assessment show that the capability level/capability level according to DISKOMINFO is level 2 for each objective. Recommendations focus on making documentation of risk management activities in the form of risk guidelines, risk acceptance, activities for risk management methods, as well as the application of risk management evaluation of IT which is used by DISKOMINFO on a regular basis.Originality/value/state of the art:From various types of risk management research with different frameworks, this research will use the COBIT 2019 performance standards to carry out information technology risk management. Where COBIT 2019 is the latest version of COBIT which was prepared to help companies manage and manage resources to achieve existing goals. COBIT 2019 has a broader scope than ISO SO/IEC 17799:2005 which includes a combination of principles that have been embedded and known as reference models (such as COSO), and are aligned with IT standard infrastructure.

Systematic Literature Review on Auditing Information Technology Risk Management Using the COBIT Framework

Information technology has an important role in carrying out company management activities. It is important that information technology is managed properly so that no risks arise that could endanger the company. Companies can implement information technology risk management through risk management audits. An audit on information technology risk management can help evaluate companies by identifying information technology risks and minimizing information technology risks. Such audits can be carried out with the help of the COBIT framework. This study intends to conduct a systematic literature review on risk management audits related to information technology using the COBIT framework. Literature search from IEEXplore, ScienceDirect and Garuda Kemdikbud database sources. Papers were selected based on inclusion criteria. Inclusion criteria include paper language is Indonesian and English, paper is published between 2019-2023, the paper describes COBIT in IT risk management audits, and paper is available as full text. The results obtained were 24 papers. There are two criteria for assessing paper quality, namely the paper contains the COBIT framework used for IT risk management audits and the paper contains the COBIT domain used. The results of the analysis of research questions indicate that COBIT 5 is a guide used by many researchers in information technology audits for risk management. COBIT 5 provides a complete and comprehensive risk governance guide for measuring enterprise IT risk management. Implementation of COBIT 5 in IT risk management audits to assist in risk assessment and risk management in order to minimize and prevent IT risks that may occur. Domain APO12 (Manage Risk) and EDM03 (Ensure Risk Optimization) as a reference in conducting IT risk management.

Implementing Information Technology Risk Management: A Case Study in the African Airline Industry

Implementing Information Technology Risk Management: A Case Study in the African Airline Industry

Impacts of Information technology and Risk Management on Cybersecurity Governance: Empirical Study on Malaysian Financial Institutions

"Cybersecurity threats have successfully targeted financial institutions worldwide due to the increased connectivity of seamless and borderless financial services. Considering that criminals have employed more sophisticated methods to exploit the financial industry, financial institutions must adopt an integrated framework to counter the attacks and protect financial infrastructure from exploitation. The study examined cybersecurity governance by extending the Integrated System Theory (IST), including information technology (IT) governance and risk management (RM) governance. Questionnaires were distributed to Malaysian financial institutions through corporate social media platforms, email, and Google Form in November 2021. The questionnaire used a five-point Likert scale and comprised Section A which focused on the respondents’ demographic profile, while Section B emphasised the research construction. A total of 128 respondents participated within four weeks. Data obtained from the questionnaire was analysed for descriptive statistics, correlation, and regression analyses. Resultantly, IT governance and RM governance significantly and positively impacted cybersecurity governance. The study provides better insights to the practitioners, academicians, or researchers to identify which factors to be considered and emphasise before developing an integrated cybersecurity governance framework."

Risk-Management Framework and Information-Security Systems for Small and Medium Enterprises (SMEs): A Meta-Analysis Approach

Information-technology (IT) security standards are regularly updated in a rapidly changing technological world to maintain pace with advanced technologies. This study was motivated by the realization that established IT risk-management frameworks might provide an adequate defence for small- and medium-sized enterprises (SMEs), especially those actively adopting new technologies. We reviewed that a dynamic IT risk-management framework, updated to reflect emerging technological changes, would offer improved security and privacy for SMEs. To evaluate this, we conducted a systematic literature review spanning 2016 to 2021, focusing on IT risk-management research in various application areas. This study revealed that, while established frameworks like NIST have their benefits, they need to be better suited to the unique needs of SMEs due to their high degree of abstractness, vague guidelines, and lack of adaptability to technological advancements. The findings suggest a pressing need to evolve IT risk-management frameworks, particularly by incorporating advanced methods such as system dynamics, machine learning, and technoeconomic and sociotechnological models. These innovative approaches provide a more dynamic, responsive, and holistic approach to risk management, thereby significantly improving the IT security of SMEs. The study’s implications underscore the urgency of developing flexible, dynamic, and technology-informed IT risk-management strategies, offering novel insights into a more practical approach to IT risk management.

