ДОСЛІДЖЕННЯ АРХІТЕКТУРНИХ РІШЕНЬ ДЛЯ ПОБУДОВИ БЕЗПЕЧНОЇ СИСТЕМИ ЗБЕРІГАННЯ ТА ПЕРЕДАЧІ КОНФІДЕНЦІЙНИХ ДАНИХ

The purpose of information systems (IS) security behavior, represented by the difference between work and personal purpose, has been neglected in the research of user's IS security behavior. This is especially important for the organizations that allow or inevitably allow their employees to do personal tasks during work hours, because it may bring big threats to an organization's IS. Unfortunately, few empirical studies have examined if different behavioral purpose, typically, work/personal purpose, affects users' IS security behavior decision. Based on boundary theory and the idea of multidimensional rationality, we argue that people demarcate a psychological boundary for work and personal usages of IS and thus apply different rationalities to make IS security-related decisions. Our empirical investigation indicates that in a work usage context, people apply rule-based rationality and therefore are more influenced by mandatoriness and facilitating conditions. Whereas in a personal usage context, people apply outcome-based rationality and therefore are more concerned with task benefits and costs. The findings imply that organizations and vendors may devise different measures to ensure users' IS security behavior in different contexts.

Cet article decrit, du point de vue d'un clinicien generaliste, une solution pour l'implementation de dossiers concernant les patients en toute securite, ainsi que les strategies mises en place pour cette implementation. Cet article souligne donc l'importance de la securite pour la confidentialite de ces dossiers, mais aussi la difficulte de mettre en place un systeme de protection de l'information sur

HOW MUCH ICT SECURITY HAS IMPROVED DURING THE LAST DECADE

Protection motivation theory (PMT) is one of the most commonly used theories to examine information security behaviors. Our systematic review of the application of PMT in information systems (IS) security and the comparison with its application for decades in psychology identified five categories of important issues that have not yet been examined in IS security research. Discussing these issues in terms of why they are relevant and important for IS security, and to what extent IS research has not considered them, offers new research opportunities associated with the study of PMT and IS security threats. We suggest how future studies can approach each of the open issues to provide a new road map for quantitative and qualitative IS scholars.

In the former VLDB Conference we have presented a global model for the design of a complete information system (IS). This model constitutes an original attempt to integrate at the conceptual level, data, processes and dynamics in the design of IS. In the same way, we now present a system of tools allowing IS definition, creation and functionning compatible with the general model previously defined. This system is an extension of the DBMS approach for the design and management of IS. The goal of those tools is to create an IS functioning and evolving as the dynamic reality it represents.

An Information System (IS) security programme consists of several essential security controls. In order to verify and maintain the effectiveness of an IS security programme, it is pertinent to identify how security controls are compared to each other in terms of their practical implications. This study reports the results from an experience survey to offer insights of the roles of security controls in IS security programmes. Four clusters of security controls were identified with technical security controls (such as authentication and confidentiality) being high on respondents' perceived importance. An approach to develop SAI with weighted security controls is explained to help security administrators conduct security assessments. The results of this study contribute to IS security budget planning and resource allocation. Managerial implications are also reported.

Business process (BP) designs and enterprise information system (IS) designs are often not well aligned. Missing alignment may result in performance problems at run-time, such as large process execution time or overloaded IS resources. The complex interrelations between BPs and ISs are not adequately understood and considered in development so far. Simulation is a promising approach to predict performance of both BP and IS designs. Based on prediction results, design alternatives can be compared and verified against requirements. Thus, BP and IS designs can be aligned to improve performance. In current simulation approaches, BP simulation and IS simulation are not adequately integrated. This results in limited prediction accuracy due to neglected interrelations between the BP and the IS in simulation. In this paper, we present the novel approach Integrated Business IT Impact Simulation (IntBIIS) to adequately reflect the mutual impact between BPs and ISs in simulation. Three types of mutual impact between BPs and ISs in terms of performance are specified. We discuss several solution alternatives to predict the impact of a BP on the performance of ISs and vice versa. It is argued that an integrated simulation of BPs and ISs is best suited to reflect their interrelations. We propose novel concepts for continuous modeling and integrated simulation. IntBIIS is implemented by extending the Palladio tool chain with BP simulation concepts. In a real-life case study with a BP and IS from practice, we validate the feasibility of IntBIIS and discuss the practicability of the corresponding tool support.

Although many information systems (IS) design methods and techniques are available to IS professionals, none of them completely supports the design process. One of the problems is that there is a mismatch between IS design method; and the system to be built. Actually, in designing an IS, the methods or techniques employed should match the types and characteristics of the system to be built. Thus paper will explore the relationship between IS types/characteristics and systems design methods, and provide IS designers with a systems framework to develop methods or techniques that match the types and characteristics of IS.

The Zachman framework for information systems architecture is a classification scheme for development and documenting an enterprise-wide information system. It is useful in teaching various topics on information systems, such as: information systems development as an engineering process, basic information systems components and design artefacts, system development life cycle and information systems architecture, roles involved in development of information systems, control points of information systems development, focus of information systems development methods, and improving information systems maintenance. The Framework also helps improving information systems teaching programme.

