Reducing normative conflicts in information security

Information systems user security: A structured model of the knowing–doing gap

The article addresses the problem of the discrepancy between declared information security policies, the requirements of standards and protocols, and the actual functioning of organizational information infrastructures. In practice, components of comprehensive information security systems (CISS) are often developed formally, without considering real risks, characteristics of network protocols, or compliance with international and national security standards. As a result, information security policies are not aligned with technical configuration parameters, leading to fragmentation of protection mechanisms and a decrease in overall system effectiveness. Another critical issue is the continued use of outdated or insecure protocols that remain operational due to the absence of systematic compliance control mechanisms. This study proposes a method for integrating information security policies, standard requirements (ISO/IEC 27001:2022, NIST SP 800-53, Ukrainian ND TZI), and secure network protocols (TLS 1.3, SSHv2, DNSSEC, IPSec) into the process of developing a comprehensive information security system. The method consists of four stages: asset and protocol analysis, development and formalization of security policies, compliance mapping with standards, and construction of an integrated CISS architecture based on the obtained results. To quantitatively assess the consistency of CISS components, a compliance scoring algorithm is introduced, enabling objective evaluation of the information infrastructure’s conformity with regulatory requirements and internal policies. Experimental validation of the method in a test environment demonstrated an increase in compliance with standards from 52% to 92%, the elimination of outdated or insecure protocols (FTP, SMB1, HTTP), and improved accuracy of CISS parameterization due to automated mapping of policies to technical security mechanisms. The obtained results confirm the feasibility and effectiveness of the proposed method for designing and modernizing CISS in organizations of various types. The purpose of this study is to develop a method for integrating information security policies, standards, and protocols into the formation of a comprehensive information security system within an organization.

A security policy which includes the appropriate phases of implementation, enforcement, auditing and review is vital to protecting an organisations information security. This paper examined the information security policy of a government organisation in response to a number of perceived shortcomings. The specific issues identified relating to the organisations security policy as a result of this investigation were as follows: a culture of ignoring policies, minimal awareness of policies, minimal policy enforcement, policy updating and review ad hoc at best, policy framework, lengthy policy development and approval process, no compliance program, no formal non-compliance reporting and an apparent inconsistent enforcement across the whole of the organisation. In response to these identified issues, the following recommendations were made to improve the information security of the organisation: changing the organisations culture, creating an awareness mechanism for policies, improving the organisations culture, create an ICT policy awareness programme, review and re-write existing policies, policy enforcement, policy compliance, policy noncompliance reporting, policy updating and review, improve the policy development and approval process, policy compliance checking and uniform policy enforcement. Whilst it is also likely that a lack of governance contributed to these issues, this aspect was not addressed in this paper. It is hoped that timely implementation of the remedies presented here will increase the organisations information security.

