Business Security Architecture: Weaving Information Security into Your Organization's Enterprise Architecture through SABSA®

With increasing dependence on information technology and information system, enterprises are confronting with a more and more complicated information security environment. Thus, information security has become an intractable problem for many enterprises. Generally speaking, there are two methods to improve enterprises’ information security level, that is, technology and management means. Technology means mainly settle software and hardware security of computers and networks, while management means mainly regulate and restrain the entire enterprise system including software, hardware, and employees. At present, a lot of enterprises mostly employ the technology means to solve information security problems. However, the lack or imperfection of information security institutions leads to bad enterprise information security situation. Therefore, technology and management means to solve information security are complementary to each other. As such, it is urgent and necessary to establish and improve information security institutions for many enterprises. In fact, enterprise information security is a complicated activity which needs different sectors to get involved in. More specifically, the information security departments play the very critical role in the implementation of information security institutions, and all employees should comply with the information security policy. Therefore, only the top management teams have the ability to coordinate the relationship between different departments, determine the introduction of information technology, and deploy the information systems. In response, top management support has an important impact on the construct of information security institutions and the effectiveness of information security management. So far, few studies have investigated the mechanism that how top management support affects information security legitimation, and legitimation information security management. Therefore, it has great theoretical and practical significance to the exploration of whether the legitimation supported by top management can improve the effectiveness of information security management. The objective of the current study is to explore whether legitimation prompted by top management team can improve the effectiveness of enterprise information security management. By doing so, the data was collected from the enterprises which have passed the certification of information security management system, and analyzed by using PLS-SEM. The results indicate that information security awareness can improve top management support（including top management belief and top management participation）and the effectiveness of information security management respectively. In addition, top management belief can improve implementation（the first stage of legitimation）and internalization（the second stage of legitimation）. Moreover, implementation can improve the effectiveness of information security management. This paper analyzes the way to enhance effectiveness of information security management, which has a reality-oriented meaning for prompting information security management of enterprises from the standpoint of institution.

In the modern world automation technologies of industrial processes have found wide application. Automated process control systems have become an important part of enterprises that operate in different economic fields and life support facilities all over the world. Nevertheless, the high growth of automation means raises the acute problem of providing APCs information security from external and internal threats. There are systematic reports in the media about new critical vulnerabilities in industrial equipment and attacks based on the exploitation of such vulnerabilities. When designing such systems it is necessary to estimate possible information security threats that already exist in the system or that are predicted to appear. That is why threat modeling is an important part of providing information security at industrial facilities using automation. In this work the author investigates the methodology of estimating threats to software security TRIKE. The research is aimed at finding general approaches to determine threat sources, tactics, and techniques for making implementation scenarios of threats to software information security, for applying them to provide cyber security of automated process control systems. In the frameworks of the subject mainstreaming, the research gives a description of cyber-attacks at big industrial facilities, and their basic vulnerabilities are emphasized. In the article the analysis of TRIKE methodology has been done. It is aimed at determining basic threat modeling stages applicable to industrial automation systems. The approach of TRIKE methodology to generating a list of threats to information security is formalized. To achieve the aims the author constructs DFD data flow diagrams with the decomposition of peculiar elements of the algorithm for modeling threats to information security of automated process control systems using TRIKE methodology.KeywordsAutomated process control systemsInformation securityThreatThreat modelTRIKEData flow diagramsAttack library

