Multicriteria Decision Analysis on Information Security Policy: A Prioritization Approach

Information security has become an issue that reaches the organizations, once it puts at risk the continuity of the businesses. On the basis of literature review this research identified six constructs of information security (Integrity, Availability, Confidentiality, Equipment, Policies and Procedures and People). These constructs had been used in a survey electronic questionnaire, where one sample composed by 129 users of accounting information from various Brazilian organizations provided their perceptions regarding information security. These data allowed the realization of a gap analysis which consisted in comparing the means of assessment (how the respondent evaluates information security in your organization) and importance (how much the respondent considers information security important) attributed to each construct of information security. As a result, it was evidenced the existence of statistically significant gap s for all the six constructs of information security checked, showing that the organizations are giving less importance to the matter than expected by respondents. The People construct presented the largest gap of this research, suggesting that the organizations face difficulties to control the human component in information security, and people are not aware of the importance of their role in the effectiveness of information security in the organizations.

This article discusses the actual issues of training mediators–translators in the light of the changes of the political situation in the country and overseas. The mediator–translator should use the digital environment, could possess knowledge of lingua-sociocultural and information security, and smooth out intercultural conflicts in the translation process. The goal of this research is to clarify the types of professional activity of the mediator-translator who functions in the digital environment with the focus on the information and lingua sociocultural security, and to define special skills of future mediators-translators for their development in the process of the university professional training. Methodology and research methods include the analysis and the synthesis of scientific literature on translation’s studies, cultural studies, psychology, linguistics, computer science, mediation and the analysis of Russian Federation government documents on the information security. Results. The main types of professional activity and requirements to the mediator-translator in the digital educational environment with focus on the information and lingua sociocultural security are clarified. The mediator-translator as “homo informaticus”- (human of information) within current changes is a specialist who values his or her sense of identity, permanently improves his or her mother tongue, protecting the Russian language from foreign influence, and critically tracks the information on translation machines within the digital environment. In conclusion the article presents the learning prospects of mediators-translators in Russia. The paper will be useful for teaching and learning foreign languages, intercultural communication, theory and practice on translation, pedagogy.

INTRODUCTION Today, in large part, information security is the implementation of controls and best practices suggested by consultants, standard governing bodies (i.e. National Institute of Standards & Technology) (NIST), International Organization for Standardization / International Electrotechnical Commission (ISO/IEC), etc.), the organization's information security department and, sometimes, the organization's employees. While the use of global standards of practice, top management and the information security department within the organization to guide information security planning and implementations may be useful, existing research consistently shows a positive relationship exists between user involvement in planning and the effectiveness of the information systems function within organizations (Gottschalk, 1999; Sambamurthy et al., 1994; Segars & Grover, 1998). A deliverable of the information security planning process is the organization's information security policies and procedures. Standard governing bodies (NIST, ISO/IEC) and researchers (Bidgoli, 2003; Garrison & Posey, 2006) stress the importance of creating information security policies and provide guidance on the different types of information security policies that an organization may need. This research attempts to examine the impact of end-user involvement and formalized information security policies on the effectiveness of the information security function within organizations. Specifically, this study focuses on two antecedent variables, collaborative exchange and formalization, and how it impacts the effective utilization of the information security strategies of deterrence, detection and recovery. Collaborative exchange is an assessment of the extent of collaboration between upper-level management, end users and the information security function. Formalization is an assessment of the extent of established formal information security policies within an organization. The purpose of this research is twofold. First, this research aims to examine the individual effects of formalization and collaborative exchange on the effectiveness of information security detection, deterrence, and recovery activities. Much of the effort expended in the management of information security is in developing and enforcing information security policies. By examining formalization separately, the impact of information security policy development on effective utilization of information security strategies can be assessed. The second aim of this research is to examine the impact of collaborative exchange and formalization in concert on the effectiveness of information security detection, deterrence, and recovery activities. Evaluating complementary effect of collaborative exchange and formalization on effective utilization of information security strategies provides evidence supporting the importance of establishing information security policies with input and effort from all major constituencies within the organization. This study makes several contributions to the literature and practice. First, this research provides insight into how management choices in regards to establishing formal communication channels and developing information security policies may impact the effectiveness of the information security function. Second, the presence of the dependent variable, effectiveness of detection, deterrence and recovery activities, gives academics and practitioners a success measure which can guide more effective decision making in the information security domain. The remainder of this manuscript is organized as follows. The next section discusses the literature supporting the constructs of interest in this study. The following two sections will present the methodological approach taken in this study and the results of data collection. The next section will present the efforts in data analysis. The last section will present a discussion of the important findings and limitations of this research. …

"This book offers insightful articles on the most salient contemporary issues of managing social and human aspects of information security" - Provided by publisher

