Better information security management in municipalities

The article justifies the imperatives of applying the situational approach to information security management (ISM). We modified the model of the Information Security Management System (ISMS), which is the basis of ISO/IEC 27005: 2011: we added the “Decision Making” stage after the “Determining the main criteria” step. The solution is to choose an approach to proccesing information security risks — their assessment, impact and taking — based on certain criteria. Using the developed algorithm, we implemented a cognitive software module of the information system management (ISM) in an educational institution. The use of the cognitive software module has significantly reduced the labor costs of specialists in the Information Security (IS) Department, including automation of the reporting procedures. The application of the situational approach allowed us to integrate a person into the automated system to ensure the cybersecurity of the educational sector.

This paper presents an ongoing case study into stakeholder perceptions regarding information security management systems in emergent organisations operating in Western Australia. It takes a socio-political perspective on the problem of how to manage simultaneously virtual collaboration and information security management. A literature review introduces the context and history of the research. In light of this, it is proposed that social and political issues need to be researched and addressed before many of the existing technological strategies for information security will succeed. The research project is then outlined and the design and preliminary results presented. The results point to a lack of clarity and cohesion amongst stakeholders about how their information security management systems operate and who has ownership of the security function. This emerging trend is discussed and the plans for future research explained.

In the wave of the progressive informatization process, Korean enterprises are making a vast amount and range of investments in the information security sector in order to counter the information dysfunction. In addition, to achieve an objective evaluation thereon, they have been increasingly exhibiting a preference for a certification system of information security management, as developed by the government This study aims to reduce the possible trials and errors while promoting the establishment and certification of the information security management system by enterprises. To satisfy this purpose, this study presents the defects by item found during the certification process of the information security management system of a number of enterprises. By analyzing the derived defects, we have outlined the issues to be attended to among enterprises at each stage of the establishment of an information security management system. The study also presents a reference model for conducting a self check, so that companies may be able to self-verify the completeness of their establishment of the information security management system. Through the results of this study, enterprises will be able to self-verify their completeness levels when promoting the establishment and certification of the information security management system, and improve the efficiency and effectiveness thereof so as to raise the general level and awareness among enterprises of the importance of information security.

With increasing dependence on information technology and information system, enterprises are confronting with a more and more complicated information security environment. Thus, information security has become an intractable problem for many enterprises. Generally speaking, there are two methods to improve enterprises’ information security level, that is, technology and management means. Technology means mainly settle software and hardware security of computers and networks, while management means mainly regulate and restrain the entire enterprise system including software, hardware, and employees. At present, a lot of enterprises mostly employ the technology means to solve information security problems. However, the lack or imperfection of information security institutions leads to bad enterprise information security situation. Therefore, technology and management means to solve information security are complementary to each other. As such, it is urgent and necessary to establish and improve information security institutions for many enterprises. In fact, enterprise information security is a complicated activity which needs different sectors to get involved in. More specifically, the information security departments play the very critical role in the implementation of information security institutions, and all employees should comply with the information security policy. Therefore, only the top management teams have the ability to coordinate the relationship between different departments, determine the introduction of information technology, and deploy the information systems. In response, top management support has an important impact on the construct of information security institutions and the effectiveness of information security management. So far, few studies have investigated the mechanism that how top management support affects information security legitimation, and legitimation information security management. Therefore, it has great theoretical and practical significance to the exploration of whether the legitimation supported by top management can improve the effectiveness of information security management. The objective of the current study is to explore whether legitimation prompted by top management team can improve the effectiveness of enterprise information security management. By doing so, the data was collected from the enterprises which have passed the certification of information security management system, and analyzed by using PLS-SEM. The results indicate that information security awareness can improve top management support（including top management belief and top management participation）and the effectiveness of information security management respectively. In addition, top management belief can improve implementation（the first stage of legitimation）and internalization（the second stage of legitimation）. Moreover, implementation can improve the effectiveness of information security management. This paper analyzes the way to enhance effectiveness of information security management, which has a reality-oriented meaning for prompting information security management of enterprises from the standpoint of institution.

