Situational approach to information security

In the wave of the progressive informatization process, Korean enterprises are making a vast amount and range of investments in the information security sector in order to counter the information dysfunction. In addition, to achieve an objective evaluation thereon, they have been increasingly exhibiting a preference for a certification system of information security management, as developed by the government This study aims to reduce the possible trials and errors while promoting the establishment and certification of the information security management system by enterprises. To satisfy this purpose, this study presents the defects by item found during the certification process of the information security management system of a number of enterprises. By analyzing the derived defects, we have outlined the issues to be attended to among enterprises at each stage of the establishment of an information security management system. The study also presents a reference model for conducting a self check, so that companies may be able to self-verify the completeness of their establishment of the information security management system. Through the results of this study, enterprises will be able to self-verify their completeness levels when promoting the establishment and certification of the information security management system, and improve the efficiency and effectiveness thereof so as to raise the general level and awareness among enterprises of the importance of information security.

With increasing dependence on information technology and information system, enterprises are confronting with a more and more complicated information security environment. Thus, information security has become an intractable problem for many enterprises. Generally speaking, there are two methods to improve enterprises’ information security level, that is, technology and management means. Technology means mainly settle software and hardware security of computers and networks, while management means mainly regulate and restrain the entire enterprise system including software, hardware, and employees. At present, a lot of enterprises mostly employ the technology means to solve information security problems. However, the lack or imperfection of information security institutions leads to bad enterprise information security situation. Therefore, technology and management means to solve information security are complementary to each other. As such, it is urgent and necessary to establish and improve information security institutions for many enterprises. In fact, enterprise information security is a complicated activity which needs different sectors to get involved in. More specifically, the information security departments play the very critical role in the implementation of information security institutions, and all employees should comply with the information security policy. Therefore, only the top management teams have the ability to coordinate the relationship between different departments, determine the introduction of information technology, and deploy the information systems. In response, top management support has an important impact on the construct of information security institutions and the effectiveness of information security management. So far, few studies have investigated the mechanism that how top management support affects information security legitimation, and legitimation information security management. Therefore, it has great theoretical and practical significance to the exploration of whether the legitimation supported by top management can improve the effectiveness of information security management. The objective of the current study is to explore whether legitimation prompted by top management team can improve the effectiveness of enterprise information security management. By doing so, the data was collected from the enterprises which have passed the certification of information security management system, and analyzed by using PLS-SEM. The results indicate that information security awareness can improve top management support（including top management belief and top management participation）and the effectiveness of information security management respectively. In addition, top management belief can improve implementation（the first stage of legitimation）and internalization（the second stage of legitimation）. Moreover, implementation can improve the effectiveness of information security management. This paper analyzes the way to enhance effectiveness of information security management, which has a reality-oriented meaning for prompting information security management of enterprises from the standpoint of institution.

Information Security Management System (ISMS) implementation in Institution is an effort to minimize information security risks and threats such as information leakage, application damage, data loss and declining IT network performance. The several incidents related to information security have occurred in the implementation of the Academic System application in Indonesian higher education. This research was conducted to determine the maturity level of information security practices in Academic Information Systems at universities in Indonesia. The number of universities used as research samples were 35 institutions. Compliance with the application of ISO 27001:2013 standard is used as a reference to determine the maturity level of information system security practices. Meanwhile, to measure and calculate the level of maturity using the SSE-CMM model. In this research, the Information System Security Index obtained from the analysis results can be used as a tool to measure the maturity of information security that has been applied. There are six key areas examined in this study, namely the role and importance of ICT, information security governance, information security risk management, information security management framework, information asset management, and information security technology. The results showed the level of information security maturity at 35 universities was at level 2 Managed Process and level 3 Established Process. The composition is that 40% of universities are at level 3, and 60% are out of level 3. The value of the gap between the value of the current maturity level and the expected level of maturity is varied for each clause (domain). The smallest gap (1 level) is in clause A5: Information Security Policy, clause A9: Access Control, and clause A11: Physical and environmental security. The biggest gap (4 levels) is in clause A14: System acquisition, development and maintenance and clause A18: compliance.  Â