Subject. In the modern information society, ensuring information security is one of the key tasks of organizations, especially in the context of growing cybersecurity threats. Every year, companies face increasingly complex and diverse threats that can cause significant damage to both the financial resources and reputation of the organization. In this context, ensuring information security becomes an important strategic task for enterprises in various fields of activity. Information security plays a critical role in protecting information confidentiality, ensuring the integrity and availability of information, as well as the security of information systems and networks. Goal. The main goal of the research in this work is a comprehensive study of the technology for ensuring the protection of information, preventing unauthorized actions with it, in particular, its use, disclosure, distortion, modification, research and destruction, as well as the correct strategy for information protection of data from external and internal threats. Method or methodology. The research is based on general scientific methodology, which involves the use of a systematic approach and general scientific methods of cognition. The results of the work. In the course of the study, the authors of the article tried to resolve the problem of the interdependence of information security and the strategy for information protection of data from external and internal threats by structuring the subject area of information security policy, which made it possible to set priorities in solving the problems of ensuring the required level of security of information resources and supporting infrastructure in the context of the development of digital technologies. When analyzing problems related to information security, the authors note the importance of mechanisms for generating new solutions that allow, at a minimum, to adequately respond to threats to information security or to anticipate new threats and be able to resist them. Conclusions. The study found that information security plays a critical role in the modern world, ensuring data protection, privacy and sustainability of business processes. In an environment of constantly changing and evolving threats, maintaining a reliable information security system becomes an integral part of the success of organizations and personal security. This is an important step towards creating an information security management system at the enterprise, with the help of which constant and effective monitoring of the effectiveness of security measures is carried out, timely correction of actions taken and revision of existing provisions to ensure maximum security.

HOW MUCH ICT SECURITY HAS IMPROVED DURING THE LAST DECADE

The relevance of the work is due to the need to adapt regulatory mechanisms to the actively developing digitalization processes. On the other hand, in the context of growing cyber threats and increasing dependence of public relations on information and telecommunications technologies, the directions for the development of legislation that ensure stability and security of the relevant infrastructure are subject to a certain rethinking in the legal aspect. The subject of the study is the legal support for the development of a sustainable and secure information and telecommunications infrastructure. The purpose of the work is to identify key areas for improving legal regulation in the field of functioning and development of sustainable and secure information and telecommunications infrastructure. The study applies methods of analysis, synthesis and comparison, as well as literal and systematic interpretation of the norms of the current legislation in the field of functioning and developing sustainable and secure information and telecommunications infrastructure. Finally, conclusions are formulated regarding the need for the development of legal regulation in this area. The research outlines the specific directions for changing the legal field, which ensure the sustainable development of information and telecommunications infrastructure in the Russian Federation.

The Government and industry are currently using information and communication technology a lot. The Government and companies in Indonesia have regulations on operational standards and management procedures for information and communication systems security at Government regarding implementing information system security. Information security is essential because there are many threats to information security. Information security in this era of Information and Communication Technology (ICT) is fundamental. Information Exchange Environment (IEE) vulnerabilities have increased as threats become more widespread and complex; therefore, information security has become a fundamental problem for businesses, organizations, and governments. So, in this paper, we will explain the review of the impact of Information Security For Government and companies in terms of threats and types of information security. Some security system methods are analyzed, among others—application Security, cloud security, Cryptography, security infrastructure, Incident response, and vulnerability management. The results of this review analysis, it known threat has several solutions, each depending on the type of threat for both the Government and the Company. Furthermore, Information Security is considered very important, especially for data stored in Government and companies.

This article provides the modern cybersecurity trends directly related to aim ant tasks of criminals. It reflect the assessment of global technological risks discussed at 2020 World Economic Forum. The article covers estimations on increase on negative impact of geopolitical sharpness elements on economic potential of next generation technologies. Data fraud and cyberattacks are considered as priority key indicators at assessment of the most possible global risks, and attacks at informational infrastructure are equal to the cyberattacks risks at the rating of the most possible risks. Forecast indicates that cyberattacks are the most likely to be used as indirect conflicts between countries which look forward to expand their range on influence. In such situation the cybersecurity issues can`t stay on the second place or be the issues which should be solved at existence of direct cyber threats to the modern informational systems, IoT systems and SCADA. Obviously, we should revise the approaches to creation and development of modern informational technologies and cybersecurity issues should be considered as constituent element in development of modern informational systems from the very moment of its initiation, projecting, and on all stages of production and support. Reorientation of informational system developers to creation of new integrated platforms with cybersecurity constituent elements demands the research and implementation of new approaches to its development, as well as engagement of the world community at elaboration of relevant standards and protocols, which ensure the secure functioning of informational systems at world net. The article provides the basic requirements to constituent elements at development of concept of informational and cyber security in conditions of hybrid threats especially provides recommendations on organizational structure for informational security department and general principles to organize the activities and controls on informational and cyber protection. The article defines tasks for informational security department, provides the list of basic actions to secure information, and formulates the tasks, which should be ensured by technical infrastructure, organizational, procedural and hardware and technical actions to manage the informational security, and other principles to ensure informational security in development of concept of informational security within the hybrid threats conditions.