Transformasi Digital InsurCo dengan Merancang Pengelolaan Risiko Teknologi Informasi Menggunakan Framework COBIT 2019 IT Risk Management Focus Area

Rapid advancements in Information Technology (IT) play a vital role in fostering innovation within a company. Previous research has successfully identified the significance of IT Governance and Management (ITGM) in the process of Digital Transformation (DT). However, a more comprehensive analysis is needed to understand the role of IT risk management in supporting such changes, particularly through a case study on the insurance company InsurCo. This study employs the Design Science Research (DSR) method, utilizing interview data and the COBIT 2019 IT Risk Management Focus Area framework to design an IT risk management approach that supports InsurCo's DT. Capability assessments, gap analysis, potential improvements, improvement designs, roadmap development, and impact estimation of implementation have been executed on seven ITGM components. InsurCo, being a State-Owned Enterprise, is bound by the regulation PER-2/MBU/03/2023 concerning the Guidelines for Governance and Significant Corporate Activities of State-Owned Enterprises. Additionally, the Financial Services Sector Master Plan 2021-2025 highlights the acceleration of DT. The prioritized ITGM objectives required by InsurCo are derived from three design factor determinations: focus areas, design mechanisms, and ITGM mechanisms concerning DT, resulting in the following prioritized ITGM objectives: APO12 Managed Risk, EDM03 Ensure Risk Optimization, and DSS04 Managed Continuity. There is an estimated average capability increase of 3.57% across these three ITGM objectives. The research outcome presents a recommended design for the seven components of the governance system, aiming to enhance the IT risk management capability index within InsurCo. This study contributes to a deeper understanding of the concept of prioritizing IT risk management to support organizational digital transformation, specifically providing practical implications for InsurCo to bolster the success of their strategic programs, and benefit the insurance industry.

Manajemen Risiko Teknologi Informasi Aplikasi E-Office ASN Menggunakan ISO 31000:2018

In carrying out the task of government affairs at Diskominfosanditik Sumedang Regency, an E-Government system is implemented, namely the ASN E-Office application which is a website-based and mobile-based application with a minimum specification of Android 4 which is used by all ASN (State Civil Apparatus) consisting of PNS (Civil Servants) and PPPK (Government Employees with Work Agreements) in Sumedang Regency. With this application, there may be threats and attacks including vulnerabilities that pose a risk, which disrupt the process of using the application. Therefore, the researcher decided to conduct information technology risk management research as a handling and protection of the application by applying the risk management process from ISO 31000:2018 where any information needed in this research was obtained from internal sources at Diskominfosanditik Sumedang Regency. This research was conducted in the informatics section and resulted in 14 possible risks consisting of 3 risks with high levels, 2 risks with medium levels, and 9 risks with low levels. From the GAP measurement, there is a difference that the need for risk measurement as the first step for risk management.

Context-Based and Adaptive Cybersecurity Risk Management Framework

Currently, organizations are faced with a variety of cyber-threats and are possibly challenged by a wide range of cyber-attacks of varying frequency, complexity, and impact. However, they can do something to prevent, or at least mitigate, these cyber-attacks by first understanding and addressing their common problems regarding cybersecurity culture, developing a cyber-risk management plan, and devising a more proactive and collaborative approach that is suitable according to their organization context. To this end, firstly various enterprise, Information Technology (IT), and cybersecurity risk management frameworks are thoroughly reviewed along with their advantages and limitations. Then, we propose a proactive cybersecurity risk management framework that is simple and dynamic, and that adapts according to the current threat and technology landscapes and organizational context. Finally, performance metrics to evaluate the framework are proposed.

