Information Technology Risk Research Articles

A Proposed Model of Digital Forensic on Cloud Computing Security Infrastructure

Over the past decades, practitioners and researchers have made remarkable achievements in digital forensic. The abilities to conquer major technical obstacles are bestowing practitioners greater access to digital evidence. Sophisticated forensic techniques and tools are being developed to assist forensic acquisition and extraction of volatile data, inspection of remote repositories system and analysis of network traffic. Computer forensic is a comprehensive work that based on several attributes that are : objectivity, relevance and legitimacy to compose a system model that projected to be an electronic evidence forensic system. Latest studies show that the rapid growing of cloud computing facilities usage that has enable various improvements as part of the innovation process at organisations. Information systems are in frequently exposed to various types of threats which able to trigger different types of bad consequences as more and more information stored, problems arise especially about security information technology risk aspects.
 Keywords—computer forensic, cloud computing, electronic evidence forensic system, security, information technology risk, information system

The Insurance Business in Transition to the Cyber-Physical Market: Communication, Coordination and Harmonization of Cyber Risk Coverages

This investigative study examines the business of insurance from a loss exposure and coverage development perspective and compares its findings with current market practices dealing with cyber risk(s). It discusses the importance of government regulation of data and privacy protection for the public, in general, and insurance buyers, in particular. Evidence shows incomplete communication among information technology professionals, risk managers and insurance underwriters. Their efforts are inadequately coordinated, and each industry seems to have its own set of risk management guidelines. Evidence shows that insurance policies – including risk classification and policy wording – are not standardized, likely resulting in coverage gaps and a litigious claims environment. More importantly, the insurance market treats all insurable loss exposures and the parties exposed to them in cyberspace using a single policy approach – an approach for a world of risk in which human activities, artificial intelligence and machine-learning become complicated and are increasingly interconnected. This multiplicity-in-cause, multiplicity-in-outcome nature of the risks in the cyber world, of which coverages every individual and business will need, requires the insurance industry to evaluate whether this single policy approach is appropriate, and separately to agree on meaningful standardization of coverages. Finally, this study proposes that, as the cyber world adds more risks on top of cybersecurity-related loss exposures, the business of insurance is in transition to operations in the physical-cyber market.

An IT Governance Framework for Virtual Enterprise in Tourism Industry: Evidence from Small Tourism Enterprises in Thailand

Information technology (IT) plays a significant role on a highly information-intensive industry like tourism industry globally and dramatically. Virtual enterprise (VE) concept is an innovation that enables small tourism enterprises (STEs) in developing countries to offer effective tourism services without large investment in IT. As STEs operate their VEs based on cloud-sourcing environment, STEs have to deal with IT risks that may affect the entire organization. As almost all STEs are found lacking in IT management experience, it is not effective to apply traditional IT governance frameworks, such as Control objectives for information and related technologies (COBIT), IT Infrastructure Library (ITIL), and International organization for standardization (ISO). This study proposes an IT governance framework for STEs operating in VE concept with cloud-sourcing environment. The methodology began with multiple-case study research via semi-structure interviews. Subjects are IT leaders from 10 STEs. IT governance framework for STEs was derived from the interview results, the framework consists of five IT governance areas: Strategy, Administration, Technology and Infrastructure, Supply, and Human Resource. This study also proposed performance assessment criteria for assessing IT governance performance. The proposed assessment criteria were integrated from relevance criteria in COBIT, ISO38500, ITIL, and previous research. STEs can adopt the proposed framework in their VEs to ensure the achievement of effectiveness and efficiency of their services in virtual environment. This will eventually guarantee their continued success in tourism services at present and in the future.

