Organizational Information Security Research Articles

Expressing opinions about information security in an organization: the spiral of silence theory perspective

Purpose Expressing views on organizational information security (IS) by employees is vital for improving security processes, policies and trainings, while non-communication may conceal the true state of the human factor of IS and lead to security breaches. The purpose of this paper is to introduce the concept of opinion expressing about organizational IS, provide an explanatory model based on the theory of spiral of silence and offer its empirical validation. Design/methodology/approach Data from a web-based survey among the employees of one the universities in the European Union (n = 504) was analyzed with regression analysis to investigate the proposed hypotheses. Findings The study reveals that employees with positive opinions about IS will be more willing to share their opinions with coworkers and management. However, when employees perceive that their pro-IS opinions are not shared by other coworkers, they will remain silent, which increases the risk of problematic opinions spreading throughout the organization. Research limitations/implications The study highlights the need to focus on the communication perspectives of organizational information security, an area often overlooked in the human factor of information security research. Practical implications The results highlight the need to examine the gap between the dominant climate of opinion about IS in the organization and the display of compliant IS behaviors in order to strengthen IS endeavors. Organizations are encouraged to facilitate open dialogue about IS processes, policies and training and implement mechanisms for considering employees’ feedback in order to improve the organization’s IS. Originality/value The study contributes to a growing body of research that moves beyond viewing employees merely as subjects of compliance, recognizing instead their agency in IS issues that can enhance organizational resilience. To the best of the authors’ knowledge, this is the first study to apply the spiral of silence theory in the IS field, thereby helping to overcome the lack of communication science perspectives in organizational IS research.

Fostering security-related citizenship through the employee-supervisor relationship: An examination of supervisor security embodiment

Organizational information security performance is increasingly dependent on employees’ security-related citizenship behaviors that stretch beyond the scope of formal organizational prescription and control. Unfortunately, cultivating enactment of these valued behaviors has proven challenging for many companies. The literature has recognized workplace relationships as important determinants of behavioral security outcomes and extra-role security behaviors (ERBs) in particular. Taken further, an employee's relationship with the immediate supervisor is recognized as one of the most influential relational factors shaping a variety of workplace behaviors, including those related to security. Consistent with these notions, scholars have called for making the employee-supervisor relationship a more central component of behavioral security research and practice. Currently however, beyond recognition of this relationship's importance, the knowledge base is unclear about how it shapes ERB enactment. Because employees view supervisors as both organizational agents and as individuals in their own rights, this relationship has the potential to drive productive or counterproductive security behaviors, depending on how aligned the supervisor's security values are with those of the organization. Yet, the security literature has given surprisingly little consideration to the notion that employees can differ in the extent to which they perceive supervisors as embodying organizational information security values. Responding to this gap, the current study examines how employee-supervisor relations and perceived security-related value alignment between supervisors and the broader organization shape employees’ commitment to organizational information security and ultimately, ERB enactment. Grounded in the social identity theory of leadership (SITL), a research model is developed that positions high-quality employee-supervisor exchange as a direct antecedent of affective commitment to organizational information security, which then serves as a central intrinsic motivational mechanism driving ERB enactment. Further, rooted in SITL's principles on leader prototypicality and supervisor organizational embodiment, employee-perceived value alignment between the immediate supervisor and the organization as a whole—referred to here as supervisor security embodiment (SSE)—is introduced as a critical boundary condition influencing the extent to which employee-supervisor relations drive commitment. Results from model testing empirically demonstrate the value of SSE in explicating how this important relationship shapes workplace ERB enactment, through its influence on affective commitment to organizational information security performance.

The defining features of a robust information security climate

Data breaches have become a common occurrence with serious consequences, making organizational security management critically important. Nonetheless, the research community has not yet clearly defined the characteristics of a strong organizational security climate. This study conducts a comprehensive literature analysis to identify a collection of research-based and managerially relevant constructs that represent the essential components of a strong security climate. We operationalize the identified measures of the constructs and empirically validate them for reliability, construct validity, and nomological validity in terms of their relationships with employees' security awareness, neutralization, and intention to comply with organizational information security policies (ISPs). The results suggest that these integral elements, when embraced by organizations, discourage employees’ use of neutralization to justify violation of ISPs and improve employees’ security awareness and their ISP compliance intention. Organizations can use the identified subcomponents and their corresponding measures as a diagnostic decision support instrument to make a reliable and valid assessment of the strengths and weaknesses of their security climate, to continuously monitor their security climate, and to develop interventions that contribute to a strong security climate.

