Search

As organizations increasingly view information as one of their most valuable assets, which supports the creation and distribution of their products and services, information security will be an integral part of the design and operation of organizational business processes. Yet, risks associated with cyber attacks are on the rise. Organizations that are subjected to attacks can suffer significant reputational damage as well as loss of information and knowledge. As a consequence, effective leadership is cited as a critical factor for ensuring corporate level attention for information security. However, there is a lack of empirical understanding as to the roles strategic leaders play in shaping and supporting the cyber security strategy. This study seeks to address this gap in the literature by focusing on how senior leaders support the cyber security strategy. The authors conducted a series of exploratory interviews with leaders in the positions of Chief Information Officer, Chief Security Information Officer, and Chief Technology Officer. The findings revealed that leaders are engaged in both transitional, where the focus is on improving governance and integration, and transformational support, which involves fostering a new cultural mindset for cyber resiliency and the development of an ecosystem approach to security thinking. Managerial relevance statement Our findings provide interesting insights for managers particularly those in the role of Chief Information Officers (CIOs), Chief Security Information Officers (CSIOs), and Chief Technology Officers (CTOs). We propose a Cyber Security Strategy Framework (CSSF) which can be used by these information/technology managers to design an effective organizational strategy to develop cyber resilience in their organization. Our framework suggests that managers should focus on transitional and transformational support. The transitional support focuses on improving governance and integration whereas transformational support focuses on the emphasis of fostering a new cultural mindset for cyber resiliency and the development of an ecosystem approach to security thinking. Our findings provide good evidence showing how leaders can support more effective cyber security initiatives.

Cet article est consacré à la dimension eurasiatique de la politique extérieure russe. L’intégration eurasiatique, qui n’avait pas la faveur des élites russes dans les années 1990, s’est progressivement imposée dans les années 2000 du fait de l’échec des projets d’union incluant l’Ukraine, comme des tentatives de rapprochement avec l’Europe occidentale. Désormais, Moscou s’appuie sur l’Union économique eurasiatique (uee) et sur l’Organisation du Traité de sécurité collective (otsc) pour tenter de réaffirmer son leadership en Eurasie postsoviétique et établir des partenariats internationaux à l’échelle continentale afin de structurer le projet de Grande Eurasie. Si cette politique a connu certains succès, notamment dans la coopération avec la Chine pour la mise en place des Nouvelles routes terrestres de la soie, elle continue de se heurter à l’incompréhension des puissances occidentales qui refusent toute forme de partenariat entre les structures euro-atlantiques et les organisations eurasiatiques., This article is devoted to the Eurasian dimension of Russian foreign policy. Eurasian integration, which was popular among Russian elites in the 1990s, gradually imposed itself in the 2000s due to the failure of union projects including Ukraine and of attempts to rapprochement with Western Europe. Moscow now relies on the Eurasian Economic Union (eaeu) and the Collective Security Treaty Organization (csto) to try to reaffirm its leadership in post-Soviet Eurasia and establish international partnerships on a continental scale in order to structure the Great Eurasia project. If this policy has known certain successes, in particular in the cooperation with China for the establishment of the New Land Silk Roads, it continues to come up against the incomprehension of the Western powers which refuse any form of partnership between the Euro-Atlantic structures and Eurasian organizations.

While many researchers have investigated soft skills for different roles related to business, engineering, healthcare and others, the soft skills needed by the chief information security officer (CISO) in a leadership position are not studied in-depth. This paper describes a first study aimed at filling this gap. In this multimethod research, both the business leaders perspective as well as an analysis of CISO job ads is studied. The methodology used to capture the business leaders perspective is via a Delphi study and the jobs adds are studied using a quantitative content analysis. With an increasing threat to information security for companies, the CISO role is moving from a technical role to an executive role. This executive function is responsible for information security across all layers of an organisation. To ensure compliance with the security policy among different groups within the company, such as employees, the board, and the IT department, the CISO must be able to adopt different postures. Soft skills are thus required to be able to assume this leadership role in the organisation. We found that when business leaders were asked about the most important soft skills the top three consisted out of 'communication', ‘leadership’ and 'interpersonal' skills while 'courtesy' was last on the list for a CISO leadership role.