Information Technology Risk Management in Educational Institutions Using ISO 31000 Framework

As information technology becomes increasingly integrated into daily business processes within educational institutions in Indonesia, the need to address potential risks associated with this integration has become crucial. This research focuses on analyzing information technology risk management in Indonesian educational institutions using the ISO 31000 framework. The study aims to minimize the occurrence and impact of various information technology risks that can disrupt organizational processes. Through a comprehensive examination encompassing risk assessment, analysis, evaluation, and treatment, this research provides valuable insights into identifying potential risks within educational institutions. Furthermore, the findings serve as a reference for formulating risk management policies, enabling institutions to proactively mitigate the possibility of information technology risks and their future impact. By adopting the ISO 31000 framework, educational institutions can enhance their efficiency, effectiveness, and accessibility while safeguarding against potential disruptions.

Managing Information Technology Risks to Achieve Business Goals: A Case of Pharmaceutical Company

Extant literature has shown that sectoral characteristics play a critical role in business value creation through information technology (IT). Therefore, managing IT and its associated risks needs to consider specific industrial traits to understand the distinct business nature and regulations that shape IT-enabled business value creation. This study presents an in-depth analysis of business goals, IT processes, and IT risks in the case of a pharmaceutical company through which appropriate controls are designed to ensure business value creation through IT. Drawing on a case study of a pharmaceutical company in Indonesia, we found that managing IT risks in the pharmaceutical industry entails two main objectives: 1) ensuring compliance with external laws and regulations as well as internal policies, 2) supporting the optimization of business functions, processes, and costs. Throughout one year of engagement during the project, this study identified ten risks associated with the operation of business processes. Risks are dominated by moderate levels given the current state of controls and appetite, most of which emerge from the company’s existing internal processes. Internal actors are involved in all risks, with most events occurring due to laws and regulations. Further, the study designs and elaborates IT risk controls by drawing from COBIT 5 Seven Enablers. Overall, IT risk management through cascading processes of analysis ensures the alignment of IT risk controls with achieving business goals in the pharmaceutical industry.

Small and Medium Businesses Readiness towards Cyberattacks in Saudi Arabia

While large companies have the capability and resources to protect their systems from the increasing number of cyberattacks, little is known regarding the recent cybersecurity preparedness of Small and Medium Businesses (SMBs). The purpose of this study is to examine the factors that impact the SMB's readiness towards cyberattacks, this research used the identified constructs, the SMB's readiness toward cyberattacks, government regulations and support, cyberattacks, awareness of cybersecurity-threat, and information technology risk management that were established in prior research. The findings demonstrated an overall good model. In addition, the results showed that government regulations and support, awareness of cybersecurity-Threat, and information technology risk management have a significant impact on the SMB's readiness toward cyberattack. Furthermore, government regulations and support have a significant impact on cyberattacks and awareness of cybersecurity-threat. These findings can be used to facilitate future studies and improve the existing understanding of how SMBs can be prepared to reduce the incidence and effect of cyberattacks.

Engaging Knowledge Capabilities to Sustain the Application of Information Technology Governance in Healthcare Institutions

The healthcare sector has faced increasing pressures to reduce costs and increase healthcare quality in recent years. Thus, managing knowledge in healthcare organizations is critical to achieving low-cost optimization of higher quality services. Also, information technology (IT) plays an essential and crucial role in providing a central database for managing patient data in the healthcare sector. The current study investigates the effects of three aspects of knowledge capabilities (i.e., individual knowledge capabilities, managerial knowledge capabilities, and collaborative organizational capabilities) on information technology governance in healthcare institutions in the Sultanate of Oman. Data were collected using a non-simple random sampling technique by distributing a questionnaire completed by (325) employees working in (13) public hospitals and medical centers in (8) governorates. The collected data were analyzed using AMOS software and structural equation modeling (SEM). This study indicates that individual knowledge capabilities significantly affect only one dimension of IT governance: IT risk management. Moreover, collaborative knowledge capabilities significantly influence all dimensions of IT governance pillars in healthcare institutions, while managerial knowledge capabilities have no significant effect. The study findings can be used to deeply understand the role of knowledge capabilities in sustaining the IT governance application in the health sector context.