The interstitiality ofITrisk: An inquiry into information systems development practices

AbstractInformation systems development (ISD) has been part of the core of information systems for over 40 years. Throughout its history, the issue of risk has been closely related to ISD projects, and significant efforts have been made by researchers and practitioners to improve their quality. While important headway has been made in assessing and resolving ISD risk, the literature shows that new and salient risks emerge outside the scope of extant risk management regimes. As a consequence, organizations still struggle with leveraging new technology as projects continue to fail at almost the same rate, albeit for different reasons. Understood as the distinction between reality and possibility, risk is inherently intertwined with practice and rooted in the knowledge, goals, power, and values of specific actors in particular contexts. Hence, to understand how risks emerge, we present a longitudinal case study in which we trace the origin and locus of risks in contemporary ISD practices. We draw on these insights to theorize information technology risk as increasingly interstitial, originating from sources positioned in between established practices and therefore outside the scope of conventional risk analyses. In conclusion, we discuss interstitial risks as an important form of emergent risk with implications for both research and practice.

Enlightenment on Medical Equipment Application Quality Management of "Top 10 Health Technology Hazards" in Recent Five Years

The article briefly introduced the basic situation of "top 10 health technology hazards", which issued by ECRI of United States. We comprehensively analyzes the main contents and characteristics of "top 10 health technology hazards", when issued from 2013 to 2017. Discussing the influence factors of medical devices application quality, which "top 10 health technology hazards" focus on, from human factors, risk of medical devices, information technology and other auxiliary measures. Then we introduced relevant practical measures, and discussed related enlightenment and thinking that combined with working practice.

When IT Creates Legal Vulnerability: Not Just Overutilization but Underprovisioning of Health Care Could be a Consequence

We study the potential impact of the legal vulnerability created by ubiquitous information technology (IT) and provide insights into its unintended consequences in a typical healthcare context. Informed by algorithmic predictions based on risk information, screening policies determine the level of care provision (i.e., whether to conduct a test). When such predictions are provided to physicians via IT in the testing stage, follow-up decisions could be more accurate. Yet, physicians may also observe heightened legal risk due to increased information visibility. In this context, we examine the socially optimal screening (based on risk information) and follow-up policies (based on risk and test information) in light of increased visibility of patient data due to health IT and possible litigation risks associated with it.We nd that strategic underprovisioning of health care, therefore a lower utilization of health care services, through screening policies could potentially mitigate the adverse impact of health IT. The underprovisioning of health care is aggravated if the precision of the risk factors relative to that of the medical test increases or the physician becomes more self-interested and less patient-oriented. On the other hand, limits on malpractice damage can alleviate the underprovisioning of health care.

Factors Comprising Effective Risk Communication, Decision-Making, and Measurement of IT and IA Risk

This article focuses on factors that comprise effective risk communication, decision-making, and measurement of information technology (IT)/ information assurance (IA) risk. A review of the extant literature provided the basis for the formulation of research questions. The sample population consisted of senior IT/IA practitioners from Florida chapters of information security professional organizations. Results of this study found that decision making, and measurement are all factors in effective risk communication of IT/IA risk to non-IT personnel. This research has implications for both IT/IA practitioners and recipients of risk communication through the identification of factors which influence IT/IA professionals in how and why IT/IA risk communication take place, and consequently, how to simplify and improve its effectiveness.

A Novel Approach for Optimizing Governance, Risk management and Compliance for Enterprise Information security using DEMATEL and FoM

Information technology Governance, Risk management and Compliance (IT-GRC) are critical in the contemporary business environment since most of the business processes rely on information technology. However, studies indicate that off-the-shelf IT-GRC products are unsuitable for measuring the effectiveness and efficiency of IT-GRC controls. This article proposes a novel approach of measuring effectiveness and efficiency of IT-GRC controls by using the Decision Making Trial and Evaluation Laboratory (DEMATEL) methodology and arriving at the Figure of Merit (FoM) to find the optimal value of effectiveness and efficiency. The proposed method quantifies the input values by calculating the relative influence and cause of the controls. The efficiency and effectiveness are analysed based on the key metrics such as performance, the strength of security controls, ease of use and cost. The proposed method has been applied to various scenarios with varying controls for evaluation and then the optimal value (Figure of Merit) is found by an iterative method. This method can be extended to any type of IT security control standards and frameworks such as ISO 27001, COBIT 5, ITIL and PCI-DSS.

