IT Security Risk Management under Network Effects and Layered Protection Strategy

The article considers main methods to use intelligent techniques and algorithms, synthesized on their basis, as well as examinesdata presentation of network monitoring for IT security risk management of secure multiservice networks. The mathematical model of intelligent data presentation is developed and examined for IT security risk investigation and assessment.

With the recent spate of high-profile data breaches, security-conscious organizations realize that their financial viability and business continuity depend on effective IT security risk management. Given the potential fallout of a breach, many organizations rely on vulnerability and compliance management initiatives to keep their critical information secure, protect sensitive systems, and demonstrate compliance with regulatory requirements. These efforts are further complicated by burgeoning new security exposures introduced by a proliferation of applications, employee-owned devices, mobile computing, social networks, and other expanding attack surfaces. As well, critical compliance regulations, such as PCI, HIPAA, and Sarbanes-Oxley, also mandate specific security controls pertaining to vulnerability management. Unfortunately, there’s no way around the harsh reality that noncompliance results in penalties, lost business, and other indirect costs. Additionally, aligning internal security processes with regulations and providing meaningful reports to management and auditors are notoriously time-consuming and costly exercises.

Cybersecurity social networking is a new scientific and engineering discipline that was interdisciplinary in its early days, but is now transdisciplinary. The issues of reviewing and analyzing of principal tasks related to information collection, monitoring of social networks, assessment methods, and preventing and combating cybersecurity threats are, therefore, essential and pending. There is a need to design certain methods, models, and program complexes aimed at estimating risks related to the cyberspace of social networks and the support of their activities. This study considers a risk to be the combination of consequences of a given event (or incident) with a probable occurrence (likelihood of occurrence) involved, while risk assessment is a general issue of identification, estimation, and evaluation of risk. The findings of the study made it possible to elucidate that the technique of cognitive modeling for risk assessment is part of a comprehensive cybersecurity approach included in the requirements of basic IT standards, including IT security risk management. The study presents a comprehensive approach in the field of cybersecurity in social networks that allows for consideration of all the elements that constitute cybersecurity as a complex, interconnected system. The ultimate goal of this approach to cybersecurity is the organization of an uninterrupted scheme of protection against any impacts related to physical, hardware, software, network, and human objects or resources of the critical infrastructure of social networks, as well as the integration of various levels and means of protection.

Digitalization forces manufacturing companies to shift towards customer-oriented, highly data-driven forms of value creation. This results in a changing IT security risk landscape as data becomes an attractive target for adversaries leading to an increasing number of attacks. In order to successfully protect data, it is essential that it is assessed in an integrated manner. Although IT security and data-based value creation have been studied by large research bodies, the existing literature fails to provide guidance on IT security risk analysis in data-based value chains. To contribute to the closure of this research gap, we propose a modeling approach which allocates different data types to value activities and analyses the data types in relation to the properties of relevant IT security risks. The evaluation, conducted with industry experts, reveals that it is not only a company’s primary assets that are of concern but also less important data types subject to significant levels of exposure that bear considerable IT security risks.

GRC is an umbrella acronym covering the three disciplines of governance, risk management and compliance.In this context, IT GRC is the subset of GRC dealing with IT aspects of GRC.The main challenge of GRC is to have an approach as integrated as possible of the three domains.The objective of our paper is to study one facet of IT GRC: the links and integration between IT governance and risk management that we consider today as the least integrated.To do so, the method followed in this paper is first a systematic literature review, in order to identify the existing research works in this field.The resulting contribution of the paper is a set of recommendations established for practitioners and for researchers on how better deal with the integration between IT governance and risk management.It is then complemented by an analysis of ISO related standards, representative of industrial practices.

This work aims to fill theoretical and operational gaps in managing the interfaces and shared impacts of safety and security risks in Liquefied Natural Gas (LNG) ports which threaten the supply chain with high risks and disruption. It proposes a holistic and integrated approach to security risk assessment and management in LNG ports and marine terminals, which are strategically located midstream the supply chain and present credible targets for international terrorism. Rising global demand has focused on safety and security concerns spanning LNG production, transport, distribution, and related infrastructures. To prevent interruptions and to raise supply chain robustness and resilience, LNG port safety and security risk management is viewed from a supply chain perspective and the relationships and shared impacts are examined. A case study embracing multiple research methods engaged expert practitioners in reformulating the prevailing dichotomous approach to risk management. A holistic approach, considered essential, was encapsulated in a practical conceptual model for LNG port integrated safety and security risks and emergency management, including risk prevention, mitigation, emergency planning and response, and port business continuity. Implementation is urgent at LNG ports lacking this approach.

