Managing Information Security Complexity

News about various information security attacks against companies appears almost every day. The sources of these attacks vary from cyber-criminals who want to steal companies’ data to demand a ransom, to current or former employees who want to create damage to the organization. The best way to defend organizational critical assets is to implement an Information Security Management System that secures all sensitive assets from confidentiality, availability and integrity perspective. An Information Security Management System offers top management a framework for sensitive information flow control. This framework includes with a risk assessment that considers the security threats and vulnerabilities of the company’s assets. Companies usually implement Information Security Management System only after they have a functional quality management system, which brings clarity and optimization to the company’s processes. Current approaches on creation and implementation of effective Information Security Management System are very theoretical and thus difficult to use in practice. The main objective of this paper is to present an Information Security Management System implementation method in the case of a small company by defining the basic steps in achieving a fully functional Information Security Management System. The proposed methodology considers the top management Information Security Management System objectives, organizational context, risks assessment and third parties expectations fulfillment.

This study examines the effect of an Information Security Management System (ISMS) on organizational performance in a Small and Medium Business (SMB), with a focus on Red Mango Ltd. The study employed a correlational survey design to assess the relationship between ISMS implementation and organizational performance. Primary data was collected from 44 respondents, including management and staff, through structured questionnaires. The convenience sampling technique was used for respondent selection, and data analysis was conducted using the Statistical Package for Social Sciences (SPSS) version 25. Correlation and regression analyses were applied to determine the relationship and effect of ISMS on organizational performance. Findings revealed that ISMS is well-implemented at Red Mango Ltd, with clear policies, structured roles and responsibilities, and comprehensive employee training on security measures. Employees are well-informed about acceptable usage of information security systems, and security incidents are promptly reported. However, several challenges hinder ISMS implementation, including leadership issues, technical system difficulties, personnel constraints, and financial limitations. Despite these challenges, ISMS adoption has led to significant benefits, including regulatory compliance, optimized business processes, cost savings, improved information security awareness, enhanced company reputation, and increased productivity. The study further established a strong positive correlation between ISMS implementation and organizational performance at Red Mango Ltd. Regression analysis indicated that a unit increase in ISMS adoption results in a 0.495 increase in organizational performance, confirming its significant impact. The study concludes that effective ISMS implementation enhances security, improves operational efficiency, and contributes to overall business success. Organizations are encouraged to address implementation challenges through leadership commitment, technical capacity building, and financial investment to fully realize ISMS benefits.

In the wave of the progressive informatization process, Korean enterprises are making a vast amount and range of investments in the information security sector in order to counter the information dysfunction. In addition, to achieve an objective evaluation thereon, they have been increasingly exhibiting a preference for a certification system of information security management, as developed by the government This study aims to reduce the possible trials and errors while promoting the establishment and certification of the information security management system by enterprises. To satisfy this purpose, this study presents the defects by item found during the certification process of the information security management system of a number of enterprises. By analyzing the derived defects, we have outlined the issues to be attended to among enterprises at each stage of the establishment of an information security management system. The study also presents a reference model for conducting a self check, so that companies may be able to self-verify the completeness of their establishment of the information security management system. Through the results of this study, enterprises will be able to self-verify their completeness levels when promoting the establishment and certification of the information security management system, and improve the efficiency and effectiveness thereof so as to raise the general level and awareness among enterprises of the importance of information security.

This paper presents an ongoing case study into stakeholder perceptions regarding information security management systems in emergent organisations operating in Western Australia. It takes a socio-political perspective on the problem of how to manage simultaneously virtual collaboration and information security management. A literature review introduces the context and history of the research. In light of this, it is proposed that social and political issues need to be researched and addressed before many of the existing technological strategies for information security will succeed. The research project is then outlined and the design and preliminary results presented. The results point to a lack of clarity and cohesion amongst stakeholders about how their information security management systems operate and who has ownership of the security function. This emerging trend is discussed and the plans for future research explained.