Chapter 1 - Designing a Secure Network Framework

INTRODUCTION Today, in large part, information security is the implementation of controls and best practices suggested by consultants, standard governing bodies (i.e. National Institute of Standards & Technology) (NIST), International Organization for Standardization / International Electrotechnical Commission (ISO/IEC), etc.), the organization's information security department and, sometimes, the organization's employees. While the use of global standards of practice, top management and the information security department within the organization to guide information security planning and implementations may be useful, existing research consistently shows a positive relationship exists between user involvement in planning and the effectiveness of the information systems function within organizations (Gottschalk, 1999; Sambamurthy et al., 1994; Segars & Grover, 1998). A deliverable of the information security planning process is the organization's information security policies and procedures. Standard governing bodies (NIST, ISO/IEC) and researchers (Bidgoli, 2003; Garrison & Posey, 2006) stress the importance of creating information security policies and provide guidance on the different types of information security policies that an organization may need. This research attempts to examine the impact of end-user involvement and formalized information security policies on the effectiveness of the information security function within organizations. Specifically, this study focuses on two antecedent variables, collaborative exchange and formalization, and how it impacts the effective utilization of the information security strategies of deterrence, detection and recovery. Collaborative exchange is an assessment of the extent of collaboration between upper-level management, end users and the information security function. Formalization is an assessment of the extent of established formal information security policies within an organization. The purpose of this research is twofold. First, this research aims to examine the individual effects of formalization and collaborative exchange on the effectiveness of information security detection, deterrence, and recovery activities. Much of the effort expended in the management of information security is in developing and enforcing information security policies. By examining formalization separately, the impact of information security policy development on effective utilization of information security strategies can be assessed. The second aim of this research is to examine the impact of collaborative exchange and formalization in concert on the effectiveness of information security detection, deterrence, and recovery activities. Evaluating complementary effect of collaborative exchange and formalization on effective utilization of information security strategies provides evidence supporting the importance of establishing information security policies with input and effort from all major constituencies within the organization. This study makes several contributions to the literature and practice. First, this research provides insight into how management choices in regards to establishing formal communication channels and developing information security policies may impact the effectiveness of the information security function. Second, the presence of the dependent variable, effectiveness of detection, deterrence and recovery activities, gives academics and practitioners a success measure which can guide more effective decision making in the information security domain. The remainder of this manuscript is organized as follows. The next section discusses the literature supporting the constructs of interest in this study. The following two sections will present the methodological approach taken in this study and the results of data collection. The next section will present the efforts in data analysis. The last section will present a discussion of the important findings and limitations of this research. …

Information security has become an issue that reaches the organizations, once it puts at risk the continuity of the businesses. On the basis of literature review this research identified six constructs of information security (Integrity, Availability, Confidentiality, Equipment, Policies and Procedures and People). These constructs had been used in a survey electronic questionnaire, where one sample composed by 129 users of accounting information from various Brazilian organizations provided their perceptions regarding information security. These data allowed the realization of a gap analysis which consisted in comparing the means of assessment (how the respondent evaluates information security in your organization) and importance (how much the respondent considers information security important) attributed to each construct of information security. As a result, it was evidenced the existence of statistically significant gap s for all the six constructs of information security checked, showing that the organizations are giving less importance to the matter than expected by respondents. The People construct presented the largest gap of this research, suggesting that the organizations face difficulties to control the human component in information security, and people are not aware of the importance of their role in the effectiveness of information security in the organizations.

The Government and industry are currently using information and communication technology a lot. The Government and companies in Indonesia have regulations on operational standards and management procedures for information and communication systems security at Government regarding implementing information system security. Information security is essential because there are many threats to information security. Information security in this era of Information and Communication Technology (ICT) is fundamental. Information Exchange Environment (IEE) vulnerabilities have increased as threats become more widespread and complex; therefore, information security has become a fundamental problem for businesses, organizations, and governments. So, in this paper, we will explain the review of the impact of Information Security For Government and companies in terms of threats and types of information security. Some security system methods are analyzed, among others—application Security, cloud security, Cryptography, security infrastructure, Incident response, and vulnerability management. The results of this review analysis, it known threat has several solutions, each depending on the type of threat for both the Government and the Company. Furthermore, Information Security is considered very important, especially for data stored in Government and companies.

Managing Security Clearances within Government Institutions

When we define the term “social norm”, these three major points should be clarified. (1) The location of social norms : Where are social norms located? Are they internal or external to members of a social group? (2) Their constraints : Do social norms always have coercive powers? Should the social norms characterized by constraints? (3) The process of their generation : Have social norms always generated by almost all the people in a social group? In this paper, I have clarified these three points.(1) From an analytical point of view, there are two different kinds of social norms : social expectations and social rules. A social expectation is a set of personal expectations of the members and it is located in the collectivity of members. On the other hand, social rules are located in a social group as a unit. (2) Constraint is not characteristic of a social norm itself but of the norm perceived by members. Social expectations always have compelling powers through the perception, but social rules do not always have them. (3) The social rules are often established by men of power. But social expectations are not made by them.