Common Techniques, Success Attack Factors and Obstacles to Social Engineering: A Systematic Literature Review

Knowledge of Social Engineering is crucial to prevent potential attacks related to organizational Information Security. The objective of this paper aims to identify the most common social engineering techniques, success attack factors, and obstacles, as well as the good practices and frameworks that could be adopted concerning their mitigation. As an analysis methodology, a Systematic Literature Review was carried out. The findings revealed that the discussion about SE attacks has increased and that the most imminent threat is phishing. Exploiting human vulnerabilities is a growing threat when the attack is not carried out directly through technical means. There continue to be more technical attacks than non-technical attacks. Encouraging organizational security prevention, like training, education, technical controls, process development, defense in detail, and the development of security policies, should be considered mitigating factors for the negative impact of SE attacks. Most SE frameworks/models are focused on attack techniques and methods, mostly on technical components, decorating human factor. As a novelty, we found the opportunity to develop a new framework that could improve coverage of the gaps found, supported on security international standards, that could help and support researchers in developing their work, understanding open research topics, and providing a clearer understanding of this type of threat. Doi: 10.28991/ESJ-2024-08-02-025 Full Text: PDF

Chief Information Security Officer: A Vital Component of Organizational Information Security Management

Chief Information Security Officer: A Vital Component of Organizational Information Security Management

The moderating impact of organizational culture on information security compliance

This research paper investigates the association between organizational culture and employees' compliance with information security policies. Drawing upon rational choice theory (RCT) and the competing values framework (CVF), our study explores the moderating effects of cultural dimensions on information security compliance in a diverse range of organizations. We employ a scenario-based approach and analyze the data using Partial Least Squares Structural Equation Modeling (PLS-SEM). Our findings underscore the robustness of the model and emphasize the pivotal role of cultural dimensions in influencing employees' compliance intentions.
 The study contributes by synthesizing non-fear-based deterrence theory with organizational culture theory, offering practical insights for information security managers. Recommendations include framing compliance as a moral duty, involving end-users in policy development, utilizing effective communication, implementing monitoring systems, and fostering a consistency culture. For organizations, the research underscores the importance of cultivating an ethical culture, emphasizing moral beliefs, and leveraging cultural dimensions to enhance compliance intentions.
 Acknowledging limitations related to single-country data collection, a focus on compliance intentions, and the selection of organizations with established policies, this research paves the way for future studies. Future research should aim to replicate this study in diverse cultural settings, consider individual-level culture measurement, and explore additional moderating factors. This research contributes to understanding the intricate relationship between organizational culture and information security compliance, offering actionable insights for practitioners and prospects for further exploration in the information security field.

An assessment of critical success factors in information security implementation in organizations in Ghana

Purpose This paper aims to identify the critical success factors in improving information security in Ghanaian firms. Design/methodology/approach Through an exploratory study of both public and private Ghanaian organizations. The study relied on a research model based on the technology–organization–environment (TOE) framework and a survey instrument to collect data from 525 employees. The data was analyzed using partial least squares-structural equation modeling (PLS-SEM). Findings The findings confirm the role of the technological, organizational and environmental contexts as significant determinants in the implementation of information security in Ghanaian organizations. Results from PLS-SEM analysis demonstrated a positive correlation between the technology component of information security initiative, organization’s internal efforts toward its acceptance and a successful implementation of information security in Ghanaian firms. Top management support and fund allocation among others will result in positive information security initiatives and positive attitudes toward securing the organization’s information assets. Research limitations/implications The authors discussed the implications of the authors’ findings for research, practice and policy. Social implications The results of this study will be useful for both governmental and non-governmental organizations in terms of best practices for increasing information security. Results from this study will aid organizations in developing countries to better understand their information security needs and identify the necessary procedures to address them. Originality/value This study contributes to filling the knowledge gap in organizational information security research and the TOE framework. Despite the TOE framework being one of the most influential theories in contemporary research of information system domains in an organizational context, there is not enough research linking the domains of information security and the TOE model.