Diese Masterarbeit beschäftigt sich mit der Aufbereitung von Security Assessment Berichten für verschiedene Zielgruppen. Diverse Best Practices, wie beispielsweise der Penetration Testing Execution Standard oder der OWASP Testing Guide, bieten für die Erstellung eines solchen Berichts nur eine Vorlage an, in der lediglich das Management und die Techniker*innen berücksichtigt werden. Mit dieser wissenschaftlichen Arbeit wird untersucht, ob die Erstellung eines einzigen Abschlussberichts, mit einer strikten Trennung des Inhalts für das Management und die Techniker*innen, tatsächlich ausreichend ist oder ob es mehrere Zielgruppen zu berücksichtigen gilt, wodurch mehrere Berichte mit einer jeweils individuell angepassten Struktur sinnvoll wären. Dazu werden sämtliche Akteur*innen aus dem Bereich der Informationssicherheit identifiziert und in einem weiteren Schritt nur jene selektiert, für die der Empfang eines Security Assessment Berichts von Relevanz ist. Die verbleibenden Akteur*innen werden schließlich auf Basis einer Literaturrecherche näher auf ihre Aufgaben, Rollen, Verantwortlichkeiten etc. untersucht und gegebenenfalls zusammengefasst. Dadurch ergeben sich vier Akteur*innen, die sich aus dem Topmanagement (vertretend für CEO, CIO und CFO), dem CISO (Repräsentant für sämtliche Personen mit Sicherheitsaufgaben), dem Information System Owner und dem System Engineer zusammensetzen. Für die spätere individuelle Aufbereitung von Security Assessment Berichten werden zunächst konkrete Vorlagen von Best Practices betrachtet. Die Empfehlungen dieser verschiedenen Ansätze werden in einem einzigen Abschlussbericht zusammengeführt, der als weitere Ausgangsbasis dient. Für jede*n Akteur*in wird auf Basis der Informationen durch die Literaturrecherche im Anschluss die optimale Struktur eines Security Assessment Berichts ausgearbeitet. Diese finden als Hypothesen in der Empirie Verwendung. Die Richtigkeit dieser Hypothesen wurde mithilfe einer quantitativen Umfrage, die 42 Fachexpert*innen umfasst, überprüft. Die Aufgabe der Fachexpert*innen lag darin, die präsentierten Annahmen kritisch zu hinterfragen und gegebenenfalls zu korrigieren. Die Ergebnisse der Umfrage zeigen, dass ein einziger Security Assessment Bericht, in welchem die Inhalte für das Management und die Techniker*innen strikt getrennt werden, nicht ausreichend ist. Für die System Engineers sind nicht nur die detaillierten Ergebnisse zur Behebung der Schwachstellen von Bedeutung, sondern auch einige Unterkapitel aus der Zusammenfassung und den organisatorischen Informationen. Die detaillierten Ergebnisse haben zwar keinerlei Relevanz für das Topmanagement, dafür werden die organisatorischen Informationen zur Gänze benötigt. Der CISO hingegen ist sowohl an der kompletten Zusammenfassung, sämtlichen organisatorischen Informationen als auch am Großteil der detaillierten Ergebnisse interessiert. Der Information System Owner wiederum zieht den größten Nutzen aus den Ergebnissen, welche die unter seiner Obhut stehenden Systeme betreffen. Das Endresultat sind verschiedene Security Assessment Berichte, mit welchen klar ersichtlich wird, dass es mehrere Zielgruppen zu berücksichtigen gilt und damit eine individuelle Aufbereitung sinnvoll ist. This master thesis deals with the creation of security assessment reports for different target groups. Various best practices, such as the Penetration Testing Execution Standard or the OWASP Testing Guide, offer only one template for the creation of such a report, in which only management and technicians are taken into account. This scientific thesis examines whether the production of a single final report, with a strict separation of the content for management and technicians, is actually sufficient or whether several target groups need to be considered, which would result in several reports, each with its own customized structure. For this purpose, all actors in the field of information security are identified and in a subsequent step only those are selected for whom the recipience of a security assessment report is relevant. Finally, the remaining actors are examined more closely with regard to their tasks, roles, responsibilities, etc. on the basis of a literature search and combined in one actor if necessary. This results in four actors, consisting of the top management (representing the CEO, CIO and CFO), the CISO (representing all persons with security responsibilities), the information system owner and the system engineer. Specific templates of best practices are initially considered for the subsequent individual creation of security assessment reports. The recommendations of these different approaches will be merged into a single final report, which serves as a further starting point. The ideal structure of a security assessment report is then created for each actor based on the information provided by the literature search. These are used as hypotheses in empirical studies. The validity of these hypotheses was verified by means of a quantitative survey involving 42 experts. The task of the experts was to critically question the assumptions presented and correct them if necessary. The results of the survey show that a single security assessment report, in which the contents are strictly separated for management and technicians, is not sufficient. For system engineers, not only the detailed results to remedy the vulnerabilities are important, but also some sub-chapters from the summary and the organizational information. Although the detailed results are not relevant for the top management, the organizational information is required in its entirety. The CISO, on the other hand, is interested in the complete summary, all organizational information and most of the detailed results. The information system owner derives the greatest benefit from the results concerning the systems under his care. The end result is a number of different security assessment reports, showing clearly that there are several target groups to be considered and therefore an individual creation of the reports is appropriate. Abweichender Titel laut Übersetzung der Verfasserin/des Verfassers Arbeit an der Bibliothek noch nicht eingelangt - Daten nicht geprüft Wien, FH Campus Wien, Masterarb., 2020

