Security Maturity Level Research Articles

Maturity of information systems' security in Ethiopian banks: case of selected private banks

PurposeInformation systems' security is more critical than ever before since security threats are rapidly growing. Before putting in place information systems' security measures, organizations are required to determine the maturity level of their information security governance. Literature review reveals that there is no recent study on information systems' security maturity level of banks in Ethiopia. This study thus seeks to measure the existing maturity level and examine the security gaps in order to propose possible changes in Ethiopian private banking industry's information system security maturity indicators.Design/methodology/approachFour private banks are selected as a representative sample. The system security engineering capability maturity model (SSE-CMM) is used as the maturity measurement criteria, and the measurement was based on ISO/IEC 27001 information security control areas. The data for the study were gathered using a questionnaire.FindingsA total of 93 valid questionnaires were gathered from 110 participants in the study. Based on the SSE-CMM maturity model assessment criteria the private banking industry's current maturity level is level 2 (repeatable but intuitive). Institutions have a pattern that is repeated when completing information security operations but its existence was not thoroughly proven and institutional inconsistency still exists.Originality/valueThis study seeks to measure the existing maturity level and examine the security gaps in order to propose possible changes in Ethiopian private banking industry's information system security maturity indicators. This topic has not been attempted previously in the context of Ethiopian financial sector.

Cyber Security Maturity Assessment Framework for Technology Startups: A Systematic Literature Review

Cybersecurity has gained increasing importance among firms of different sizes and industries due to the significant rise of cyber-attacks over time. Technology startups are particularly vulnerable to cyber-attacks due to the lack of cyber security measures. This is because of limited human capital and financial resources to quantify cyber risks and allocate appropriate investments to cyber security. Technology startups are suppliers and vendors to large organisations such as MNCs, government and financial institutions. They could possibly have a network connection back to the large organisations and might even store confidential information of these large organisations such as financial records, personal data and other proprietary information. As such, with the lack of appropriate cyber security measures, technology startups may be an attack vector for malicious hackers to gain entry to the large organisations. Focusing on technology startups, this study conducted a systematic literature review on cyber security maturity assessment frameworks. This study addressed five research questions on the existing cyber security maturity assessment frameworks in various industries, the target for implementation, cyber security maturity level, shared control domains of these frameworks, and the quantification of the return of cyber security investments. Referring to the Preferred Reporting Items for Systematic Reviews and Meta-Analysis (PRISMA) checklist, a detailed analysis was performed on 24 published research articles (out of 650) from reputable journals and conference proceedings from January 2011 to June 2022. The results revealed the lack of an end-to-end cyber security maturity assessment framework for technology startups. Despite the similarities in the cyber security maturity level for certain frameworks, the results revealed no singular framework that can evaluate the cyber security maturity level of technology startups. The results further revealed the lack of studies on the quantification of the return of cyber security investments in an end-to-end cyber security maturity assessment framework for technology startups. This put the startup in a vulnerable position since management is not able to obtain relevant data on the startup’s cyber maturity posture and without such information, they are not able to appropriately justify their security investments to mitigate the evolving cyber risks.

Strategy for Implementation of the Security Maturity Model in e-Government Systems in Indonesia

The security maturity level of Indonesia's e-Government system needs to be evaluated to determine the current status of security implementations and to plan for overall system security improvements. In general, the maturity model describes how a system consisting of humans and devices performs their duties. These capabilities include effective leadership and governance, level of awareness of implementers, and capabilities of existing tools. This study aims to create a strategy in implementing the security maturity model in the e-Government system in Indonesia. The research method uses a mix method, namely qualitative and quantitative methods. The qualitative method aims to obtain the Critical Success Factors Implementation of the security maturity model, and the quantitative method is used to analyze the results of the Critical success factor validation using SPSS. The strategy for the Security maturity model is based on the PDCA (Plan-Do-Check-Act) Model.