Cybersecurity and information security risks are generally addressed following the guidelines of current standards and best practices, which traditionally point to ISO 31000 risk management. This key exercise to ensure the “known” risks is carried out in a reactive perspective, since not only the risks are known and treated, but also the organization is prepared when one of them materializes. Thus, it is necessary to advance in cyber risk management from the adversary's perspective. That is, to understand both the intentions and their capabilities to get out of the comfort zone of standards, and mobilize the organization to another framework that seeks to detect, deter, delay, confuse and anticipate the adversary. Therefore, this article develops two perspectives of security and cybersecurity risk management (from the victim and the adversary), in order to tune efforts around the treatment of known risks and the development of capabilities to maintain a vigilant posture towards latent and emerging risks, allowing the organization navegate throughout the uncertainties and instability of the current international context.KeywordsRisk managementAdversaryVictimCybersecurityCyberrisk

Software Defined Networking (SDN) is a new paradigm that has shown significant advantages and increased profit for the private network industry. Research and Educational Networks (RENs) started adopting SDN, but there is a lack of understanding of the factors persuading RENs to adopt SDN. The goal of this study is to examine how the SDN technology factors (e.g., advantage, compatibility, testability, observability, complexity, and IT security risk) facilitate RENs’ adoption of SDN. A research model was developed based on the Diffusion of Innovation theory. The study used a positivist approach and collected 216 survey data. The Structural Equation Modeling Partial Least Square (SEM-PLS) was used to analyze the data and the results showed that relative advantage, compatibility, and observability had significant positive effects on the adoption of SDN by RENs. The complexity and testability of the SDN technology did not show significant effects. IT security risk had a positive effect on complexity and a negative effect on SDN adoption. This study provides insights on SDN adoption decision making when it comes to implementing SDN or not in newly formed RENs.KeywordsSoftware Defined Networking (SDN)Research and Educational Networks (RENs)AdoptionSecurityPartial Least Squares (PLS)

In everyday life, we come across multiple emerging applications of CloudIoT like the smartphone, smart television, smart city, smart factory, smart agriculture, etc. CloudIoT is the collaboration of cloud computing and internet of things technology. Even though IoT and cloud are having contradicting characteristics, the collaboration of IoT and cloud helps in solving their issues partially and gives rise to new services. The objective of this study is to develop a model using the structural equation modelling approach to identify the determinants of the CloudIoT technologies adoption in the Indian MSMEs, which have significant contribution in the national growth. The determinants considered for the study were cloud computing, perceived IT security risk, social influence, internet of things, perceived ease of use, perceived usefulness, trust, and intention to use. The data were collected from the 500 respondents of Indian MSMEs. The results of the investigation revealed that cloud computing, social influence, internet of things, perceived ease of use, trust, and perceived IT security risk positively influence the intention to use. The developed model is intended to guide the organisational managers, decision, and policymakers in understanding the relationship between the various determinants and intention to use CloudIoT technologies.

IT risks — risks associated with the operation or use of information technology — have taken on great importance in business, and IT risk management is accordingly important in the science and practice of information management. Therefore, it is necessary to systematize IT risks in order to plan, manage and control for different risk-specific measures. In order to choose and implement suitable measures for managing IT risks, effect-based and causebased procedures are necessary. These procedures are explained in detail for IT security risks because of their special importance.

Enterprise cybersecurity is undergoing significant transformation due to the widespread adoption of agile development and self-steering teams, particularly in large organizations. Traditionally, cybersecurity governance has been centralized, relying on structured coordination across people, processes, technologies, and compliance mechanisms. However, agile methodologies—marked by decentralized, autonomous teams—have shifted organizational dynamics from hierarchical to distributed models. While this enhances responsiveness and innovation, it also introduces fragmentation in cybersecurity responsibilities, complicating unified decision-making and the enforcement of security controls.This study explores how large agile enterprises can effectively manage cybersecurity, with a specific focus on ransomware threats. Through qualitative interviews with nine cybersecurity professionals from a highly digitalized public organization in the Netherlands, the research identifies two core organizational tensions: (1) balancing agility and cyber security in decision making about security controls and risk management, and (2) balancing operational business requirements with cybersecurity improvement.The first tension stems from the fragmentation of cybersecurity responsibilities across agile teams. Respondents reported weakened accountability, inconsistent policy enforcement, and an over-reliance on tools to bridge communication gaps. These challenges are linked to mechanistic thinking—an outdated organizational mindset that views departments as isolated units. This leads to siloed operations and a narrow focus on technical solutions. To address this, the study advocates for a systems thinking approach, which views organizations as dynamic networks of interdependent elements. Systems thinking emphasizes holistic understanding, collaboration, and feedback loops.A key recommendation is the introduction of boundary spanners—individuals who bridge communication gaps between teams and align local actions with enterprise cybersecurity goals. These roles facilitate cross-team coordination, support unified decision-making, and help integrate cybersecurity efforts across the organization.The second tension involves the misalignment between the steady rhythm of operational teams and the dynamic pace of cybersecurity innovation. Operational teams prioritize stability, while innovation efforts require flexibility and rapid iteration. This mismatch is exacerbated by Out-Group Bias, where teams resist adopting solutions developed externally, leading to inconsistent security practices and delayed implementation of improvements.To overcome these challenges, the study proposes a programmatic approach to cybersecurity improvement. A program, defined as a coordinated set of related projects, ensures strategic alignment, resource allocation, and effective decision-making. The approach incorporates short-cycled project phases—explore, experiment, pilot, and scale—each with clear objectives and standardized methods. This structure accommodates operational constraints while ensuring timely progress and shared ownership.A successful example of this method is found in the Dutch financial sector, where the Partnership for Cyber Security Innovation (PCSI) implemented a four-month cycle with joint steering committees. This setup promoted inclusivity, countered Out-Group Bias, and enhanced cross-organizational cybersecurity awareness.In conclusion, the study underscores the need for systemic thinking and structured program management to align agile practices with robust cybersecurity strategies. By addressing internal tensions and fostering collaboration across teams, organizations can enhance their resilience against complex cyber threats while maintaining the benefits of agility. Future work will involve field-testing these models, including training boundary spanners and implementing short-cycled programs, with a one-year implementation horizon recommended for optimal impact.