The purpose of this study was to investigate and analyze the assumptions and requirements for the implementation of Information Security Management System (ISMS). Methodology: To check assumptions security management system implementation is the population of Tabriz hospitals. Review the requirements and assumptions are based on the standard ISO / IEC 27001, ISO / IEC 27002 test target setting and ISO 27001 standard questionnaire containing 33 questions in 11 control is used. The data were analyzed using descriptive and inferential statistical method that factors in the implementation of information security management system was confirmed. As well as to identify factors contributing to the implementation of information security management system and factor analysis, structural equation model was used PLS smart software that based on its findings to impact and indirect aspects of implementation effectiveness of the system. Results: Using the software, smart-PLS and using structural equation modeling confirmatory factor analysis was performed to measure the test of convergent validity, divergent validity, reliability Security and reliability of observable variables and quality test and measurement model of the 101 comments experts, all the prerequisites and requirements, including information security policy, the organization of information security, asset management, human resources in terms of security, physical and environmental security, communications and operations management, access control, use, development and maintenance, incident management information security, business continuity management and compliance with laws in secure level at %99 is forecast in Tabriz hospitals are effective information security management system. Conclusion: According to prioritize the factors affecting information security management system, operating (after) the most monitors and agents (after) the supply and implementation of information security management system least affected are in Tabriz hospitals.

The article justifies the imperatives of applying the situational approach to information security management (ISM). We modified the model of the Information Security Management System (ISMS), which is the basis of ISO/IEC 27005: 2011: we added the “Decision Making” stage after the “Determining the main criteria” step. The solution is to choose an approach to proccesing information security risks — their assessment, impact and taking — based on certain criteria. Using the developed algorithm, we implemented a cognitive software module of the information system management (ISM) in an educational institution. The use of the cognitive software module has significantly reduced the labor costs of specialists in the Information Security (IS) Department, including automation of the reporting procedures. The application of the situational approach allowed us to integrate a person into the automated system to ensure the cybersecurity of the educational sector.

The human resources management is one of enterprise most important functions, how will attract, remains in office with the drive more and more diverse manpower or the attraction, obtains and has has suitably no matter what technical, the knowledge and ability talented person, will let the organization have the competitive power to become an important subject (Walton，1985). Although information digitizing brings the conveniences which many manages, but the security problem also starts to prepare is challenged. This research mainly aims at the customer information of human resources the protection part to make the thorough discussion, understands each kind of influence customer information the threat, as well as understanding practical realm to customer information management measure why. This study takes the financial insurance business object of as the this research, conducts the research in view of the information security management system in influence human resources part, understands in the information security the human resources whether for most main security loophole. This study discovered the customer information the protection involves the scope is quite widespread, including entity security, human affairs security, communication security and operational security. Between each other close correlation, complements one another, is unable alone to exist. In order to strengthen the customer information the safe protection, may from obtain the higher order manager's support, the enhancement education and training guidance, strengthens the personal security to control the tube, the establishment “wickedly by the human nature this” and embraces “the guard for the starting point not however” point of view aspects and so on management mechanism carries on.

To date, the issue of security of information system resources in the presence of threats in the global information sphere is one of the most urgent both in Russia and in the world. This is due to stricter requirements for companies that store and process personal data. Recently, more and more companies of large and medium-sized businesses regularly face the resolution of incidents related to data loss as a result of cyber attacks or violation of established information security regulations by the company's personnel. In this regard, priority attention to information security has become a necessity for running a successful business. An information security management system — ISMS) is a part of an organization's overall management system based on a risk-based approach to managing information security. SMIB allows not only to minimize the risks associated with information security, but also can give a serious competitive advantage in the global market.

This paper proposes a technique for the design and implementation of the information security management system (ISMS) for small and medium enterprises (SMEs). The technique is based on ISO 27001 standard ISMS requirements object model. The model was designed using methods and tools of the information security integral engineering (ISIE) framework, so the first part of the paper also briefly describes some features, components and engineering methods within the ISIE framework, which are important in practical applications but were presented insufficiently or were not presented at all in the previous papers. Along with the description of a general ISMS design and implementation method, the paper provides an example of the application of this method to design ISMS for city medium telecommunication SME. The paper also gives the evaluation of the technique's efficiency.

