Information Technology Security Risk Research Articles

Information Technology Asset Security Risk Management at the Secretariat of the Salatiga City DPRD Using ISO 31000

The lack of resources that have an information technology background in handling information technology asset security risks makes it asset management in the Secretariat of the Salatiga City DPRD less optimal. The application of risk management is very necessary, especially in the security of information technology assets in agencies because it can help all existing business process activities in agencies so that they can run well. For this reason, it is necessary to implement information technology asset security risk management using ISO 31000 in these agencies. By implementing the ISO 31000 framework at the Secretariat of the Dprd Kota Salatiga can assist agencies in achieving goals, making decisions, improving performance, and effectively allocating and using resources for risk management. The purpose of this study is to identify, analyze, and handle information technology security risks that exist in the Secretariat of the Salatiga City DPRD. The method used by this research is a qualitative approach, namely case study. The result of this study is that there are 20 possible risks that can interfere with business processes in the Secretariat of the Salatiga City DPRD, including 3 possible high-level risks, 12 possible medium-level risks, and 5 possible low-level risks.

Information Technology (IT) Users in Tertiary Education Institutions in Bulawayo, Zimbabwe: Case of Security Awareness

Information Technology (IT) expansion exposes organisations in developing countries to IT security risks. Zimbabwe’s tertiary education institutions (TEIs) are not spared. Every year, cyber-attacks increase and become more sophisticated, resulting in losses of personal and financial data for individuals, organisations and governments. As the world is interconnected, small and big organisations share the same internet platform. Therefore, IT security risks that affect one, affect all. When IT users are unaware of the risks and uninformed of ways to protect their IT systems, they remain vulnerable. Like other organisations in Zimbabwe, TEIs are vulnerable to cyber-attacks. The study that directed this article employed a quantitative methodological approach in the collection of the data and its analysis. A sample of 261 respondents was selected from the population of IT users in TEIs in Bulawayo. The results indicated that IT security awareness of IT users in TEIs in Bulawayo is low. This is evidenced by the low IT drivers’ contribution towards building IT users’ security awareness, and inadequate implementation and utilisation of IT security awareness tools. The prevailing phenomenon exposes TEIs in Bulawayo to a high risk of cyber-attacks. The results indicated a positive and significant correlation between IT security drivers’ contribution and IT security awareness tools utilisation in TEIs in Bulawayo. The implication is that an increase in IT security drivers’ contribution and IT security awareness tools utilisation will lead to increased IT security awareness. The study recommends that IT drivers double their contribution towards building IT security awareness through adequate implementation and utilisation of IT security awareness tools. This will safeguard the information that tertiary education institutions generate.

Моделі аналізу ризику безпеки інформаційних технологій

Моделі аналізу ризику безпеки інформаційних технологій

Method for Attack Tree Data Transformation and Import Into IT Risk Analysis Expert Systems

Information technology (IT) security risk analysis preventatively helps organizations in identifying their vulnerable systems or internal controls. Some researchers propose expert systems (ES) as the solution for risk analysis automation since risk analysis by human experts is expensive and timely. By design, ES need a knowledge base, which must be up to date and of high quality. Manual creation of databases is also expensive and cannot ensure stable information renewal. These facts make the knowledge base automation process very important. This paper proposes a novel method of converting attack trees to a format usable by expert systems for utilizing the existing attack tree repositories in facilitating information and IT security risk analysis. The method performs attack tree translation into the Java Expert System Shell (JESS) format, by consistently applying ATTop, a software bridging tool that enables automated analysis of attack trees using a model-driven engineering approach, translating attack trees into the eXtensible Markup Language (XML) format, and using the newly developed ATES (attack trees to expert system) program, performing further XML conversion into JESS compatible format. The detailed method description, along with samples of attack tree conversion and results of conversion experiments on a significant number of attack trees, are presented and discussed. The results demonstrate the high method reliability rate and viability of attack trees as a source for the knowledge bases of expert systems used in the IT security risk analysis process.

Information security management and the human aspect in organizations

PurposeThe aim of this study is to encourage management boards to recognize that employees play a major role in the management of information security. Thus, these issues need to be addressed efficiently, especially in organizations in which data are a valuable asset.Design/methodology/approachBefore developing the instrument for the survey, first, effective measurement built upon existing literature review was identified and developed and the survey questionnaires were set according to past studies and the findings based on qualitative analyses. Data were collected by using cross-sectional questionnaire and a Likert scale, whereby each question was related to an item as in the work of Witherspoon et al. (2013). Data analysis was done using the SPSS.3B.FindingsBased on the results from three surveys and findings, a principle of information security compliance practices was proposed based on the authors’ proposed nine-five-circle (NFC) principle that enhances information security management by identifying human conduct and IT security-related issues regarding the aspect of information security management. Furthermore, the authors’ principle has enabled closing the gap between technology and humans in this study by proving that the factors in the present study’s finding are interrelated and work together, rather than on their own.Research limitations/implicationsThe main objective of this study was to address the lack of research evidence on what mobilizes and influences information security management development and implementation. This objective has been fulfilled by surveying, collecting and analyzing data and by giving an account of the attributes that hinder information security management. Accordingly, a major practical contribution of the present research is the empirical data it provides that enable obtaining a bigger picture and precise information about the real issues that cause information security management shortcomings.Practical implicationsIn this sense, despite the fact that this study has limitations concerning the development of a diagnostic tool, it is obviously the main procedure for the measurements of a framework to assess information security compliance policies in the organizations surveyed.Social implicationsThe present study’s discoveries recommend in actuality that using flexible tools that can be scoped to meet individual organizational needs have positive effects on the implementation of information security management policies within an organization. Accordingly, the research proposes that organizations should forsake the oversimplified generalized guidelines that neglect the verification of the difference in information security requirements in various organizations. Instead, they should focus on the issue of how to sustain and enhance their organization’s compliance through a dynamic compliance process that involves awareness of the compliance regulation, controlling integration and closing gaps.Originality/valueThe rapid growth of information technology (IT) has created numerous business opportunities. At the same time, this growth has increased information security risk. IT security risk is an important issue in industrial sectors, and in organizations that are innovating owing to globalization or changes in organizational culture. Previously, technology-associated risk assessments focused on various technology factors, but as of the early twenty-first century, the most important issue identified in technology risk studies is the human factor.

