Organizational Information Security Research Articles

Shaping extra-role security behaviors through employee-agent relations: A dual-channel motivational perspective

Organizational information security performance increasingly depends on employees’ extra-role security behaviors (ERBs), which go beyond the scope of formal organizational prescription and control. At the same time, however, the literature suggests ERBs are largely unresponsive to traditional outline-and-control approaches to behavioral security. Instead, this stream finds that ERBs are primarily cultivated through social interactions with other organizational agents, namely the IS department and the direct supervisor. While important progress has been made in explicating the social nature of ERBs and the organizational agents that shape it, little is currently understood about the attributes of these employee-agent relationships that give rise to their influence on ERB enactment. Tied to this void, review of the literature reveals two separate and fundamentally different explanations of relational influence in this context which, according to theory, are associated with different relational attributes. Responding to these gaps, the current study presents a mixed-method examination of the relational antecedents of ERB enactment. We first theoretically develop and quantitatively examine a dual-channel model of socially motivated ERB enactment that highlights two co-existing motivational channels—an exchange-based channel rooted in norms of reciprocity and an identity-based channel rooted in self-verification. Then, applying the findings from quantitative examination of the dual-channel model, we qualitatively examine the specific attributes of these employee-agent relationships that promote ERB enactment. In doing so, this study makes multiple contributions to the literature including unification of prior work in this stream and introduction of detailed profiles of effective employee-agent relationships in this context.

Top Management Leadership in Combating Information Security Threats through Organizational Information Security Practices

Top Management Leadership in Combating Information Security Threats through Organizational Information Security Practices

Expressing opinions about information security in an organization: the spiral of silence theory perspective

Purpose Expressing views on organizational information security (IS) by employees is vital for improving security processes, policies and trainings, while non-communication may conceal the true state of the human factor of IS and lead to security breaches. The purpose of this paper is to introduce the concept of opinion expressing about organizational IS, provide an explanatory model based on the theory of spiral of silence and offer its empirical validation. Design/methodology/approach Data from a web-based survey among the employees of one the universities in the European Union (n = 504) was analyzed with regression analysis to investigate the proposed hypotheses. Findings The study reveals that employees with positive opinions about IS will be more willing to share their opinions with coworkers and management. However, when employees perceive that their pro-IS opinions are not shared by other coworkers, they will remain silent, which increases the risk of problematic opinions spreading throughout the organization. Research limitations/implications The study highlights the need to focus on the communication perspectives of organizational information security, an area often overlooked in the human factor of information security research. Practical implications The results highlight the need to examine the gap between the dominant climate of opinion about IS in the organization and the display of compliant IS behaviors in order to strengthen IS endeavors. Organizations are encouraged to facilitate open dialogue about IS processes, policies and training and implement mechanisms for considering employees’ feedback in order to improve the organization’s IS. Originality/value The study contributes to a growing body of research that moves beyond viewing employees merely as subjects of compliance, recognizing instead their agency in IS issues that can enhance organizational resilience. To the best of the authors’ knowledge, this is the first study to apply the spiral of silence theory in the IS field, thereby helping to overcome the lack of communication science perspectives in organizational IS research.

Penerapan ISO/IEC 27001:2022 dalam Tata Kelola Keamanan Sistem Informasi: Evaluasi Proses dan Kendala

Implementing ISO/IEC 27001:2022 in information security management is crucial and timely due to the increasing cyber threats, the necessity for regulatory compliance, and the significance of information security as a competitive edge. The latest revision of this standard demands proper adaptation and implementation to ensure effective information security management across various organizations. This study examines the key components of ISO/IEC 27001:2022, including organizational context, leadership, planning, support, operations, performance evaluation, and improvement. It delves into the application of ISO/IEC 27001:2022 in security system governance, emphasizing how this standard can enhance risk management and information security within an organization. A case study on a logistics company adopting this standard was conducted to identify best practices, implementation challenges, and its impact on security and regulatory compliance. The study's findings demonstrate that implementing ISO/IEC 27001:2022 effectively improves an organization's information security posture by integrating security policies, procedures, and controls into business processes. These findings offer recommendations as practical guidelines for organizations aiming to strengthen their information security management through the adoption of globally recognized international standards.

