Chapter 1 - Domain 1: Information Security Governance and Risk Management

Information security is a critical field in which many different factors and constraints must be taken into account to ensure that data and infrastructure are protected. One of the main challenges in this area is the optimal allocation of limited resources between different security measures, which requires the use of mathematical methods to find optimal solutions. This article discusses the use of linear programming methods to solve problems related to optimizing the costs of information security risk reduction measures. The article reviews scientific sources on the applied aspect of linear programming for risk assessment and information security risk management. The article shows the process of building a model based on a linear programming problem, starting with the formalization of the problem, selection of the objective function and constraints, and ending with obtaining an optimal solution with its analysis and interpretation. The model in the form of a linear programming problem allows optimizing the total costs of information security, taking into account the chosen direction of optimization and given the given constraints on resources - budget, time, technical and other. The article presents the use of linear optimization based on the SWOT analysis of information security risks, which allows organizations to systemize and specify the risk management process, directing limited resources to the most critical areas and ensuring optimal protection of data and information systems. The obtained results show that the use of linear programming methods allows to achieve a significant optimization of information security costs, providing a high level of protection. Among the promising directions for further research are multi-criteria optimization and dynamic planning with consideration of time changes in risks and costs. This study can be used as an illustrative example of intersubject connections of the disciplines of the specialty 125 Cybersecurity and information protection in the educational activities of students of this specialty.

Information Security Management System (ISMS) implementation in Institution is an effort to minimize information security risks and threats such as information leakage, application damage, data loss and declining IT network performance. The several incidents related to information security have occurred in the implementation of the Academic System application in Indonesian higher education. This research was conducted to determine the maturity level of information security practices in Academic Information Systems at universities in Indonesia. The number of universities used as research samples were 35 institutions. Compliance with the application of ISO 27001:2013 standard is used as a reference to determine the maturity level of information system security practices. Meanwhile, to measure and calculate the level of maturity using the SSE-CMM model. In this research, the Information System Security Index obtained from the analysis results can be used as a tool to measure the maturity of information security that has been applied. There are six key areas examined in this study, namely the role and importance of ICT, information security governance, information security risk management, information security management framework, information asset management, and information security technology. The results showed the level of information security maturity at 35 universities was at level 2 Managed Process and level 3 Established Process. The composition is that 40% of universities are at level 3, and 60% are out of level 3. The value of the gap between the value of the current maturity level and the expected level of maturity is varied for each clause (domain). The smallest gap (1 level) is in clause A5: Information Security Policy, clause A9: Access Control, and clause A11: Physical and environmental security. The biggest gap (4 levels) is in clause A14: System acquisition, development and maintenance and clause A18: compliance.  Â

6 .. , .. , ..

In the globalized business world, financial information security management (FISM) and corporate risk management (CRM) have become critical elements for ensuring business sustainability and gaining a competitive advantage. The security of financial information not only protects the financial integrity of businesses but also supports long-term success by enhancing reputation management, regulatory compliance, and stakeholder trust. However, the necessity of addressing the relationship between financial information security and corporate risk management within a holistic framework has not been sufficiently emphasized in the literature, especially with the increasing threats in cybersecurity. This gap creates uncertainties regarding how businesses should integrate financial information security into their risk management strategies. The purpose of this study is to analyze the interaction between financial information security management and corporate risk management and to provide a practical and applicable framework for integrating financial information security into business risk management strategies. The study examines how financial information security management is integrated into corporate risk management processes (risk identification, assessment, response, and monitoring) and its impact on organizational performance (cost reduction, efficiency improvement, and competitive advantage). Considering major financial crises and cyberattacks, the global impact of financial information security threats on businesses, national economies, and the global financial system is increasingly being discussed. In this context, the study highlights the critical importance of FISM and CRM for businesses and presents concrete examples of the risks that may arise if these two concepts are not considered together (data breaches, financial losses, reputational damage, legal sanctions). The study systematically reviews existing approaches in the literature (such as ISO 27001 and the NIST Cybersecurity Framework) to contribute to the development of effective financial security and risk management policies for businesses.This study employs qualitative research methods, including a literature review and expert opinions. By analyzing current studies and industry reports, the relationship between financial information security and corporate risk management is examined in depth.In conclusion, integrating financial information security management with effective corporate risk management policies plays a crucial role in enhancing business sustainability, gaining a competitive advantage, and reducing costs. Businesses must adopt a holistic management approach that incorporates cybersecurity measures, financial risks, and regulatory requirements. This comprehensive approach is essential for ensuring long-term success and maintaining a competitive edge in today's dynamic business environment.