The Influence of Risk Factors in Decision-Making Process for Open Source Software Adoption

“Nobody ever got fired for buying IBM,” was a widely used cliché in the 1970s in the corporate IT (information technology) world. Since then, the traditional process of purchasing software has dramatically changed, challenged by the advent of open source software (OSS). Since its inception in the 1980s, OSS has matured, grown, and become one of the important driving forces of the enterprise ecosystem. However, it has also brought important IT security risks that are impacting the OSS IT adoption decision-making process. The recent Heartbleed bug demonstrated the grandeur of the issue. While much of the noise relates to the amplification of perceived risks by the popular mass media coverage, the effect is that many enterprises, mainly for risk reasons, have still chosen not to adopt OSS. We investigated “how do information security related characteristics of OSS affect the risk perception and adoption decision of OSS” by conducting an online survey of 188 IT decision-makers. The proposed Open Source Risk Adoption Model offers novel insights on the importance of the perceived risk antecedents. Our research brings new theoretical contributions, such as understanding the perceived IT security risk (PISR) relationship with adoption intention (AI) in the OSS context, for researchers and important insights for IT information professionals. We have found that IT security risk has a significant role in OSS adoption intention. Our results offer possible future research directions and extend existing theoretical understanding of OSS adoption.

Employee Misuse of Information Technology Resources: Testing a Contemporary Deterrence Model

ABSTRACTRecent research in information systems and operations management has considered the positive impacts of information technology (IT). However, an undesirable side effect of firms’ increasing reliance on IT to support the distribution and delivery of goods and services to customers is a greater exposure to a diverse set of IT security risks. One such risk is intentional employee misuse of technology resources. In this article, we draw upon modern deterrence frameworks to develop a predictive model of technology misuse intention that incorporates formal and informal sanctions as well as employment context factors. The model specifies previously untested relationships between formal and informal sanctions, thereby providing fresh insight into the role of sanctions in deterring technology misuse in organizations. Our results suggest that a predisposition toward the need for social approval and moral beliefs regarding the behavior are key determinants of technology misuse. Contrary to criminological research that has questioned the relative importance of formal sanctions in the deterrence process, we also found that the threat of formal sanctions has both direct and indirect influences on technology misuse intention. Further, from an employment context standpoint, employees who spend more working days away from the office (i.e., “virtual” mode) appear more inclined to misuse their organization's technology resources. The findings have implications for the research and practice of technology management.

Assessing the information technology security risk in medical supply chains

Many medical organisations around the world have connected themselves in supply chains, and are exploring the strategic utilisation of information technology (IT) throughout their chains to improve their overall efficiency and effectiveness. Although these efforts may reduce health costs, both the current status of IT security risk and the potential consequences of interconnectedness are largely unknown. This research examines medical supply chain risk exposure. In particular, data from six pharmaceutical companies and eight healthcare organisations is combined with input from security experts to determine the current degree of IT security risk. In addition, we examine an optimal strategy to reduce overall risk and the amount of supply chain risk due to partnering. We find, for the surveyed organisations, a dramatic under-deployment of controls, resulting in huge risk exposure.

Managing supply chain risk and disruption from IT security incidents

Supply chain practices often put companies and their supply chains at risk. One of the most serious risks is disruptions. While many types of disruptions have been considered, little attention has been given to disruptions caused by information technology (IT) security incidents. Partner cooperation can assist in preventing or mitigating damage from IT security breaches in supply chains, where breaches can disrupt production, cause loss of essential data, and compromise confidential information. We develop a generalizable mathematical model that quantifies IT security risk in the supply chain. We then show how to find solutions for optimal risk reduction under several definitions of optimality: minimizing upstream risk, minimizing downstream risk, and minimizing global (supply chain) risk. We show how to develop curves for each of the above scenarios that indicate when extra funds should be spent on security, which security controls should be implemented, and when subsidies among partners are beneficial.

The Value of Intrusion Detection Systems in Information Technology Security Architecture

The increasing significance of information technology (IT) security to firms is evident from their growing IT security budgets. Firms rely on security technologies such as firewalls and intrusion detection systems (IDSs) to manage IT security risks. Although the literature on the technical aspects of IT security is proliferating, a debate exists in the IT security community about the value of these technologies. In this paper, we seek to assess the value of IDSs in a firm’s IT security architecture. We find that the IDS configuration, represented by detection (true positive) and false alarm (false positive) rates, determines whether a firm realizes a positive or negative value from the IDS. Specifically, we show that a firm realizes a positive value from an IDS only when the detection rate is higher than a critical value, which is determined by the hacker’s benefit and cost parameters. When the firm realizes a positive (negative) value, the IDS deters (sustains) hackers. However, irrespective of whether the firm realizes a positive or negative value from the IDS, the IDS enables the firm to better target its investigation of users, while keeping the detection rate the same. Our results suggest that the positive value of an IDS results not from improved detection per se, but from an increased deterrence enabled by improved detection. Finally, we show that the firm realizes a strictly nonnegative value if the firm configures the IDS optimally based on the hacking environment.