MODEL OF INFORMATION TECHNOLOGY PROJECT FINANCING RISK ASSESSMENT

Context. The investigation of the actual problem of information technology mathematical models of risk assessment projects regarding the security of their financing, using fuzzy math to various investment entities is done. Development of this technology will allow adequately review the projects; increase the degree of decisions making validity in case of investments and increase economic security and management. Objective of this work is to develop a mathematical model of fuzzy information technology risk assessment for commercial projects regarding the security of their financing. Method. The two-level fuzzy mathematical model to obtain aggregate risk assessment of the project to combine expert opinions in groups criteria in the final assessment and risk project is designed. The set of criteria for risk assessment projects of different origin, which is divided into groups, is formed. The rules of belonging of the resulting term-evaluation for risk criteria groups for the knowledge base building are formulated. The presented model for risk assessment regarding the security of financing for the project, using a systematic approach based on: fuzzy models of the project evaluation, depending on its origin; fuzzy evaluation model of the industries in which commercial project will be implemented and aggregate risk assessment project valuation. Result. The resulting study is the result of the risk assessment model commercial projects regarding the security of their financing, the release of which is linguistic assessment on the proposed project. The rationality of this assessment show the advantages of the model. Conclusions. The paper solved scientific-practical task of development of a mathematical model of information technology for commercial projects risk assessment regarding the security of their financing. The model project evaluation of different origin in conditions of fuzzy expert evaluations based system of fuzzy sets and fuzzy logic. The practical significance of the results, in particular the developed model for risk assessment regarding the security of funding for the project could be implemented in the work of investment and venture funds. The proposed model is a useful tool for increased safety and validity of investment decision-making entities which wish to finance commercial projects of various origins.

The Management of Risk Institutional in the Jordanian Insurance Companies - Reality and Challenges

During the last decade and as a result of the 2008 global financial crisis, Enterprise Risk Management (ERM) gained more attention from the financial services sector especially banks and insurance companies. In addition, many companies had adopted practices dedicated to ERM and consulting firms started to establish departments specialized in ERM. Meanwhile, universities have developed specializations related to ERM. Moreover, research centers embarked on research on this subject matter. This study aims to investigate the reality of enterprise risk management in the Jordanian insurance industry in order to reveal the challenges facing it by focusing on the four most important dimensions related to enterprise risk management which are: governance and risk management strategy, risk culture, risk management operations and its interdependencies, and finally the support technology for risk management. The study is based on the descriptive inductive methodology in building the questionnaire, which was distributed to a sample that consisted of most insurance companies in Jordan during the period from December 2015 to February 2016. The study found that risk management practices and regulatory authorities have a long way to go, where the most important results of this study were: 28% of the insurance companies surveyed have a plan and a budget for Information Technology (IT) risk management. The support level of technology to the risk management in the insurance companies surveyed is 30%. 33% of the insurance companies surveyed have standard practices in the enterprise risk management, such as: ISO 31000 and COSO standard. 33% of the insurance companies surveyed currently have a risk management system. 37% of the insurance companies surveyed were a target of electronic attacks over the past 18 months. 47% of the insurance companies surveyed have a risk management department that is responsible for adhering to regulatory and legislative requirements set by the legislator. 49% of the insurance companies surveyed, are evolving universities, consulting firms and specialized training centers, in developing and enhancing risk management personnel. 56% of the insurance companies surveyed are willing to have a risk management program 60% of the insurance companies surveyed have an accredited policy of risk management The level of the risk management operations and its interdependence in the insurance companies is 64% The level of the governance of risk management and its strategy in the insurance companies is 69% Based on these results and in order to begin to improve the reality of risk management practices in the Jordanian insurance companies, the researcher has the following recommendations: Activating the role of risk management through the establishment of specialized departments in this field. Activating the role of the legislative and regulatory authorities to play a bigger role in order to confirm the existence of these departments and to improve procedures and instructions provided by these actors in this area. Increasing the role of academia represented by universities, consulting firms and specialized training centers, to ensure improving the efficiency of the staff of risk departments. Encouraging the companies through the regulatory authorities to adopt global standards in risk management, such as: ISO 31000 COSO standards. Encouraging the companies to have a plan and a budget for the information technology risk management. Directing companies to have accredited policies in risk management. Drawing the attention of the companies to the importance of technology information in the risk management systems and the confidentiality of their information. Drawing the attention of companies to raise the level of management in the governance and risk management strategies in the insurance companies. Inducing to increase the level of risk management operations and its interdependencies among insurance companies. Drawing the attention of researchers and academia to the importance of research and scientific studies in this area to demonstrate its importance to the Jordanian insurance companies, to increase the desire and willing of the insurance companies to adopt risk management programs, at present time and in the future.

