Implementation of Zero Trust Architecture on Local Server Management in Educational Institutions

The increasing complexity of digital transformation in higher education institutions underscores the need for [i]effective IT governance frameworks. Universitas Katolik Musi Charitas (UKMC), a medium-sized university in Indonesia, faces challenges in aligning IT operations with its strategic objectives, including overlapping applications, limited resources, and insufficient risk management. This study evaluates UKMC's IT governance maturity using the COBIT 2019 framework to identify gaps and propose actionable recommendations. This study adopted a qualitative case study approach, incorporating structured interviews, focus group discussions (FGDs), observations, and document analysis. UKMC's IT governance practices were mapped against COBIT 2019's maturity model, focusing on key processes such as risk optimization, security management, and IT change management. The results indicate that UKMC's IT maturity level is at stage 2 (Managed), reflecting basic but structured governance practices. Key gaps include a lack of comprehensive risk management frameworks, limited documentation, and underutilized IT tools. The study recommends improving documentation, establishing standard operating procedures (SOPs), conducting regular risk assessments, and providing targeted training to enhance staff competency. The findings emphasize the importance of tailoring COBIT 2019 to address the specific challenges of medium-sized universities in developing countries. By implementing the proposed roadmap, UKMC can achieve greater alignment between IT capabilities and institutional goals, contributing to improved operational efficiency, service quality, and regulatory compliance. This study offers practical insights for similar institutions seeking to enhance their IT governance maturity in the context of limited resources and dynamic technological environments

The increasing complexity of digital transformation requires an adaptive, measurable, and contextaware IT governance model. However, existing frameworks such as COBIT, ITIL, TOGAF, and ISO/IEC 38500 tend to be partial and prescriptive, failing to address strategic, operational, and innovative needs holistically. This study proposes the Adaptive Digital IT Governance Framework, anovel governance model synthesized from eleven leading IT frameworks and structured into three integrated domains: Govern, Manage, and Adapt. Employing a Design Science Research methodology, the model was developed through a systematic framework analysis, conceptual domain formulation, iterative implementation mapping, and the design of a maturity assessment instrument. The results demonstrate that the Adaptive Digital IT Governance Framework offers a modular, scalable, and value-driven governance solution suited for diverse organizational contexts. Theoretical contributions include extending the IT governance paradigm by integrating strategic alignment, agile governance, and digital sustainability. Practically, the framework provides actionable guidance for designing, assessing, and enhancing digital governance systems across sectors. Unlike previous cross-framework synthesis efforts, the Adaptive Digital IT Governance Framework explicitly introduces the Adapt domain, operationalizing governance agility, innovation capability, and sustainability measurement. This makes the Adaptive Digital IT Governance Framework the first modular, maturity-oriented framework that simultaneously integrates strategy, operations, and adaptability, positioning it as a next-generationmodel to support organizational resilience and sustainable digital transformation.

Over years, research in Management Information Systems (MIS) has resulted in significant implications for organizations in a wide variety of areas by using socio-technical perspective, which has helped to deliver more business focused solutions. This study reports the results of an empirical examination of the effect of IT governance framework based on COBIT and Organizational Knowledge Pillars in enhancing the IT Governance framework (Business / IT Strategic alignment, Business value delivery, risk management, Resource management, performance measurement) to enhance the business intelligence application and usability within the organization. Quantitative method is adopted for answering the research questions. A questionnaire was used for data collection after contacting several companies, in addition confirmatory factor model and structural equation model were developed and tested and the overall results of the empirical investigation supported the general framework. Using confirmatory factor analysis techniques, the effects of the combination between IT governance factors seen by ITGI and organizational knowledge pillars of the firm on BI Systems application in it were tested and confirmed and the models were also verified. Several statistical methods were used for data analysis; moreover different statistical tools as software packages were employed such as SPSS 17 and EQS 6.1. The study proposes that knowledge management (KM) and IT Governance framework are vital organizational abilities that support business intelligence application; it also observes that combination of IT governance framework with organizational knowledge within the firm can enhance the organization’s BI system application and usability, and its goal is to advance the understanding of the relationships among these factors. The study develops and tested two main hypothesizes: (1) IT Governance framework supports business intelligence application. (2) Organizational knowledge, in turn, leads to support business intelligence application.