Tighter regulatory demands and higher customer expectations regarding the protection of information force enterprises to systematically ensure confidentiality, integrity and availability of stored information and processing facilities. Information Security Management Systems (ISMSs) are used to address these challenges. Recent studies show that the majority of companies plans to establish at least basic information security management to prepare for future developments. Larger enterprises have already embraced ISMSs, whereas small and medium-sized enterprises (SMEs) are catching up and require support in defining, introducing and operating them. We developed ADAMANT, an SME-friendly tool that supports continuous information security management incorporating stakeholders of different domains. In this paper, we evaluated our approach to introduce an ISMS in SMEs using an introductory information security training. The evaluation shows that our tool improves critical information security management tasks. Furthermore, integrating ADAMANT in customized security trainings allows companies to directly use training results to implement an ISMS.

News about various information security attacks against companies appears almost every day. The sources of these attacks vary from cyber-criminals who want to steal companies’ data to demand a ransom, to current or former employees who want to create damage to the organization. The best way to defend organizational critical assets is to implement an Information Security Management System that secures all sensitive assets from confidentiality, availability and integrity perspective. An Information Security Management System offers top management a framework for sensitive information flow control. This framework includes with a risk assessment that considers the security threats and vulnerabilities of the company’s assets. Companies usually implement Information Security Management System only after they have a functional quality management system, which brings clarity and optimization to the company’s processes. Current approaches on creation and implementation of effective Information Security Management System are very theoretical and thus difficult to use in practice. The main objective of this paper is to present an Information Security Management System implementation method in the case of a small company by defining the basic steps in achieving a fully functional Information Security Management System. The proposed methodology considers the top management Information Security Management System objectives, organizational context, risks assessment and third parties expectations fulfillment.

This paper proposes an organizational management model for implementing the Information Security Management System (ISMS) Plan, Do, check and Act (PDCA) framework to achieve an improved balance between the effectiveness and efficiency of an organizations ISMS. Specifically describing the role of managerial structure and organizational structure in realizing the ISMS framework. Demonstrating the drawbacks in organizational structure that were reduced and the enhanced workflow within the organization due to the improved managerial role distinction regarding information security management. Projecting the effects of the proposed parallel loosely coupled approach when managing an ISMS related project within an organization.

This study examines the effect of an Information Security Management System (ISMS) on organizational performance in a Small and Medium Business (SMB), with a focus on Red Mango Ltd. The study employed a correlational survey design to assess the relationship between ISMS implementation and organizational performance. Primary data was collected from 44 respondents, including management and staff, through structured questionnaires. The convenience sampling technique was used for respondent selection, and data analysis was conducted using the Statistical Package for Social Sciences (SPSS) version 25. Correlation and regression analyses were applied to determine the relationship and effect of ISMS on organizational performance. Findings revealed that ISMS is well-implemented at Red Mango Ltd, with clear policies, structured roles and responsibilities, and comprehensive employee training on security measures. Employees are well-informed about acceptable usage of information security systems, and security incidents are promptly reported. However, several challenges hinder ISMS implementation, including leadership issues, technical system difficulties, personnel constraints, and financial limitations. Despite these challenges, ISMS adoption has led to significant benefits, including regulatory compliance, optimized business processes, cost savings, improved information security awareness, enhanced company reputation, and increased productivity. The study further established a strong positive correlation between ISMS implementation and organizational performance at Red Mango Ltd. Regression analysis indicated that a unit increase in ISMS adoption results in a 0.495 increase in organizational performance, confirming its significant impact. The study concludes that effective ISMS implementation enhances security, improves operational efficiency, and contributes to overall business success. Organizations are encouraged to address implementation challenges through leadership commitment, technical capacity building, and financial investment to fully realize ISMS benefits.

