IT Security Risk Research Articles

Understanding the Mediation Effect of Cloud Computing Adoption in Indian Organization

The aim of this paper is to measure the business performance by taking Cloud computing adoption as a mediating variable in Indian industries. A conceptual model is framed using the concept of a TAM-TOE framework which is combined with some new constructs of ‘Risk'. Partial and full mediation are used from the umbrella concept of SEM (Structural Equation Modelling) to test the hypotheses. The study identified that Technological variables ‘Technology Innovation (TI)' and ‘Usage of Technology (UT)' positively mediates the relationship, Organizational variable ‘Industry Usage (IU)' negatively mediates the relationship and Environmental variables ‘Management Style (MS)' positively mediates the relationship whereas ‘Trust (T)' has no mediation effect. The ‘Risk' factors ‘Risk Analysis (RA)' positively influences the mediation process and ‘Perceived IT Security Risk (PITR)' has no mediation effect on the dependent variable ‘Business performance (BP)'. The findings of the study have some important implications. As the constructs ‘Risk (Perceived IT Security Risk)' and ‘Trust' have no mediation effect, it implies industries do not give importance on these factors while adopting Cloud computing. Hence, risk and trust resulted as the barriers for technology adoption, and organizations should verify these criteria during Cloud computing adoption of a better performance in the business. The study tests indirect effect and direct effect on business performance considering Cloud computing adoption as the mediating variable.

Towards a Framework to Improve IT Security and IT Risk Management in Small and Medium Enterprises

In this article, an IT risk management (ITRM) framework for small and medium enterprises (SMEs) is designed and evaluated. The framework's objective is to provide an uncomplicated and accessible ITRM approach primarily aimed at SMEs without a dedicated ITRM. The framework combines essential elements from three leading (IT) risk management frameworks: COBIT 5 for Risk, ISO/IEC 27005:2011 and M_o_R. The framework was developed by employing a design science research methodology for social artefacts and evaluated in two healthcare SMEs. The ITRM framework itself was assessed as comprehensible and potentially useful. Simultaneously, over-arching IT governance issues prevented the immediate framework implementation in the two cases. IT management researchers can draw on this article's findings to better understand the role of the social context in SMEs to achieve an effective practical impact. Practitioners in SMEs can draw on the current state of the framework for an initial ITRM implementation or to increase their current ITRM approaches' maturity.

Systematic Literature Review and ISO Standards analysis to Integrate IT Governance and Security Risk Management

Systematic Literature Review and ISO Standards analysis to Integrate IT Governance and Security Risk Management

Using the Analytical Hierarchy Process Model in the Prioritization of Information Assurance Defense In-Depth Measures?—A Quantitative Study

Organizational computing devices are increasingly becoming targets of cyber-attacks, and organizations have become dependent on the safety and security of their computer networks and their organizational computing devices. Business and government often use defense in-depth information assurance measures such as firewalls, intrusion detection systems, and password procedures across their enterprises to plan strategically and manage IT security risks. This quantitative study explores whether the analytical hierarchy process (AHP) model can be effectively applied to the prioritization of information assurance defense in-depth measures. In response to these threats, the President, legislators, experts, and others have characterized cyber security as a pressing national security issue. The methods used in this study consisted of emailing study participants a survey requesting that they prioritize five defense in-depth information assurance measures, anti-virus, intrusion detection, password, smart-cards, and encryption, with a range of responses from 1 - 5 using a Likert scale to consider standard cost, effectiveness, and perceived ease of use in terms of protection of organizational computing devices. The measures were then weighted, based on ranking. A pair-wise comparison of each of the five measures is then made using AHP to determine whether the Likert scale and the AHP model could be effectively applied to the prioritization of information assurance measures to protect organizational computing devices. The findings of the research reject the H0 null hypothesis that AHP does not affect the relationship between the information technology analysts’ prioritization of five defense in-depth dependent variables and the independent variables of cost, ease of use, and effectiveness in protecting organizational devices against cyber-attacks.

Application of Intelligent Methods of Information Representation to Manage Information Security Risks in Secure Multiservice Special-Purpose Networks

The article considers main methods to use intelligent techniques and algorithms, synthesized on their basis, as well as examinesdata presentation of network monitoring for IT security risk management of secure multiservice networks. The mathematical model of intelligent data presentation is developed and examined for IT security risk investigation and assessment.