The lack of effective IT governance is widely recognized as a key inhibitor to successful global IT outsourcing relationships. In this study we present the development and application of a governance framework to improve outsourcing relationships. The approach used to developing an IT governance framework includes a meta model and a customization process to fit the framework to the target organization. The IT governance framework consists of four different elements (1) organisational structures, (2) joint processes between in- and outsourcer, (3) responsibilities that link roles to processes and (4) a diverse set of control indicators to measure the success of the relationship. The IT governance framework is put in practice in Shell GFIT BAM, a part of Shell that concluded to have a lack of management control over at least one of their outsourcing relationships. In a workshop the governance framework was used to perform a gap analysis between the current and desired governance. Several gaps were identified in the way roles and responsibilities are assigned and joint processes are set-up. Moreover, this workshop also showed the usefulness and usability of the IT governance framework in structuring, providing input and managing stakeholders in the discussions around IT governance.KeywordsAccount ManagerPortfolio ManagementMeta ModelJoint ProcessGovernance FrameworkThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

IT Governance frameworks such as COBIT, ITIL, and ISO have become the most important guidelines for IT Governance (ITG). These frameworks are used by organizations as a tool to evaluate their own ITG systems and to help the IT managers to bridge any gaps between the technical issues, business risks, and control requirements. The main objective of the research is to study the various IT governance frameworks used by the organizations and the challenges they face in compliance with the IT Governance framework, and the steps taken to overcome these challenges in the UAE. This objective was achieved by using a quantitative approach through a questionnaire felt by a sample of IT executives or IT professionals working at different private and public organizations in the UAE. The results of the study discovered that most of the organizations use ITIL and ISO as their preferred choice of the ITG framework, and the major challenge faced by the organizations in compliance with the ITG frameworks is the lack of people’s acceptance which overcomes by training people using tools and systems with the frameworks used in the organizations. This study provides useful information for future researchers to understand the challenges in implementing the ITG frameworks and how to overcome them in the context of the private and public sectors in the UAE.

This study theoretically argues and empirically evaluates how a firm's five governance domains impact the level of IT governance maturity and how a firm's five proposed governance mechanisms impact the overall effectiveness of IT governance. Using data from 20 Emirati organizations within financial services, telecommunications, manufacturing, and public service, this study found robust empirical evidence that the maturity of the firm's five suggested governance domains greatly enhances the level of IT Governance Maturity. Moreover, this study found robust empirical evidence that the existence of the firm's five proposed governance mechanisms greatly enhances the overall effectiveness of IT governance.

The assessment of IT governance maturity is part of the assurance function. The assessment is carried out to ensure technology support in achieving business goals. In this context, companies should comply with regulations, as well as the need to continue to improve the quality of implementation of IT governance. The average value of PT X's IT governance maturity in Year 2 has increased from 3.21 to 3.26. There is an increase in the average score of 0.05 over one year. Success factors in implementing IT governance must be maintained and encouraged to continue the grow. This research was conducted to identify what organizational initiatives to increase the maturity and what the key factors are. Factors identification is done using evidence analysis method based on CSF references and attributes criteria. The results of the analysis obtained key factors that strengthen the maturity. The main factors are CSF2 providing IT infrastructure that supports the development and exchange of IT applications and services (21.72%), and CSF4 staff development to meet professional IT HR qualifications (17.39%). On the other hand, maturity attribute which gave the biggest contribution was ATR1 related to policies and procedures (34.6%), and ATR3 related to defining goals and actions (30.77%).