Organizational information security threats: Status and challenges

Organizational information security is a critical concern in today’s interconnected and data-driven world. With the increasing frequency and sophistication of cyber threats, organizations face significant risks to the confidentiality, integrity, and availability of their sensitive information. This paper provides an overview of the key aspects and challenges related to organizational information security. It highlights the importance of implementing robust security measures, such as firewalls, intrusion detection systems, encryption technologies, and secure coding practices, to protect against external threats. It also demonstrates the need for continuous monitoring, threat intelligence sharing, and incident response capabilities to detect and respond to security incidents effectively. This survey shows importance of user awareness, training, and adherence to security policies and procedures. In addition, the significance of establishing a security-centric culture within organizations to mitigate the risk of insider threats and promote a strong security posture is discussed. The evolving threat landscape, including challenges associated with advanced persistent threats, zero-day vulnerabilities, and the security of emerging technologies such as IoT and AI are highlighted, together with the need for ongoing research and innovation to address these challenges and enhance the effectiveness of preventive measures.

Cyber Security and Compliance Management through a Single Integrated Platform

Abstract: These days, any information security product or service used in an organization is a stand-alone solution. Examples include information risk management, data security, auditing, and incident management. Since different organizations use different services from different providers, there is currently no single platform or architecture that can address all of an organization's fundamental information security procedures in one easy step. Because of this, businesses must spend a significant amount of money on separate services in order to meet the information security standards that are necessary for their businesses. These dispersed services lead to an increase in physical and manual labor, disorganized processes, and a lack of clarity regarding all information security-related business issues. To solve these issues, the approach covered in this article combines information security as a service with end-to-end platform/framework to give organizations a single framework for all information security-related organizational aspects. A single service that can handle every information security-related work for the company, including risk assessment, mitigation, vulnerability assessment, incident management, threat analytics, risk response management, and auditing. This will assist the company in spending less money on a wider range of security-related services.

Usaglašenost stilova rukovođenja sa informacionom bezbednošću u organizacijama

This paper investigates the significance of the alignment of leadership styles with information security in organizations. The focus is on the analysis of transactional and transformational leadership and their contribution to the implementation of security policies and practices. Transactional leadership, focused on setting clear goals and rewarding, provides structure and accountability, while transformational leadership, which inspires and encourages change, encourages engagement, adaptability and innovation. Through the integration of these leadership styles, organizations can build a holistic approach that supports a safety culture and effectively responds to dynamic safety challenges. It is critical that leaders recognize the importance of information security and adapt their leadership styles to support the integrity, confidentiality and availability of information, key components of a secure organization in the digital age.

Information Security Maturity Model for Healthcare Organizations in the United States

This article provides a maturity model for information security for healthcare organizations in the United States. Healthcare organizations are faced with increasing threats to the security of their information systems. The maturity model identifies specific performance metrics, with relative importance measures, that can be used to enhance information security at healthcare organizations allowing them to focus scarce resources on mitigating the most important information security threat vectors. This generalizable, hierarchical decision model uses both qualitative and quantitative metrics based on objective goals. This model may be used as a baseline by which to measure individual organizational performance, to measure performance against other organizations, or to monitor changes in the information security environment over time.

Managing organizations in the context of digital transformation

In the context of dynamic digital transformation, there is a need to reconsider traditional approaches to organizational management, as information insecurity poses a threat to the security of domestic organizations and leads to the loss of their competitive positions, along with the inevitable loss of previously achieved financial, operational, and investment advantages. The practical value of the obtained results lies in the development of methodological recommendations for conducting cluster analysis of organizations based on a group of indicators for assessing the level of information authentication, as well as the level of utilization of specialized software tools and information protection instruments, which will allow for evaluation and ranking of the information security of organizations. It is concluded that the most successful organizations are financial institutions and organizations in the information technology sector, as they have been able to transform into leading technological companies by revising the content of their core business processes in the context of digitalization. Many of them have formed a comprehensive ecosystem, which has enabled them to quickly adapt to changing conditions, which would not have been possible without the implementation of digital transformation processes.

