A policy driven, human oriented information security model: a case study in UAE banking sector

This research paper presentation will feature current frameworks to addressing risk and security modeling and metrics. The paper will analyze technical level risk and security metrics of Common Criteria/ISO15408, Centre for Internet Security guidelines, NSA configuration guidelines and metrics used at this level. Information IT operational standards view on security metrics such as GMITS/ISO13335, ITIL/ITMS and architectural guidelines such as ISO7498-2 will be explained. Business process level standards such as ISO17799, COSO and CobiT will be presented with their control approach to security metrics. Top level, the maturity standards such as SSE-CMM/ISO21827, NSA Infosec Assessment and CobiT will be explored and reviewed. For each defined level of security metrics the research presentation will explore the appropriate usage of these standards. The paper will discuss standards approaches to conducting the risk and security metrics. The research findings will demonstrate the need for common baseline for both risk and security metrics. This paper will show the relation between the attribute based common baseline and corporate assets and controls for risk and security metrics. IT will be shown that such approach spans over all mentioned standards. The proposed approach 3D visual presentation and development of the Information Security Model will be analyzed and postulated. Presentation will clearly demonstrate the benefits of proposed attributes based approach and defined risk and security space for modeling and measuring.

INTRODUCTION Today, in large part, information security is the implementation of controls and best practices suggested by consultants, standard governing bodies (i.e. National Institute of Standards & Technology) (NIST), International Organization for Standardization / International Electrotechnical Commission (ISO/IEC), etc.), the organization's information security department and, sometimes, the organization's employees. While the use of global standards of practice, top management and the information security department within the organization to guide information security planning and implementations may be useful, existing research consistently shows a positive relationship exists between user involvement in planning and the effectiveness of the information systems function within organizations (Gottschalk, 1999; Sambamurthy et al., 1994; Segars & Grover, 1998). A deliverable of the information security planning process is the organization's information security policies and procedures. Standard governing bodies (NIST, ISO/IEC) and researchers (Bidgoli, 2003; Garrison & Posey, 2006) stress the importance of creating information security policies and provide guidance on the different types of information security policies that an organization may need. This research attempts to examine the impact of end-user involvement and formalized information security policies on the effectiveness of the information security function within organizations. Specifically, this study focuses on two antecedent variables, collaborative exchange and formalization, and how it impacts the effective utilization of the information security strategies of deterrence, detection and recovery. Collaborative exchange is an assessment of the extent of collaboration between upper-level management, end users and the information security function. Formalization is an assessment of the extent of established formal information security policies within an organization. The purpose of this research is twofold. First, this research aims to examine the individual effects of formalization and collaborative exchange on the effectiveness of information security detection, deterrence, and recovery activities. Much of the effort expended in the management of information security is in developing and enforcing information security policies. By examining formalization separately, the impact of information security policy development on effective utilization of information security strategies can be assessed. The second aim of this research is to examine the impact of collaborative exchange and formalization in concert on the effectiveness of information security detection, deterrence, and recovery activities. Evaluating complementary effect of collaborative exchange and formalization on effective utilization of information security strategies provides evidence supporting the importance of establishing information security policies with input and effort from all major constituencies within the organization. This study makes several contributions to the literature and practice. First, this research provides insight into how management choices in regards to establishing formal communication channels and developing information security policies may impact the effectiveness of the information security function. Second, the presence of the dependent variable, effectiveness of detection, deterrence and recovery activities, gives academics and practitioners a success measure which can guide more effective decision making in the information security domain. The remainder of this manuscript is organized as follows. The next section discusses the literature supporting the constructs of interest in this study. The following two sections will present the methodological approach taken in this study and the results of data collection. The next section will present the efforts in data analysis. The last section will present a discussion of the important findings and limitations of this research. …

The article addresses the problem of the discrepancy between declared information security policies, the requirements of standards and protocols, and the actual functioning of organizational information infrastructures. In practice, components of comprehensive information security systems (CISS) are often developed formally, without considering real risks, characteristics of network protocols, or compliance with international and national security standards. As a result, information security policies are not aligned with technical configuration parameters, leading to fragmentation of protection mechanisms and a decrease in overall system effectiveness. Another critical issue is the continued use of outdated or insecure protocols that remain operational due to the absence of systematic compliance control mechanisms. This study proposes a method for integrating information security policies, standard requirements (ISO/IEC 27001:2022, NIST SP 800-53, Ukrainian ND TZI), and secure network protocols (TLS 1.3, SSHv2, DNSSEC, IPSec) into the process of developing a comprehensive information security system. The method consists of four stages: asset and protocol analysis, development and formalization of security policies, compliance mapping with standards, and construction of an integrated CISS architecture based on the obtained results. To quantitatively assess the consistency of CISS components, a compliance scoring algorithm is introduced, enabling objective evaluation of the information infrastructure’s conformity with regulatory requirements and internal policies. Experimental validation of the method in a test environment demonstrated an increase in compliance with standards from 52% to 92%, the elimination of outdated or insecure protocols (FTP, SMB1, HTTP), and improved accuracy of CISS parameterization due to automated mapping of policies to technical security mechanisms. The obtained results confirm the feasibility and effectiveness of the proposed method for designing and modernizing CISS in organizations of various types. The purpose of this study is to develop a method for integrating information security policies, standards, and protocols into the formation of a comprehensive information security system within an organization.

