An Ontology-Based Approach for Zero-Day Information Security Threat Management

IS professionals’ information security behaviors in Chinese IT organizations for information security protection

Self-efficacy in information security: Its influence on end users' information security practice behavior

A large variety of financial instruments has emerged to allow hedging of risks associated with the underlying assets, whether it is a commodity, weather or economic indicators. However, in the information security domain, cyber-insurance products are the only financial instrument available to hedge the information security risk. Furthermore, cyber-insurance markets are unable or unwilling to accept the high probability and/or high-intensity risks. Thus, there is a need for new financial instruments and a market mechanism to facilitate risk hedging in the information security domain. This article explains the limitations of cyber-insurance market and presents a novel financial instrument and a corresponding trading mechanism to address the problems in the cyber-insurance market. The proposed instrument and trading mechanism can be implemented in an information security prediction market to facilitate the hedging of the risk associated with the underlying information security event or condition. Furthermore, the article demonstrates the application of the proposed financial instrument in an imaginary scenario. Lastly, the article presents an evaluation of the proposed financial instrument and corresponding trading mechanism in hedging the underlying risk. In our analysis, we found that the proposed financial instrument can be a solution, at least to some extent, to the problems in the existing risk hedging mechanisms available in the information security domain.

INTRODUCTION Today, in large part, information security is the implementation of controls and best practices suggested by consultants, standard governing bodies (i.e. National Institute of Standards & Technology) (NIST), International Organization for Standardization / International Electrotechnical Commission (ISO/IEC), etc.), the organization's information security department and, sometimes, the organization's employees. While the use of global standards of practice, top management and the information security department within the organization to guide information security planning and implementations may be useful, existing research consistently shows a positive relationship exists between user involvement in planning and the effectiveness of the information systems function within organizations (Gottschalk, 1999; Sambamurthy et al., 1994; Segars & Grover, 1998). A deliverable of the information security planning process is the organization's information security policies and procedures. Standard governing bodies (NIST, ISO/IEC) and researchers (Bidgoli, 2003; Garrison & Posey, 2006) stress the importance of creating information security policies and provide guidance on the different types of information security policies that an organization may need. This research attempts to examine the impact of end-user involvement and formalized information security policies on the effectiveness of the information security function within organizations. Specifically, this study focuses on two antecedent variables, collaborative exchange and formalization, and how it impacts the effective utilization of the information security strategies of deterrence, detection and recovery. Collaborative exchange is an assessment of the extent of collaboration between upper-level management, end users and the information security function. Formalization is an assessment of the extent of established formal information security policies within an organization. The purpose of this research is twofold. First, this research aims to examine the individual effects of formalization and collaborative exchange on the effectiveness of information security detection, deterrence, and recovery activities. Much of the effort expended in the management of information security is in developing and enforcing information security policies. By examining formalization separately, the impact of information security policy development on effective utilization of information security strategies can be assessed. The second aim of this research is to examine the impact of collaborative exchange and formalization in concert on the effectiveness of information security detection, deterrence, and recovery activities. Evaluating complementary effect of collaborative exchange and formalization on effective utilization of information security strategies provides evidence supporting the importance of establishing information security policies with input and effort from all major constituencies within the organization. This study makes several contributions to the literature and practice. First, this research provides insight into how management choices in regards to establishing formal communication channels and developing information security policies may impact the effectiveness of the information security function. Second, the presence of the dependent variable, effectiveness of detection, deterrence and recovery activities, gives academics and practitioners a success measure which can guide more effective decision making in the information security domain. The remainder of this manuscript is organized as follows. The next section discusses the literature supporting the constructs of interest in this study. The following two sections will present the methodological approach taken in this study and the results of data collection. The next section will present the efforts in data analysis. The last section will present a discussion of the important findings and limitations of this research. …

When looking for qualified specialists in the field of IT and information security employers give preferences to candidates with professional certificates from reliable and worldwide recognized organisations. Attracting certified professionals allows the company to make the most efficient use of its staff and thereby increase its competitiveness. For qualified specialist, the certificate is a guarantee of his competence and the basis of confidence in a successful professional career. Today, the market of IT and information security professional certification offers both certification programs from well-known software or hardware manufacturers, as well as vendor-neutral certifications, developed by expert organizations in this field and not related to the products of individual manufacturers. Vendor-neutral certification programs provide a comprehensive approach to information security and ensure that certified specialists acquire understanding of technical and managerial aspects of information protection, as well as possess a wide range of diverse knowledge and practical skills. The article researches the most popular and demanded on the market certification courses in information security from (ISC)2, ISACA, EC-Council and CompTIA. The authors found that reviewed certifications have the following common features: short training period of the certification programs, usually 5-7 days; joining both basic and specialized components within the courses; the use of well-known and mostly open hardware and software during training; combining various forms and methods of training: face-to-face and distance learning with an instructor, self-study, online tests and special learning platforms; conducting a comprehensive exam with the issuance of a certificate; three-year validity period of the certificate which must be confirmed through participation in scientific and practical activities in the specialty. The study of international certification for information security specialists in Ukraine showed that there are several companies-authorized providers of certification services: ISSP Training Center, Fast Lane Group, Kyiv Chapter of ISACA, PwC Ukraine, which certify information security professionals through vendor-neutral courses, as well as certification programs of software and hardware developers.