The field of risk management is one of today's most main fields. Risk-free business is not possible. It is necessary to calculate the risks that arise in every business so that it does not create any problems for us later. Although it is not possible to reduce the risk to zero, it is possible to reduce the risk. One of the most utilised areas of the risk term is the risk of informatisation. Ensuring the confidentiality, integrity and transparency of information is one of today's main problems. For this purpose, some standards and standards have been prepared. Some of these standards are ISO 27001 and ISO 31000. With the widespread use of computer networks and the Internet, Information Security has become very important. Since organisations are mostly dependent on information, technology and systems, Information Security is of vital importance and the need to protect information assets from damage arises from this. On the other hand, many companies still do not take adequate and necessary measures in information security. As a result, many companies, including many large and international organisations, are under serious threat. In order to be able to recognise these threats in advance and to reduce the severity of threats, it is necessary to comply with the Risk Management and the whole of the ISO 27001:2022 standard. Today, organisations face a risk in almost every transaction. It is necessary to identify and evaluate the risks that may arise during the functions of the institutions carefully and in detail in advance and to take measures to minimise or completely eliminate these risks. In this article, the steps to be taken to meet the requirements of ISO 27001:2022 Information Security Management System Risk Management are analysed step by step and a software has been developed to enter the data containing these requirements and receive the relevant reports. In this context, the ISO 27000:2018 family referenced by the ISO 27001:2022 Standard has been examined. The ways in which risk analyses can be performed and how risk improvement can be achieved have been investigated. As a result of the study, all these have been brought together in a software and made reportable. The security structure should be established by taking into account the differences of the organisation and the system. Afterwards information security risk management and methods that are not fully detailed in the standard. A documentation by analysing assets under a corporate information processing structure has been created. To create this structure and at the same time to create a dynamic a basic level of information security control software has been produced to provide control. Keywords: Information, information security, risk, risk management, risk analysis.

Information security awareness has been extensively discussed as an effective means to reduce security risks. The hacking incident experienced by the judiciary within the Supreme Court of the Republic of Indonesia in 2021. This resulted in disrupted services to the community. Therefore, it is necessary to conduct an information security audit. Information security audits were carried out using an information security evaluation using the US Index. The research methodology was conducted by interviewing resource persons at the Bureau of Public Relations Data and Information of the Supreme Court of the Republic of Indonesia and using the US index questionnaire version 3.1. The results of the study show that from 6 (six) assessment categories, the Electronic System Category has a value of “35” with a “strategic” level, Information Security Governance with a value of “32” with a status of “initial condition and starting to be implemented”, Information Security Risk Management with a value of “8” status. “Initial condition”, Information Security Management Framework value “31” status “initial condition, Information Asset Management value “86” status “implementation of basic framework”, Technology and Information Security value “63” status “initial condition and implementation commenced” Overall, the results of the final evaluation of the level of application information security standards scored “224” and the status was “inappropriate”. From the results of this study, several recommendations are then given based on SNI ISO/IEC 27001: 2013 to assist the Supreme Court in determining corrective measures.

Information society is rapidity developing in the various fields of banking, trade, medical service, energy, and education using information system. Evaluation for security risk analysis should be done before security management for information system and security risk analysis is the best method to safely prevent it from occurrence, solving weaknesses of information security service. In this paper, modeling it did the CBR (case-based reasoning) evaluation function it will be able to establish the evaluation plan of optimum. CBR evaluation functions manage a security risk analysis evaluation at project unit. It evaluates the evaluation instance for beginning of history degree of existing. It seeks the evaluation instance which is similar and result security risk analysis evaluation of optimum about under using planning.

Cybersecurity and information security risks are generally addressed following the guidelines of current standards and best practices, which traditionally point to ISO 31000 risk management. This key exercise to ensure the “known” risks is carried out in a reactive perspective, since not only the risks are known and treated, but also the organization is prepared when one of them materializes. Thus, it is necessary to advance in cyber risk management from the adversary's perspective. That is, to understand both the intentions and their capabilities to get out of the comfort zone of standards, and mobilize the organization to another framework that seeks to detect, deter, delay, confuse and anticipate the adversary. Therefore, this article develops two perspectives of security and cybersecurity risk management (from the victim and the adversary), in order to tune efforts around the treatment of known risks and the development of capabilities to maintain a vigilant posture towards latent and emerging risks, allowing the organization navegate throughout the uncertainties and instability of the current international context.KeywordsRisk managementAdversaryVictimCybersecurityCyberrisk

SIMWAS is an information system at the XYZ Ministry that is used to manage supervisory activities and follow up on supervisory results. SIMWAS is an important asset that contains all internal control business processes, but in practice, SIMWAS information security risks have not been managed properly. To overcome these problems, information security risk management is needed at SIMWAS. This study aims to design and analyze SIMWAS information security risk management using the NIST SP 800-30 framework. NIST SP 800-30 focuses on a particular infrastructure and its boundaries. Since the purpose is to perform a technical risk analysis of the core IT infrastructure, it is highly prescriptive. It has nine primary steps to conduct risk assessment. The NIST SP 800-30 framework is used to design and analyze SIMWAS information security risks by identifying threats, vulnerabilities, impacts, likelihoods, and recommendations for controls. SIMWAS information security risk assessment is carried out by analyzing data obtained from the results of interviews, observations, and document reviews. The results of this study show that SIMWAS information security has four low-level risks, eight moderate-level risks, and five high-level risks. Very low and low risk levels are acceptable according to the risk appetite of the business owner, but moderate, high, and very high-risk levels require risk avoidance, risk transfer and risk reduction. The XYZ Ministry need to carry out residual risk analysis and cost-benefit analysis from implementing controls in each risk scenarios.