Trabalho de projeto de mestrado, Informática, Universidade de Lisboa, Faculdade de Ciências, 2020 Submitted by Teresa Boa (tdboa@fc.ul.pt) on 2021-05-19T18:03:36Z No. of bitstreams: 1 ulfc126313_tm_Cátia_Rodrigues.pdf: 7082792 bytes, checksum: 9433447526cf72ef216e72bc3aa6eecb (MD5) Made available in DSpace on 2021-05-19T18:03:46Z (GMT). No. of bitstreams: 1 ulfc126313_tm_Cátia_Rodrigues.pdf: 7082792 bytes, checksum: 9433447526cf72ef216e72bc3aa6eecb (MD5) Previous issue date: 2020

Organizações do mundo inteiro estão sofrendo impactos significativos decorrente de diversos tipos de incidentes de segurança da informação (SI), e isso fez com que a área de SI e sua principal liderança (CISO – Chief Information Security Officer) ganhassem importância. Há muitos estudos acadêmicos sobre SI, mas pouquíssimos que focam em como tornar esse profissional mais efetivo no exercício da sua função. Através da Teoria do Foco Regulatório será estudado como esses profissionais tomam decisões (muitas vezes carregando vieses comportamentais) e o reflexo nas organizações. Resultados revelaram que dependendo do foco motivacional do profissional, ele poderá tomar decisões desalinhadas ao contexto da organização, como por exemplo, seus objetivos e estratégias, podendo impactar na sua performance e na performance da organização para a qual atua. Organizations around the world are suffering significant impacts from various types of information security (IS) incidents, and this has made the IS area and its chief information security officer (CISO) gain importance. There are many academic studies on IS, but very few focus on how to make it more effective in the exercise of its function. Through the Regulatory Focus Theory will be studied how these professionals make decisions (often carrying behavioral biases) and the reflection in organizations. Results revealed that depending on the motivational focus of the professional, he / she can make decisions that are out of alignment with the context of the organization, such as its objectives and strategies, and may impact on his performance and the performance of the organization for which it operates.