Nowadays, Security Information and Event Management (SIEM) is very important in software. SIEM stores and monitors events in software and unauthorized access to logs can prompt different security threats such as information leakage and violation of confidentiality. In this paper, a novel method is suggested for secured and integrated access control in the SIEM. First, the key points where the SIEM accesses the information within the software is specified and integrated policies for access control are developed in them. Accordingly, the threats entered into the access control module embedded in this system are carefully detected. By applying the proposed method, it is possible to provide the secured and integrated access control module for SIEM as well as the security of the access control module significantly increases in these systems. The method is implemented in the three stages of the requirements analysis for the establishment of a secure SIEM system, secure architectural design, and secure coding. The access control module is designed to create a secured SIEM and the test tool module is designed for evaluating the access control module vulnerabilities. Also, to evaluate the proposed method, the dataset is considered with ten thousand records, and the accuracy is calculated. The outcomes show the accuracy of the proposed method is significantly improved. The results of this paper can be used for designing an integrated and secured access control system in SIEM systems.

Does good IT governance improve the effect of IT? This paper presents the IT Organization Modeling and Assessment Tool (ITOMAT) which has been created to overcome operationalization and subjectivity weaknesses in the Control Objectives for Information and related Technology (COBIT) framework. ITOMAT was applied to assess IT governance maturity in four case studies. Simultaneously, external metrics of the effect of IT were collected and correlated to the maturity levels. Based on the correlations, a model linking internal and external measures was created. The model can be used to predict the effect of IT given the maturity levels of IT processes.

The increasing migration of enterprise operations to Amazon Web Services (AWS) has amplified the need for robust, scalable, and intelligent cybersecurity solutions. Security Information and Event Management (SIEM) systems have become vital for detecting threats, correlating logs, and maintaining compliance in cloud environments. This systematic review explores the integration of SIEM tools within AWS-based infrastructures, focusing on their effectiveness in threat detection and log correlation. It examines leading SIEM solutions such as Splunk, IBM QRadar, Sumo Logic, and AWS-native services like Amazon GuardDuty, AWS CloudTrail, and AWS Security Hub. Emphasis is placed on key integration approaches, including API-based ingestion, agentless data capture, and real-time event streaming through AWS services like Kinesis and S3. The review critically analyzes studies published between 2018 and 2023, highlighting trends in the automation of log management, enrichment of security alerts through machine learning, and orchestration via Security Orchestration, Automation, and Response (SOAR) platforms. Challenges such as data normalization, scalability limitations, cross-service visibility, and compliance adherence in multi-account AWS architectures are discussed. The findings indicate that SIEM integration enhances threat detection efficiency by enabling proactive anomaly detection, facilitating rapid incident response, and improving forensic investigation capabilities. However, the review identifies gaps, particularly in cost optimization, handling high-velocity log streams, and adapting traditional SIEM models to dynamic, serverless AWS architectures. Best practices for successful SIEM deployment include leveraging AWS-native integrations, prioritizing event prioritization algorithms, applying continuous tuning, and aligning with security frameworks like NIST and CIS AWS Foundations Benchmark. Future research directions propose the development of AI-driven adaptive SIEM systems tailored for cloud-native environments, advanced correlation engines for serverless and containerized workloads, and strategies to optimize licensing and resource utilization. This systematic review provides cybersecurity practitioners, cloud architects, and researchers with a comprehensive understanding of SIEM integration complexities and evolving practices in AWS infrastructures, ultimately contributing to improved cloud security postures and operational resilience in the face of sophisticated cyber threats.

Business/IT alignment can be considered a key challenge in IT governance and becomes especially important in IT-heavy and internet based business models. Recent discussions express the need for a bi-directional paradigm for internet based business models. IT governance frameworks support business/IT alignment but mostly follow a business-driven alignment paradigm. We identify characteristics of internet based business models and examine how the IT governance framework COBIT 5 can integrate these characteristics under consideration of a bi-directional business/IT alignment process. We reveal that requirements for internet based business models are not fully covered by the framework. Based on a structural description of internet based business models and the COBIT 5 Goal Cascade, we explain these specific requirements and propose a possible integration of a bottom-up alignment. With this work we provide guidance in the challenge of business/IT alignment for internet based business models and show pathways for IT governance frameworks to better support a bi-directional alignment.