The advent of the era of digital information, vast amounts of data is gradually affect people's way of life, work and study habits, etc., bring convenience to people at the same time, also make people face a lot of information security threats and challenges, so the information security problems faced by big data era is of great significance. This paper first analyzes the current big data era background, on the basis of the key problems of personal information security, analysis of information security risks at the same time, put forward the issue of information security strategy.

The existent models aiming at information security risk analysis primary startle the problem from a technical view and the real-time assessment approaches are seldom studied. The knowledge based approaches for information security risk analysis are limited in rule presentation and risk management. The bottom-up approaches fails to support effective security decision and control. Real-time assessment is more practical in the managerial view and helps to construct quick response to reduce the risk. This paper studies knowledge model and danger model for information security risk real-time assessment.

Information technology outsourcing (ITO) has grown significantly in recent decades and is now over a USD trillion-dollar industry. Service provider organisations are striving to improve the efficiencies of their service deliveries. Natural language processing (NLP) provides an opportunity to bring efficiencies through automation in understanding and processing information. Since information security risk management (ISRM) in ITO is a growing concern of both, client and service provider organisations, they are adopting to improve ISRM in ITO using NLP. This paper explores those ISRM improvement scenarios. It also investigates the information security risks (ISRs) that result from the use of NLP in ITO and proposes strategies to manage those ISRs. To gain insights into the problem, a qualitative research approach is followed using the case study method. Six semi-structured interviews were conducted from participants in three organisations in the ICT industry, engaged in an ITO relationship. To the best of our knowledge, it is the first study to investigate the use of NLP for enhancing ISRM in ITO.

Information Security Risk Management (ISRM) in Information Technology Outsourcing (ITO) is among the most critical and under-studied areas of ITO research. This study investigates the body of knowledge focusing on ISRM in ITO by conducting a systematic literature review (SLR) and analyzes 63 papers published between 1994 and 2020. The findings suggest that developing conceptual models or providing commentary is the most popular methodology. Most studies collect data from secondary sources instead of industry. A majority of the studies neither investigate any specific industry nor ITO orientation, i.e., client or service providers. Information security risks (ISRs) from the literature are categorized into 27 types. Most ISRs belong to operations practice, while lack of staff loyalty is the least investigated type of ISRs. Theories, frameworks and models discussed in the literature are explored. A critical analysis of the findings is conducted to identify the gaps and future directions. Since most of the literature is based on conceptual work, it is hard for practitioners to apply this knowledge in the industry unless validated by further research. Specialized literature from the perspectives of ITO orientation, industry type and demographics is required to investigate focused issues and develop accurate knowledge of ISRM in ITO.

A Review of AI Assisted Continuous Auditing Systems in Technology Risk and Cybersecurity Oversight explores how artificial intelligence is transforming assurance practices in increasingly digital and distributed enterprises. Traditional audit approaches, typically periodic and retrospective, struggle to keep pace with the speed, scale, and complexity of modern technology environments. Continuous auditing supported by artificial intelligence offers the ability to monitor controls, detect anomalies, and generate assurance insights in near real time. This review synthesizes current research and industry practices on AI enabled continuous auditing systems, focusing on their application in technology risk management and cybersecurity governance. The study examines machine learning, natural language processing, process mining, and anomaly detection techniques used to evaluate access controls, configuration management, incident response, and regulatory compliance. It categorizes existing models into data driven monitoring, predictive risk analytics, and automated assurance reporting approaches. Strengths and limitations are analyzed across scalability, explainability, data quality, and integration with governance risk and compliance platforms. The review highlights the growing convergence between internal audit, information security, and enterprise risk management functions as organizations adopt integrated assurance models. Emphasis is placed on explainable artificial intelligence, model transparency, and ethical considerations to ensure trust and regulatory acceptance. The paper proposes a conceptual lifecycle for AI assisted continuous auditing that includes data ingestion, control mapping, risk scoring, alerting, investigation support, and audit ready reporting. It also examines how dashboards and visualization tools enhance decision making for executives and boards. Key implementation challenges are discussed, including skills gaps, privacy concerns, legacy system integration, and resistance to organizational change. By consolidating fragmented knowledge, the review provides a comprehensive perspective on how AI can strengthen proactive oversight, reduce audit fatigue, and improve organizational resilience. Future research directions include standardized benchmarks, cross industry collaboration, and the integration of privacy preserving analytics. The findings position AI assisted continuous auditing as a strategic capability that enhances transparency, accountability, and cyber resilience in technology driven enterprises worldwide today.

There is a dearth of academic research literature on the practices and commitments of information security governance in organizations. Despite the existence of referential and standards of the security governance, the research literature remains limited regarding the practices of organizations and, on the other hand, the lack of a strategy and practical model to follow in adopting an effective information security governance. This chapter aims to explore the engagement processes and the practices of organizations involved in a strategy of information security governance via a statistical and econometric analysis of data from a survey of 1000 participants (with a participation rate of 83.67%) from large and medium companies belonging to various industries. Based on the results of the survey regarding practices of information security management and governance, a practical maturity framework for the information security governance and management in organizations is presented.