The paper compares information security policies of two countries, Russia and Armenia. Provided the common historical past, two countries have a close cultural, historical and, partially, language basis. Moreover currently both countries tightly cooperate, particularly, in political, economic, and military fields. As cases for comparison, we choose countries – members to such international regional organizations, as Eurasian Economic Union (EEU) and Collective Security Treaty Organization (CSTO). In accordance with the Index of Democracy, Armenia and Russia are countries in democratic transition. However they have different approaches to information security – more liberal in case of Armenia and more centralized in case of Russia. We use two levels (legal and practical) to analyze cyber strategies, institutions and experience (policies) of two countries. First of all, we provide deep and comprehensive literature review on information security. The latter is performed on the following aspects of international information security: theoretical, legal, activities of international organizations, as well as Russia and Armenia positions on these issues. Second, we analyze key theoretical concepts (information security, information warfare, etc.) and approaches to them in academic and political communities. Third, we reveal basic doctrines and policy papers regulating information security policy in these states. One of the ways to evaluate information policy effectiveness is based on comparison of countries’ positions in global rankings (e.g. ITU Global Cybersecurity Index). In addition the research considers official statistics data, experts’ surveys, public opinion polls and media publications.

The article addresses the problem of the discrepancy between declared information security policies, the requirements of standards and protocols, and the actual functioning of organizational information infrastructures. In practice, components of comprehensive information security systems (CISS) are often developed formally, without considering real risks, characteristics of network protocols, or compliance with international and national security standards. As a result, information security policies are not aligned with technical configuration parameters, leading to fragmentation of protection mechanisms and a decrease in overall system effectiveness. Another critical issue is the continued use of outdated or insecure protocols that remain operational due to the absence of systematic compliance control mechanisms. This study proposes a method for integrating information security policies, standard requirements (ISO/IEC 27001:2022, NIST SP 800-53, Ukrainian ND TZI), and secure network protocols (TLS 1.3, SSHv2, DNSSEC, IPSec) into the process of developing a comprehensive information security system. The method consists of four stages: asset and protocol analysis, development and formalization of security policies, compliance mapping with standards, and construction of an integrated CISS architecture based on the obtained results. To quantitatively assess the consistency of CISS components, a compliance scoring algorithm is introduced, enabling objective evaluation of the information infrastructure’s conformity with regulatory requirements and internal policies. Experimental validation of the method in a test environment demonstrated an increase in compliance with standards from 52% to 92%, the elimination of outdated or insecure protocols (FTP, SMB1, HTTP), and improved accuracy of CISS parameterization due to automated mapping of policies to technical security mechanisms. The obtained results confirm the feasibility and effectiveness of the proposed method for designing and modernizing CISS in organizations of various types. The purpose of this study is to develop a method for integrating information security policies, standards, and protocols into the formation of a comprehensive information security system within an organization.

One of the priorities in the field of national security in modern conditions, taking into account new challenges and threats, is ensuring the security of the “sphere of meanings”, which forms the socio‑humanitarian dimension of information security. Protecting individual and public consciousness from destructive informational influence is currently recognized as an important condition for ensuring personal, public, and state security. Understanding the ongoing “shifts” in the structure of information security, reflecting the recognition of the socio‑humanitarian component as an integral element, is the basis for developing a paradigm of legal regulation of the information circulation sphere. The legal outlines of the information‑psychological component of the information sphere, which are emerging today in strategic planning documents and industry legislation, reflect the approach to defining its place in the national security system, which was fixed at the doctrinal level more than two decades ago. In turn, the ongoing legal institutionalization of the information‑psychological security of the individual and society as a socio‑humanitarian component of information security requires its normative articulation. The method of axiological analysis of the socio‑humanitarian component of information security allowed the author to determine its place in the system of national interests protected by criminal law, and to substantiate the need to improve the criminal law mechanisms for its provision. The author’s conclusions about the implicit nature of the legal contours of information security, the actual recognition of it as an integrative object of criminal‑legal protection, including technological, humanitarian and social elements, are based on a discursive analysis of the criminal law based on its axiological interpretation. The socio‑humanitarian component of information security, defined in scientific legal discourse as informational‑psychological security of the individual and society, has gained the status of a legally protected good in the context of modern challenges and threats, the protection of which is ensured by a system of criminal law measures against destructive informational influence on individual and public consciousness as a form of criminal activity. Considering the criminal‑legal institutionalization of information security as an integrative object of criminal law protection, its formalization within the hierarchy of values protected in the list in Part 1 of Article 2 of the Russian Criminal Code appears important.

