Improving Information System Flexibility through Remote Dynamic Component Configuration

HOW MUCH ICT SECURITY HAS IMPROVED DURING THE LAST DECADE

The purpose of information systems (IS) security behavior, represented by the difference between work and personal purpose, has been neglected in the research of user's IS security behavior. This is especially important for the organizations that allow or inevitably allow their employees to do personal tasks during work hours, because it may bring big threats to an organization's IS. Unfortunately, few empirical studies have examined if different behavioral purpose, typically, work/personal purpose, affects users' IS security behavior decision. Based on boundary theory and the idea of multidimensional rationality, we argue that people demarcate a psychological boundary for work and personal usages of IS and thus apply different rationalities to make IS security-related decisions. Our empirical investigation indicates that in a work usage context, people apply rule-based rationality and therefore are more influenced by mandatoriness and facilitating conditions. Whereas in a personal usage context, people apply outcome-based rationality and therefore are more concerned with task benefits and costs. The findings imply that organizations and vendors may devise different measures to ensure users' IS security behavior in different contexts.

Software product lines (SPL) dynamic configuring process could use methods for recommendation system (RS) elaboration. An overview and analysis of such methods was done in this paper. SPL represent a set of software systems that have common and variable functional components and use a set of paradigms and methods for development. In the classical static SPL the process of configuring performed before executing and performing in the operation environment (OE), in contrast dynamic software product lines performs after executing in the OE. Through the use of which it is possible to customize software solutions in accordance with the needs of end users. The following possible methods to build RS were considered: clustering, Markov decision-making process, matrix factorization. According to the review of the intelligent RS method development and researching of the functionalities of such systems in some open-source projects it was proposed to use N-dimensional context-dependent tensor factorization method and CARSkit tool system. Functional requirements and software architecture of the RS were developed. It allows to automatize software components configuration in the „Smart Home” (SH) systems that could be implemented with CARSkit software toolkit and algorithms implemented with programming language Python. This implementation allows to build a process for tracking changes in the external environment and transfer information to the SH system and, after analyzing the input data, process it in the RS to track changes in the context information. In the future research some additional quantitative experiments will be performed considering the specifics of the SH systems, additionally quantitative metrics will be used for efficiency assessment of the tensor factorization algorithms to predict the dynamic configurations of software components in these systems. Keywords: recommendation system, software product line, variability, dynamic configuration, architecture.

Ensuring information security in public sector information systems is now more important than ever. Advances in technology and information have not only made daily life easier, but also made the opportunities for cybercrimes vast and inevitable. This study aims to create a framework for evaluation that measure the maturity level of information security in information systems by integrating existing frameworks, NIST Cybersecurity Framework (CSF) and COBIT 2019. The result of this framework development is implemented in a public sector organization called PT XYZ, which has an information system as a tool to assist in the implementation of public services. The Capability Maturity Model Integration (CMMI) method is used to calculate the maturity level. The implemented approach resulted in information security maturity evaluation framework for information systems. This framework includes 118 activities which are divided into 23 categories. The distribution of the integration of the two frameworks contributes 61% activities, the NIST CSF contributes 8% and the COBIT 2019 framework contributes 31% activities. The measurement result of the information security maturity level in the information system at PT XYZ shows that all functions are at level 1 or the initial level. PT XYZ's low information security maturity reveals the critical need for stronger data protection and system resilience. This study introduces a novel approach to demonstrating a practical methodology for integrating two frameworks. The resulting framework enables public sector organizations to assess their security posture, identify areas for improvement, and enhance resilience against cyber threats, strengthening public service and safeguarding data.

Protection motivation theory (PMT) is one of the most commonly used theories to examine information security behaviors. Our systematic review of the application of PMT in information systems (IS) security and the comparison with its application for decades in psychology identified five categories of important issues that have not yet been examined in IS security research. Discussing these issues in terms of why they are relevant and important for IS security, and to what extent IS research has not considered them, offers new research opportunities associated with the study of PMT and IS security threats. We suggest how future studies can approach each of the open issues to provide a new road map for quantitative and qualitative IS scholars.

Security of Organizations' Information Systems (IS) and the Auditors: A Schematic Study

What are the key topics for Information Systems (IS) security researchers? How have these topics been changing, and what topics are emerging to offer new opportunities for research? We address these questions by analyzing the abstracts of 261 articles focusing on IS security that have appeared in leading IS journals and journals devoted to this area. Using Latent Semantic Analysis (LSA) to analyze the text of these abstracts uncovers five primary research topics: Security Design & Management, Business Operations Security, Behavioral Aspects, Authentication & Integrity Controls, and Prevention & Detection. These five primary topics are aggregates of more granular topics that are utilized to find trends to understand the changing complexion of IS security research. Our study contributes by developing the key topics and their trends in this area using an analytical and replicable method to synthesize the existing research.

In an information system, applications often make use of services that they access using the parameters described in their configuration files. Various applications then use different codes to denote the same parameters. When access parameters of a service are modified, it is necessary to update them in every configuration file using them. These changes are necessary, for example because of security policies involving regular changes of passwords, or departure of some system administrators. The database password could be changed for example. When system administrators can not immediately identify all services affected by a change or when they feel they don’t have the skills to edit these files, these parameters remain unchanged, creating critical security flaws. This was observed in more than 80% of the organizations we studied. It then becomes necessary to ensure automatic synchronization of all affected files when changing certain settings. Conventional synchronization solutions are difficult to apply when the relevant applications have already been developed by third parties. In this paper, we propose and implement a solution to automatically update all configuration files affected by a change, respecting their structure and codification. It combines a parameters database, a mapping between the configuration files parameters codes and those of the database, and templates for the generation of files. It achieves the objective for all non-encrypted configuration files.

