Capturing industry experience for an effective information security assessment

The purpose of information systems (IS) security behavior, represented by the difference between work and personal purpose, has been neglected in the research of user's IS security behavior. This is especially important for the organizations that allow or inevitably allow their employees to do personal tasks during work hours, because it may bring big threats to an organization's IS. Unfortunately, few empirical studies have examined if different behavioral purpose, typically, work/personal purpose, affects users' IS security behavior decision. Based on boundary theory and the idea of multidimensional rationality, we argue that people demarcate a psychological boundary for work and personal usages of IS and thus apply different rationalities to make IS security-related decisions. Our empirical investigation indicates that in a work usage context, people apply rule-based rationality and therefore are more influenced by mandatoriness and facilitating conditions. Whereas in a personal usage context, people apply outcome-based rationality and therefore are more concerned with task benefits and costs. The findings imply that organizations and vendors may devise different measures to ensure users' IS security behavior in different contexts.

What are the key topics for Information Systems (IS) security researchers? How have these topics been changing, and what topics are emerging to offer new opportunities for research? We address these questions by analyzing the abstracts of 261 articles focusing on IS security that have appeared in leading IS journals and journals devoted to this area. Using Latent Semantic Analysis (LSA) to analyze the text of these abstracts uncovers five primary research topics: Security Design & Management, Business Operations Security, Behavioral Aspects, Authentication & Integrity Controls, and Prevention & Detection. These five primary topics are aggregates of more granular topics that are utilized to find trends to understand the changing complexion of IS security research. Our study contributes by developing the key topics and their trends in this area using an analytical and replicable method to synthesize the existing research.

Protection motivation theory (PMT) is one of the most commonly used theories to examine information security behaviors. Our systematic review of the application of PMT in information systems (IS) security and the comparison with its application for decades in psychology identified five categories of important issues that have not yet been examined in IS security research. Discussing these issues in terms of why they are relevant and important for IS security, and to what extent IS research has not considered them, offers new research opportunities associated with the study of PMT and IS security threats. We suggest how future studies can approach each of the open issues to provide a new road map for quantitative and qualitative IS scholars.

Even though the human component has been recognized to have a crucial role in information systems (IS) security, the human issues have not received much attention. Recently a few approaches aimed at minimizing human‐related faults in the area of IS security have been put forward. This paper analyses different approaches aimed at minimizing user‐related faults. The existing approaches will be analysed from the viewpoint of their theoretical background, the research approaches employed, the research objectives and the organizational role of IS security. As a result, a new taxonomy, a comparison and critical analyses of the strengths and weaknesses of state‐of‐the‐art approaches shall be presented. Moreover, several issues that future research should explore and practitioners should consider when applying the results of the existing research are suggested.

HOW MUCH ICT SECURITY HAS IMPROVED DURING THE LAST DECADE

Ensuring information security in public sector information systems is now more important than ever. Advances in technology and information have not only made daily life easier, but also made the opportunities for cybercrimes vast and inevitable. This study aims to create a framework for evaluation that measure the maturity level of information security in information systems by integrating existing frameworks, NIST Cybersecurity Framework (CSF) and COBIT 2019. The result of this framework development is implemented in a public sector organization called PT XYZ, which has an information system as a tool to assist in the implementation of public services. The Capability Maturity Model Integration (CMMI) method is used to calculate the maturity level. The implemented approach resulted in information security maturity evaluation framework for information systems. This framework includes 118 activities which are divided into 23 categories. The distribution of the integration of the two frameworks contributes 61% activities, the NIST CSF contributes 8% and the COBIT 2019 framework contributes 31% activities. The measurement result of the information security maturity level in the information system at PT XYZ shows that all functions are at level 1 or the initial level. PT XYZ's low information security maturity reveals the critical need for stronger data protection and system resilience. This study introduces a novel approach to demonstrating a practical methodology for integrating two frameworks. The resulting framework enables public sector organizations to assess their security posture, identify areas for improvement, and enhance resilience against cyber threats, strengthening public service and safeguarding data.

Management of information systems (IS) security in organizations has been hampered by the apparent lack of inclusion of organizational security objectives in the traditional strategic planning process. In order to improve IS security strategic planning, we argue that there should be a renewed emphasis on security planning objectives. In this paper we present two sets of objectives – fundamental and means. We then define an evaluation mechanism for assessing the security posture of a firm. Based on case work in healthcare, we illustrate the usefulness of the security evaluation method for designing enterprise security.

Confidentiality, integrity and availability, while being key requirements for ensuring security, have had limitations in providing an integral security model that incorporates the benefits of all predominant designs. Heeding to the call that security models cater to unique operational characteristics of individual firms, this paper presents a deep structure framework of information systems (ISs) security. The framework incorporates three models—representational model, which identifies subsystems within an organization; state-tracking model, which ensures that different states trace IS security in the real world;nd the decomposition model, which defines specific external events that are a stimuli to changes in internal events. In a final synthesis, the paper presents a deep structure-based conceptual clarity that manifests the meaning of dynamic, custom-fit and flexible IS security solutions.