The process of declaring information security profiles

The article discusses the process of declaring information security profiles, which is an important aspect of ensuring information security in modern organizations. The main purpose of the declaration is to establish clear requirements and control measures to ensure an appropriate level of protection of information assets against potential threats and vulnerabilities. The authors of the article analyze the basic and target information security profiles, emphasizing their features, advantages and disadvantages. In particular, the basic security profile is considered as a minimum set of requirements that can be quickly implemented to ensure an initial level of protection. At the same time, the target security profile is aimed at more detailed adaptation of security measures to the specific needs and risks of the organization, which provides a higher level of protection. The process of declaring security profiles includes several stages, such as assessing the current state of security, identifying threats and vulnerabilities, defining security requirements, developing and implementing security profiles, and regularly monitoring and updating security measures. The article also discusses the current standards and regulations that govern the process of declaring security profiles, in particular, NIST SP 800-53 rev. 5, ISO/IEC 27001, and ND TZI 3.6-006-21. The article analyzes how these standards can be used to create effective security profiles that meet the specific requirements of organizations of various sizes and industries. The authors conclude that the process of declaring information security profiles is critical to ensuring an adequate level of protection of information assets. Implementation of clearly defined security profiles allows organizations to take a systematic approach to risk management, reduce the likelihood of security incidents and increase the overall level of information security.

Fostering security-related citizenship through the employee-supervisor relationship: An examination of supervisor security embodiment

Organizational information security performance is increasingly dependent on employees’ security-related citizenship behaviors that stretch beyond the scope of formal organizational prescription and control. Unfortunately, cultivating enactment of these valued behaviors has proven challenging for many companies. The literature has recognized workplace relationships as important determinants of behavioral security outcomes and extra-role security behaviors (ERBs) in particular. Taken further, an employee's relationship with the immediate supervisor is recognized as one of the most influential relational factors shaping a variety of workplace behaviors, including those related to security. Consistent with these notions, scholars have called for making the employee-supervisor relationship a more central component of behavioral security research and practice. Currently however, beyond recognition of this relationship's importance, the knowledge base is unclear about how it shapes ERB enactment. Because employees view supervisors as both organizational agents and as individuals in their own rights, this relationship has the potential to drive productive or counterproductive security behaviors, depending on how aligned the supervisor's security values are with those of the organization. Yet, the security literature has given surprisingly little consideration to the notion that employees can differ in the extent to which they perceive supervisors as embodying organizational information security values. Responding to this gap, the current study examines how employee-supervisor relations and perceived security-related value alignment between supervisors and the broader organization shape employees’ commitment to organizational information security and ultimately, ERB enactment. Grounded in the social identity theory of leadership (SITL), a research model is developed that positions high-quality employee-supervisor exchange as a direct antecedent of affective commitment to organizational information security, which then serves as a central intrinsic motivational mechanism driving ERB enactment. Further, rooted in SITL's principles on leader prototypicality and supervisor organizational embodiment, employee-perceived value alignment between the immediate supervisor and the organization as a whole—referred to here as supervisor security embodiment (SSE)—is introduced as a critical boundary condition influencing the extent to which employee-supervisor relations drive commitment. Results from model testing empirically demonstrate the value of SSE in explicating how this important relationship shapes workplace ERB enactment, through its influence on affective commitment to organizational information security performance.

The defining features of a robust information security climate

Data breaches have become a common occurrence with serious consequences, making organizational security management critically important. Nonetheless, the research community has not yet clearly defined the characteristics of a strong organizational security climate. This study conducts a comprehensive literature analysis to identify a collection of research-based and managerially relevant constructs that represent the essential components of a strong security climate. We operationalize the identified measures of the constructs and empirically validate them for reliability, construct validity, and nomological validity in terms of their relationships with employees' security awareness, neutralization, and intention to comply with organizational information security policies (ISPs). The results suggest that these integral elements, when embraced by organizations, discourage employees’ use of neutralization to justify violation of ISPs and improve employees’ security awareness and their ISP compliance intention. Organizations can use the identified subcomponents and their corresponding measures as a diagnostic decision support instrument to make a reliable and valid assessment of the strengths and weaknesses of their security climate, to continuously monitor their security climate, and to develop interventions that contribute to a strong security climate.