Evaluasi Tingkat Kesiapan Keamanan Informasi Menggunakan Indeks Keamanan Informasi (Indeks KAMI) Versi 4.0 pada Dinas Komunikasi dan Informatika Kota Bogor

Communications and Informatics Office of Bogor Municipality is a government agency that has the task of assisting the Mayor of Bogor in carrying out Government Affairs in the field of Communication, Informatics, Statistics, and Encryption management that has implemented e-Government in its public services. The impact of the e-Government’s implementation in public services with the increasing communication and exchange of data electronically causes vulnerabilities in information and communication system transactions which greatly affect the quality and security of information, so that the management of information security becomes very important for the Communications and Informatics Office of Bogor Municipality. This research was conducted to determine the level of readiness of information security management at the Communications and Informatics Office of Bogor Municipality using the Information Security Index (KAMI Index) Version 4.0 according to the security aspects defined by the ISO/IEC 27001:2013 standard made by the National Cyber and Crypto Board (BSSN). by evaluating various areas that are the target of the application of information security through the interview process. The evaluation result of the Electronic System Category obtained value of 35 and included in the Strategic Category illustrating that the use of electronic systems is an integral strategic part in supporting ongoing work processes. The evaluation result of the five areas of information security obtained a total score of 395 at the Basic Framework stage with Maturity Levels I+ to II. Based on the evaluation results, recommendations are prioritized at the lowest maturity level, namely the Information Security Risk Management area so that in the next evaluation there can be an increase in the level of information security maturity until it reaches the expected maturity level according to ISO 27001 compliance standards, which is at level III.

Information System Security Audit Based on the DSS05 Framework Cobit 5 at Higher Education XX

Currently, information has become a commodity or basic need, it can even be said that we are already in an "information-based social" era. It is undeniable that the ability to access and ensure the availability of information quickly and accurately has become a very essential component for an organization, whether in the form of social or commercial organizations, educational institutions such as universities, government agencies, and individuals. Various channels were created to regulate access rights to information, to prevent unauthorized people from accessing it, to minimize losses for the owner of the information. Based on the results of interviews with the research object of XX college, there are still frequent disruptions to information system security such as attacks on servers that result in server downtime, attacks on institutional e-mails that result in being unable to receive or even send e-mails, and other disturbances. This certainly harms information services at the tertiary institution, therefore an information system security audit is required. This study aims to measure the level of information system security capabilities using the Cobit 5 framework in the APO13 and DSS05 domains. Based on the results of the audit, it was found that the GAP value was 3.6 for the APO13 domain or at level 1 while 3.4 for the GAP DSS05 value or at level 2, it can be concluded that the information system security maturity level is still very low so that it needs improvement. It is recommended to make SOPs and documentation of maintenance, control, and periodic security evaluation, install an antivirus that has high and up to date protection accuracy, and make regular maintenance reports both on software and hardware.

Maturity level assessments of information security controls: An empirical analysis of practitioners assessment capabilities

Maturity models are a widely used concept for measuring information security. The idea is to systematically evaluate the maturity of security-relevant processes in an organisation. This enables decision-makers to get an overview of the implementation status of relevant processes to identify neuralgic points. Maturity models thus play a central role in the conception of information security management systems (ISMS). Some industries, for instance, the German automotive industry, have even established security maturity levels as the de facto standard for measuring information security. However, the quality of security maturity level assessments has not been sufficiently investigated yet. Therefore, we have analysed to what extent security managers can accurately assess the maturity levels of security controls. To verify the quality of maturity level assessments a case study was conducted where security experts assessed a subset of the ISO/IEC 27002 security controls for a hypothetical scenario using the COBIT maturity levels. Additionally, ex-post interviews have been conducted with several participants of the study to verify some of the hypotheses developed during the previous analyses. Our results show that many security experts struggled with the task and did not perform well. However, we discovered professional characteristics that have a strong significant effect on the assessment capabilities. We also identified various types of additional support that can help practitioners to make more reliable assessments in practice. Moreover, the experts' self-perception was overly optimistic when asked to assess their performance. We even found a weak inverted correlation for more experienced experts, also known as Dunning-Kruger effect. Our results have a strong impact on practice since they indicate that practitioners need support to carry out high-quality assessments and they also show what kind of support addresses the identified challenges.