Information security technology is an essential component for protecting public and private computing infrastructures. With the widespread utilization of information technology applications, organizations are becoming more aware of the security threats to their resources. No matter how strict the security policies and mechanisms are, more organizations are becoming susceptible to a wide range of security breaches against their electronic resources. Network‐intrusion detection is an essential defense mechanism against security threats, which have been increasing in rate lately. It is defined as a special form of cyber threat analysis to identify malicious actions that could affect the integrity, confidentiality, and availability of information resources. Data mining‐based intrusion‐detection mechanisms are extremely useful in discovering security breaches. This article will provide an overview of the applications of data mining techniques in the information security domain. The focus will be on applying data mining to intrusion detection and intrusion prevention. This article will present a critical overview of the research directions in these fields, which will help researchers identify the key practical and research issues essential for building a successful network‐protection system. WIREs Comp Stat 2011 3 221–229 DOI: 10.1002/wics.161This article is categorized under: Statistical and Graphical Methods of Data Analysis > Data Reduction, Smoothing, and Filtering Algorithms and Computational Methods > Networks and Security Statistical Learning and Exploratory Methods of the Data Sciences > Text Mining

Knowledge sharing is an important component of knowledge management systems. Security knowledge sharing substantially reduces risk and investment in information security. Despite the importance of information security, little research based on knowledge sharing has focused on the security profession. Therefore, this study analyses key factors, containing attitude, self-efficacy, personal outcome expectation, and facilitating condition, in respect of the information security workers intention to share knowledge. Information security professionals in virtual communities, including the Information Security Professional Association (ISPA), Information Systems Security Association (ISSA), Society of Information Risk Analysts (SIRA), and LinkedIn security groups, were surveyed to test the proposed research model. Confirmatory factor analysis (CFA) and the structural equation modelling (SEM) technique were used to analyse the data and evaluate the research model. The results showed that the research model fit the data well and the structural model suggests a strong relationship between attitude and knowledge sharing intention. Hypotheses regarding the influence of self-efficacy and personal outcome expectation, to knowledge sharing attitude were upheld. Facilitating condition showed significant influences on moderating between attitude and intention.

Information Security Management System (ISMS) implementation in Institution is an effort to minimize information security risks and threats such as information leakage, application damage, data loss and declining IT network performance. The several incidents related to information security have occurred in the implementation of the Academic System application in Indonesian higher education. This research was conducted to determine the maturity level of information security practices in Academic Information Systems at universities in Indonesia. The number of universities used as research samples were 35 institutions. Compliance with the application of ISO 27001:2013 standard is used as a reference to determine the maturity level of information system security practices. Meanwhile, to measure and calculate the level of maturity using the SSE-CMM model. In this research, the Information System Security Index obtained from the analysis results can be used as a tool to measure the maturity of information security that has been applied. There are six key areas examined in this study, namely the role and importance of ICT, information security governance, information security risk management, information security management framework, information asset management, and information security technology. The results showed the level of information security maturity at 35 universities was at level 2 Managed Process and level 3 Established Process. The composition is that 40% of universities are at level 3, and 60% are out of level 3. The value of the gap between the value of the current maturity level and the expected level of maturity is varied for each clause (domain). The smallest gap (1 level) is in clause A5: Information Security Policy, clause A9: Access Control, and clause A11: Physical and environmental security. The biggest gap (4 levels) is in clause A14: System acquisition, development and maintenance and clause A18: compliance.  Â

Devising a successful risk mitigation plan requires estimation of risk and loss impact. However, the information security industry suffers from the problem of information asymmetry, thus leading to not-so correct estimates for risk and loss impact. Prediction markets have been found to be highly effective in the prediction of future events in several domains such as politics, sports, governance, and so on. Also, many organizations such as Google, General Electric, Hewlett Packard, and others have used prediction markets to forecast various business management issues. Based on the application of prediction markets in other domains and various types of financial markets discussed in the literature, such as macro-markets, weather derivatives and economic derivative markets, we hypothesize that: (i) a well-designed prediction market can be used for risk estimation and estimation of loss impact in information security domain. This will help the decision makers in adopting appropriate risk mitigation strategy; (ii) Prediction markets can further be useful in hedging information security risks by allowing trading of financial instruments linked to the risk of information security events. In this paper, we explore the possibility of information security market where financial and insurance-linked instruments can be traded to facilitate the mitigation of a substantial proportion (if not all) of the information security risk. We present the key design issues relevant to the market for trading of information security related financial instruments. Further, we present a risk assessment of such a market’s relevance to its usefulness in hedging information security risks.KeywordsInformation SecurityMarket ParticipantHedge FundPrediction MarketWeather DerivativeThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