Mestrado em Gestão de Sistemas de Informação Num mundo cada vez mais conectado e digital, a informação é crescentemente vista como potenciador do negócio e fonte de vantagem competitiva. Assim, a segurança de informação torna-se crítica ao proteger os ativos de informação, pelo que a estratégia de segurança organizacional tem vindo a alinhar-se com os seus objetivos de negócio. Por outro lado, as recentes alterações legais, tais como a Diretiva Segurança das Redes e da Informação e o Regulamento Geral de Proteção de Dados, vêm impor regras relativamente à privacidade e à segurança da informação, permitindo às organizações um redesenho ou ajuste dos seus processos de forma a garantir que a informação se encontra efetivamente segura. Neste contexto, o Chief Information Security Officer assume um papel de destaque na coordenação da confidencialidade, integridade e disponibilidade da informação na organização. Este trabalho pretende estudar o ambiente geral da segurança de informação nas organizações, analisar o papel do CISO, e compreender onde este deverá estar integrado na estrutura organizacional. Para tal, foram realizadas entrevistas a consultores especialistas e a pessoas com cargos diretivos nas áreas de sistemas de informação e de segurança da informação, que permitiram concluir que ainda é necessário um grande amadurecimento a nível das organizações em Portugal relativamente ao tema, e que tal poderá dever-se à ausência de uma cultura de segurança estabelecida no país. Por outro lado, o papel do CISO tem assumido uma maior relevância, sendo que é uma opinião geral que o mesmo deverá ter uma relação próxima com a administração das organizações. In an increasingly connected and digital world, information is seen as a business enabler and a source of sustained competitive advantage. Thus, information security is becoming critical so to protect these information assets, which is why the concern with organizations’ security strategy has been aligning with their strategic objectives. On the other hand, recent changes in regulation, as Network and Information Security (NIS) directive and the General Data Protection Regulation (GDPR), come to regulate and create rules when it comes to information security, and allow organizations to redesign or adjust these processes in order to ensure that information is, in fact, safe. In this context, the Chief Information Security Officer (CISO) comes to play an important role in coordinating confidentiality, integrity, and availability of information in the organization. This paper aims to study organizations’ information security environment in general, analyse the CISO’s role inside them, and understand where they should be integrated in the corporate structure. To do so, interviews were conducted on experienced information security consultants and information systems and information security directors, which allowed to conclude that organizations in Portugal still need a great amount of maturing when it comes to information security, and that this may eventually be due to the absence of an established security culture in the country. On the other hand, the CISO’s role has been increasing in relevance, being a general opinion that their relationship with organizations’ boards should be close. info:eu-repo/semantics/publishedVersion

IT Security Risiken sind auf dem Vormarsch und haben sich in den letzten Jahren zum Nr. 1 Risiko der Versicherungsunternehmen entwickelt. Die fortschreitende Digitalisierung, Vernet-zung und Globalisierung der Unternehmen beschleunigten diese Entwicklung weiter. Diese Ar-beit beschäftigt sich daher mit der Einführung eines IT Security Risk Managements, den nötigen Rahmenbedingungen, Voraussetzungen aber auch Herausforderungen im Betrieb. Um ein pra-xisnahes Bild zu erhalten wurden 7 Experteninterviews mit erfahrenen Security Verantwortlichen und ISO Auditoren durchgeführt. Nach der qualitativen Inhaltsanalyse der Interviews zeigte sich, dass es sehr pragmatische Ansätze gibt, ein Security Management zu betreiben, aber auch die ISO und normbasierte Ansätze, um hier den gesetzlichen Anforderungen gerecht zu werden. Als Voraussetzung war hier die Rolle der Geschäftsführung als Enabler sehr wichtig und dass es eine zentrale Organisation mit einen Verantwortlichen Risk Manager gibt, welcher Richtlinien erstellt, Prozesse definiert und eine Sicherheitsmanagement aufbaut. Als kritischer Punkt wurde auch der zunehmende Personalmangel beleuchtet, bei welchen Prozesse vereinfacht werden und man einen Best-of-Breed Ansatz verfolgt. Besonders empfohlen wurden Tools wie CRI-SAM, welche bei der Einführung aber auch dem Betrieb unterstützen. Die finanzielle und quanti-tative Bewertung von Risiken wurde als sehr kritisch betrachtet und ist in der Praxis oftmals sehr komplex. Helfen kann hier ein Enterprise Riskmanagement mit einheitlichen Vorgaben und viel Know-How., Erik Struck, Masterarbeit Universität Klagenfurt, Universitätslehrgang Business Manager/in 2022