Aim/Purpose: This paper examines the behavior of financial firm employees with regard to information security procedures instituted within their organization. Furthermore, the effect of information security awareness and its importance within a firm is explored. Background: The study focuses on employees’ attitude toward compliance with information security policies (ISP), combined with various norms and personal abilities. Methodology: A self-reported questionnaire was distributed among 202 employees of a large financial Corporation Contribution: As far as we know, this is the first paper to thoroughly explore employees’ awareness of information system procedures, among financial organizations in Israel, and also the first to develop operative recommendations for these organizations aimed at increasing ISP compliance behavior. The main contribution of this study is that it investigates compliance with information security practices among employees of a defined financial corporation operating under rigid regulatory governance, confidentiality and privacy of data, and stringent requirements for compliance with information security procedures. Findings: Our results indicate that employees’ attitudes, normative beliefs and personal capabilities to comply with firm’s ISP, have positive effects on the firm’s ISP compliance. Also, employees’ general awareness of IS, as well as awareness to ISP within the firm, positively affect employees’ ISP compliance. Recommendations for Practitioners: This study can help information security managers identify the motivating factors for employee behavior to maintain information security procedures, properly channel information security resources, and manage appropriate information security behavior. Recommendation for Researchers: Researchers can see that corporate rewards and sanctions have significant effects on employee security behavior, but other motivational factors also reinforce the ISP’s compliance behavior. Distinguishing between types of corporations and organizations is essential to understanding employee compliance with information security procedures. Impact on Society: This study offers another level of understanding of employee behavior with regard to information security in organizations and comprises a significant contribution to the growing knowledge in this area. The research results form an important basis for IS policymakers, culture designers, managers, and those directly responsible for IS in the organization. Future Research: Future work should sample employees from another type of corporation from other fields and should apply qualitative analysis to explore other aspects of behavioral patterns related to the subject matter.

The key threat to information security is constituted by careless employees who do not comply with information security policies. To ensure that employees comply with organizations’ information security procedures, a number of information security policy compliance measures have been proposed in the past. Prior research has criticized these measures as lacking theoretically and empirically grounded principles to ensure that employees comply with information security policies. To fill this gap in research, this paper advances a new model that explains employees’ adherence to information security policies. In this model, we extend the Protection Motivation Theory (PMT) by integrating the General Deterrence Theory (GDT) and the Theory of Reasoned Action (TRA) with PMT. To test this model, we collected data (N = 917) from four different companies. The results show that threat appraisal, self-efficacy and response efficacy have a significant impact on intention to comply with information security policies. Sanctions have a significant impact on actual compliance with information security policies. Intention to comply with information security policies also has a significant impact on actual compliance with information security policies.KeywordsInformation SecuritySecurity PolicyActual ComplianceResponse EfficacyThreat AppraisalThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

With increasing dependence on information technology and information system, enterprises are confronting with a more and more complicated information security environment. Thus, information security has become an intractable problem for many enterprises. Generally speaking, there are two methods to improve enterprises’ information security level, that is, technology and management means. Technology means mainly settle software and hardware security of computers and networks, while management means mainly regulate and restrain the entire enterprise system including software, hardware, and employees. At present, a lot of enterprises mostly employ the technology means to solve information security problems. However, the lack or imperfection of information security institutions leads to bad enterprise information security situation. Therefore, technology and management means to solve information security are complementary to each other. As such, it is urgent and necessary to establish and improve information security institutions for many enterprises. In fact, enterprise information security is a complicated activity which needs different sectors to get involved in. More specifically, the information security departments play the very critical role in the implementation of information security institutions, and all employees should comply with the information security policy. Therefore, only the top management teams have the ability to coordinate the relationship between different departments, determine the introduction of information technology, and deploy the information systems. In response, top management support has an important impact on the construct of information security institutions and the effectiveness of information security management. So far, few studies have investigated the mechanism that how top management support affects information security legitimation, and legitimation information security management. Therefore, it has great theoretical and practical significance to the exploration of whether the legitimation supported by top management can improve the effectiveness of information security management. The objective of the current study is to explore whether legitimation prompted by top management team can improve the effectiveness of enterprise information security management. By doing so, the data was collected from the enterprises which have passed the certification of information security management system, and analyzed by using PLS-SEM. The results indicate that information security awareness can improve top management support（including top management belief and top management participation）and the effectiveness of information security management respectively. In addition, top management belief can improve implementation（the first stage of legitimation）and internalization（the second stage of legitimation）. Moreover, implementation can improve the effectiveness of information security management. This paper analyzes the way to enhance effectiveness of information security management, which has a reality-oriented meaning for prompting information security management of enterprises from the standpoint of institution.