News about various information security attacks against companies appears almost every day. The sources of these attacks vary from cyber-criminals who want to steal companies’ data to demand a ransom, to current or former employees who want to create damage to the organization. The best way to defend organizational critical assets is to implement an Information Security Management System that secures all sensitive assets from confidentiality, availability and integrity perspective. An Information Security Management System offers top management a framework for sensitive information flow control. This framework includes with a risk assessment that considers the security threats and vulnerabilities of the company’s assets. Companies usually implement Information Security Management System only after they have a functional quality management system, which brings clarity and optimization to the company’s processes. Current approaches on creation and implementation of effective Information Security Management System are very theoretical and thus difficult to use in practice. The main objective of this paper is to present an Information Security Management System implementation method in the case of a small company by defining the basic steps in achieving a fully functional Information Security Management System. The proposed methodology considers the top management Information Security Management System objectives, organizational context, risks assessment and third parties expectations fulfillment.

Tighter regulatory demands and higher customer expectations regarding the protection of information force enterprises to systematically ensure confidentiality, integrity and availability of stored information and processing facilities. Information Security Management Systems (ISMSs) are used to address these challenges. Recent studies show that the majority of companies plans to establish at least basic information security management to prepare for future developments. Larger enterprises have already embraced ISMSs, whereas small and medium-sized enterprises (SMEs) are catching up and require support in defining, introducing and operating them. We developed ADAMANT, an SME-friendly tool that supports continuous information security management incorporating stakeholders of different domains. In this paper, we evaluated our approach to introduce an ISMS in SMEs using an introductory information security training. The evaluation shows that our tool improves critical information security management tasks. Furthermore, integrating ADAMANT in customized security trainings allows companies to directly use training results to implement an ISMS.

This paper presents an ongoing case study into stakeholder perceptions regarding information security management systems in emergent organisations operating in Western Australia. It takes a socio-political perspective on the problem of how to manage simultaneously virtual collaboration and information security management. A literature review introduces the context and history of the research. In light of this, it is proposed that social and political issues need to be researched and addressed before many of the existing technological strategies for information security will succeed. The research project is then outlined and the design and preliminary results presented. The results point to a lack of clarity and cohesion amongst stakeholders about how their information security management systems operate and who has ownership of the security function. This emerging trend is discussed and the plans for future research explained.

This study examines the effect of an Information Security Management System (ISMS) on organizational performance in a Small and Medium Business (SMB), with a focus on Red Mango Ltd. The study employed a correlational survey design to assess the relationship between ISMS implementation and organizational performance. Primary data was collected from 44 respondents, including management and staff, through structured questionnaires. The convenience sampling technique was used for respondent selection, and data analysis was conducted using the Statistical Package for Social Sciences (SPSS) version 25. Correlation and regression analyses were applied to determine the relationship and effect of ISMS on organizational performance. Findings revealed that ISMS is well-implemented at Red Mango Ltd, with clear policies, structured roles and responsibilities, and comprehensive employee training on security measures. Employees are well-informed about acceptable usage of information security systems, and security incidents are promptly reported. However, several challenges hinder ISMS implementation, including leadership issues, technical system difficulties, personnel constraints, and financial limitations. Despite these challenges, ISMS adoption has led to significant benefits, including regulatory compliance, optimized business processes, cost savings, improved information security awareness, enhanced company reputation, and increased productivity. The study further established a strong positive correlation between ISMS implementation and organizational performance at Red Mango Ltd. Regression analysis indicated that a unit increase in ISMS adoption results in a 0.495 increase in organizational performance, confirming its significant impact. The study concludes that effective ISMS implementation enhances security, improves operational efficiency, and contributes to overall business success. Organizations are encouraged to address implementation challenges through leadership commitment, technical capacity building, and financial investment to fully realize ISMS benefits.