Higher Education Institution are complex organizations that require an adequate IT infrastructure and information systems to fulfill their mission. IT governance as ‘an important part of enterprise (corporate) governance that articulates the processes, structures and relational mechanisms in the organization that enable both business and IT people to execute their responsibilities in support of business/IT alignment and the creation of business value’. It is evident that there is a lack of studies on IT governance for higher education and no studies conducted yet on this paradigm. Due to the considerable difficulty in implementing IT governance frameworks for different organizations, thus may require different solutions for IT governance. The propose model illustrates how IT governance align with enterprise governance and corporate governance of Philippines’s Higher Education Institution. A Design Science Research (DSR) methodology was adopted which is extensively used in information systems research to solve complex problems. The researchers thus recommends that a combination of COBIT and ISO/IEC 3800 guidelines be adopted and used with a balanced scorecard for enterprise governance as IT Governance Framework for higher education institutions in the Philippines. This will ensure effectiveness and efficiency of IT processes as well as accountability to all stakeholder in the higher educational institutions.

The topic of cybersecurity is becoming increasingly important as the number of cyberattacks continues to grow; it is no longer just a matter of protecting, but rather of detecting cyberattacks at an early stage and responding accordingly.Detecting cyberattacks in organisations is an increasingly difficult task, since the ability of malware to hide from Anti-Virus systems has massively improved.Therefore, more sophisticated security measures are required, to protect complex information systems from cyberthreats.One of the state-of-the-art solutions is a Security Information and Event Management (SIEM) system, which collects all security related information and events on a central location.Thus, it is possible to correlate and better analyse security-related events, detect, and defend sophisticated threats.The deployment of a SIEM system (SIEMS) is a process where all devices in the network need to be registered and integrated.There is no generic model for the evaluation, deployment, and operation of a sufficient SIEMS that can be applied independently of the dedicated vendor.Usually, vendors provide deployment guides for their SIEMS; however, these are product-specific and not scientifically evaluated.Applying Design Science as methodological approach, the goal of this research was to develop and scientifically validate a generic model called EDO4SIEM for the vendor-neutral evaluation, deployment, and operation of a SIEMS in organisations.As desire for future research, the model should be applied in various organisations to confirm its applicability and to further develop it.

Identity and access management (IAM) functions as a core component for today’s enterprises managing digital identities and their access to resources. However, IAM systems are quite isolated from other applications with useful information resulting in individual data pots. By interconnecting these systems, important information on relevant IAM entities like criticality or usage information can be additionally gathered for further improvement. Current IAM landscapes within enterprises are not prepared for such challenges as the data needs to be harmonised, analysed, and verified. Within this work a state-of-the-art IAM architecture in enterprises and existing shortcomings are defined. Based on these, an extended IAM architecture scheme is proposed and described in detail. Key component is the integration of additional information sources for mutual benefit in IAM and external applications. Finally, the approach is applied to two use cases based on real data. They originate from our conducted IAM projects and show the feasibility of the proposed architecture.

Purpose This paper aims to reveal the potential challenges and opportunities for information technology (IT) governance in higher education institutions (HEIs). Furthermore, the authors extend what the identified determinants mean for Saudi universities. Design/methodology/approach This study pursued a systematic literature review applying the Preferred Reporting Items for Systematic Reviews and Meta-Analyses strategy protocol. Findings IT governance is both beneficial and challenging to integrate into the higher education setting. This is because most IT Governance frameworks are created and implemented in a traditional organizational setting, which differs from the overall culture of HEIs. As for the context of Saudi Arabia, findings depict a hopeful picture for the future of IT Governance, as HEI stakeholders are primarily aware of IT Governance policies, but Saudi HEIs are yet to work toward this goal systematically. Research limitations/implications Apart from extending the current literature on IT governance, this paper adds the educational perspective and the Saudi context, which is found to be limited in the existing literature. The findings could be used to benchmark the IT Governance scenario in other countries, wherein this study could support the roadmap of effective IT governance adoption in HEIs in various nations. Originality/value This study could support improving the institutional operational performance of HEIs in Saudi Arabia, particularly in terms of electronic monitoring systems, effective monitoring of processing systems, prevention of fraud and reducing the manipulation and wasting of funds. The insights from this study could be beneficial to government policymakers, higher education managers, researchers and academics.