Security of Organizations' Information Systems (IS) and the Auditors: A Schematic Study

Risk management is today a major steering tool for any organization wanting to deal with Information System (IS) security. However, IS Security Risk Management (ISSRM) remains difficult to establish and maintain, mainly in a context of multi-regulations with complex and inter-connected IS. We claim that a connection with Enterprise Architecture Management (EAM) contributes to deal with these issues. According to our research agenda, a first step towards a better integration of both domains is to define an EAM-ISSRM conceptual integrated model. To build such a model, we will improve the ISSRM domain model, a conceptual model depicting the domain of ISSRM, with the concepts of EAM. The contribution of this paper is focused on the improvement of the ISSRM domain model with the concepts of TOGAF, a well-known EAM standard.

This study examines the implementation of information system at RSUD Palembang BARI with the aim of enhancing information system security. In this context, a security audit is conducted using the COBIT 2019 framework. The COBIT 2019 domains and processes utilizing include EDM03, APO12, APO13, APO14, and DSS05. The research involves the identification and evaluation of information security risks, determination of necessary security controls, and ensuring compliance with the information security standards established by COBIT 2019. The findings indicate that the level of information system security at RSUD Palembang BARI is at level 3 (Defined), with a gap analysis difference of 1 level below the expected target. Based on the above results, efforts to improve and enhance the information system security at RSUD Palembang BARI are still needed. The use of information system security techniques such as vulnerability scanning, penetration testing, WAF, IDS and IPS, and data encryption, as well as improving security in terms of server physical aspects such as installing CCTV and restricting user access with access cards or fingerprints, can be implemented to ensure compliance with relevant information security standards. Consideration for obtaining security certifications, like ISO 27001, should also be taken. Additionally, the quality of human resources in terms of policy-making and the ability of employees to address threats and attacks on information system security should be improved through training and strengthening coordination among employees.

Security requirements managers aim at eliciting, reusing and keeping their sets of requirements. They desire well defined, consistent and up to date requirements throughout the system lifecycle. This paper presents security ontology (SO) which can be used as a basis for eliciting risk-based security requirements. The ontology is based on the security relationship model described in the national institute of standards and technology special publication 800-12 but use-misuse case concepts and some extensions were used. We extended use case with some elements (action and object) to facilitate information system (IS) security policy instantiation after the system has been deployed. We incorporated risk and privilege concepts in order to represent risk knowledge in an unambiguous way and to enable ontology control security issues respectively. This ontology enriches the modelling and management of risk-based safeguard requirements within the requirements engineering discipline by organising the security knowledge to form heavy weight ontology which include concepts, concept taxonomies, relationships, properties, axioms and constraints. This ontology provides capabilities such as IS security management, traceability and reuse. OWL protege 3.3.1 editor was used for the ontology coding. The results of its adoption in capturing safeguard requirements of healthcare IS were also discussed.

Managing the security of information systems (SIS) is at once a tedious task and the cornerstone of business in a highly competitive environment. Successful control of the SIS in a business requires many years of experience, expertise and continuous improvement. This implies real know-how for the employees who are responsible for SIS control. This article focuses on the encapsulation of this know-how into UML models through profiles according to the meta-object facility (MOF) standards from the object management group (OMG). The main idea is to understand, manipulate and exploit this delicate and valuable know-how without being necessarily an expert on SIS. This challenge is threefold: firstly, to find a common language, as well as approaches and tools for Engineering of both IS and SIS; secondly, to generate earnings and make use of the enormous progress in Engineering of IS, to establish and improve Engineering of SIS; and thirdly, to achieve homogeneous management and follow-up of IT projects and their security. This paper presents the context of the Engineering of Security of Information Systems, its importance and the feasibility of this challenge.

The relationship between abusive supervision and employee workplace deviance has received much attention. Conceptualizing information systems (IS) misuse as a form of workplace deviance, the literature on IS security lacks a theoretical and empirical investigation of the relationship between abusive supervision and employee IS misuse. Drawing on retaliation, displaced aggression, and neutralization, we develop and empirically test a research model of the relationships among abusive supervision, neutralization, and two types of employees’ IS misuse. Results of a two-stage survey of 203 responses showed that when individuals perceived abusive supervision, they were likely to invoke the metaphor of the ledger as a neutralization technique to rationalize their engagement in IS misuse. Our results also reveal that employees’ reactions to abusive supervision could be influenced by their tenure with supervisor. These findings contribute to the IS security field and provide important guidance for learning how leaders influence employees’ IS security behaviors.

An integrative study of information systems security effectiveness