Practical Assessment of the ISMS Effectiveness in Accordance with the Requirements of the Various Standardization Systems both ISO 27001 and STO Gazprom

This issue briefly covers the need of numerical evaluation for Information Security Management Systems (ISMS) effectiveness in accordance with the requirements of two or more different standardization systems, such as ISO / IEC 27001 series of standards and Information Security Providing System STO Gazprom series 4.2 (ISPS). This problem is important to minimize the violation of IT-security risks and ensure the information processes stability in the information systems. This issue describes methodological difficulties in reconciling the requirements of different Standardization systems both ISO / IEC and ISPS that must be considered when assessing the ISMS effectiveness. The formulas have been proposed to solve the problem for calculating the ISMS effectiveness and discussed practical examples (cases), explaining the calculation for specific situations. These results can be used to create models and methods to provide the ISMS audits and monitoring IT-security facilities both ISMS and / or ISPS Gazprom.

The Effect of Smartwork Environment on Organizational Commitment and Innovative Behavior in the Global Financial Service Industry

This study analyzed how smartwork environment perceived by employees in global financial service industry (GFSI) influences their organizational commitment and innovative behavior. Data were collected through a questionnaire survey from 147 respondents randomly selected from seven global financial service firms in Seoul, Korea, where all three types of smartwork setting (working at home, mobile office, and smartwork center) are utilized. We found that no specific characteristic of smartwork environment (presenteeism, IT complexity, security risks, task interdependence) was significantly related to organizational commitment. For innovative behavior, only IT complexity and security risks of smartwork environment appeared to be significantly related. Contrary to our expectations, it was found that the negative emotion and stress of employees as to the complexity of IC technology and IT security risks can actually inspire their innovative behavior.

1A22 Security Evaluation for Communication Based Train Control System Using Attack Tree Method(Electrical-Power)

We introduce a case study of IT security analysis for the wireless transmission system of JRTC-W, a communication based train control system. We used the "attack tree" method together with an IT security risk evaluation procedure of IEC15408 (CC) to assess potential threats to the wireless transmission system of JRTC-W in conformity with the lifecycle safety management process of IEC62278 (RAMS). Attack Tree is an FTA-like purpose-oriented tree-form analysis method of hierarchical decomposition of complex attack scenarios into simple and non-divisible (assets). We identified 43 attack methods for individual wireless communication (from Zone controller to On-board controller) for instance, and classified 10 different kinds of assets. We report how the analysis has been done.

E – Banking: Challenges and Development in India

The changing financial landscape has posed new challenges for banks and policymakers/supervisors. Banks now have increased reliance on technology to compete in an increasingly competitive business environment and thus need to effectively manage the IT security and other related risks. Central Banks and supervisory authorities are facing new challenges in banking supervision as well as in designing and implementing monetary policy. The growing scope of E-Banking and increasing complexity of banking products and services demands continuous adaptation of regulatory framework and effective supervisory oversight. In India, there are guidelines or legal frame work for regulating the system and try to control the risks. Reserve Bank of India and judiciary took number of steps and frame rules and regulation so that there should not exist any lacuna in regulating the system. And they are always in a position to satisfy the need of the hour for that they occasionally amend laws and even frame laws. Still in India, due to the system it can be traced out that along with the development of economy, country facing various problems like cyber crime and other frauds.

A new lightweight method for security risk assessment based on fuzzy cognitive maps

Abstract For contemporary software systems, security is considered to be a key quality factor and the analysis of IT security risk becomes an indispensable stage during software deployment. However, performing risk assessment according to methodologies and standards issued for the public sector or large institutions can be too costly and time consuming. Current business practice tends to circumvent risk assessment by defining sets of standard safeguards and applying them to all developed systems. This leads to a substantial gap: threats are not re-evaluated for particular systems and the selection of security functions is not based on risk models. This paper discusses a new lightweight risk assessment method aimed at filling this gap. In this proposal, Fuzzy Cognitive Maps (FCMs) are used to capture dependencies between assets, and FCM-based reasoning is performed to calculate risks. An application of the method is studied using an example of an e-health system providing remote telemonitoring, data storage and teleconsultation services. Lessons learned indicate that the proposed method is an efficient and low-cost approach, giving instantaneous feedback and enabling reasoning on the effectiveness of the security system.

Do we need innovative trust intermediaries in the digital economy?

