IT Security Risk Management Research Articles

Cybersecurity Risk Assessments within Critical Infrastructure Social Networks

Cybersecurity social networking is a new scientific and engineering discipline that was interdisciplinary in its early days, but is now transdisciplinary. The issues of reviewing and analyzing of principal tasks related to information collection, monitoring of social networks, assessment methods, and preventing and combating cybersecurity threats are, therefore, essential and pending. There is a need to design certain methods, models, and program complexes aimed at estimating risks related to the cyberspace of social networks and the support of their activities. This study considers a risk to be the combination of consequences of a given event (or incident) with a probable occurrence (likelihood of occurrence) involved, while risk assessment is a general issue of identification, estimation, and evaluation of risk. The findings of the study made it possible to elucidate that the technique of cognitive modeling for risk assessment is part of a comprehensive cybersecurity approach included in the requirements of basic IT standards, including IT security risk management. The study presents a comprehensive approach in the field of cybersecurity in social networks that allows for consideration of all the elements that constitute cybersecurity as a complex, interconnected system. The ultimate goal of this approach to cybersecurity is the organization of an uninterrupted scheme of protection against any impacts related to physical, hardware, software, network, and human objects or resources of the critical infrastructure of social networks, as well as the integration of various levels and means of protection.

ANAYSIS OF IMPACTS OF A SIX FACTOR MODEL CASE ON EIB STOCK PRICE IN COMMERCIAL BANKING INDUSTRY IN VIETNAM -- AND ROLES OF IT SECURITY AND RISK MANAGEMENT

During Covid 19 we need to recognize role of risk management including IT security and financial risk management. Risk can reflex in Fluctuation of stock price in commercial banks in developing countries such as Vietnam, which will reflect the business health of bank system and the whole economy. Good business management requires us to consider the impacts of multi macro factors on stock price, and it contributes to promoting business plan and economic policies for economic growth and stabilizing macroeconomic factors. By data collection method through statistics, analysis, synthesis, comparison, quantitative analysis to generate qualitative comments and discussion; using econometric method to perform regression equation and evaluate quantitative results, the article analyzed and evaluated the impacts of six (6) macroeconomic factors on stock price of a joint stock commercial bank, Eximbank (EIB) in Vietnam in the period of 2014-2019, both positive and negative sides. The results of quantitative research, in a seven factor model, show that the increase in Risk free rate has a significant effect on increasing EIB stock price with the highest impact coefficient, the second is decreasing CPI and lending rate. This research finding and recommended policy also can be used as reference in policy for commercial bank system in many developing countries. We also recommend some plans to deal with risk management and IT security in this industry.

Towards a Framework to Improve IT Security and IT Risk Management in Small and Medium Enterprises

In this article, an IT risk management (ITRM) framework for small and medium enterprises (SMEs) is designed and evaluated. The framework's objective is to provide an uncomplicated and accessible ITRM approach primarily aimed at SMEs without a dedicated ITRM. The framework combines essential elements from three leading (IT) risk management frameworks: COBIT 5 for Risk, ISO/IEC 27005:2011 and M_o_R. The framework was developed by employing a design science research methodology for social artefacts and evaluated in two healthcare SMEs. The ITRM framework itself was assessed as comprehensible and potentially useful. Simultaneously, over-arching IT governance issues prevented the immediate framework implementation in the two cases. IT management researchers can draw on this article's findings to better understand the role of the social context in SMEs to achieve an effective practical impact. Practitioners in SMEs can draw on the current state of the framework for an initial ITRM implementation or to increase their current ITRM approaches' maturity.

Systematic Literature Review and ISO Standards analysis to Integrate IT Governance and Security Risk Management

Systematic Literature Review and ISO Standards analysis to Integrate IT Governance and Security Risk Management

Application of Intelligent Methods of Information Representation to Manage Information Security Risks in Secure Multiservice Special-Purpose Networks

The article considers main methods to use intelligent techniques and algorithms, synthesized on their basis, as well as examinesdata presentation of network monitoring for IT security risk management of secure multiservice networks. The mathematical model of intelligent data presentation is developed and examined for IT security risk investigation and assessment.

IT Security Risk Management Model for Cloud Computing

The authors combined ISO 27005 framework for IT Security Risk Management with NIST Multitier framework. With this combined framework the authors create a new approach to IT Security Risk Management where IT Security Risk Management is place at the strategic, tactical and operational levels of an organizational. In this paper the authors concentrate on the monitoring and communication steps of IT Security Risk Management and especially escalation of new IT Security Incidents. The authors present a first draft to an IT Security Risk Escalation Capability Maturity Model based on ISACA´s Risk IT Framework. Finally the authors apply the approach to typical cloud computing environment as a first step to evaluate this new approach.

Information Technology Risks & the Extent of Their Impact: An Analysis of Zimbabwean Insurance Companies in the Context of E-Commerce

The conditions for doing business are rapidly changing. The Internet and related advances in information technology significantly affect financial services in general and insurance markets and banks in particular. The growing importance of e-commerce represents a watershed event for insurance markets and banking institutions, as it does for most industries. By managing Information Technology risks, e-commerce will enable insurers to classify, underwrite, and price risk as well as settle claims more accurately and efficiently. The risk connected with the wide application of information technologies in business grows together with the increase of enterprise’s correlation from its customers, business partners and outsourced operations. Technological progress generates dependencies which evoke growth of diversities, complexity, non-descriptiveness and quantity of risk factors. In insufficient investments on information security the issue of IT risk management becomes more significant, concentrating on searching optimal proportion between threats and costs of IT systems protections. In such dynamic development of Information Technology the time needed for appropriate reaction on risk is decidedly shortened. The lack of appropriate preparation may lead the company to collapse, thus appropriate reaction on risk constitutes about possibilities of survival and development of enterprise. One of the most important stages of this process is risk analysis, used for optimization, and correctly for minimizations of losses connected with risk. The dissertation will present the issue of IT security risk management; discuss the most significant stage of risk management which is IT security risk analysis. Chosen computer applications supporting these processes will be presented. Selected research connected with IT security risk management will be discussed in the literature review. Overally, the Internet – through a secure platform of I.T, will significantly enhance the efficiency of the insurance markets and institutions and benefit consumers by lowering transaction and information costs. The foundation for the purpose of this research has been created by a prospective study to explore I.T risks & the extent of their impact on the Zimbabwean insurance companies in the context of e-commerce. In order to fulfill the purpose of this study, a frame of reference will be emerged based on a vast literature review. With the focus at quantitative research as a general approach and descriptive research as the type of research in this study, a structured questionnaire will be used as the data collection instrument. To accomplish this, a survey of 25 people (in almost all active insurance companies in Zimbabwe) will be carried out. The respondents from almost every department within the targeted insurance companies will be randomly chosen. Focus will be on the perception of insurers and re-insurers regarding the subject of study, and thus, the perception of other stakeholders such as insurance agents/brokers and even their customers will be suggested for future research, due to limitation and demarcation of this research.

Network externalities, layered protection and IT security risk management

This paper considers two important issues related to security risk management. First, the presence of network externalities in security risks. Second, the distinction of general (network) and system-specific protection measures. We found the optimal allocation of security resources (investments) in protecting every system in an organization. The results show that the consideration of network externalities and layered protection changes the risk mitigation decisions significantly. In addition, accurate estimation of system risk plays a critical role in the success of risk management. Otherwise, the use of a uniform baseline protection approach may be more desirable when the misjudgment of relative system risks is likely to occur.