Common Techniques, Success Attack Factors and Obstacles to Social Engineering: A Systematic Literature Review

Knowledge of Social Engineering is crucial to prevent potential attacks related to organizational Information Security. The objective of this paper aims to identify the most common social engineering techniques, success attack factors, and obstacles, as well as the good practices and frameworks that could be adopted concerning their mitigation. As an analysis methodology, a Systematic Literature Review was carried out. The findings revealed that the discussion about SE attacks has increased and that the most imminent threat is phishing. Exploiting human vulnerabilities is a growing threat when the attack is not carried out directly through technical means. There continue to be more technical attacks than non-technical attacks. Encouraging organizational security prevention, like training, education, technical controls, process development, defense in detail, and the development of security policies, should be considered mitigating factors for the negative impact of SE attacks. Most SE frameworks/models are focused on attack techniques and methods, mostly on technical components, decorating human factor. As a novelty, we found the opportunity to develop a new framework that could improve coverage of the gaps found, supported on security international standards, that could help and support researchers in developing their work, understanding open research topics, and providing a clearer understanding of this type of threat. Doi: 10.28991/ESJ-2024-08-02-025 Full Text: PDF

Chief Information Security Officer: A Vital Component of Organizational Information Security Management

Chief Information Security Officer: A Vital Component of Organizational Information Security Management

The moderating impact of organizational culture on information security compliance

This research paper investigates the association between organizational culture and employees' compliance with information security policies. Drawing upon rational choice theory (RCT) and the competing values framework (CVF), our study explores the moderating effects of cultural dimensions on information security compliance in a diverse range of organizations. We employ a scenario-based approach and analyze the data using Partial Least Squares Structural Equation Modeling (PLS-SEM). Our findings underscore the robustness of the model and emphasize the pivotal role of cultural dimensions in influencing employees' compliance intentions.
 The study contributes by synthesizing non-fear-based deterrence theory with organizational culture theory, offering practical insights for information security managers. Recommendations include framing compliance as a moral duty, involving end-users in policy development, utilizing effective communication, implementing monitoring systems, and fostering a consistency culture. For organizations, the research underscores the importance of cultivating an ethical culture, emphasizing moral beliefs, and leveraging cultural dimensions to enhance compliance intentions.
 Acknowledging limitations related to single-country data collection, a focus on compliance intentions, and the selection of organizations with established policies, this research paves the way for future studies. Future research should aim to replicate this study in diverse cultural settings, consider individual-level culture measurement, and explore additional moderating factors. This research contributes to understanding the intricate relationship between organizational culture and information security compliance, offering actionable insights for practitioners and prospects for further exploration in the information security field.

An assessment of critical success factors in information security implementation in organizations in Ghana

Purpose This paper aims to identify the critical success factors in improving information security in Ghanaian firms. Design/methodology/approach Through an exploratory study of both public and private Ghanaian organizations. The study relied on a research model based on the technology–organization–environment (TOE) framework and a survey instrument to collect data from 525 employees. The data was analyzed using partial least squares-structural equation modeling (PLS-SEM). Findings The findings confirm the role of the technological, organizational and environmental contexts as significant determinants in the implementation of information security in Ghanaian organizations. Results from PLS-SEM analysis demonstrated a positive correlation between the technology component of information security initiative, organization’s internal efforts toward its acceptance and a successful implementation of information security in Ghanaian firms. Top management support and fund allocation among others will result in positive information security initiatives and positive attitudes toward securing the organization’s information assets. Research limitations/implications The authors discussed the implications of the authors’ findings for research, practice and policy. Social implications The results of this study will be useful for both governmental and non-governmental organizations in terms of best practices for increasing information security. Results from this study will aid organizations in developing countries to better understand their information security needs and identify the necessary procedures to address them. Originality/value This study contributes to filling the knowledge gap in organizational information security research and the TOE framework. Despite the TOE framework being one of the most influential theories in contemporary research of information system domains in an organizational context, there is not enough research linking the domains of information security and the TOE model.

Organizational information security threats: Status and challenges

Organizational information security is a critical concern in today’s interconnected and data-driven world. With the increasing frequency and sophistication of cyber threats, organizations face significant risks to the confidentiality, integrity, and availability of their sensitive information. This paper provides an overview of the key aspects and challenges related to organizational information security. It highlights the importance of implementing robust security measures, such as firewalls, intrusion detection systems, encryption technologies, and secure coding practices, to protect against external threats. It also demonstrates the need for continuous monitoring, threat intelligence sharing, and incident response capabilities to detect and respond to security incidents effectively. This survey shows importance of user awareness, training, and adherence to security policies and procedures. In addition, the significance of establishing a security-centric culture within organizations to mitigate the risk of insider threats and promote a strong security posture is discussed. The evolving threat landscape, including challenges associated with advanced persistent threats, zero-day vulnerabilities, and the security of emerging technologies such as IoT and AI are highlighted, together with the need for ongoing research and innovation to address these challenges and enhance the effectiveness of preventive measures.