Proposal for a Risk Communication-Based Approach to IT Risk

With society’s increasing dependence on information technology (IT) systems, it is becoming increasingly difficult to resolve safety problems related to IT systems through conventional information security technology alone. Accordingly, under the heading of “IT risk” research, we have been investigating ways to address broader safety problems that arise in relation to IT systems themselves, along with the services and information they handle, in situations that include natural disasters, malfunctions, and human error, as well as risks arising from wrongdoing. Through our research, we confirmed that a risk communication-based approach is essential for resolving IT risk problems, and clarified five issues that pertain to a risk-based approach. Simultaneously, as tools to support problem resolution, we developed a multiple risk communicator (MRC) for consensus formation within organizations, along with Social-MRC for social consensus formation. The results of our research are detailed in this paper.

Terceirização de TI nas pequenas empresas: uma visão dos riscos e ações mitigadoras

Estudos sobre a terceirização da Tecnologia da Informação (TI) nas pequenas empresas são pertinentes em virtude da posição de destaque que essas organizações ocupam no mercado. Deste modo, esta pesquisa visa identificar os riscos da terceirização da TI nas pequenas empresas e analisar as iniciativas/ações adotadas para reduzir tais riscos. Como método de pesquisa, utilizou-se o estudo de casos múltiplos em pequenas empresas que utilizam Sistema de Informação (SI) terceirizado. Para tratamento dos dados, utilizou-se a análise de conteúdo. Os resultados indicam que o modelo identificado para as pequenas empresas, em que imperam as estratégias de curto prazo e as ações reativas, acaba por torná-las vulneráveis aos riscos da terceirização da TI. Limitações e oportunidades de pesquisa constam nas considerações finais.

Risk assessment of critical infrastructures – New parameters for commercial ports

Risk assessment of critical infrastructures is an important topic, but the available methodologies do not enable the proper scoring of the risks to commercial port infrastructures, which is vital to formulating effective and realistic security plans. Developing a comprehensive risk assessment methodology for commercial ports is a long-term project. However, this paper focuses on the first mandatory step of analyzing the different types of risks faced by a commercial port infrastructure. The number of potential risks is large – information technology risks, operational risks, labor risks, etc. Therefore, the emphasis is on the risks associated with threats to people, infrastructure, services and goods, which include terrorism, sabotage, criminal activities involving contraband goods and human trafficking, and labor conflicts.This paper presents a methodology for improving the scoring of the risks to commercial ports and understanding their real scope. This is accomplished by examining the key methodologies related to infrastructures in general and commercial ports in particular. After comparing the characteristics of the selected methodologies, the paper discusses the results of a survey of experts at Spanish ports and an analysis of almost two years of security statistics, the goal being to obtain realistic information about the importance of the various risks in order to specify suitable countermeasures and evaluate their costs. The results have enabled the identification of several new parameters that must be considered when assessing the risks to commercial ports, as well as enhancements to the definitions and use of some of the existing parameters. The new parameters include the intrinsic risk to a port, intrinsic risk to the type of terminal, accessibility, terminal layout and operational relevance of key elements to port operations (e.g., structures, railroad facilities and warehouses). The results presented in this paper have been validated by an expert panel.