An Information System (IS) security programme consists of several essential security controls. In order to verify and maintain the effectiveness of an IS security programme, it is pertinent to identify how security controls are compared to each other in terms of their practical implications. This study reports the results from an experience survey to offer insights of the roles of security controls in IS security programmes. Four clusters of security controls were identified with technical security controls (such as authentication and confidentiality) being high on respondents' perceived importance. An approach to develop SAI with weighted security controls is explained to help security administrators conduct security assessments. The results of this study contribute to IS security budget planning and resource allocation. Managerial implications are also reported.

Even though the human component has been recognized to have a crucial role in information systems (IS) security, the human issues have not received much attention. Recently a few approaches aimed at minimizing human‐related faults in the area of IS security have been put forward. This paper analyses different approaches aimed at minimizing user‐related faults. The existing approaches will be analysed from the viewpoint of their theoretical background, the research approaches employed, the research objectives and the organizational role of IS security. As a result, a new taxonomy, a comparison and critical analyses of the strengths and weaknesses of state‐of‐the‐art approaches shall be presented. Moreover, several issues that future research should explore and practitioners should consider when applying the results of the existing research are suggested.

Banks are one of the companies that use computers as a means of information systems. Internal control is used to prevent the possibility of inefficiency, error, and embezzlement of assets. So it is necessary to have a strict information and security system, the quality of the accounting information system and its security is very important for effective internal control to overcome possible errors. This study aims to determine the partial and simultaneous influence between the quality of accounting information systems and the security of accounting information systems on the company's internal control at BJB Purwakarta Sub-Branch Office. This study uses qualitative research and data collection techniques through distributing questionnaires, the analysis used includes, classical assumption test, multiple linear regression analysis test and hypothesis testing using SPSS. Based on the research results, the t test results show that the quality of the accounting information system has no effect on the company's internal control and the security of the accounting information system affects internal control. While the results of the f test show that the accounting information system and the security of the accounting information system affect internal control.

The paper describes a framework and tools for automating the production of designs that can be partially reconfigured at run time. The approach involves several stages, including: (i) a partial evaluation stage, which produces configuration files for a given design, where the number of configurations is minimised during the compile-time sequencing stage; (ii) an incremental configuration calculation stage, which takes the output of the partial evaluator and generates an initial configuration file and incremental configuration files that partially update preceding configurations; and (iii) an optimisation stage for devices or systems supporting simultaneous configuration of multiple components. While many of the techniques are independent of the design language and device used, experimental tools have been developed that target Xilinx 6200 devices. Simultaneous configuration, for example, can be used to reduce the time for reconfiguring an adder to a subtractor from time linear with respect to its size to constant time at best and logarithmic time at worst. The tools have been used in developing a variety of designs, including arithmetic, video and database applications.

The economic market changes constantly, requiring increasingly complex and agile adaptations from organizations. Along with these changes and with the various revolutions that have emerged in these sectors, companies felt the need for something that would facilitate the generation and decision making. In this context arose information systems, which were developed to automate organizations, facilitating the processing of information, and consequently, generating reports, concrete and reliable information for managers. However, it is known that such information processed by humans, it is prone to errors and fraud. Therefore organizations also felt the need of a conference or oversight to certify the systems where this information is generated. Thus emerged auditing systems, through techniques that verifies information systems from physical facilities to the security procedures of the software. The main objective of this paper is to show the main points of systems audit in relation to the security of information systems for the Accounting Advisory’s Offices of Guaraniacu - PR. To reach the proposed goals were developed questionnaires, which were applied to all city offices, with 39 questions, which got 100% of responses. Through research points were demonstrated auditing as physical facilities, safety and contingency, physical access control, backup procedures, network computers, human factor, logical access control and password. He pointed also to the current security situation of the storage location of the servers and system access, and showed preventive measures for the safety of the same. This study was conducted through descriptive research, using the method of survey research in the Offices of Accounting Advisory Guaraniacu PR through qualitative methodology. In this context the systems audit is essential in organizations because it helps the security of information systems, pointing and establishing preventive measures for security of these systems. One concluded that through it, there is a systemic view of organizations, in relation to the information system, then you can point your fails, your mistakes, fraud and abuse by officials and employees and even stranger by having access to restricted information.

Information System Security is essential to ensure the proper functioning of the information system. Weak information system security may result that other people who do not have the right can be entered into the system information without passed the security and perform activities that can damage or destroy data on the information system, even can destroy that information system itself. On one side, security of the information system needs to be improved, like in login process to get into the information system. Login process becames a tool to pave the ways for someone to infiltrate into the information system. There are several ways to do so that login process to be secure, such as anti SQL Injection and Verification login with SMS Gateway. Expected by using the login process with anti SQL Injection and Verification login with SMS Gateway can reduce the occurrence of fraud against Information Systems in STMIK PPKIA Pradnya Paramita Malang. Keywords: Security, Information Systems, and SMS Gateway

Risk management is today a major steering tool for any organization wanting to deal with Information System (IS) security. However, IS Security Risk Management (ISSRM) remains difficult to establish and maintain, mainly in a context of multi-regulations with complex and inter-connected IS. We claim that a connection with Enterprise Architecture Management (EAM) contributes to deal with these issues. According to our research agenda, a first step towards a better integration of both domains is to define an EAM-ISSRM conceptual integrated model. To build such a model, we will improve the ISSRM domain model, a conceptual model depicting the domain of ISSRM, with the concepts of EAM. The contribution of this paper is focused on the improvement of the ISSRM domain model with the concepts of TOGAF, a well-known EAM standard.