Abstrak
 Penerapan Enterprise Arsitektur (EA) merupakan konsep penting yang dibutuhkan oleh perguruan tinggi skala besar. Penerapan EA bertujuan secara komprehensif membantu menyelesaikan dinamika atau permasalahan yang ada. Pentingnya EA mulai dari penataan SI strategi yang mendukung perkuliahan, layanan Teknologi Informasi (TI), data, aplikasi dan teknologi kedepannya. Rencana Strategi dan Rencana Induk Pengembangan Universitas Pattimura menjadi acuan dalam penerapan EAP, dan juga wawancara kepada mahasiswa, Dosen dan Karyawan bagian pengelolaan TI menjadi metode penelitian penulis, sehingga menemukan data kongkrit untuk dapat merencanakan EA Universitas Pattimura. TOGAF ADM merupakan sebuah kerangka kerja atau framework yang mampu mengatur sebuah arsitektur perusahan, dan juga merupakan sebuah metode mengembangkan arsitektur sebuah korporat yang dipakai oleh peneliti. Blueprint arsitektur bisnis, data, aplikasi sistem informasi dan teknologi merupakan hasil dari pemodelan EA yang diterapkan pada ruang lingkup Universitas Pattimura. TOGAF ADM pada fase Preliminary Phase atau fase awal mengidentifikasi suatu korporat dari arsitektur bisnis, data, aplikasi dan teknologi. Pada fase Vision Architecture menghasilkan visi arsitektur antara lain arsitektur bisnis, data, aplikasi dan teknologi. Pada fase Business Architecture menghasilkan blueprint arsitektur bisnis. Pada fase Information System Architecture menghasilkan blueprint arsitektur SI, dan pada fase Technology Architecture menghasilkan blueprint arsitektur TI. Penerapan metode EAP pada Universitas Pattimura membawa dampak positif karena menghasilkan keselarasan strategi bisnis dan strategi TI sehingga penting untuk diterapkan.

Information security of an enterprise is a functional element of the system for ensuring its strategic development. Its main task is to ensure the stability of the enterprise's existence in the present and the prospects for its sustainable development in the future. The integrated system for ensuring the information security of enterprises takes into account modern legal and organizational and managerial measures, as well as software and hardware tools for countering external and internal threats, which ensures the state of information security and the prospects for the development of information technologies. The organizational level of information protection includes organizational regulation, organizational regulation and organizational instruction and ensures the organization of security, regime, work with personnel, with documents, standards for the use of technical security means and procedures for information and analytical activities of the enterprise to identify threats. The organizational aspect of ensuring the information security of an enterprise is one of its most important elements, since the effectiveness of all activities to support the information security system at the proper level largely depends on the actions taken for implementation. The main task is to characterize the information security system at the enterprise. The research of the information security system at the enterprise was carried out. It has been determined that the correct solution to the issue of creating information security bodies will help accelerate the integrated implementation and maintenance of an integral information security system, coordinate legal, administrative, organizational, technological, scientific, technical and physical measures to protect information. It is given that information security programs should take into account how an organization and its people, processes and technologies interact; and how organizational governance, culture, human factors, and architecture support or hinder an enterprise's ability to protect information and manage risk. It is highlighted that information security managers should do their best to create programs that meet the goals and priorities of the enterprise, benefit the enterprise and support the ability of management to innovate while controlling risks.