Emerging smart manufacturing technologies combine physical production networks with digital IT systems, resulting in complex smart factory networks, which are especially vulnerable to IT security risks, such as IT component non-availabilities. Companies must employ extensive IT security measures to secure their production facilities. However, complex network structures and inherent dependencies of smart factory networks complicate corresponding investment decisions and increase the need for appropriate decision support. We develop a risk assessment model that supports companies in the investment decision-making process regarding IT security measures by identifying and evaluating the most critical areas of the information network while considering the underlying production network. For this purpose, IT availability risks are quantified by means of graph theory, matrix notation, and value-at-risk. Our model provides a structured approach and considers network structures and interdependencies. The insights gained by our model present a profound economic basis for investment decisions on IT security measures. By applying our model in an exemplary real-world setting, we analyze various IT security measures and their risk reduction effect.

Construction is a critical sector of any economy in terms of value production, labor, and contributing to the gross national product. Managing risk is a relatively young area in Yemen’s construction sector, but it is gaining traction as building activity and competition rise. Construction firms mitigate risk by using a variety of risk management methods. Therefore, there is a need to assess these procedures in order to detect shortcomings. This research aims to establish the existing risk management strategies used in Yemeni building projects. Survey questionnaires were used to collect data. Respondents were drawn from Yemeni construction businesses. Risk management is not executed systematically, intentionally, or continuously, and most firms’ risk management procedures are reactive, semipermanent, informal, and unstructured, with no or few dedicated resources to address risks. This strategy is inconsistent with generally accepted risk management principles. Nonetheless, the findings suggest a general understanding of risk management and a willingness to learn from previous errors. The study of the findings suggests that risk identification approaches such as judgment and historical data are employed for risk analysis, and that the industry typically attempts to avoid or transfer risks in Yemeni building projects. The results shed light on the shortcomings of Yemen’s project management practices. To guarantee that construction projects obtain maximum value for money, project managers of big construction businesses in Yemen need a strong understanding of and training in globally accepted systematic risk management procedures. Finally, this study can help future stakeholders determine how to work together to manage risk.

Risk management is an essential component of effective campus recreational sport programming. However, research on risk management policies, procedures, and practices within recreational sports is both limited and outdated. As such, this study provides an overview of current risk management policies, procedures, and practices across North American collegiate recreational sports departments. Specifically, the results emphasize current training practices for both part-time and full-time staff, practices in establishing and updating emergency action plans, and contents covered in emergency action plans. The results suggest that while the vast majority of recreational sport programs have established risk management procedures and engage in risk management training, they diverge in best practices related to emergency action plans and in terms of contents covered in such plans. Applications of these results for practitioners and institutions are emphasized, including discussions around best practices in risk management.

The present study integrates external and internal factors for measuring the performance of the organisation through the adoption of cloud computing activities. External factors consisted of perceived IT security risk, risk analysis, and social influence; whereas, trust, technology innovation, and industry usage were considered as internal factors. A statistical approach, namely structural equation modelling, was employed for the analysis of the data obtained through a questionnaire survey. The findings showed that external factors hurt cloud computing adoption (CCA), whereas internal factors and perceived ease of use have a positive impact on CCA. This investigation is intended to guide the policy and decision makers in formulating the efficient strategies/policies for the effective implementation of CCA.