PurposeThis investigation serves a dual purpose: providing preliminary results and serving as a pilot study to confirm the viability of the hypotheses advanced towards a full-scale study. This paper aims to present the preliminary findings of an investigation that explored the constructs of personality traits and situational crime prevention theory (SCPT) as antecedents to social cognitive determinants (attitude, perceived behavioural control and subjective norms using the theory of planned behaviour [TPB] framing) and how these elements subsequently estimate compliant information security behaviour. Moreover, this paper delves into the contrasting influences of light and dark personality traits on insider information security compliance.Design/methodology/approachA cross-sectional survey was conducted to study SCPT measures and the personality factors dyad using a diverse but limited sample (n = 82).FindingsThere were ten significant direct relationships between SCPT factors and personality traits related to the components of the TPB. Seventeen hypotheses were not supported. However, these findings highlight the complexity of the topic under study.Practical implicationsUnderstanding individual differences within the compliance model could be used for custom training protocols, employee selection, assignment and specific types of information security interventions.Originality/valueThere is a scarcity of studies considering the effects of situational and personality factors, specifically the dark versus light triad of personality traits within the information security domain. Therefore, this preliminary result provides early insight that could guide further studies. This research could have important implications for organisations at risk of insider attacks.

The security problem of the Internet of things (IOT) system has caused high attention in the information security (IS) industry. This paper studies the IS of the IOT based on perception and interaction technology. In the research, we put forward an IS protection method of the IOT based on the perception and interaction technology, and tested the method and the traditional IS protection method on the industrial IS attack and defense drill platform respectively. The test results show that the response time of the IOT IS measures based on perception and interaction technology proposed in this paper is 27 μs, while the traditional method needs 83 μs. From the perspective of false positive rate (FPR) and false negative rate (FNR), there are obvious differences between them. The FPR and FNR of the traditional method are 12.7% and 7.9% respectively, and the FPR and FNR of the method in this paper are 5.4% and 3.1%. The test results show that the IOT IS protection means based on perception and interaction technology can effectively ensure the IS of the IOT.

One of the major problems concerning information security is malicious code. To evade detection, malware (unwanted malicious piece of code) is packed, encrypted, and obfuscated to produce variants that continue to plague properly defended and patched systems and networks with zero day exploits. Zero day exploits are used by the attackers to compromise victims computer before the developer of the target software knows about the vulnerability.

Prediction Markets are the markets designed and operated to mine and aggregate the information scattered among the traders. Recently, some researchers have started exploring the application of prediction markets in the information security domain. The information security prediction market will facilitate trading of contracts to hedge the financial impact of the risks associated with the underlying information security events, such as discovery of a vulnerability in a piece of software. However, prediction markets differ in their objectives and requirements, and therefore information security prediction markets need to be carefully engineered to meet the specific requirements. The contribution of this paper is the identification of a set of design requirements for an information security prediction market, and associated performance criteria. We present five categories of design requirements: Contracts, Trading Process, Participants and Incentives, Clearing House, and Market Management for the information security prediction market. Furthermore, we present six performance measures: Information Elicitation, Transparency, Efficiency, Transaction Cost, Liquidity, and Manipulation Resistance for the performance assessment of information security prediction market.

Information security products have evolved rapidly over the last decade. However, the science of evaluating products has virtually stood still during that same time period, creating a knowledge gap that has made it difficult for information security buyers to determine whether or not a product meets specific security and/or compliance needs. This paper discusses a new method for evaluating technology products based upon the appropriateness within the context that they will be deployed. By applying a Use Case-based methodology, information security professionals can more clearly identify detailed protection requirements for a given environment. Two examples are given: (1) Use Cases can clarify different application security requirements between retail storefronts and back-end e-commerce datacenters; and (2) Use Cases allow the assessment of anti-malware products based on the relative importance of different malware attack vectors to the endpoints being protected.

Information Security Awareness, though known as a primary and important issue in the domain of Information Security, CSI computer crime and security survey showed poor security awareness training in public and private sectors. In many studies, the authors have found that the usage of knowledge maps helps the process of learning and conception building. Therefore, the authors have tried to figure out if the implementation of knowledge maps on the training materials of Information Security Awareness will improve the learning performance. Based on the e-learning materials for E-Mail Information Security Awareness, the authors designed them in the format of knowledge maps and compared the learning performance with common browsing-based materials. The results showed the knowledge map-based materials lead to higher learning performance than browse-based ones.