Information Security Management System (ISMS) implementation in Institution is an effort to minimize information security risks and threats such as information leakage, application damage, data loss and declining IT network performance. The several incidents related to information security have occurred in the implementation of the Academic System application in Indonesian higher education. This research was conducted to determine the maturity level of information security practices in Academic Information Systems at universities in Indonesia. The number of universities used as research samples were 35 institutions. Compliance with the application of ISO 27001:2013 standard is used as a reference to determine the maturity level of information system security practices. Meanwhile, to measure and calculate the level of maturity using the SSE-CMM model. In this research, the Information System Security Index obtained from the analysis results can be used as a tool to measure the maturity of information security that has been applied. There are six key areas examined in this study, namely the role and importance of ICT, information security governance, information security risk management, information security management framework, information asset management, and information security technology. The results showed the level of information security maturity at 35 universities was at level 2 Managed Process and level 3 Established Process. The composition is that 40% of universities are at level 3, and 60% are out of level 3. The value of the gap between the value of the current maturity level and the expected level of maturity is varied for each clause (domain). The smallest gap (1 level) is in clause A5: Information Security Policy, clause A9: Access Control, and clause A11: Physical and environmental security. The biggest gap (4 levels) is in clause A14: System acquisition, development and maintenance and clause A18: compliance.  Â

This research examined information security as a comprehensive strategy for risk management in the digital world. A literature review was conducted, including frameworks, international standards and best practices. Cyber-attacks, malware, phishing and data leakage are some of the main risks and threats to information security in the digital world. Comprehensive risk management strategies and measures were compiled, including the implementation of an ISO/IEC 27001-compliant information security management system (ISMS), staff training and awareness, adoption of security technologies, and incident response.

The subject of research in the article is the management of vulnerabilities in the information security management system. The purpose of the work is to consider modern standards that establish and regulate the management of vulnerabilities and risks associated with vulnerabilities. The article considers the process of integration of vulnerability management into information security management system and its form. Conclusions: modern information security management system does not properly take into account vulnerabilities and risks associated with vulnerabilities, the current regulatory framework of Ukraine almost does not regulate and does not set requirements for information security systems in the field of vulnerabilities. Currently, the processes of risk management and assessment are entrusted to administrators, so effective management of vulnerabilities requires a clear system of rules and methodologies. The development of such a system is a promising task, and in the process of modernization of standards, requirements of Ukraine after some time will become a necessity. When adding a quality vulnerability assessment system, such a system will be clear, standardized and will serve as a guide to action in a particular situation

Information is the life blood of all modern organizations yet the news media continue to report stories of critical information loss. The purpose of information security is to protect valuable assets, such as information, hardware, software and people. The majority of information security specialists believe that promoting good end user behavior and constraining bad end user behavior is an important component of an effective Information Security Management System (ISMS). Implementing effective information security involves understanding security-related risk, then developing and implementing appropriate controls. In general the better employees are at applying the controls the more secure the organization will be, because even the best designed technical controls and procedures will be of limited value if the staff involved do not understand why they have been implemented and what they are accomplishing. Achieving the required level of understanding usually requires more than an annual awareness training initiative and represents a major challenge for most organizations. In fact, for many organizations it will involve a cultural change to ensure the integration of information security concepts into the organizational culture.

Computer security policies are relatively new to many organisations, particularly regarding their Information Security Management Systems (ISMS). Although their conceptual origins date back to the 1980s, verifying these policies computationally remains a significant challenge. This research proposes a new tool for the verification of ISMS policies based on the VPD methodology. This methodology assesses information security policies and their compliance with ISMS by comparing the set of directive policies (M1) with the implemented policies (M2). The case study presented in this paper involves the M2 policies implemented in the security system of the Mayor’s Office in the municipality of Funza, Cundinamarca. These are based on established standards, such as ISO 27001, ITIL best practice libraries, the OISM3 guidelines, and Colombian government regulations—particularly those aligned with standards set by the Ministry of Information and Communication Technologies (MINTIC). The main contribution of this research is the development of ESVIT, an expert system built upon the VPD methodology to support the evaluation of policies in both public and private sector entities.

Рассматриваются законодательные акты в области защиты банковских транзакций в национальной системе массовых электронных платежей (НСМЭП), ее структура. Проводится анализ основных источников угроз конфиденциальности, целостности и доступности данных, рассматриваются основные требования стандартов к функциям системы управления информационной безопасностью, программные средства технических систем безопасности информации в банковских институтах Национального банка Украины.