The features of the functioning of the on-board information systems of a car are considered. Threats to their security are analyzed, and methods for ensuring information security and functional security of on-board information systems are proposed. The design of road networks in the organization of road traffic is one of the factors in ensuring the functional security of modern intelligent transport systems, that is, compliance with such information security attributes as data confidentiality, integrity, availability, authenticity and novelty of data. The security of on-board vehicle information systems is a critical issue in the modern world, as more and more vehicles are equipped with electronic systems that may be vulnerable to cyber attacks. One of the main challenges of protecting on-board information systems is the wide range of devices and technologies used in modern vehicles. Different systems may have different security requirements and vulnerabilities. They may interact with each other in a complex way. Another challenge is that many of these systems were not designed originally with security in mind. They may lack basic security features such as encryption and authentication and use outdated software and protocols that are vulnerable to known attacks. The main types of attacks and threats to the elements of the transportation system that interact with the VANET were identified to analyze the information security of vehicle in-vehicle systems. Based on the theory of fuzzy sets under conditions of uncertainty and using the Fuzzy Logic Toolbox in the integrated Matlab environment, the level of information security of the OBU-VANET system was modeled. The obtained results allowed us to formulate the degree of information security of vehicle operation elements against unauthorized access to data. The results of the study showed that technical communication systems have the highest security level (> 0.7), and vehicles become the most vulnerable in public places.

What are the key topics for Information Systems (IS) security researchers? How have these topics been changing, and what topics are emerging to offer new opportunities for research? We address these questions by analyzing the abstracts of 261 articles focusing on IS security that have appeared in leading IS journals and journals devoted to this area. Using Latent Semantic Analysis (LSA) to analyze the text of these abstracts uncovers five primary research topics: Security Design & Management, Business Operations Security, Behavioral Aspects, Authentication & Integrity Controls, and Prevention & Detection. These five primary topics are aggregates of more granular topics that are utilized to find trends to understand the changing complexion of IS security research. Our study contributes by developing the key topics and their trends in this area using an analytical and replicable method to synthesize the existing research.

This paper arose from concerns regarding the current conceptualizations of ‘design’ in the emerging literature on design science (DS) in information systems (IS). In this paper, we argue that current conceptualizations of design in IS are overly narrow, which necessarily limits what is viewed as acceptable DS research. In response we advance a more encompassing view of design. The revised view extends the current perspectives of design in the IS literature to embrace broader conceptualizations of design, which are evident in many intellectual communities outside IS where design is viewed as a critical component of both research and practice - such as management, engineering, architecture and others. In addition to the fairly common conceptualizations of design as product and design as process or action, design is also conceived as: intention; planning - including modeling and representation; communication; user experience; value; professional practice; and as service. Further, whereas the current conceptualization of design in IS views IS design knowledge as split across two paradigms, namely DS and behavioral science, in this paper we argue for a broader and more integrated view of design: one that emphasizes both the construction-centered and human-centered aspects of design in IS. Building from our broader view, we discuss some of the implications for design-oriented research in IS, and consider ways in which this human- centered perspective might impact on the context and content of design research in IS.

Even though the human component has been recognized to have a crucial role in information systems (IS) security, the human issues have not received much attention. Recently a few approaches aimed at minimizing human‐related faults in the area of IS security have been put forward. This paper analyses different approaches aimed at minimizing user‐related faults. The existing approaches will be analysed from the viewpoint of their theoretical background, the research approaches employed, the research objectives and the organizational role of IS security. As a result, a new taxonomy, a comparison and critical analyses of the strengths and weaknesses of state‐of‐the‐art approaches shall be presented. Moreover, several issues that future research should explore and practitioners should consider when applying the results of the existing research are suggested.

Management of information systems (IS) security in organizations has been hampered by the apparent lack of inclusion of organizational security objectives in the traditional strategic planning process. In order to improve IS security strategic planning, we argue that there should be a renewed emphasis on security planning objectives. In this paper we present two sets of objectives – fundamental and means. We then define an evaluation mechanism for assessing the security posture of a firm. Based on case work in healthcare, we illustrate the usefulness of the security evaluation method for designing enterprise security.

Ensuring information security in public sector information systems is now more important than ever. Advances in technology and information have not only made daily life easier, but also made the opportunities for cybercrimes vast and inevitable. This study aims to create a framework for evaluation that measure the maturity level of information security in information systems by integrating existing frameworks, NIST Cybersecurity Framework (CSF) and COBIT 2019. The result of this framework development is implemented in a public sector organization called PT XYZ, which has an information system as a tool to assist in the implementation of public services. The Capability Maturity Model Integration (CMMI) method is used to calculate the maturity level. The implemented approach resulted in information security maturity evaluation framework for information systems. This framework includes 118 activities which are divided into 23 categories. The distribution of the integration of the two frameworks contributes 61% activities, the NIST CSF contributes 8% and the COBIT 2019 framework contributes 31% activities. The measurement result of the information security maturity level in the information system at PT XYZ shows that all functions are at level 1 or the initial level. PT XYZ's low information security maturity reveals the critical need for stronger data protection and system resilience. This study introduces a novel approach to demonstrating a practical methodology for integrating two frameworks. The resulting framework enables public sector organizations to assess their security posture, identify areas for improvement, and enhance resilience against cyber threats, strengthening public service and safeguarding data.