Self-efficacy in information security: Its influence on end users' information security practice behavior

Information as one of the important assets in an organization has a strategic value in particular conditions should fulfill confidentiality, integrity, availability, compliance, and reliability. In performing its functions, most organizations have a security threats, therefore it is necessary to implement the governance of information security to protect information that has strategic value. In managing information, information security aspects such as confidentiality, integrity and availability is a very important aspect to be considered to business process sustainability and to achieve the objectives of the organization. To ensure information security in an organization, information security governance could be one of the strategies actions that can be implemented. COBIT 5 provides a comprehensive framework that helps companies in achieving their goals for the governance and management of enterprise IT. COBIT 5 for Information Security is built based on COBIT 5 framework that focuses on information security and provides more detailed guidance and more practical for security information. This paper discusses how to design an information security governance using COBIT 5 for Information Security and Analytic Network Process to select the priority objectives of the organization.

У статті досліджено концептуальні й прикладні аспекти «гострої сили» Китаю як нової технології впливу в міжнародній політиці, що спрямована на досягнення конкурентних переваг за допомогою інформаційних операцій, кіберзагроз і маніпулювання новинним контентом мас-медіа й соціальних мереж, проаналізовано зміни в стратегії інформаційної безпеки Китаю з огляду на використання такого інструментарію, як сучасна форма політичної діяльності держави в міжнародних відносинах. Інструментарій «гострої сили» може включати спроби окремих міжнародних акторів управляти інформацією про себе в мас-медіа, освітніх і культурологічних системах іншої країни аби ввести в оману або розділити громадську думку в обраній країні чи відвернути увагу від негативної інформації про себе. Зокрема, китайські урядові інституції здійснюють підтримку своєї політики та інформаційної безпеки шляхом нейтралізації критики Китаю за межами країни, намагаються впливати на міжнародну взаємодію через «гостру» дипломатію, яка зумовлюється ідеологією, що підтримує привілеї державної влади над особистою свободою і є принципово ворожою для відкритих дискусій та незалежної думки. З’ясовано, що Китай має різні позиції щодо політики «гострої сили» як складової частини інформаційної безпеки на міжнародному й національному рівнях, що зумовлюється технологічними інноваціями в телекомунікаціях та соціальних медіа, які вважаються викликом для глобальної демократії, проведення відповідної правової міжнародної політики та ефективного співробітництва. Уключення контенту «гострої сили» до стратегії інформаційної безпеки Китаю свідчить про спрямоване позиціонування політики країни у світі, оперативне реагування щодо забезпечення національних інтересів і формування прийнятної для Китаю громадської думки щодо ролі держави в процесах глобального управління.

The development of the post-industrial society requires the acceleration of the integration of the national economy into the globalized economic space. This stage is characterized by active informatization of all spheres of life in society, which requires information security and cyber protection for high-quality information provision of the country’s population, intellectualization of economic processes and prevention of destructive informational influence on the social status of the individual. It is also necessary to consider that for Ukraine the specified stage is complicated by the hybrid war with Russia, which requires strengthening the protection of information from cyber-attacks and the formation of new approaches in preserving the quality of information on social networks. Therefore, the purpose of this article is the development of scientific and methodological approaches in information security management, strengthening its social significance. This requires solving a certain range of tasks of identifying and preventing socially dangerous information based on the use of economic and mathematical methods and models. The article highlights the main directions of socialization of modern technological development and theoretically substantiates its significant impact on human consciousness and behavior, puts a person in front of serious challenges and, under conditions of hybrid warfare, requires strengthening of information security in social networks. In the work, the components of information security are supplemented, its impact on social aspects of society’s life is highlighted. As a result of the research, the authors proposed a scientific and methodical approach to the construction of a system for countering the spread of socially dangerous information in social networks. Besides, its functional elements are highlighted. A method of combating the spread of harmful information in social networks has been developed, which solves the problem of information support of the decision-making process and includes providing the chosen and alternative options to the person making the decision, with the justification of the choice. This creates prerequisites for information support for making a well-founded management decision.

As organizations’ interest in information resources expands, their investments in information security (IS), such as the introduction of IS policies and new technologies, are also expanding. Nevertheless, IS incidents and threats within the organization have not decreased. This study aims to protect organizations’ information assets by maintaining the level of continuous IS behavior of the organization insiders. Moreover, this study suggests a method to induce continuous security behavior of individuals by confirming the relationship between IS-related voice behavior and IS-related organizational justice, which is an action concept that provides continuous opinions to achieve security goals. This study derives research models and hypotheses through previous studies and tests hypotheses through structural equation modeling. The target subjects are members of the organization who introduced the IS policy. A total of 325 samples were secured through the questionnaire method, and hypotheses were verified. Results reveal that voice behavior related to IS is negatively influenced by work impediment and positively influenced by organizational identification. In addition, procedural and information justice that influence prior actions related to IS affect the cause of personal security behavior (work impediment and organizational identification). Additionally, justice sensitivity adjusted the impact relationship between IS-related organizational justice and the cause of security behavior. The study presents the importance of voice behavior in maintaining the level of IS within the organization continuously. Moreover, it has practical implications in that efforts to improve organizational justice and voice behaviors vary according to the level of individual justice sensitivity.