Towards Secure Information Systems: Developing and Implementing an Information Security Evaluation Model Using NIST CSF and COBIT 2019

Information Security Management System (ISMS) implementation in Institution is an effort to minimize information security risks and threats such as information leakage, application damage, data loss and declining IT network performance. The several incidents related to information security have occurred in the implementation of the Academic System application in Indonesian higher education. This research was conducted to determine the maturity level of information security practices in Academic Information Systems at universities in Indonesia. The number of universities used as research samples were 35 institutions. Compliance with the application of ISO 27001:2013 standard is used as a reference to determine the maturity level of information system security practices. Meanwhile, to measure and calculate the level of maturity using the SSE-CMM model. In this research, the Information System Security Index obtained from the analysis results can be used as a tool to measure the maturity of information security that has been applied. There are six key areas examined in this study, namely the role and importance of ICT, information security governance, information security risk management, information security management framework, information asset management, and information security technology. The results showed the level of information security maturity at 35 universities was at level 2 Managed Process and level 3 Established Process. The composition is that 40% of universities are at level 3, and 60% are out of level 3. The value of the gap between the value of the current maturity level and the expected level of maturity is varied for each clause (domain). The smallest gap (1 level) is in clause A5: Information Security Policy, clause A9: Access Control, and clause A11: Physical and environmental security. The biggest gap (4 levels) is in clause A14: System acquisition, development and maintenance and clause A18: compliance.  Â

The purpose of information systems (IS) security behavior, represented by the difference between work and personal purpose, has been neglected in the research of user's IS security behavior. This is especially important for the organizations that allow or inevitably allow their employees to do personal tasks during work hours, because it may bring big threats to an organization's IS. Unfortunately, few empirical studies have examined if different behavioral purpose, typically, work/personal purpose, affects users' IS security behavior decision. Based on boundary theory and the idea of multidimensional rationality, we argue that people demarcate a psychological boundary for work and personal usages of IS and thus apply different rationalities to make IS security-related decisions. Our empirical investigation indicates that in a work usage context, people apply rule-based rationality and therefore are more influenced by mandatoriness and facilitating conditions. Whereas in a personal usage context, people apply outcome-based rationality and therefore are more concerned with task benefits and costs. The findings imply that organizations and vendors may devise different measures to ensure users' IS security behavior in different contexts.

HOW MUCH ICT SECURITY HAS IMPROVED DURING THE LAST DECADE

Protection motivation theory (PMT) is one of the most commonly used theories to examine information security behaviors. Our systematic review of the application of PMT in information systems (IS) security and the comparison with its application for decades in psychology identified five categories of important issues that have not yet been examined in IS security research. Discussing these issues in terms of why they are relevant and important for IS security, and to what extent IS research has not considered them, offers new research opportunities associated with the study of PMT and IS security threats. We suggest how future studies can approach each of the open issues to provide a new road map for quantitative and qualitative IS scholars.

An Information System (IS) security programme consists of several essential security controls. In order to verify and maintain the effectiveness of an IS security programme, it is pertinent to identify how security controls are compared to each other in terms of their practical implications. This study reports the results from an experience survey to offer insights of the roles of security controls in IS security programmes. Four clusters of security controls were identified with technical security controls (such as authentication and confidentiality) being high on respondents' perceived importance. An approach to develop SAI with weighted security controls is explained to help security administrators conduct security assessments. The results of this study contribute to IS security budget planning and resource allocation. Managerial implications are also reported.