Cyber Security and Compliance Management through a Single Integrated Platform

Abstract: These days, any information security product or service used in an organization is a stand-alone solution. Examples include information risk management, data security, auditing, and incident management. Since different organizations use different services from different providers, there is currently no single platform or architecture that can address all of an organization's fundamental information security procedures in one easy step. Because of this, businesses must spend a significant amount of money on separate services in order to meet the information security standards that are necessary for their businesses. These dispersed services lead to an increase in physical and manual labor, disorganized processes, and a lack of clarity regarding all information security-related business issues. To solve these issues, the approach covered in this article combines information security as a service with end-to-end platform/framework to give organizations a single framework for all information security-related organizational aspects. A single service that can handle every information security-related work for the company, including risk assessment, mitigation, vulnerability assessment, incident management, threat analytics, risk response management, and auditing. This will assist the company in spending less money on a wider range of security-related services.

Usaglašenost stilova rukovođenja sa informacionom bezbednošću u organizacijama

This paper investigates the significance of the alignment of leadership styles with information security in organizations. The focus is on the analysis of transactional and transformational leadership and their contribution to the implementation of security policies and practices. Transactional leadership, focused on setting clear goals and rewarding, provides structure and accountability, while transformational leadership, which inspires and encourages change, encourages engagement, adaptability and innovation. Through the integration of these leadership styles, organizations can build a holistic approach that supports a safety culture and effectively responds to dynamic safety challenges. It is critical that leaders recognize the importance of information security and adapt their leadership styles to support the integrity, confidentiality and availability of information, key components of a secure organization in the digital age.

Information Security Maturity Model for Healthcare Organizations in the United States

This article provides a maturity model for information security for healthcare organizations in the United States. Healthcare organizations are faced with increasing threats to the security of their information systems. The maturity model identifies specific performance metrics, with relative importance measures, that can be used to enhance information security at healthcare organizations allowing them to focus scarce resources on mitigating the most important information security threat vectors. This generalizable, hierarchical decision model uses both qualitative and quantitative metrics based on objective goals. This model may be used as a baseline by which to measure individual organizational performance, to measure performance against other organizations, or to monitor changes in the information security environment over time.

Managing organizations in the context of digital transformation

In the context of dynamic digital transformation, there is a need to reconsider traditional approaches to organizational management, as information insecurity poses a threat to the security of domestic organizations and leads to the loss of their competitive positions, along with the inevitable loss of previously achieved financial, operational, and investment advantages. The practical value of the obtained results lies in the development of methodological recommendations for conducting cluster analysis of organizations based on a group of indicators for assessing the level of information authentication, as well as the level of utilization of specialized software tools and information protection instruments, which will allow for evaluation and ranking of the information security of organizations. It is concluded that the most successful organizations are financial institutions and organizations in the information technology sector, as they have been able to transform into leading technological companies by revising the content of their core business processes in the context of digitalization. Many of them have formed a comprehensive ecosystem, which has enabled them to quickly adapt to changing conditions, which would not have been possible without the implementation of digital transformation processes.

Methods for determining the categories of cyber incidents and assessing information security risks

The article is devoted to the study of categories of cyber incidents and their prioritization in the context of information security. It discusses the main sources that provide information about cyber threats and defines their role in detecting and analyzing incidents, and provides tools for collecting and analyzing data. The concepts of event, incident, and crime and the relationship between them are discussed. The author provides a classification of various types of cyber threats, how they are coded, their characteristics and impact on information systems. Examples of the use of cyber incident classification are given. The authors of the article also consider specific types of cyber incidents that may occur in various fields of activity and the threats they pose to various information systems. The necessity and methods of determining priorities in responding to cyber threats are substantiated, which allows for the effective allocation of resources and the implementation of preventive cyber security measures. The approach to assessing and classifying incidents according to their possible impact on the organization's activities, information security and ability to recover from cyber attacks is revealed. The article highlights various approaches and methodologies for identifying and managing information security risks, including the use of standards, models and assessment tools. This article is a resource for cybersecurity professionals, researchers, and executives interested in risk management and information asset protection in today's digital environment.

