2 - Cross-sector security priorities and issues

Assessing the strategic value of Information Technology: An analysis on the insurance sector

Milano Mitra Abadi is a retail company engaged in the fashion and shoes in the business process is not separated from the use of IT. IT is an effective step taken by the company to develop its business in order to provide a level of efficiency and effectiveness in the management of sales data or inventory data with good and orderly. One of the tools used for IT Governance is COBIT (Control Objectives for Information and Related Technology) is a standard model that provides documentation of best IT management practices that can help management and user To bridge the gap between business risks, control needs, and technical problems. The analysis for the maturity level is done by comparing the level of maturity that exists at the moment with the level of maturity. The level of maturity that is intended on the basis represents the level of maturity of the industry average at level 3. Current level of maturity (current maturity level) for each process that is in the domain of Deliver and Support and Monitor and Evaluate is almost entirely at level 2. This can be said that the process of IT governance in PT. Milano Mitra Abadi has been done but has not been running optimally, has a pattern that is repeatedly done in conducting activities management related to technology governance Information, but its existence has not been well-defined and formal so that there is still an inconsistency. It is recommended that the evaluation of IT can be done routinely every specific time period (periodically) so that the desired level of maturity can be achieved and performed by a specific unit.

IT business value (ITBV) research generally state that various “good” IT management and IT governance practices influence positively IT deployment success and organizational performance. This has proved hard to verify empirically. For this study, the authors analyzed factors that influence IT deployment success. First, the authors identified potential factors, then hypothesized about the relationships among and between the factors and finally integrated the hypotheses into a research model. The authors then empirically evaluated the hypotheses and the entire research model. Special attention was placed on the Business-IT alignment, IT management and the consistency of IT investments in relation to the cyclical behavior of the economy. The consistency of IT investment is a novel factor introduced in this study to the ITBV research. The authors used survey data of 212 responses collected from CxOs during an economic recession. Empirical results confirmed that all research model factors impacted positively on IT deployment success.

Information Systems (IS) planning has gained considerable interest among researchers and practitioners in recent years because of the large investments that firms have made in IS and the increasingly strategic nature of the impact of information systems on organizational performance. Since IS planning is performed in an organizational context, characteristics of the organization may have a significant influence on the quality and effectiveness of the IS planning process. A research model is developed that links two major dimensions of IS planning—the quality of the planning process and planning effectiveness—with a set of eight organizational factors derived from contingency research in IS planning, strategic business planning, organizational studies, and technology innovation. The model is validated using data collected from a field survey of 249 senior IS executives. Canonical correlation analysis is used to test the research hypotheses and validate the model. The results of the study indicate that the two planning dimensions respectively reflecting the “means” and “ends” of IS planning are equally important. The results also indicate that planning resources, the intended strategic impact of IS on future business operations, the quality of facilitation mechanisms, the quality of implementation mechanisms, and the quality of strategic business planning are significantly associated with the quality and effectiveness of IS planning. The implications of the results to further research and to managerial practice are highlighted.

The problems of development and construction of a universal consolidated strategy of interaction of IT services and information security, which is based on the study and in-depth analysis of statistics on the current situation with the interaction of corporate IT services and security in different international companies in different industries and countries, are considered. specialists, experts and analysts. The subject of research in the article is the issue of optimal interaction of IT and security services in ensuring a high level of corporate information security in the EMEA region. The goal is to analyze the issues related to the construction and implementation of consolidated strategies for IT and security management in order to eliminate inconsistencies and increase the efficiency of the relevant services to ensure effective information security of organizations on the example of the EMEA region. Objectives: processing and analysis of the results of an online survey on the interaction of IT and security services of companies and organizations in various industries in different countries and regions of the world, including the EMEA region; research of problems and advantages of building a consolidated strategy of IT management and information security in the EMEA region; development of recommendations for solving existing problems in the development and construction of corporate strategies for effective IT management and information security. The general scientific method of systems analysis is used to determine the features of interaction between IT services and security of companies and organizations of different industries in different regions of the world, as well as to study the problems and benefits of a unified consolidated IT management strategy and information security. The following results were obtained: based on quantitative and qualitative assessment, as well as analysis of the results of the survey of IT and security specialists and experts in the EMEA region, the participation of companies in the development and implementation of information security strategies was determined; the main tasks of IT and security services in the organization of their joint work and coordination of actions among themselves are defined; the main obstacles in the organization of joint work of IT services and security services of companies are investigated, among which significant are tensions and conflicts between employees of services, global and regional shortage of qualified personnel, technical difficulties. Conclusions: it is established that the consolidated strategy of IT management and information security based on advances in security and technology can help solve the main problems of effective interaction of relevant company services; developed a number of recommendations to address existing problems of building corporate strategies for effective IT management and information security, designed to help eliminate inconsistencies and improve the efficiency of relevant services to ensure effective information security of organizations in the EMEA in various organizations and companies, regardless of their field of activity.

Security of Organizations' Information Systems (IS) and the Auditors: A Schematic Study

The purpose of this panel is to provide a forum to discuss the main IT security issues confronting organizations today. The panelists and attendees will discuss the existing gap between current IT security practices vs. best practices based on survey trends on IT security for the past 5 years, explore popular models used to justify IT security investments, and showcase some of the most popular hacking tools to demonstrate why it is so easy to compromise organizational IT security assets. The panel will conclude by discussing the emerging IT security standards and practices that may help deter, detect, and mitigate the impact of cyber-attacks. As the title suggests, we posit the question: Is Managing IT Security a Mirage?