In developing standards and guidelines required by the Federal Information Security Management Act (FISMA), NIST consults with other federal agencies and offices as well as the private sector to improve information security, avoid unnecessary and costly duplication of effort, and ensure that NIST standards and guidelines are complementary with standards and guidelines employed for the protection of national security systems. In addition to its comprehensive public review and vetting process, NIST is working with the Office of the Director of National Intelligence (ODNI), the Department of Defense (DOD), and the Committee on National Security Systems (CNSS) to establish a common foundation for information security across the federal government. The common foundation for information security will provide the Intelligence, Defense, and Civil sectors of the federal government and their support contractors, more uniform and consistent ways to manage the risk to organizational operations, organizational assets, individuals, other organizations, and the Nation that results from the operation and use of information systems. In another collaboration initiative, NIST is working with public and private sector entities to establish specific mappings and relationships between the security standards and guidelines developed by NIST and the International Organization for Standardization and International Electrotechnical Commission (ISO/IEC) 27001, Information Security Management System (ISMS). NIST Special Publication 800-53A is a companion publication to NIST Special Publication 800-53, not a replacement or update. Special Publication 800-53 remains the definitive NIST recommendation for employing security controls in federal information systems.

Özet Bu çalışmanın amacı, ISO 500’de yer alan kooperatiflerin web sitelerinin incelenerek sürdürülebilirlik çatısı altında sürdürülebilirliğin sosyal, ekonomik ve çevresel boyutlarına göre mevcut durumlarını ortaya koymaktır. Bu kapsamda, kooperatiflerin Kurumsal Sosyal Sorumluluk, ISO 9001 Kalite Yönetim Sistemi, ISO 14001 Çevre Yönetim Sistemi, ISO 27001 Bilgi Güvenliği Yönetim Sistemi, ISO 22000 Gıda Güvenliği Yönetim Sistemi, ISO 45001 İş Sağlığı ve Güvenliği Yönetim Sistemi, ISO 50001 Enerji Yönetim Sistemi sertifikasyon durumu incelenmiştir. Betimsel tarama modelinde olan araştırmada amaçlı örneklem yöntemiyle seçilen yedi kooperatifin web siteleri taranmıştır. Araştırmada içerik analizi yöntemlerinden yüzde ve frekans analizi kullanılmıştır ve veriler arasındaki korelasyon incelenmiştir. Analizler sonucunda sürdürülebilirlik kavramı kapsamında incelenen parametrelerle kooperatiflerin ISO 500 sıralaması arasında anlamlı bir ilişkinin olmadığı görülmektedir. Bununla birlikte kooperatiflerin tamamının sosyal sorumluluk projeleri yaptığı, %86’sının kalite (ISO 9001), %71’inin çevre (ISO 14001), iş sağlığı ve güvenliği (ISO 45001) ve gıda güvenliği (ISO 22000), %29’unun enerji güvenliği (ISO 50001) ve %14’ünün bilgi güvenliği (ISO 27001) yönetim sistemlerine sahip olduğu belirlenmiştir.

An Information Security Management System (ISMS) compliant with ISO/IEC 27001 requires the development and implementation of an effective system to guarantee the protection of information from threats. The aim of the study was to propose a set of indicators to measure the effectiveness of SZBI safeguards in manufacturing companies. A model for analysing the effectiveness of the SMS was built, which requires significant involvement of the company’s management. Systemic information security management produces the best results, as it involves treating as a whole all processes taking place in the organisation and is consistent with them. A way to measure the degree of information security was defined using indicator analysis and the application of key performance indicators (KPIs). The metrics addressed key areas such as malware protection, quality of passwords and authentication, updating systems and applications, data handling and training. The implementation of a set of indicators makes it possible to diagnose the security system currently in place and identify critical areas for improvement. The model and set of indicators presented in the study can be a helpful tool in maintaining an effective SMS and safeguarding the interests of manufacturing enterprises and their stakeholders.