Evaluating compliance for organizational information security and business continuity: three strata of ventriloqual agency

PurposeThe purpose of this research is to study how compliance evaluation becomes performed in practice. Compliance evaluation is a common practice among organizations that need to evaluate their posture against a set of criteria (e.g. a standard, legislative framework and “best practices”). The results of these evaluations have significant importance for organizations, especially in the context of information security and continuity. The author argues that how these evaluations become performed is not merely a “social” activity but shaped by the materiality of the evaluation criteriaDesign/methodology/approachThe authors adopt a sociomaterial practice-based view to study the compliance evaluation through in situ participant observations from compliance evaluation workshops to evaluate organizational compliance against a information security and business continuity criteria. The empirical material was analyzed to construct vignettes that serve to illustrate the practice of compliance evaluation.FindingsThe research analysis shows how the information security and business continuity criteria themselves partake in the compliance evaluations by operating through (ventriloqually) the evaluators on three strata: the material, the textual and the structural. The author also provides a conceptualization of a hybrid agency.Originality/valueThis research contributes to lack of studies on the organizational-level compliance. Further, the research is an original contribution to information security and business continuity management by focusing on the practices of compliance evaluation. Further, the research has theoretical novelty by adopting the ventriloqual agency as a hybrid agency to study the sociomateriality of a phenomenon.

APPLICATION OF ARTIFICIAL INTELLIGENCE FOR IMPROVING SITUATIONAL TRAINING OF CYBERSECURITY SPECIALISTS

The article identifies the problem of the need for continuous development and improvement of practical skills for cybersecurity professionals due to the constant growth and evolution of threats to information and cyber security for organizations, businesses, society, and the state. The relevance of implementing innovative technologies to improve the methods of developing technical and managerial competencies of cybersecurity specialists in higher education institutions is justified in accordance with the strategic direction of education reform in Ukraine. The relevance of developing the ability and skills for cybersecurity professionals to respond promptly to threats is associated with the use of artificial intelligence by cybercriminals. The analysis conducted in this work allowed us to conclude the need for improvement of the situational teaching method as one of the main ways to develop the competencies of students majoring in Cybersecurity and Information Security in higher education institutions. One of the ways to improve the method is to use artificial intelligence tools in creating various types of tasks for classes. To create educational situations and options for resolving conflicting situations in cybersecurity management and cyber incidents with the aim of developing skills in future cybersecurity managers to make timely, correct, and effective decisions, it proposed to use the artificial intelligence tool - the ChatGPT language model. Thanks to its excellent capabilities, which include summarizing and analyzing articles, encoding, debugging, and generating thematic blocks of situations, it represents significant progress in the field of artificial intelligence. The application of ChatGPT allowed the creation of the necessary number of situational tasks with options for correct solutions in a short time, covering all areas of activity for cybersecurity specialists. However, during the research, there was a need for critical evaluation and verification of the information provided by the model for compliance with the context and rules, laws, and ethical norms that apply in each specific situation. This issue addressed by refining and specifying the request to the ChatGPT language model to generate situations.

A qualitative study of penetration testers and what they can tell us about information security in organisations

PurposeThis paper presents a qualitative study of penetration testing, the practice of attacking information systems to find security vulnerabilities and fixing them. The purpose of this paper is to understand whether and to what extent penetration testing can reveal various socio-organisational factors of information security in organisations. In doing so, the paper innovates theory by using Routine Activity Theory together with phenomenology of information systems concepts.Design/methodology/approachThe articulation of Routine Activity Theory and phenomenology emerged inductively from the data analysis. The data consists of 24 qualitative interviews conducted with penetration testers, analysed with thematic analysis.FindingsThe starting assumption is that penetration testers are akin to offenders in a crime situation, dealing with targets and the absence of capable guardians. A key finding is that penetration testers described their targets as an installed base, highlighting how vulnerabilities, which make a target suitable, often emerge from properties of the existing built digital environments. This includes systems that are forgotten or lack ongoing maintenance. Moreover, penetration testers highlighted that although the testing is often predicated on planned methodologies, often they resort to serendipitous practices such as improvisation.Originality/valueThis paper contributes to theory, showing how Routine Activity Theory and phenomenological concepts can work together in the study of socio-organisational factors of information security. This contribution stems from considering that much research on information security focuses on the internal actions of organisations. The study of penetration testing as a proxy of real attacks allows novel insights into socio-organisational factors of information security in organisations.