IT managers’ vs. IT auditors’ perceptions of risks: An actor–observer asymmetry perspective

With the growing role of information technology (IT), many organizations struggle with IT-related risks. Both IT managers and IT auditors are involved in assessing, monitoring, and reporting IT risks, but this does not necessarily mean that they share the same views. In this study, we draw upon the actor–observer asymmetry perspective to understand differences in IT managers’ vs. IT auditors’ perceptions of risks. Through a quasi-experiment with 76 employees of a financial institution, we found that IT managers and IT auditors showed the expected actor–observer differences. Implications for both research and practice are discussed.

Effects of Risk Management Practices on IT Project Success

AbstractSuccessful management of an information technology (IT) project is the most desirable for all organisations and stakeholders. Many researchers elaborated that risk management is a key part of project management for any project size. Risk management is so critical because it provides project managers with a forward-looking view of both threats and opportunities to improve the project success. The objectives of this research are to explore organisational factors affecting IT project success and risk management practices influencing IT project success. Risk management practices include risk identification, risk analysis, risk response planning, and risk monitoring and control. The IT project success is measured by process performance and product performance. Data are collected from 200 project managers, IT managers, and IT analysts in IT firms through questionnaires and analysed using Independent Sample t-test, One-way ANOVA, and Multiple Linear Regression at the statistical significance level of 0.05. The results show that the differences in organisational types affect IT project success in all aspects, while the differences on organisational sizes affect IT project success in the aspect of product performance and total aspects. Risk identification and risk response planning influence the process performance and the total aspects of IT project success. Risk identification has the highest positive influence on product performance, followed closely by risk response, while risk analysis negatively influences product performance.

A Normative Model for Assessing SME IT Effectiveness

Information technology (IT) is a key enabler of modern small businesses, yet fostering reliably effective IT systems remains a significant challenge. This paper presents a light weight IT effectiveness model for small businesses to assess their IT and formulate strategies for improvement. Employing an action research approach we investigate a mixed method analysis of 120 survey responses from small family businesses and user participation in 10 semi-structured interviews. We then conduct critical reflection to identify refinements which are validated using 72 survey responses from university students. The results present compelling evidence that employees’ normative patterns (norms) are a significant driver of IT effectiveness in a second order PLS predictive model able to explain 26% of observed variance. A norms-based approach to IT effectiveness helps fill a significant research and managerial gap for organizations unable or unwilling to adopt IT best practice frameworks used by large organizations. Our findings imply that comparing norms to IT best practices may offer a less technical approach to assessing IT operations, which may be well suited to small businesses. Although further investigation cycles are needed to systematically test this model, we encourage small business managers to: 1) anticipate IT risks and mitigate them; 2) identify measures of IT performance, and monitor them, and 3) review/synchronize business and IT goals.

IT risk management disclosure in the integrated reports of the top 40 listed companies on the JSE limited