Even almost 20 years after the launch of online shopping (B2C E-Commerce) as an important pillar of the digital economy, a significant number of consumers are still reluctant to buy goods and services via a website due to lack of trust. Study after study has shown that this lack of trust is due to privacy issues, IT security and performance risks. As a consequence, a few years after the advent of the digital economy trust marks began to be introduced which vendors can display on their websites in the hope of remedying this lack of trust. Several studies exploring the effectiveness of trust marks showed low awareness and an inadequate understanding of such certification. The aim of this repeat study is to explore whether awareness and understanding of German trust marks have changed from 2007 to 2012 through increased Internet experience and online purchasing activity as well as through the wider proliferation of Internet trust marks. The results show that the problems associated with lack of awareness of Internet trust marks identified earlier still persist and do not appear to have diminished over time.

IT Security Risk Management Model for Cloud Computing

The authors combined ISO 27005 framework for IT Security Risk Management with NIST Multitier framework. With this combined framework the authors create a new approach to IT Security Risk Management where IT Security Risk Management is place at the strategic, tactical and operational levels of an organizational. In this paper the authors concentrate on the monitoring and communication steps of IT Security Risk Management and especially escalation of new IT Security Incidents. The authors present a first draft to an IT Security Risk Escalation Capability Maturity Model based on ISACA´s Risk IT Framework. Finally the authors apply the approach to typical cloud computing environment as a first step to evaluate this new approach.

Information Technology Risks & the Extent of Their Impact: An Analysis of Zimbabwean Insurance Companies in the Context of E-Commerce

The conditions for doing business are rapidly changing. The Internet and related advances in information technology significantly affect financial services in general and insurance markets and banks in particular. The growing importance of e-commerce represents a watershed event for insurance markets and banking institutions, as it does for most industries. By managing Information Technology risks, e-commerce will enable insurers to classify, underwrite, and price risk as well as settle claims more accurately and efficiently. The risk connected with the wide application of information technologies in business grows together with the increase of enterprise’s correlation from its customers, business partners and outsourced operations. Technological progress generates dependencies which evoke growth of diversities, complexity, non-descriptiveness and quantity of risk factors. In insufficient investments on information security the issue of IT risk management becomes more significant, concentrating on searching optimal proportion between threats and costs of IT systems protections. In such dynamic development of Information Technology the time needed for appropriate reaction on risk is decidedly shortened. The lack of appropriate preparation may lead the company to collapse, thus appropriate reaction on risk constitutes about possibilities of survival and development of enterprise. One of the most important stages of this process is risk analysis, used for optimization, and correctly for minimizations of losses connected with risk. The dissertation will present the issue of IT security risk management; discuss the most significant stage of risk management which is IT security risk analysis. Chosen computer applications supporting these processes will be presented. Selected research connected with IT security risk management will be discussed in the literature review. Overally, the Internet – through a secure platform of I.T, will significantly enhance the efficiency of the insurance markets and institutions and benefit consumers by lowering transaction and information costs. The foundation for the purpose of this research has been created by a prospective study to explore I.T risks & the extent of their impact on the Zimbabwean insurance companies in the context of e-commerce. In order to fulfill the purpose of this study, a frame of reference will be emerged based on a vast literature review. With the focus at quantitative research as a general approach and descriptive research as the type of research in this study, a structured questionnaire will be used as the data collection instrument. To accomplish this, a survey of 25 people (in almost all active insurance companies in Zimbabwe) will be carried out. The respondents from almost every department within the targeted insurance companies will be randomly chosen. Focus will be on the perception of insurers and re-insurers regarding the subject of study, and thus, the perception of other stakeholders such as insurance agents/brokers and even their customers will be suggested for future research, due to limitation and demarcation of this research.

Employing Cost Effective Internet-Based Networking Technologies to Manage B2B Relationship

Using Internet-based technologies to establish network connectivity between firms can create conduit for propagation of threat vectors. Sharing data and information assets with other firms may give rise to external seats of loss exposure. Together, these practices complicate the IT security risk in business relationship: misaligned incentive for IT security investment and free rider behavior arise. Naïve pursuit to enter into business relationships using Internet-based technologies can prove myopic because the IT security risk profile of the resultant B2B network may be untenable. This research exhibits the impact of sharing and linking of information and network assets on IT security risk in modern business relationship with the help of a 2-firm symmetric B2B. This work demonstrates why managers should consider expanding their business relationship to include IT security initiatives as well, especially when they employ Internet-based technologies to interlink their networks.