In developing standards and guidelines required by the Federal Information Security Management Act (FISMA), NIST consults with other federal agencies and offices as well as the private sector to improve information security, avoid unnecessary and costly duplication of effort, and ensure that NIST standards and guidelines are complementary with standards and guidelines employed for the protection of national security systems. In addition to its comprehensive public review and vetting process, NIST is working with the Office of the Director of National Intelligence (ODNI), the Department of Defense (DOD), and the Committee on National Security Systems (CNSS) to establish a common foundation for information security across the federal government. The common foundation for information security will provide the Intelligence, Defense, and Civil sectors of the federal government and their support contractors, more uniform and consistent ways to manage the risk to organizational operations, organizational assets, individuals, other organizations, and the Nation that results from the operation and use of information systems. In another collaboration initiative, NIST is working with public and private sector entities to establish specific mappings and relationships between the security standards and guidelines developed by NIST and the International Organization for Standardization and International Electrotechnical Commission (ISO/IEC) 27001, Information Security Management System (ISMS). NIST Special Publication 800-53A is a companion publication to NIST Special Publication 800-53, not a replacement or update. Special Publication 800-53 remains the definitive NIST recommendation for employing security controls in federal information systems.

Özet Bu çalışmanın amacı, ISO 500’de yer alan kooperatiflerin web sitelerinin incelenerek sürdürülebilirlik çatısı altında sürdürülebilirliğin sosyal, ekonomik ve çevresel boyutlarına göre mevcut durumlarını ortaya koymaktır. Bu kapsamda, kooperatiflerin Kurumsal Sosyal Sorumluluk, ISO 9001 Kalite Yönetim Sistemi, ISO 14001 Çevre Yönetim Sistemi, ISO 27001 Bilgi Güvenliği Yönetim Sistemi, ISO 22000 Gıda Güvenliği Yönetim Sistemi, ISO 45001 İş Sağlığı ve Güvenliği Yönetim Sistemi, ISO 50001 Enerji Yönetim Sistemi sertifikasyon durumu incelenmiştir. Betimsel tarama modelinde olan araştırmada amaçlı örneklem yöntemiyle seçilen yedi kooperatifin web siteleri taranmıştır. Araştırmada içerik analizi yöntemlerinden yüzde ve frekans analizi kullanılmıştır ve veriler arasındaki korelasyon incelenmiştir. Analizler sonucunda sürdürülebilirlik kavramı kapsamında incelenen parametrelerle kooperatiflerin ISO 500 sıralaması arasında anlamlı bir ilişkinin olmadığı görülmektedir. Bununla birlikte kooperatiflerin tamamının sosyal sorumluluk projeleri yaptığı, %86’sının kalite (ISO 9001), %71’inin çevre (ISO 14001), iş sağlığı ve güvenliği (ISO 45001) ve gıda güvenliği (ISO 22000), %29’unun enerji güvenliği (ISO 50001) ve %14’ünün bilgi güvenliği (ISO 27001) yönetim sistemlerine sahip olduğu belirlenmiştir.

The purpose of this study was to investigate and analyze the assumptions and requirements for the implementation of Information Security Management System (ISMS). Methodology: To check assumptions security management system implementation is the population of Tabriz hospitals. Review the requirements and assumptions are based on the standard ISO / IEC 27001, ISO / IEC 27002 test target setting and ISO 27001 standard questionnaire containing 33 questions in 11 control is used. The data were analyzed using descriptive and inferential statistical method that factors in the implementation of information security management system was confirmed. As well as to identify factors contributing to the implementation of information security management system and factor analysis, structural equation model was used PLS smart software that based on its findings to impact and indirect aspects of implementation effectiveness of the system. Results: Using the software, smart-PLS and using structural equation modeling confirmatory factor analysis was performed to measure the test of convergent validity, divergent validity, reliability Security and reliability of observable variables and quality test and measurement model of the 101 comments experts, all the prerequisites and requirements, including information security policy, the organization of information security, asset management, human resources in terms of security, physical and environmental security, communications and operations management, access control, use, development and maintenance, incident management information security, business continuity management and compliance with laws in secure level at %99 is forecast in Tabriz hospitals are effective information security management system. Conclusion: According to prioritize the factors affecting information security management system, operating (after) the most monitors and agents (after) the supply and implementation of information security management system least affected are in Tabriz hospitals.