Evaluating compliance for organizational information security and business continuity: three strata of ventriloqual agency

PurposeThe purpose of this research is to study how compliance evaluation becomes performed in practice. Compliance evaluation is a common practice among organizations that need to evaluate their posture against a set of criteria (e.g. a standard, legislative framework and “best practices”). The results of these evaluations have significant importance for organizations, especially in the context of information security and continuity. The author argues that how these evaluations become performed is not merely a “social” activity but shaped by the materiality of the evaluation criteriaDesign/methodology/approachThe authors adopt a sociomaterial practice-based view to study the compliance evaluation through in situ participant observations from compliance evaluation workshops to evaluate organizational compliance against a information security and business continuity criteria. The empirical material was analyzed to construct vignettes that serve to illustrate the practice of compliance evaluation.FindingsThe research analysis shows how the information security and business continuity criteria themselves partake in the compliance evaluations by operating through (ventriloqually) the evaluators on three strata: the material, the textual and the structural. The author also provides a conceptualization of a hybrid agency.Originality/valueThis research contributes to lack of studies on the organizational-level compliance. Further, the research is an original contribution to information security and business continuity management by focusing on the practices of compliance evaluation. Further, the research has theoretical novelty by adopting the ventriloqual agency as a hybrid agency to study the sociomateriality of a phenomenon.

APPLICATION OF ARTIFICIAL INTELLIGENCE FOR IMPROVING SITUATIONAL TRAINING OF CYBERSECURITY SPECIALISTS

The article identifies the problem of the need for continuous development and improvement of practical skills for cybersecurity professionals due to the constant growth and evolution of threats to information and cyber security for organizations, businesses, society, and the state. The relevance of implementing innovative technologies to improve the methods of developing technical and managerial competencies of cybersecurity specialists in higher education institutions is justified in accordance with the strategic direction of education reform in Ukraine. The relevance of developing the ability and skills for cybersecurity professionals to respond promptly to threats is associated with the use of artificial intelligence by cybercriminals. The analysis conducted in this work allowed us to conclude the need for improvement of the situational teaching method as one of the main ways to develop the competencies of students majoring in Cybersecurity and Information Security in higher education institutions. One of the ways to improve the method is to use artificial intelligence tools in creating various types of tasks for classes. To create educational situations and options for resolving conflicting situations in cybersecurity management and cyber incidents with the aim of developing skills in future cybersecurity managers to make timely, correct, and effective decisions, it proposed to use the artificial intelligence tool - the ChatGPT language model. Thanks to its excellent capabilities, which include summarizing and analyzing articles, encoding, debugging, and generating thematic blocks of situations, it represents significant progress in the field of artificial intelligence. The application of ChatGPT allowed the creation of the necessary number of situational tasks with options for correct solutions in a short time, covering all areas of activity for cybersecurity specialists. However, during the research, there was a need for critical evaluation and verification of the information provided by the model for compliance with the context and rules, laws, and ethical norms that apply in each specific situation. This issue addressed by refining and specifying the request to the ChatGPT language model to generate situations.

A qualitative study of penetration testers and what they can tell us about information security in organisations

PurposeThis paper presents a qualitative study of penetration testing, the practice of attacking information systems to find security vulnerabilities and fixing them. The purpose of this paper is to understand whether and to what extent penetration testing can reveal various socio-organisational factors of information security in organisations. In doing so, the paper innovates theory by using Routine Activity Theory together with phenomenology of information systems concepts.Design/methodology/approachThe articulation of Routine Activity Theory and phenomenology emerged inductively from the data analysis. The data consists of 24 qualitative interviews conducted with penetration testers, analysed with thematic analysis.FindingsThe starting assumption is that penetration testers are akin to offenders in a crime situation, dealing with targets and the absence of capable guardians. A key finding is that penetration testers described their targets as an installed base, highlighting how vulnerabilities, which make a target suitable, often emerge from properties of the existing built digital environments. This includes systems that are forgotten or lack ongoing maintenance. Moreover, penetration testers highlighted that although the testing is often predicated on planned methodologies, often they resort to serendipitous practices such as improvisation.Originality/valueThis paper contributes to theory, showing how Routine Activity Theory and phenomenological concepts can work together in the study of socio-organisational factors of information security. This contribution stems from considering that much research on information security focuses on the internal actions of organisations. The study of penetration testing as a proxy of real attacks allows novel insights into socio-organisational factors of information security in organisations.