Effectiveness of Security Control Risk Assessments for Enterprises: Assess on the Business Perspective of Security Risks

ABSTRACT Today's businesses being IT enabled, the complexity of risks affecting the business has increased manifold and the need to gauge the Information Technology risks acting on the business operations has become paramount. The business managers who run business operations need to operate securely and seamlessly leveraging Information Technology and ability to recover and resume the business without any loss of confidentiality, integrity and availability of business information/data in any event of a security incident. There is a need to quantify the impact of the IT security risk on the critical business processes, and provide the business-level insight at the management level. It is critical to classifying the Risk Ratings as per the impact on the business operations. This approach allows the organizations to understand and prioritize the security risk management activities that make the most sense for their organization to secure the business operations instead of trying to protect against every conceivable threat.

Greatest IT audit and security risks of 2006

AbstractAn expert in IT audit and security reveals the greatest audit risks discovered by his firm in 2006. An overemphasis on Sarbanes‐Oxley (SOX)‐related servers left companies with fewer resources to identify other risks. The author explains what they are and how to eliminate them. © 2007 Wiley Periodicals, Inc.

Operational risk management in financial institutions: Process assessment in concordance with Basel II

AbstractThe improvement of banks' operational risk management frameworks concerns new requirements addressed in the Basel II Framework, a new capital adequacy regulation proposed by the Basel Committee on Banking Supervision (BCBS). Basel II will apply to internationally active banks and to all banks and investment firms in the EU via transposition of a new Directive into national regulations.By doing so, the national financial supervisory authority, Commission de Surveillance du Secteur Financier (CSSF) in Luxembourg, and a public research centre, Centre de Recherche Public Henri Tudor (CRPHT), have engaged in a joint research project that investigates solutions conformant to ISO/IEC 15504 for assessing operational risk management frameworks implemented in banks.The ISO/IEC 15504 requirements can meet the CSSF's expectation on consistent, transparent and sound risk assessments, as well as the expectation on promoting enhancements in institutions' risk management practices without dictating the form or operational detail of their policies and practices.Moreover, although the domain is largely outside the scope of software and systems engineering, the ISO/IEC 15504 process assessment standard provides for an adequate solution to the so‐called supervisory review process. This adequacy is validated through the structure of Basel II and financial domain requirements. Last but not least, we will show that ISO/IEC 15504 provides an adequate approach to assessing institutions in two sub‐domains, namely, the domain of credit operational risk management and the domain of IT risk management (including IT security risks management). Copyright © 2007 John Wiley & Sons, Ltd.

Estimating Potential IT Security Losses: An Alternative Quantitative Approach

In this article, we look at the potential relationship between the cost of IT security breaches and port-scan records - specifically, we postulate that the irregular movement of port-scan records is quite similar to stock exchange price dynamics, which have been partially satisfied with stochastic movement and Poisson arrival processing. By intuition, stochastic process methodology can emulate an enterprise's information IT security situation. Our proposed generic approach provides a reasonable procedure to estimate and evaluate IT security risk through data mining of port-scan logs

Network externalities, layered protection and IT security risk management

This paper considers two important issues related to security risk management. First, the presence of network externalities in security risks. Second, the distinction of general (network) and system-specific protection measures. We found the optimal allocation of security resources (investments) in protecting every system in an organization. The results show that the consideration of network externalities and layered protection changes the risk mitigation decisions significantly. In addition, accurate estimation of system risk plays a critical role in the success of risk management. Otherwise, the use of a uniform baseline protection approach may be more desirable when the misjudgment of relative system risks is likely to occur.

4.3.1 Security Engineering: Systems Engineering of Security through the Adaptation and Application of Risk Management

AbstractInformation Technology (IT) Security Risk Management is a critical task in the organization, which must protect its resources and data against the loss of confidentiality, integrity, and availability. As systems become more complex and diverse, and more vulnerabilities are discovered while attacks from intrusions and malicious content increase, it is becoming increasingly difficult to manage IT security. This paper describes an approach to address IT security risk through risk management and mitigation in both the institution and in the project life cycle. The application of risk management to security engineering is described. Support for this through application of a security risk algorithm and a risk management tool for risk analysis is also discussed.