Serbia has important role in the regional peace and stability in South Eastern Europe. Over the last three decades Serbian security policies have been directly shaped by numerous turbulent political, social, and economic circumstances. In order the better to understand what determines the patterns of development and perceptions of Serbian security strategy and defence policies, a comprehensive overview of the legislative and institutional mechanisms of Serbian security and foreign policy in combination with content analysis of the key strategic security documents and analysis of the socio-political developments in Serbian society were conducted. After a period of confrontational discourse and abuse of the security system, the democratic changes in Serbia in the beginning of 2000s resulted with reforms in the security system as well. However, many of them were not undertaken systematically. Serbian security and foreign policy priorities are mainly determined by the EU accession process and the status of Kosovo.

The EU security policy was a leap in the dark. It was constructed under an agreement that the EU should have such a policy, but not what it should be about. On 12 December 2003, the leaders of the European Union approved the first-ever European Security Strategy, the ESS, proclaiming an intention to ‘share in the responsibility for global security and in building a better world’.1 The ESS summons up the EU’s external dimension, in a manner that transcends the metaphorical ‘pillars’ intended to visualize the workings of the Union. It encapsulates foreign and security policy—from the development and neighbourhood policies of the European Commission, via the Common Security and Defence Policy (CSDP), under the auspices of the High Representative of the Union for Foreign Affairs and Security Policy, to police and judicial cooperation.KeywordsSecurity PolicyHuman SecuritySecurity AgendaLisbon TreatyJudicial CooperationThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Notice of Violation of IEEE Publication Principles<br><br>"A Scenario-Based Test Case Generation Framework for Security Policies"<br>by Chen Yan and Wu Dan<br>International Conference on Computational Intelligence and Security, 2009. CIS '09 December 2009, pp. 489-493<br><br>After careful and considered review of the content and authorship of this paper by a duly constituted expert committee, this paper has been found to be in violation of IEEE's Publication Principles.<br><br>This paper contains significant portions of original text from the paper cited below. The original text was copied without attribution (including appropriate references to the original author(s) and/or paper title) and without permission.<br><br>Due to the nature of this violation, reasonable effort should be made to remove all past references to this paper, and future references should be made to the following article:<br><br>"Model-based Testing Using Scenarios and Event-B Refinements"<br>by Qaisar A. Malik, Johan Lilius and Linas Laibinis<br>Methods, Models and Tools for Fault-Tolerance, Lecture Notes in Computer Science series, Springer, March 2009, pp. 177-195<br><br> <br/> Security policy system is critical to the security sensitive implementation systems. To increase confidence in the correctness of the security policies, policy developers can conduct policy testing to ensure security policies are correctly implemented in these systems. In this paper we present a novel framework for security policy testing. The framework takes the security policy as a support for the secure operation of the functional systems and seizes the dynamic characteristic of the security policies which change with the refinement of functional systems. The testing framework is model based and includes three parts. They are security policy integration; refinement based testing scenario acquisition and risk-based testing organization. The framework covers all elements for the model-based testing and provides a comprehensive solution for the security policy testing.

This paper focuses on the conflict of norms in the interface between the “transplanted” formal law and the local social norms in the land-law reforms in Vietnam and Myanmar, each representing different legal families, while sharing commonness in that both have attempted law-making in the post-colonial independence period in order to restore the basis of the livelihoods of the local population. Both of the legal concepts of “land-use right” (quyen su dung dat) in Vietnam and “land-use right for cultivation” (loat paing kwint) in Myanmar have been the product of law-makers’ restorative attempts at farmland security, while intentionally avoiding usage of the term “ownership” that would result in the capitalist transaction of land as a commodity. However, the contemporary land-law reforms led by donor-oriented “legal transplant” in these countries have resulted in the plunder of such policy, by reintroducing the same mechanisms of land exploitation as existed in the colonial days. Roaring protests of the local agricultural population seem to be a rising-up of the social norm descended from the immemorial past as an unwritten Constitution to bring an end to the centuries-long movement of “legal transplant” of the modern capitalist law.