Subject. In the modern information society, ensuring information security is one of the key tasks of organizations, especially in the context of growing cybersecurity threats. Every year, companies face increasingly complex and diverse threats that can cause significant damage to both the financial resources and reputation of the organization. In this context, ensuring information security becomes an important strategic task for enterprises in various fields of activity. Information security plays a critical role in protecting information confidentiality, ensuring the integrity and availability of information, as well as the security of information systems and networks. Goal. The main goal of the research in this work is a comprehensive study of the technology for ensuring the protection of information, preventing unauthorized actions with it, in particular, its use, disclosure, distortion, modification, research and destruction, as well as the correct strategy for information protection of data from external and internal threats. Method or methodology. The research is based on general scientific methodology, which involves the use of a systematic approach and general scientific methods of cognition. The results of the work. In the course of the study, the authors of the article tried to resolve the problem of the interdependence of information security and the strategy for information protection of data from external and internal threats by structuring the subject area of information security policy, which made it possible to set priorities in solving the problems of ensuring the required level of security of information resources and supporting infrastructure in the context of the development of digital technologies. When analyzing problems related to information security, the authors note the importance of mechanisms for generating new solutions that allow, at a minimum, to adequately respond to threats to information security or to anticipate new threats and be able to resist them. Conclusions. The study found that information security plays a critical role in the modern world, ensuring data protection, privacy and sustainability of business processes. In an environment of constantly changing and evolving threats, maintaining a reliable information security system becomes an integral part of the success of organizations and personal security. This is an important step towards creating an information security management system at the enterprise, with the help of which constant and effective monitoring of the effectiveness of security measures is carried out, timely correction of actions taken and revision of existing provisions to ensure maximum security.

The article considers the legal mechanisms for ensuring information security. It has been proven that today, more than ever, when there is a war in Ukraine, the issue of ensuring information security becomes especially relevant and significant, as the information space becomes a “battlefield” on a par with the war front. Enemy forces actively use informational and psychological operations to destabilize the situation inside our country, create panic, spread fakes and undermine trust in state institutions. In these conditions, the state’s policy becomes important, which should be integral and effective in countering these threats. An effective state policy in the field of information security will help ensure society’s resilience to information threats, strengthen trust in state institutions, and maintain stability in crisis conditions. The author’s understanding of information security is offered as a state of security of information resources and information systems, which ensures their confidentiality, integrity, availability and reliability, as well as protection against unauthorized access, disclosure, modification, destruction and other forms of abuse that may lead to a violation of national security, economic stability and social order. The main components of information security, which are the basis for information security for the state as a whole, individual bodies or private enterprises, are called confidentiality, integrity and availability. The main components of the mechanism for ensuring information security, in the opinion of the author, should be: technical (creation of appropriate technical infrastructure to ensure the functioning of information security), political (development of state policy aimed at ensuring information security) and legal (adoption of high-quality normative legal acts that will determine all information security measures). These three components complement each other and are key to creating an effective system of protection against information threats.

Management of information systems (IS) security in organizations has been hampered by the apparent lack of inclusion of organizational security objectives in the traditional strategic planning process. In order to improve IS security strategic planning, we argue that there should be a renewed emphasis on security planning objectives. In this paper we present two sets of objectives – fundamental and means. We then define an evaluation mechanism for assessing the security posture of a firm. Based on case work in healthcare, we illustrate the usefulness of the security evaluation method for designing enterprise security.

What are the key topics for Information Systems (IS) security researchers? How have these topics been changing, and what topics are emerging to offer new opportunities for research? We address these questions by analyzing the abstracts of 261 articles focusing on IS security that have appeared in leading IS journals and journals devoted to this area. Using Latent Semantic Analysis (LSA) to analyze the text of these abstracts uncovers five primary research topics: Security Design & Management, Business Operations Security, Behavioral Aspects, Authentication & Integrity Controls, and Prevention & Detection. These five primary topics are aggregates of more granular topics that are utilized to find trends to understand the changing complexion of IS security research. Our study contributes by developing the key topics and their trends in this area using an analytical and replicable method to synthesize the existing research.

The objective of this study is to survey companies’ information systems security and control, and todevelop a maturity level of information systems security and control application. This application shows a company’s position of information systems security and control by comparing this position with other companies. This study is survey research. Participants are chief information security officers of 304 Stock Exchange of Thailand listed companies within eight industry groups (services, property and construction, industrials, financials, agriculture and food industry, consumer products, technology, and natural resources). The findings suggest that all companies are aware of security of network access control. Many companies also implement information security policies, asset management systems, and access controls for data, information systems and business applications.