Enterprise architecture is considered as a certain object of management, providing in business a general view of the enterprise and the mutual alignment of parts of this enterprise into a single whole, and as the discipline that arose based on this object. The architectural approach to the modeling and design of the enterprise originally arose in the field of information technology and was used to design information systems and technical infrastructure, as well as formalize business requirements. Since the early 2000’s enterprise architecture is increasingly used in organizational development and business transformation projects, especially if information technologies are involved. Enterprise architecture allows describing, analyzing and designing the company from the point of view of its structure, functioning and goal setting (motivation). In the context of this approach, the enterprise is viewed as a system of services, processes, goals and performance indicators, organizational units, information systems, data, technical facilities, etc. Enterprise architecture implements the idea of a systematic approach to managing and changing organizations in the digital economy where business is strongly dependent on information technologies. This increases the relevance of the suggested approach at the present time, when companies need to create and successfully implement a digital business strategy. Teaching enterprise architecture in higher educational institutions is a difficult task due to the interdisciplinary of this subject, its generalized nature and close connection with practical experience. In addition, modern enterprise architecture management methodologies are complex for students and contain many details that are relevant for individual situations. The paper proposes a simplified methodology for enterprise architecture management, which on the one hand will be comprehensible to students, and on the other hand, it will allow students to apply the main methods and technologies of the enterprise architecture in practice. The requirements for the simplified methodology were defined. These requirements were taken into account during methodology development and can be used when applying the methodology – it will be possible to understand the goals that can be achieved with its help, the assumptions made and the existing limitations. The proposed methodology defines the layers, aspects and objects of the enterprise architecture, describes the tasks of managing enterprise architecture and the artifacts created (lists, matrices, diagrams). The proposed methodology can be used to conduct training projects in which methods and tools of enterprise architecture management are used to optimize the company’s work based on the capabilities of information technology. Such projects will help not only to develop students’ skills, but also to establish a dialogue between universities and industry – the provider of problems and tasks for solving within students’ projects. The proposed simplified methodology for managing the architecture of the enterprise is tested and used by the authors when conducting courses in the leading universities of the Russian Federation: Graduate School of Management (St. Petersburg State University), St. Petersburg State University, Finance University under the Government of the Russian Federation, Higher School of Economics and BonchBruevich Saint-Petersburg State University of Telecommunications.

The article addresses the problem of the discrepancy between declared information security policies, the requirements of standards and protocols, and the actual functioning of organizational information infrastructures. In practice, components of comprehensive information security systems (CISS) are often developed formally, without considering real risks, characteristics of network protocols, or compliance with international and national security standards. As a result, information security policies are not aligned with technical configuration parameters, leading to fragmentation of protection mechanisms and a decrease in overall system effectiveness. Another critical issue is the continued use of outdated or insecure protocols that remain operational due to the absence of systematic compliance control mechanisms. This study proposes a method for integrating information security policies, standard requirements (ISO/IEC 27001:2022, NIST SP 800-53, Ukrainian ND TZI), and secure network protocols (TLS 1.3, SSHv2, DNSSEC, IPSec) into the process of developing a comprehensive information security system. The method consists of four stages: asset and protocol analysis, development and formalization of security policies, compliance mapping with standards, and construction of an integrated CISS architecture based on the obtained results. To quantitatively assess the consistency of CISS components, a compliance scoring algorithm is introduced, enabling objective evaluation of the information infrastructure’s conformity with regulatory requirements and internal policies. Experimental validation of the method in a test environment demonstrated an increase in compliance with standards from 52% to 92%, the elimination of outdated or insecure protocols (FTP, SMB1, HTTP), and improved accuracy of CISS parameterization due to automated mapping of policies to technical security mechanisms. The obtained results confirm the feasibility and effectiveness of the proposed method for designing and modernizing CISS in organizations of various types. The purpose of this study is to develop a method for integrating information security policies, standards, and protocols into the formation of a comprehensive information security system within an organization.