“Securing the Digital Frontier: Navigating Cyber Threats in Cloud, Network, and Information Security” offers a comprehensive exploration of the intricate landscape of Cyber security, meticulously designed to equip readers with a robust understanding of contemporary challenges and proactive strategies. With an elaborate Table of Contents spanning thirteen chapters, the book embarks on a journey that starts with laying the groundwork in Chapter 1, providing a holistic Introduction to Cyber security. Here, readers delve into the nuances of the digital realm, tracing the Evolution of Cyber Threats, and comprehending the Historical Milestones that have shaped the field. It underscores the paramount Importance of Cyber security in Modern Society and elucidates the Current State of Cyber security Challenges while speculating on Future Projections and Trends, emphasizing the Interdisciplinary Nature of Cyber security. Moving forward, Chapter 2 delves into the Fundamentals of Information Security, elucidating the CIA Triad – Confidentiality, Integrity, and Availability. It navigates through Risk Management, Compliance, and Regulatory Frameworks, shedding light on Security Policies and Procedures alongside the significance of Security Awareness Training and Incident Response Planning. Subsequent chapters systematically dissect various domains of Cyber security, from Network Security (Chapter 3) to Cloud Security (Chapter 4), Endpoint Security (Chapter 5), and Identity and Access Management (Chapter 6). Each chapter meticulously examines core concepts, methodologies, and best practices essential for fortifying digital infrastructures against evolving threats. The discourse extends to Data Protection (Chapter 7), Threat Intelligence and Detection (Chapter 8), and Incident Response and Management (Chapter 9), offering invaluable insights into encryption techniques, threat hunting strategies, and incident triage frameworks. Furthermore, Security Operations and Monitoring (Chapter 10) elucidates the pivotal role of Security Operations Centers (SOCs), Vulnerability Management, and Red Team vs. Blue Team Exercises in bolstering cyber defenses. Chapter 11 ventures into Emerging Technologies and Threats, contemplating the security ramifications of IoT, AI, Quantum Computing, Block chain, AR, VR, and Biometric Authentication. Meanwhile, Chapter 12 explores the realm of Ethical Hacking and Penetration Testing, unraveling methodologies for ethical hacking, vulnerability assessment, and social engineering mitigation. Finally, Chapter 13 prognosticates on Future Trends and Challenges, accentuating the imperative of addressing the Skills Gap, fostering Global Collaboration, and navigating Regulatory Challenges amidst burgeoning technological advancements. It underscores the ethical considerations paramount in Cyber security endeavors while advocating for resilience-building strategies against escalating cyber threats. In essence, “Securing the Digital Frontier” transcends the realms of a conventional Cyber security manual, emerging as an indispensable compendium for Cyber security professionals, aspiring enthusiasts, and stakeholders navigating the ever-evolving digital ecosystem. It amalgamates theoretical insights with practical wisdom, empowering readers to navigate the complex terrain of cyber threats with confidence and acumen.

Introduction: The role of state institutions in the formation of security policy during potential military conflicts is the key to ensuring global stability and a proactive response to world peace threats. The aim of the article is to analyse the influence of state institutions on international security policy in light of hybrid wars and innovative methods of conflict.Methods: The philosophical approach is aimed at the moral responsibility of the government to its citizens and the justification of the use of force from an ethical point of view. The article demonstrates that adapting state institutions to contemporary challenges, such as cyberthreats and hybrid technologies, contributes to strengthening global security and stability. The analysis is based on using linear regression to forecast the armament of leading countries in the military sphere and potential conflicts in the future.Results: The results obtained through linear regression predict a 20% increase in military industry and an escalation of potential military conflicts.Conclusions: The philosophical significance of the article lies in the study of the fundamental role of state institutions as bearers of the moral authority of adaptive security policy. Further research suggests delving into the philosophical foundations of creating a global security architecture.