Adopting security maturity model to the organizations’ capability model

Each organization faces threats and risks in daily operations. One of the main risks is how to assess the security level to protect from the increasing risks associated with technology evolution. So, organizations can specify the required approaches and skills. In this paper, we propose a security maturity model that classifies the organizations into five levels. Each level determines the technologies and process capability used by the organizations. There is a set of factors that can help in determining the security maturity level, such as technology, people, and infrastructure. This paper adopts an Information Security Management model to assess organization’s security level. The authors make a correspondence between maturity levels and security levels in an organization. Also, the proposed process capability controls influence both levels. The proposed model helps the organizations bridging the cybersecurity gaps. These gaps relate to talent, technology, organizational units, financial, management and operations gaps. Thus, the model helps the cybersecurity auditors to create a comprehensive plan for measuring the security level of the organization. This plan can manage and develop the organization’s automated countermeasures. Also, it can help in applying the suitable standard and framework based on the organization’s daily operation. Cybersecurity auditors use cybersecurity techniques and tools to assess the organization’s postures. Finally, the authors applied the security maturity controls in two case studies: retirement organization and public telecommunication corporation in the Republic of Yemen.

Maturity Framework Analysis ISO 27001: 2013 on Indonesian Higher Education

Information Security Management System (ISMS) implementation in Institution is an effort to minimize information security risks and threats such as information leakage, application damage, data loss and declining IT network performance. The several incidents related to information security have occurred in the implementation of the Academic System application in Indonesian higher education. This research was conducted to determine the maturity level of information security practices in Academic Information Systems at universities in Indonesia. The number of universities used as research samples were 35 institutions. Compliance with the application of ISO 27001:2013 standard is used as a reference to determine the maturity level of information system security practices. Meanwhile, to measure and calculate the level of maturity using the SSE-CMM model. In this research, the Information System Security Index obtained from the analysis results can be used as a tool to measure the maturity of information security that has been applied. There are six key areas examined in this study, namely the role and importance of ICT, information security governance, information security risk management, information security management framework, information asset management, and information security technology. The results showed the level of information security maturity at 35 universities was at level 2 Managed Process and level 3 Established Process. The composition is that 40% of universities are at level 3, and 60% are out of level 3. The value of the gap between the value of the current maturity level and the expected level of maturity is varied for each clause (domain). The smallest gap (1 level) is in clause A5: Information Security Policy, clause A9: Access Control, and clause A11: Physical and environmental security. The biggest gap (4 levels) is in clause A14: System acquisition, development and maintenance and clause A18: compliance.  Â

ANALYSIS OF GOVERNANCE SECURITY MANAGEMENT INFORMATION SYSTEM USING INDEX KAMI IN CENTRAL GOVERNMENT INSTITUTION

Information security is very vulnerable to institutions if there is interference from other parties outside the organization or institution as a supply chain of services that can pose an information security risk. Based on the Regulation of the Minister of Communication and Information Technology number 4 of 2016, the Electronic System organizers that operate Low Electronic Systems must apply the Information Security Index guidelines. Index KAMI are a tool in analyzing and evaluating the level of information security based on the criteria in organizations or in government institutions. The research objective is to measure the level of information security readiness that meets the requirements of the ISO/IEC27001: 2013 standard at the Central Government Institution Unit X. The results of the assessment with the index KAMI obtained an electronic system category score of 30, for the assessment of governance the score is 84, the risk management score is 35, the framework information security work value is 61, asset management 128, and the application of security and information technology has a value of 100, the level of information security maturity is level II+ with a value of 408, the results obtained up to the Compliance of the Basic Framework.

Analisis Big Data untuk Kota Aman

Abstract—Smart solutions are needed by the city government to overcome various city problems. One solution is smart city. To realize smart city, one of the main challenges is the solution to overcome the city's security problems. Currently cities in Indonesia do not yet know the level of security of their cities. The level of city security can be obtained by surveying various cities. But surveys require personnel, time and cost that is not small. In this study the authors propose a method by designing a model to determine the level of security of cities in Indonesia by utilizing big data through the prediction of sentiment analysis of people's perceptions of city security on Twitter. This research was conducted in 25 cities in Indonesia which are divided into 8 big cities, 9 medium cities and 8 small cities. The results of the prediction models designed in this study are generally not much different from the results of the 2019 RKCI (Indonesia Smart Cities Rating) survey in the field of security and disaster. The results of this study found that 4 cities with a maturity level of security are at the Integrative level (score 60 to 79 in GSCM Maturity Level), namely Tangerang, Kediri, Parepare and Probolinggo, while the other 21 cities are at the Scattered level (score 40 to 59). The average score for the big city category is 55.41, while the middle city score is 55.48 and the small city is 53.70. The results of performance measurement of this prediction model are for an accuracy value of 80.10% while a precision value of 81.10% and a recall value of 82.62%.