Information Technology (IT) has become an integral part of virtually all modern day organisations. The advent of IT has given rise to numerous benefits which increase productivity and efficiency in the workplace, however, IT also brings with it significant risks that can have an impact on an organisation’s ability to function as a going concern. Organisations, especially those listed on the Johannesburg Stock Exchange (JSE), are required to submit an Integrated Report (IR) on an annual basis in which they indicate how they used the resources at their disposal to create value for the organisation and its stakeholders during the year under review. The IR is also a forward-looking document, as opposed to the traditional, backward-looking reports. The purpose of this paper is to determine to what extent IT Risk and IT Risk Management are disclosed in the IR’s of the Top 40 Listed Companies on the JSE. It further aims to determine whether IT Risks are included as material risk in the entity’s risk statements of the Integrated Report, and whether proper explanations are provided on how the materiality of the risks are determined and dealt with. This is done by means of an empirical study consisting of a content analysis of the IRs of the Top 40 listed companies on the JSE. The results of the analysis indicates that more than half of the companies included IT risk as part of their material risks and outlined appropriate and detailed processes that were followed by the company to manage those IT risks. The findings of the study accordingly support the need for communicating significant risks and the management thereof to stakeholders as part of the integrated nature of governance of entities. However, it is disconcerting that some companies are not doing this, and accordingly are not realising the need for communicating significant matters to their stakeholders and the value that informative and credible reporting will bring to an entity’s Integrated Report.

A slack analysis framework for IT risk processes management through risk IT framework

It has been recognised that effective risk management is one of the requirements for the success of information technology (IT) projects. This paper proposes a slack analysis framework taken from data envelopment analysis for improving IT-related scenarios through the IT risk management processes mentioned in the most-recent framework for managing IT risks. The proposed framework enables managers to decide on which sub-indicators of an inefficient or weakly efficient scenario should be augmented to improve its CI and how much they should be increased. The proposed improvement framework is a two-stage process in which the suggested scenarios are first evaluated by a linear optimisation model, and then the improvement stage is performed on those scenarios that can increase their CI. The proposed model is applied on Iran Telecommunication Research Center (ITRC) to assess and improve several suggested scenarios that have positively impacts on the maturity level on IT governance.

A slack analysis framework for IT risk processes management through risk IT framework

It has been recognised that effective risk management is one of the requirements for the success of information technology (IT) projects. This paper proposes a slack analysis framework taken from data envelopment analysis for improving IT-related scenarios through the IT risk management processes mentioned in the most-recent framework for managing IT risks. The proposed framework enables managers to decide on which sub-indicators of an inefficient or weakly efficient scenario should be augmented to improve its CI and how much they should be increased. The proposed improvement framework is a two-stage process in which the suggested scenarios are first evaluated by a linear optimisation model, and then the improvement stage is performed on those scenarios that can increase their CI. The proposed model is applied on Iran Telecommunication Research Center (ITRC) to assess and improve several suggested scenarios that have positively impacts on the maturity level on IT governance.

A probabilistic approach to IT risk management in the Basel regulatory framework

PurposeThis paper aims to examine the connection between information system (IS) availability and operational risk losses and the capital requirements. As most businesses today become increasingly dependent on information technology (IT) services for continuous operations, IS availability is becoming more important for most industries. However, the banking sector has particular sector-specific concerns that go beyond the direct and indirect losses resulting from unavailability. According to the first pillar of the Basel II accord, IT outages in the banking sector lead to increased capital requirements and thus create an additional regulatory cost, over and above the direct and indirect costs of an outage.Design/methodology/approachA Bayesian belief network (BBN) with nodes representing causal factors has been used for identification of the factors with the greatest influence on IS availability, thus helping in investment decisions.FindingsUsing the BBN model for making IS availability-related decisions action (e.g. bringing a causal factor up to the best practice level), organization, according to the presented mapping table, would have less operational risk events related to IS availability. This would have direct impact by decreasing losses, related to those events, as well as to decrease the capital requirements, prescribed by the Basel II accord, for covering operational risk losses.Practical implicationsAn institution using the proposed framework can use the mapping table to see which measures for improving IS availability will have a direct impact on operational risk events, thus improving operational risk management.Originality/valueThe authors mapped the factors causing unavailability of IS system to the rudimentary IT risk management framework implied by the Basel II regulations and, thus, established an otherwise absent link from the IT availability management to operational risk management according to the Basel II framework.