Managing Security Clearances within Government Institutions

Purpose of the study: development of the theoretical foundations of information security through sound systematization, methods and means of information security based on the concept of interoperability. Methods of research: analysis of information interaction and threats in information interaction based on a standardized reference model of interoperability and synthesis of a systematic structured model of information security methods and tools in the context of the concept of interoperability. Result's: based on the analysis of scientific areas of interoperability and information security, it is proposed to supplement the field of interests of information security with a semantic level, in accordance with the reference model of interoperability. The analysis of information security threats to the object of protection implemented at the semantic level of information interaction has been performed. In the course of research, the need for information security at the semantic level has been proved to ensure the completeness of information interaction protection and to satisfy the interests of the information protection object. An information model for the development and implementation of information security methods is proposed to help achieve the objectives of the object of protection. A model of information security based on a reference model of interoperability is proposed. A model of information security audit and risk assessment based on a reference model of interoperability is proposed. Scientific novelty: It consists in a new approach to systematization of methods, means and increasing the sphere of interests of information security based on modern scientific ideas about the levels of information interaction in accordance with the concept of interoperability.

A multifaceted evaluation of the reference model of information assurance & security

Information systems user security: A structured model of the knowing–doing gap

The article deals with the principles of creating a special theory of administrative and legal regulation of information security, analyzes the process of its analogy with physical laws, analyzes the threats and dangers to interests and all information security that affect the process of modeling, determines the principles of constructing and researching models of information security of social systems.It was noted that the administrative and legal regulation of information secu- rity is due to the need for state management of the processes of formation and use of information resources, the creation and application of information systems and the provision of information security of social systems. It is proved that to a large extent information security is caused by the need for administrative regulation of information relations in various spheres that form the system itself and maintain its integrity. It is determined that the administrative and legal basis of information security of social systems should provide an ideal state of activity of subjects, system and its models. Selected concrete administrative and legal principles of information security, such as physical formulas, create its model. Of course, for each social system, the model of information security is individual. However, there are also general patterns of modeling, for example — the construction of the model should be based on the simple and optimal (as we are referred to by the flow of light), administrative and legal principles.It is proved that high rates of development of information technologies, create new requirements to the sphere of security in general and to information security in particular. The reform of the legislation regulating activity in the field of infor- mation security should be based on the proper scientific theory. What is urgent is the need to create a General Security Theory, which would explain and regulate the set of processes of ensuring the safety of society.

The article deals with the principles of creating a special theory of administrative and legal regulation of information security, analyzes the process of its analogy with physical laws, analyzes the threats and dangers to interests and all information security that affect the process of modeling, determines the principles of constructing and researching models of information security of social systems. It was noted that the administrative and legal regulation of information security is due to the need for state management of the processes of formation and use of information resources, the creation and application of information systems and the provision of information security of social systems. It is proved that to a large extent information security is caused by the need for administrative regulation of information relations in various spheres that form the system itself and maintain its integrity. It is determined that the administrative and legal basis of information security of social systems should provide an ideal state of activity of subjects, system and its models. Selected concrete administrative and legal principles of information security, such as physical formulas, create its model. Of course, for each social system, the model of information security is individual. However, there are also general patterns of modeling, for example — the construction of the model should be based on the simple and optimal (as we are referred to by the flow of light), administrative and legal principles. It is proved that high rates of development of information technologies, create new requirements to the sphere of security in general and to information security in particular. The reform of the legislation regulating activity in the field of information security should be based on the proper scientific theory. What is urgent is the need to create a General Security Theory, which would explain and regulate the set of processes of ensuring the safety of society.

Aim/Purpose: This paper examines the behavior of financial firm employees with regard to information security procedures instituted within their organization. Furthermore, the effect of information security awareness and its importance within a firm is explored. Background: The study focuses on employees’ attitude toward compliance with information security policies (ISP), combined with various norms and personal abilities. Methodology: A self-reported questionnaire was distributed among 202 employees of a large financial Corporation Contribution: As far as we know, this is the first paper to thoroughly explore employees’ awareness of information system procedures, among financial organizations in Israel, and also the first to develop operative recommendations for these organizations aimed at increasing ISP compliance behavior. The main contribution of this study is that it investigates compliance with information security practices among employees of a defined financial corporation operating under rigid regulatory governance, confidentiality and privacy of data, and stringent requirements for compliance with information security procedures. Findings: Our results indicate that employees’ attitudes, normative beliefs and personal capabilities to comply with firm’s ISP, have positive effects on the firm’s ISP compliance. Also, employees’ general awareness of IS, as well as awareness to ISP within the firm, positively affect employees’ ISP compliance. Recommendations for Practitioners: This study can help information security managers identify the motivating factors for employee behavior to maintain information security procedures, properly channel information security resources, and manage appropriate information security behavior. Recommendation for Researchers: Researchers can see that corporate rewards and sanctions have significant effects on employee security behavior, but other motivational factors also reinforce the ISP’s compliance behavior. Distinguishing between types of corporations and organizations is essential to understanding employee compliance with information security procedures. Impact on Society: This study offers another level of understanding of employee behavior with regard to information security in organizations and comprises a significant contribution to the growing knowledge in this area. The research results form an important basis for IS policymakers, culture designers, managers, and those directly responsible for IS in the organization. Future Research: Future work should sample employees from another type of corporation from other fields and should apply qualitative analysis to explore other aspects of behavioral patterns related to the subject matter.