This paper proposes an organizational management model for implementing the Information Security Management System (ISMS) Plan, Do, check and Act (PDCA) framework to achieve an improved balance between the effectiveness and efficiency of an organizations ISMS. Specifically describing the role of managerial structure and organizational structure in realizing the ISMS framework. Demonstrating the drawbacks in organizational structure that were reduced and the enhanced workflow within the organization due to the improved managerial role distinction regarding information security management. Projecting the effects of the proposed parallel loosely coupled approach when managing an ISMS related project within an organization.

Municipalities handle valuable information in very large quantities on a daily basis. Due to the value, and often confidential nature, of this information, the protection of the information and the related technologies are a key concern for municipalities, especially in South Africa. For this very reason, several official government documents require South African municipalities to implement effective information security management systems. However, according to the Auditor General of South Africa, municipalities are struggling in this regard. This study uses a literature review, document analysis, and argumentation to identify the crucial components of an information security management system. These components are then logically presented in a hierarchical structure to possibly assist municipalities to improve their individual information security management processes. Addressing these components can also be applied in municipalities across Africa to improve information security management.

In industrialized countries, such facilities are organized into an interconnected system — critical infrastructure in various fields of activity of states, and the information systems and telecommunications networks that support them into a critical information infrastructure. Purpose: The article examines the changing requirements for information security: from the requirements of maximum security to the more "lenient" requirements of the acceptable risk concept. The expediency of returning to the concept of maximizing security for critical information infrastructures is substantiated. Methods: As a model of the objective function of the protection system, the asymptotic information security management is considered, which makes it possible to gradually bring the required security values closer to the "ideal" ones during the operation of the control system. Results: The possibilities of implementing an asymptotic approach to information security management for various management system models developed in different countries are considered. The article analyzes the features of the implementation of the object and subject model of information security management systems in different operating conditions of the CII. The principal difference between the properties of these two models is the possibility of external control, which is typical for strict regulatory management (object model). Another (subject-based) model allows for flexibility and responsiveness in security management. In particular, the ability of the CI subject to promptly make independent decisions and take into account interactions with other CI (the subject model) reduces the response time of the management system to external influences. .When analyzing the prospects for the development of information security requirements, it is proposed to take into account not only national, but also international mechanisms for improving security. It is proposed to take into account for such mechanisms the threats and conditions that arise during hostilities or in the case of a terrorist threat. Practical relevance: The transition to the subject model when changing the target management paradigm within the framework of asymptotic management meets the requirements not only to reduce the hierarchy of management, but also to accelerate responses and. e their duplication.

An Information Security Management System (ISMS) compliant with ISO/IEC 27001 requires the development and implementation of an effective system to guarantee the protection of information from threats. The aim of the study was to propose a set of indicators to measure the effectiveness of SZBI safeguards in manufacturing companies. A model for analysing the effectiveness of the SMS was built, which requires significant involvement of the company’s management. Systemic information security management produces the best results, as it involves treating as a whole all processes taking place in the organisation and is consistent with them. A way to measure the degree of information security was defined using indicator analysis and the application of key performance indicators (KPIs). The metrics addressed key areas such as malware protection, quality of passwords and authentication, updating systems and applications, data handling and training. The implementation of a set of indicators makes it possible to diagnose the security system currently in place and identify critical areas for improvement. The model and set of indicators presented in the study can be a helpful tool in maintaining an effective SMS and safeguarding the interests of manufacturing enterprises and their stakeholders.

To date, the issue of security of information system resources in the presence of threats in the global information sphere is one of the most urgent both in Russia and in the world. This is due to stricter requirements for companies that store and process personal data. Recently, more and more companies of large and medium-sized businesses regularly face the resolution of incidents related to data loss as a result of cyber attacks or violation of established information security regulations by the company's personnel. In this regard, priority attention to information security has become a necessity for running a successful business. An information security management system — ISMS) is a part of an organization's overall management system based on a risk-based approach to managing information security. SMIB allows not only to minimize the risks associated with information security, but also can give a serious competitive advantage in the global market.