У статті представлено результати дослідження асоціативного поля концепту «інформаційна безпека». Теоретико-методологічною основою роботи стали новітні підходи до інформаційної безпеки як складової психологічної та інформаційної захищеності суспільства. Метою дослідження є виявлення асоціативного поля концепту «інформаційна безпека» за даними асоціативного експерименту з бакалаврами освітніх програм «Журналістика», «Міжнародна журналістика», «Реклама та зв’язки з громадськістю», «Видавнича справа та редагування», діяльність яких безпосередньо пов’язана з інформаційною сферою.Аналіз концепту «інформаційна безпека» як такого, що формується у свідомості споживача інформації через певне усвідомлення інформаційної та особистісної захищеності в площині соціальних комунікацій у мережі Інтернет, а також такого, що презентує мовну картину світу індивіда в інформаційну епоху, здійснювався на міждисциплінарному рівні.Зокрема, у дослідженні подано аналіз асоціативного поля концепту «інформаційна безпека» відповідно до отриманих логічних і граматичних реакцій ста вісімнадцяти респондентів. Аналіз за логічним компонентом виявив сім тематичних груп асоціацій: сфера захисту особистої інформації; сфера засобів масової інформації / соціальних мереж; сфера технологій; сфера державної інформаційної безпеки; соціальна сфера; психологічна захищеність; сфера захисту авторської інформації.Важливість поняття «інформаційна безпека» для цілої низки сфер інформаційної діяльності зумовлюється подальшим розвитком інформаційних технологій та технічних засобів обробки та захисту інформації, тому незаперечною є перспектива подальшого дослідження поняття в контексті виявлення рівня усвідомлення інформаційної безпеки як підґрунтя інформаційного та особистісного комфорту, а також для вивчення специфіки кореляції асоціативних полів концептів «інформаційна безпека», «інформаційна культура», «інформаційний комфорт», «інформаційний дискомфорт» тощо.

Properly aligned business and Information Technology (IT) can provide competitive edge to an organization. In order to align business with IT, IT should fully support business operations. Enterprise Architecture (EA) can be used to support business and IT alignment. To help design such systems using EA, Enterprise Architecture Frameworks (EAF) may be used. There are frameworks to support EA, such as Zachman Framework, the Department of Defense Architecture Framework (DoDAF), and The Open Group Architecture Framework (TOGAF). They help to design, evaluate, and build the right architecture and reduce the costs of planning, designing, and implementing [8]. ArchiMate is an open and independent architecture modeling language that complements EAF for modeling and visualizing EA. Regardless of chosen EAF, conversion processes from requirements to EA using ArchiMate are not well-defined to the best of our knowledge. Goal-oriented approach is a requirement analysis technique that supports early requirements analysis, which can be used to define a process for bridging EA requirements to ArchiMate. Therefore,we propose guidelines using goal-oriented approach and then apply them to the interoperability of prescriptions in a healthcare system.KeywordsBusiness ProcessBusiness ServiceEnterprise ArchitectureBusiness ObjectBusiness FunctionThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Companies throughout the world use Enterprise Architecture (EA) because of benefits such as the alignment of business to Information Technology (IT), centralisation of decision making and cost reductions due to standardisation of business processes and business systems. Even though EA offers organisational benefits, EA projects are reported as being costly, time consuming and require tremendous effort. Companies therefore seek to ascertain ways to measure the effectiveness of EA implementation because of the money and time being spent on EA projects. EA Effectiveness refers to the degree in which EA helps to achieve the collective goals of the organisation and its measurement depends on a list of constructs that can be used to measure the effectiveness of EA implementation. Currently, there exist no comprehensive list of constructs that are suitable to measure the effectiveness of EA implementation. The paper reports on the results of a study that explored the development of a comprehensive list of constructs suitable for measuring the effectiveness of EA implementation. The artefact developed in this research study is called Enterprise Architecture Effectiveness Constructs (EAEC). The EAEC consists of 6 constructs namely: - alignment; communication; governance; scope; top leadership commitment and skilled teams, training and education. To achieve the purpose of this research study, a design science research (DSR) strategy was followed. The EAEC was evaluated in two rounds by EA experts from industry and academia.

Information technology has become the core tool of business organisations'. External and internal threats as well as legal, regulatory and contractual compliance requirements are all combining to make effective information security a key information technology management challenges. This paper describes an undergraduate information technology security management course that provides comprehensive knowledge and skills necessary to manage both strategic and operational aspects of information security. The course covers a broad range of managerial topics in information technology security and makes use of a number of security tools and techniques to complement the theory taught. In this paper, we describe our approach, our experiences and lessons learned for teaching information technology security management course. The paper details the content of the course and outlines how it is taught and assessed.