Interoperable information system is crucial to enable an organization to provide good services to users. It can give a high impact and good return to government agencies, particularly in terms of efficiency in managing information system as well as making it time and cost effective. However, the implementation and work processes involving the interoperability of the public sector information system are still under focused. The major issues identified are concerning on difficulties in the implementation of integration between legacy systems or new systems; Recurring transactions or transactions in various systems, especially those involving legacy systems or new systems; Differences in database platforms; Difficulty in implementing the system redesign process; and no standard use of meta data, data model and complete database schema that can be used as reference. They hinder the implementation of good governance and contribute to ineffective decision-making process in the public sector. Hence, a more detailed and comprehensive study should be carried out to identify the critical success factors that contribute to the interoperability of the enterprise information system in the public sector. The method of the study is qualitative. The instruments for data collection include document analysis. The finding reveals that interoperability factors and elements can be classified according to the levels of interoperability i.e. (i) Organization; (ii) Technical; and (iii) Semantics. They can then be used as the basis for the development of reference for developing comprehensive guidelines based on the success factors and elements outlined. It is hoped that these factors could contribute to the development of enterprise information systems in the public sector which emphasizes the concept of interoperability.

Even though the human component has been recognized to have a crucial role in information systems (IS) security, the human issues have not received much attention. Recently a few approaches aimed at minimizing human‐related faults in the area of IS security have been put forward. This paper analyses different approaches aimed at minimizing user‐related faults. The existing approaches will be analysed from the viewpoint of their theoretical background, the research approaches employed, the research objectives and the organizational role of IS security. As a result, a new taxonomy, a comparison and critical analyses of the strengths and weaknesses of state‐of‐the‐art approaches shall be presented. Moreover, several issues that future research should explore and practitioners should consider when applying the results of the existing research are suggested.

The Government and industry are currently using information and communication technology a lot. The Government and companies in Indonesia have regulations on operational standards and management procedures for information and communication systems security at Government regarding implementing information system security. Information security is essential because there are many threats to information security. Information security in this era of Information and Communication Technology (ICT) is fundamental. Information Exchange Environment (IEE) vulnerabilities have increased as threats become more widespread and complex; therefore, information security has become a fundamental problem for businesses, organizations, and governments. So, in this paper, we will explain the review of the impact of Information Security For Government and companies in terms of threats and types of information security. Some security system methods are analyzed, among others—application Security, cloud security, Cryptography, security infrastructure, Incident response, and vulnerability management. The results of this review analysis, it known threat has several solutions, each depending on the type of threat for both the Government and the Company. Furthermore, Information Security is considered very important, especially for data stored in Government and companies.

Confidentiality, integrity and availability, while being key requirements for ensuring security, have had limitations in providing an integral security model that incorporates the benefits of all predominant designs. Heeding to the call that security models cater to unique operational characteristics of individual firms, this paper presents a deep structure framework of information systems (ISs) security. The framework incorporates three models—representational model, which identifies subsystems within an organization; state-tracking model, which ensures that different states trace IS security in the real world;nd the decomposition model, which defines specific external events that are a stimuli to changes in internal events. In a final synthesis, the paper presents a deep structure-based conceptual clarity that manifests the meaning of dynamic, custom-fit and flexible IS security solutions.

Information security is one of the key areas of consideration to assure reliable and dependable information systems (IS). Achieving an appropriate level of IS security requires concurrent consideration of the technical aspects of IS and the human aspects related to the end users of IS. These aspects can be described in the form of information security requirements. We propose an approach that helps select and balance information security software requirements (iSSR) and information security training requirements (iSTR) according to the information security performance of end users. The approach was tested in an experiment involving 128 IS professionals. The results showed that using the proposed approach helps IS professionals with limited experience in information security make significantly better decisions regarding iSSR and iSTR.