Information security and privacy training and awareness are challenges in every organization. Most people do not like to participate in training. Ensuring that employees understand their responsibilities for protecting information is vital to an organization's success and is required by law for many industries and jurisdictions. Helping employees understand how to identify and report fraud is especially important in today's business climate. A fraud awareness and training program must support an organization's business environment, be integrated within the information security program and policies, and meet applicable regulatory requirements. Personnel must be motivated to learn how to identify and report fraud by tangible and specific rewards and penalties to support an organization's fraud prevention efforts. Fraud prevention training must become part of the job appraisal process to build a truly effective fraud prevention education program. Corporate leaders must not only ensure compliance with regulatory issues but also effectively communicate fraud prevention policy and regulatory issues to the organization. Organizations cannot have a successful awareness and training program if personnel do not understand the impacts and consequences of noncompliance.

The key threat to information security is constituted by careless employees who do not comply with information security policies. To ensure that employees comply with organizations’ information security procedures, a number of information security policy compliance measures have been proposed in the past. Prior research has criticized these measures as lacking theoretically and empirically grounded principles to ensure that employees comply with information security policies. To fill this gap in research, this paper advances a new model that explains employees’ adherence to information security policies. In this model, we extend the Protection Motivation Theory (PMT) by integrating the General Deterrence Theory (GDT) and the Theory of Reasoned Action (TRA) with PMT. To test this model, we collected data (N = 917) from four different companies. The results show that threat appraisal, self-efficacy and response efficacy have a significant impact on intention to comply with information security policies. Sanctions have a significant impact on actual compliance with information security policies. Intention to comply with information security policies also has a significant impact on actual compliance with information security policies.KeywordsInformation SecuritySecurity PolicyActual ComplianceResponse EfficacyThreat AppraisalThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Despite increasing investment in information security and its strategic role in today’s business success, effective implementation of information security strategies still remains one of the top challenges facing global organizations. This study investigated Information Security Policy compliance of staff members of a municipality in South Africa. Factors such as information security policy, security policy strategic planning, policy implementation and compliance were considered. A questionnaire was distributed to 80 staff members from different sections in this municipality and a response rate of 100% was achieved. The study findings showed that the majority of employees are largely in support of the municipality’s efforts to develop and implement a security policy framework. They also concur that compliance to security policy safeguards and prevents intrusion information, theft and "denial of service". Among other issues, it is recommended that more training and awareness campaigns should be done to all employees in order to improve security of information in this municipality. The study results can be limited by the small number of the population as indicated that the sample was equal to the population (N=n).

"This book offers insightful articles on the most salient contemporary issues of managing social and human aspects of information security" - Provided by publisher

With increasing dependence on information technology and information system, enterprises are confronting with a more and more complicated information security environment. Thus, information security has become an intractable problem for many enterprises. Generally speaking, there are two methods to improve enterprises’ information security level, that is, technology and management means. Technology means mainly settle software and hardware security of computers and networks, while management means mainly regulate and restrain the entire enterprise system including software, hardware, and employees. At present, a lot of enterprises mostly employ the technology means to solve information security problems. However, the lack or imperfection of information security institutions leads to bad enterprise information security situation. Therefore, technology and management means to solve information security are complementary to each other. As such, it is urgent and necessary to establish and improve information security institutions for many enterprises. In fact, enterprise information security is a complicated activity which needs different sectors to get involved in. More specifically, the information security departments play the very critical role in the implementation of information security institutions, and all employees should comply with the information security policy. Therefore, only the top management teams have the ability to coordinate the relationship between different departments, determine the introduction of information technology, and deploy the information systems. In response, top management support has an important impact on the construct of information security institutions and the effectiveness of information security management. So far, few studies have investigated the mechanism that how top management support affects information security legitimation, and legitimation information security management. Therefore, it has great theoretical and practical significance to the exploration of whether the legitimation supported by top management can improve the effectiveness of information security management. The objective of the current study is to explore whether legitimation prompted by top management team can improve the effectiveness of enterprise information security management. By doing so, the data was collected from the enterprises which have passed the certification of information security management system, and analyzed by using PLS-SEM. The results indicate that information security awareness can improve top management support（including top management belief and top management participation）and the effectiveness of information security management respectively. In addition, top management belief can improve implementation（the first stage of legitimation）and internalization（the second stage of legitimation）. Moreover, implementation can improve the effectiveness of information security management. This paper analyzes the way to enhance effectiveness of information security management, which has a reality-oriented meaning for prompting information security management of enterprises from the standpoint of institution.