Information Technology Risk Management Analysis Using ISO: 31000 at PT. XYZ

XYZ is one of the branch offices of banking subsidiaries in Indonesia that focuses on providing leasing facilities, investment and working capital. As a company, PT. XYZ is inseparable in the use of information technology which gives rise to various possible risks that exist. Therefore, it is necessary to have an analysis of information technology risk management in PT. XYZ. Through this research, it is hoped that it can help PT. XYZ in identifying possible risks that occur to the company, as well as actions that must be taken in the face of such risks. The framework used in this study is the ISO 31000 framework. Based on the results of this study, 13 possible risks that have low risk levels (R01, R02, R03, R04, R05, R07, R08, R12, R13, R15, R16, R20 and R21 ), 6 possible risks that have medium risk levels (R06, R09, R10, R11, R14 and R18), as well as 2 possible risks that have high risk levels (R17 and R19). In addition, a risk treatment proposal was produced that can be used as a reference by PT. XYZ to minimize losses caused by these risks.

Analysis and Ranking of IT Risk Factors Using Fuzzy TOPSIS-Based Approach

In today’s age of information and communication technology (ICT), many companies are using advanced digital technologies as well as the application of information technology to grow the company and effectively manage their processes. The risk management of information technology plays a crucial role in protecting the important information and data assets of an enterprise. The key objective of risk management in information technology is to safeguard the digital infrastructure from ICT-related harm. An efficient as well as cost effective risk managing mechanism is an integral aspect of an extensive safety system for information technology. A successful approach to IT risk management would strive to protect the company and its infrastructure, not just its digital assets, to conduct their process. Subsequently, the risk managing mechanism must not be viewed solely for instance as a procedural task performed by the IT specialists who run and administer the IT program but as the organization’s critical management task. The risks of information technology assets are of a dynamic nature; different strategies tackle the management of information security risk. This research paper is intended to review and discuss information technology risk managing procedures. We also carried out a multi-criteria decision-making (MCDM)-based empirical investigation to analyses and prioritized different IT risk factors. This has recognized that there are many reports on the techniques, and that various approaches to risk management exist.

Analisis Manajemen Risiko Pada Aplikasi Pegadaian Digital Service Menu Tabungan Emas Menggunakan ISO 31000:2018

The purpose of this research is to analyze information technology risk management on the implementation of the gold savings menu on Pegadaian Digital Service (PDS) application in PT Pegadaian Waingapu Branch using the ISO31000:2018 framework. The risk management process is carried out starting from the communication and consultation stage, the context setting stage, the risk assessment stage, consist of risk identification, analysis and evaluation, as well as the risk treatment stage. The result of this research found that there are 23 possible risks in gold saving menu PDS application. Of the 23 possible risks, there is one risk that has a high risk level, namely data leakage, six risks at the medium level and 16 risks at the low level. This research also provides recommendations to PT Pegadaian Waingapu Branch management for risks treatment that arise from the implementation process of the gold savings menu PDS application. The results of risk management analysis for gold savings menu in PDS application from this research are documented in form of a risk register to help the management in managing risks.

Silver bank: vulnerability and risks during cyberattacks

Learning outcomes The learning outcome of this paper is to identify and interpret the risks linked to cyber-security and their impact on the organization. Analyze business management regarding cyber-security and information technology (IT) risk management. Evaluate and propose decision-making strategies for IT projects. Case overview/synopsis Silver Bank is a financial entity with broad national coverage. Its growth was directly related to its investments in customer service. The entire organization is focused on satisfying its clients’ needs, improving their experience and making them loyal to the company. However, it did not pay enough attention to a threat that, with time, had become more pronounced: cyber-attacks. Its efforts to fight against this threat were only temporary solutions, as gaps in its IT system made it an easy target for criminals until the arrival of Iván Ramírez, who proposes a holistic solution to decrease the probability and severity of these attacks. However, past experiences, ignorance and budget constraints make it a difficult task to convince the bank’s board of directors to implement the proposed solution. Complexity academic level The case can be used as teaching material in upper-level undergraduate and graduate management courses: –undergraduate courses: information technology management, IT project analysis and management – MBA or graduate courses: information technology management, strategic management and security governance. Supplementary materials Teaching notes are available for educators only. Subject code CSS 11: Strategy.

Assurance and consultancy internal audit roles in information technology risk management

Assurance and consultancy internal audit roles in information technology risk management