English

English

PENILAIAN PENGAMANAN TEKNOLOGI PADA SISTEM PEMBELAJARAN ELEKTRONIK MENGGUNAKAN INDEKS KEAMANAN INFORMASI DI POLITEKNIK NEGERI BATAM

As an electronic learning system organizer State Polytechnic of Batam (Polibatam) must arrange secured electronic learning system. Ministry of Communication and Information of Indonesia expects the organizations which arrange electronic system can perform SNI ISO 27001 certification related to information security. Information security condition on organizations which will perform on certifiation is expected on maturity level at III+ (Directorate of Information Security Team, 2011). On the other hand, there is a gap between expected conditon and actual condition. Information security index (KAMI) is a tool to assess the implementation of information security that has been done. This research is assessed related to technology component because of high dependency of organization on technology. The purpose of research is to identify how far the security of technology at State Polytechnic of Batam by using information security index. Based on research, electronic learning system that is organized by State Polytechnic of Batam is low categorized. The total percentage is 65 or 54,17% out of maximum percentage. Therefore, the maturity level of technology security is on maturity level II which means the maturity level of technology security is under the expected maturity level for minimum readiness certification on III+. It is caused the position of State Polyetechnic of Batam is on a organizational development stage. Moreover, the focus of organization is related on operational, not strategic.

Web Vulnerability Assessment and Maturity Model Analysis on Indonesia Higher Education

College websites are websites that are used as media and means of campus information. Since the website is widely accessible, the level of security on the website must always be maintained. To see the level of web security, it can be done by testing the security vulnerability of the web. The test results using the tools Nessus and Skipfish, on the websites of several universities in Jakarta, show that there are still several vulnerabilities. This vulnerability will affect the maturity level of the web site security. The results of vulnerability testing show that as many as 60% of the total 33 web sites have a maturity level below number 3. This indicates that the level of vulnerability on the web site is still high.

Maturity Level of Information Systems Security and Control: A Survey of Companies in Thailand

The objective of this study is to survey companies’ information systems security and control, and todevelop a maturity level of information systems security and control application. This application shows a company’s position of information systems security and control by comparing this position with other companies. This study is survey research. Participants are chief information security officers of 304 Stock Exchange of Thailand listed companies within eight industry groups (services, property and construction, industrials, financials, agriculture and food industry, consumer products, technology, and natural resources). The findings suggest that all companies are aware of security of network access control. Many companies also implement information security policies, asset management systems, and access controls for data, information systems and business applications.

An analysis on the dimensions of information security culture concept: A review

The cultivation of positive Information Security Culture (ISC) is an effective way to promote security behavior and practices among employees in the organization. However, there is yet a consensus on a standard set of dimensions for the ISC concept. ISC has been associated with many facets, with some overlapping dimensions found in the literature. There is little explanation, if any, as to why this happens or to what extent do variances of dimensions affects ISC concept and findings. This paper presents an analysis of the different dimensions in conceptualizing the ISC. Eight major databases including Web of Science, Scopus and Google Scholar were systematically exhausted using PRISMA and a total of 79 studies from 2000 to 2017 was selected for analysis. While different approaches such as adopted theories affect the dimensions of ISC, our analysis also covered other contributing factors such as the objective of the study, type of organization under study and the information security maturity level. In addition, we found no evidence of a set of widely accepted concepts and dimensions for ISC. This review provides substantial evidence on the numerous dimensions used in ISC and could be utilized by academicians as a reference in ISC-related studies.

Human Sensor Web Crowd Sourcing Security Incidents Management in Tanzania Context

Security incidents affecting information systems in cyberspace keep on rising. Researchers have raised interest in finding out how to manage security incidents. Various solutions proposed do not effectively address the problematic situation of security incidents. The study proposes a human sensor web Crowd sourcing platform for reporting, searching, querying, analyzing, visualizing and responding to security incidents as they arise in real time. Human sensor web Crowd sourcing security incidents is an innovative approach for addressing security incidents affecting information systems in cyberspace. It employs outsourcing collaborative efforts initiatives outside the boundaries of the given organization in solving a problematic situation such as how to improve the security of information systems. It was managed by soft systems methodology. Moreover, security maturity level assessment was carried out to determine security requirements for managing security incidents using ISO/IEC 21827: Systems security engineering capability maturity model with a rating scale of 0 - 5. It employed descriptive statistics and non-parametric statistical method to determine the significance of each variable based on a research problem. It used Chi-Square Goodness of Fit Test (X2) to determine the statistical significance of result findings. The findings revealed that security controls and security measures are implemented in ad-hoc. For managing security incidents, organizations should use human sensor web Crowd sourcing platform. The study contributes to knowledge base management learning integration: practical implementation of Crowd sourcing in information systems security.