Enforcing Information System Security

Every year brings numerous security breaches that lead to highly destructive ransomware attacks, data leaks, and reputational damage to governments, companies, and other organizations around the world. As a result, there is a growing need to ensure that workers comply with critical policies put in place to avoid such incidents. This study investigated how factors from social bond theory and involvement theory affected compliance with information security policies and procedures. All of the factors examined were found to have a significant influence on attitudes about compliance, and attitude had a significant impact on intention to comply. The findings of this study revealed that it is vital to raise employees' awareness about compliance with security policies by improving their information security behavior. Moreover, all the factors were found to have a significant influence on the attitude of employees towards compliance with their organizational information security policies and procedures.

Development of a methodology for the protection of artificial intelligence systems in distributed information systems

This article is devoted to the methodology for the construction of artificial intelligent systems for information security tasks. It is planned to protect the artificial intelligence itself and the information that this device will process. The task is large-scale in its magnitude and the author of this text will try to present not just a concept, but rather an idea of how to achieve the goal of this result. By the result we will understand the final construction of a secure AI created for the organization of information security.

Approaches to the intellectualization of information and telecommunication networks security control in transport

The specifics of modern information and telecommunication networks in transport, as an object of information security control, are investigated. The main trends in the development of information and telecommunication network protection technologies (TNPT) have been identified. The presence of the interrelation of the main integrative properties: readiness, mobility, throughput, stealth, accessibility, manageability, which is a consequence of the convergence of information transmission and processing technologies, is noted. A new integrative property of ITCS has become the presence and characteristics of distributed system memory, which allows storing transmitted messages for a certain time. An important feature of modern TNPT is the presence of artificial intelligence, which is formed on the basis of information and algorithmic support of modern TNPT, providing flexibility of the system behavior. These trends indicate the transformation of TNPT into a supersystem, the management tasks of which are insufficiently investigated at present. The purpose of this work is to study new approaches to ensuring the safety management of modern TNPT critical infrastructure, which includes modern systems of sea and river transport, taking into account their features. The object of the study is the information security control system of modern TNPT. The subject of the study is the scientific and methodological support of the TNPT critical infrastructure control. The research objectives are to analyze existing and develop new conceptual frameworks, as well as approaches to improving the TNPT information security control system based on intellectualization methods. The analysis of the existing methodology for managing complex organizational and technical systems and information security control technologies is carried out. The concept of TNPT information security control is formalized schematically. The analysis of the existing approach to the organization of the TNPT information security control process is carried out. The tasks of control intellectualization are defined. The problem of ensuring the efficiency and reliability of the TNPT control is formulated. The main scientific tasks of the development of the TNPT information security control methodology are defined.

Organisational culture and information security awareness of Chinese grassroots civil servants: A mediated moderation model

AbstractDigital information and data significantly improve the efficiency of government work in China. At the same time, in order to deal with information security and data leakage events, public departments have begun to pay attention to the information security awareness and behaviour of civil servants. Based on organisational culture and protection motivation theory, this study constructed a mediated moderation model to explore the influence mechanism of grassroots civil servants’ awareness of information security. This study collected 324 questionnaires from four regions of China. Results show that organisational culture has a significant positive impact on information security awareness. Professional identity has a significant positive effect on public service motivation and plays a negative moderating role in the relationship between organisational culture and information security awareness. Public service motivation mediates the moderating effect of professional identity on the relationship between organisational culture and information security awareness. The findings of this study offer practical implications and suggestions for further research.Points for practitioners The construction of organisational culture will effectively enhance the information security awareness of Chinese grassroots civil servants. Public departments should consider professional identity as an important factor when selecting grassroots civil servants engaged in information security work. In the implementation of information security management strategy planning, government departments can pay attention to and emphasise the public service motivation of grassroots civil servants.

Application of Internet of Things and Blockchain in Information Security and Privacy Protection of Global Organizations

Access control data will continue to be exposed to the threat of privacy leakage even if blockchain technology currently offers a new solution for the security and privacy of the internet of things (IoT). However, its usability and privacy are not completely leveraged. This paper first discusses the IoT and blockchain technology and then examines each technology's structural models in order to address the issue of information security and privacy protection for the global organization IoT based on blockchain. Second, the information security and privacy guarantee system based on blockchain is built with ZKP and TEE at its heart after problems with zero-knowledge proof (ZKP) and trusted execution environment (TEE) in information security guarantee based on blockchain are investigated. By comparing the simulation trials, the proposed system's viability is finally confirmed. The results demonstrate that the suggested algorithm's evidence generation time is 352 ms when it reaches the experiment's highest node 28, which is clearly faster than previous techniques.