Information Security Management System (ISMS) implementation in Institution is an effort to minimize information security risks and threats such as information leakage, application damage, data loss and declining IT network performance. The several incidents related to information security have occurred in the implementation of the Academic System application in Indonesian higher education. This research was conducted to determine the maturity level of information security practices in Academic Information Systems at universities in Indonesia. The number of universities used as research samples were 35 institutions. Compliance with the application of ISO 27001:2013 standard is used as a reference to determine the maturity level of information system security practices. Meanwhile, to measure and calculate the level of maturity using the SSE-CMM model. In this research, the Information System Security Index obtained from the analysis results can be used as a tool to measure the maturity of information security that has been applied. There are six key areas examined in this study, namely the role and importance of ICT, information security governance, information security risk management, information security management framework, information asset management, and information security technology. The results showed the level of information security maturity at 35 universities was at level 2 Managed Process and level 3 Established Process. The composition is that 40% of universities are at level 3, and 60% are out of level 3. The value of the gap between the value of the current maturity level and the expected level of maturity is varied for each clause (domain). The smallest gap (1 level) is in clause A5: Information Security Policy, clause A9: Access Control, and clause A11: Physical and environmental security. The biggest gap (4 levels) is in clause A14: System acquisition, development and maintenance and clause A18: compliance.  Â

The purpose of this study was to investigate and analyze the assumptions and requirements for the implementation of Information Security Management System (ISMS). Methodology: To check assumptions security management system implementation is the population of Tabriz hospitals. Review the requirements and assumptions are based on the standard ISO / IEC 27001, ISO / IEC 27002 test target setting and ISO 27001 standard questionnaire containing 33 questions in 11 control is used. The data were analyzed using descriptive and inferential statistical method that factors in the implementation of information security management system was confirmed. As well as to identify factors contributing to the implementation of information security management system and factor analysis, structural equation model was used PLS smart software that based on its findings to impact and indirect aspects of implementation effectiveness of the system. Results: Using the software, smart-PLS and using structural equation modeling confirmatory factor analysis was performed to measure the test of convergent validity, divergent validity, reliability Security and reliability of observable variables and quality test and measurement model of the 101 comments experts, all the prerequisites and requirements, including information security policy, the organization of information security, asset management, human resources in terms of security, physical and environmental security, communications and operations management, access control, use, development and maintenance, incident management information security, business continuity management and compliance with laws in secure level at %99 is forecast in Tabriz hospitals are effective information security management system. Conclusion: According to prioritize the factors affecting information security management system, operating (after) the most monitors and agents (after) the supply and implementation of information security management system least affected are in Tabriz hospitals.

Information security management, as defined in ISO 27001, deals with establishing, implementing, operating, monitoring, reviewing, maintaining, and improving an information security management system. This paper provides an analysis about the automation possibilities in information security management. The analysis takes into account the potential of using (i) security ontologies in risk management, (ii) hard- and software systems for the automatic operation of certain security controls, and (iii) the Security Control Automation Protocol (SCAP) for automatically checking compliance and security configurations. The analysis results support organizations and security managers at identifying systems they can use to achieve greater efficiency in the information security management process.

Information is the life blood of all modern organizations yet the news media continue to report stories of critical information loss. The purpose of information security is to protect valuable assets, such as information, hardware, software and people. The majority of information security specialists believe that promoting good end user behavior and constraining bad end user behavior is an important component of an effective Information Security Management System (ISMS). Implementing effective information security involves understanding security-related risk, then developing and implementing appropriate controls. In general the better employees are at applying the controls the more secure the organization will be, because even the best designed technical controls and procedures will be of limited value if the staff involved do not understand why they have been implemented and what they are accomplishing. Achieving the required level of understanding usually requires more than an annual awareness training initiative and represents a major challenge for most organizations. In fact, for many organizations it will involve a cultural change to ensure the integration of information security concepts into the organizational culture.