ABSTRACTWe examine the impact of information system (IS) function maturity and IS planning process on IS planning success in an exploratory approach. We conducted non-linear regression analysis using the Alternating Conditional Expectations algorithm, and found significant non-linear relationships between the dimensions of IS function maturity/IS planning process and those of IS planning success. We also visualised how various IS planning success measures can evolve with low or high values of determinant variables. We used four dimensions of capabilities, analysis, cooperation, and alignment to evaluate IS planning success. We also employed four dimensions to analyse each of IS function maturity and IS planning process. IS function maturity consists of IT planning mode, IT integration, IT industry practice, and IT perspective. On the other hand, IS planning process is composed of long-range planning, medium-range managerial planning, short-range operational planning, and organisational IT potential.

The purpose of information systems (IS) security behavior, represented by the difference between work and personal purpose, has been neglected in the research of user's IS security behavior. This is especially important for the organizations that allow or inevitably allow their employees to do personal tasks during work hours, because it may bring big threats to an organization's IS. Unfortunately, few empirical studies have examined if different behavioral purpose, typically, work/personal purpose, affects users' IS security behavior decision. Based on boundary theory and the idea of multidimensional rationality, we argue that people demarcate a psychological boundary for work and personal usages of IS and thus apply different rationalities to make IS security-related decisions. Our empirical investigation indicates that in a work usage context, people apply rule-based rationality and therefore are more influenced by mandatoriness and facilitating conditions. Whereas in a personal usage context, people apply outcome-based rationality and therefore are more concerned with task benefits and costs. The findings imply that organizations and vendors may devise different measures to ensure users' IS security behavior in different contexts.

Strategic information systems planning: A case study from the financial services industry

This study was conducted in 2023 to know the Farmers knowledge and perception on insect pest of rice and its management practices in Pyuthan, Nepal. In this study, district 4 wards of Pyuthan municipality under PMAMP rice zone were purposively selected to assess the insect pests prevailing in rice field and storage and methods used for their management. Primary data were collected by the use of pretested interview questionnaires from 80 respondents, selected at random. The data were processed and analyzed by using descriptive statistics through MS-excel and SPSS. The analyses showed that the main insects prevailing in the field were rice leaf folder and rice yellow stem borer. Similarly rice moth and rice weevil were dominant in storage condition. Two months stage was found to be the most severe in terms of insect pest susceptibility. Majority of respondents used chemical methods for insect management with pesticide from agro-vets which was ranked first in terms of effectiveness. Most respondents followed the advice of Agro-vets for insect management and pesticide estimation and had limited idea about hazards of pesticide. Improper dose estimation was prevalent in many farmers. Most of the respondents had not received any training on insect management and no one had practiced IPM methods in their field. Knowledge about IPM and its adoption in field is found very negligible hence FFS should be conducted and demonstration trial should be conducted in farmers’ field with their active participation.

Information systems should contribute to enterprise effectiveness, and usually do so during the operational phase of their lifecycle. From the experience of practitioners, the duration of this lifecycle is often not predetermined, therefore resulting in information systems with a relatively long lifespan and information systems with a relatively short lifespan. An important aspect of application management, is managing the application lifecycle. In the experience of practitioners, deciding the moment to end the lifecycle, refactor it, or leave it be are often not thoroughly researched. The decision to move on to a newer information system is therefore not always sufficiently justified and relies more on a gut feeling. What if the older information system is still able to perform and comply with the changes the enterprise desires? Prolonging the length of an application lifecycle could result in cost reduction in an application portfolio. In this paper, we aim to create a method of assessment of the ability to change of a legacy information system and identifying potential areas in which a legacy information system would need improvement in order to increase this ability to change.

In light of new digital opportunities, enterprises require modernization also with regard to intra-organizational business and IT management. Enterprise Service Management (ESM) is an organizational capability aimed at a more efficient and effective IT and business service management in organizations. Although ESM has been recognized as an approach to improve customer and employee satisfaction and to create digital competitive advantage, there is a methodological and analytical void for organizations in how to measure their ESM capability. Motivated by this lack of measurability and tangibility, we aim to empirically validate the ESM capability model. Our contribution to this paper is empirical, as we provide a measurable instrument for further ESM studies. We aim to initiate a broader debate on ESM and thereby add to the scholarly establishment of the concept in the Information Systems and IT Management literature. Practically, we contribute by offering companies a validated and actionable set of ESM characteristics.

Protection motivation theory (PMT) is one of the most commonly used theories to examine information security behaviors. Our systematic review of the application of PMT in information systems (IS) security and the comparison with its application for decades in psychology identified five categories of important issues that have not yet been examined in IS security research. Discussing these issues in terms of why they are relevant and important for IS security, and to what extent IS research has not considered them, offers new research opportunities associated with the study of PMT and IS security threats. We suggest how future studies can approach each of the open issues to provide a new road map for quantitative and qualitative IS scholars.

While the information systems scholarly and practice literatures both stress the importance of senior executive engagement with IT management, the recommendations for doing so remain, at best, limited and general. Examining the influence of serious IT-related deficiencies on CEO/CFO turnover within the post-SOX financial reporting context, specific CEO/CFO IT management responsibilities are identified: CEOs are shown to be held accountable for global IT management responsibilities, and CFOs are shown to be held accountable for demand-side IT management responsibilities. Implications for information systems research, management research, and information systems practice are provided.