Leadership by Example in e-Government Security Management System

e-Government is getting advance in targeting efficient services to citizens, hence, information security becomes an important asset to the national entities. Information security maturity level by Von Solms is theoretically has improved from technical to governance wave. However, a problem exists when theory does not align with the current practice because practically, the employees‟ mind-set is still in technical wave and organisations‟ strategy partially involve governance wave especially a leadership context. These can also be found by a previous contribution made by Zakaria studies, he describes a leadership stays under the manager‟s responsibilities. His study is a continuation of a Schein‟s organisation culture. Schein defines culture with three layers of values, observable and assumption, in additions Zakaria has improvised into security culture becomes security value, observable and assumption. However, manager‟s responsibilities stay under management wave; meanwhile, governance wave involves top management. Thus, the composition explores a „leadership-by-example‟ in eGovernment security management system in order to come out with a model of key-factors to line up with governance wave. In order to develop a „leadership-by-example‟ concept in the e-Government management system, the authors guide the study with four objectives and are achieved in different sections. The authors concluded an empirical study by critically reviewing previous literatures that are achieved in section 2, and followed by evaluation of leaders‟ strategy on information security development and its implementation and distribution to employees which described in section 4. Findings from the study show an inappropriate strategy of leadership concept in the organisations creates lack of motivation to employees which can be a cause of incidents by insiders. Inappropriate strategy of leadership concept is due to incompatible security leadership and unorganised security structure. Therefore, the study contributes a model of keyfactors contains of 3Ps includes „People‟, „Process‟ and „Product‟ to guide on the concept of „leadership-by-example‟ in managing information security management system systematically. General Terms Information Security Management System, People & Security and Leadership-by-Example.

Data Center Governance Information Security Compliance Assessment Based on the Cobit Framewok

One of control domain of Cobit describes information security lies in Deliver and Support (DS) on DS5 Ensure Systems Security. This domain describes what things should be done by an organization to preserve and maintain the integrity of the information assets of IT where this all requires a security management process. One of the process is to perform security monitoring by conducting periodic vulnerability assessment to identify weaknesses. Because Cobit is not explained technically so it needs a method to utilizes data that has been standardized. One of the standardized database for vulnerability is CVE (Common Vulnerabilites and Exposures).This study aims to assess current condition of Data Center on Department of Transportation, Communication and Information Technology at Sleman Regency and assess the maturity level of security as well as providing solutions in particular on IT security. Next goal is to perform vulnerability assessment to find out which are the parts of the data center that may be vulnerable. Knowing weaknesses can help evaluate and provide solutions for better future. Result from this research is to create tool for vulnerability assessment and tool to calculate maturity model.

Study on Financial-sector Information Security Level Assessment and Improvement Anticipation Model

Infringement threats to the financial sector have become more sophisticated and intelligent. In order to more effectively respond to such threats, the financial sector faces the need to perform the assessment of information security maturity level on a voluntary basis in order to better understand organizational information security situation and improve own vulnerabilities to reinforce information security. The study, in reflection of financial industrial environmental characteristics, builds a comprehensive and systematic information security assessment indices specialized in the financial sector while presenting an information security maturity level assessment model based on the indices as well as an information security improvement anticipation model through vulnerability remedy. The quantification of vulnerability levels of the control item suggested herein and the improvement anticipation model based on vulnerability correction, in particular, supports an organization under the assessment to address its vulnerabilities to effectively enhance organizational information security. In the absence of such an information security assessment model, the financial sector has poorly performed in assessing own information security activities. With the models suggested herein being in place, the sector is expected to make an active use of it to facilitate information security assessment and improve the general information security maturity level of individual financial institutions and the financial industry as a whole

조직성과에 미치는 영향요인에 관한 연구: 정보보호 성숙도의 매개효과를 중심으로

조직성과에 미치는 영향요인에 관한 연구: 정보보호 성숙도의 매개효과를 중심으로