Search

Information system security within XYZ University constitutes a vital component of its IT framework, exerting significant influence over security levels across all facets of the information systems. Among the numerous implemented information system services at the university, a considerable portion lacks active security measures within operational systems. In pursuit of achieving uniform governance, this study adopts the most recent COBIT 2019 framework. The primary objective of this research is to evaluate the degree to which current information system security management aligns with the process achievement values stipulated in the COBIT 2019 standard. This evaluation entails the calculation of maturity level values that gauge performance levels in managing information system security. Findings from the COBIT 2019 Design assessment conducted at XYZ University's LTIK reveal that individuals scoring above 80 or those requiring Capability Level 4 include APO12 and BAI10. Moreover, the calculation outcomes for each subdomain reveal the presence of 2 subdomains at Level 4, 4 subdomains at Level 3, 15 subdomains at Level 2, and 19 subdomains at Level 1. The identification outcomes underscore the existence of gaps within each domain. Particularly, the APO12 and BAI10 domains exhibit a gap spanning 2 levels.

This study examines the implementation of information system at RSUD Palembang BARI with the aim of enhancing information system security. In this context, a security audit is conducted using the COBIT 2019 framework. The COBIT 2019 domains and processes utilizing include EDM03, APO12, APO13, APO14, and DSS05. The research involves the identification and evaluation of information security risks, determination of necessary security controls, and ensuring compliance with the information security standards established by COBIT 2019. The findings indicate that the level of information system security at RSUD Palembang BARI is at level 3 (Defined), with a gap analysis difference of 1 level below the expected target. Based on the above results, efforts to improve and enhance the information system security at RSUD Palembang BARI are still needed. The use of information system security techniques such as vulnerability scanning, penetration testing, WAF, IDS and IPS, and data encryption, as well as improving security in terms of server physical aspects such as installing CCTV and restricting user access with access cards or fingerprints, can be implemented to ensure compliance with relevant information security standards. Consideration for obtaining security certifications, like ISO 27001, should also be taken. Additionally, the quality of human resources in terms of policy-making and the ability of employees to address threats and attacks on information system security should be improved through training and strengthening coordination among employees.

This paper applies the emotion extraction method based on emotion lexicon to the group emotion analysis of the information system, combines the vector space model to process the text emotion in the information system, expresses the emotion in the form of vectors, and divides the different types of emotion according to the distance between the emotion vectors for identification. The five-level index system in fuzzy mathematics is chosen to measure the value of emotional intensity, and by analyzing the emotional state of the group in the information leakage incident, a decision in line with the user’s emotion is made based on the emotion of the information system security. Accordingly, the security defense index of the information system is improved according to the information security risk index. The results show that in identifying the emotions of the information system security events, the group’s emotions are mainly biased towards the negative. The proportion of negative emotions is the largest of 98%, which indicates that attention should be paid to the confidentiality of the user group’s information in the security of the information system. The maximum security event risk value in the evaluation in the information system is in the T8 period, with a value of 0.819, indicating that the security defense of the information system should be strengthened in the T8 period.

Despite the rapid rise in social engineering attacks, not all employees are as compliant with information security policies (ISPs) to the extent that organisations expect them to be. ISP non-compliance is caused by a variety of psychological motivation. This study investigates the effect of psychological contract breach (PCB) of employees on ISP compliance intention by dividing them into intrinsic and extrinsic motivation using the theory of planned behaviour and the general deterrence theory. Data analysis from UK employees (n = 206) showed that the higher the PCB, the lower the ISP compliance intentions. The study also found that PCBs significantly reduced intrinsic motivation (attitude and perceived fairness) for ISP compliance intentions, whereas PCBs did not moderate the relationship between extrinsic motivation (sanction severity and sanctions certainty) and ISP compliance intentions. As a result, this study successfully addresses the risks of PCBs in the field of Information System (IS) security and proposes effective solutions for employees with high PCBs. [ABSTRACT FROM AUTHOR]

This study aims to investigate the direct and indirect effects of information system security practices that observed the relationship effect between cyber supply chain risk management and supply chain performance. In Industry 4.0 era, a cyber-attack becomes unavoidable and needs to adopt cyber supply chain risk management to improve the firm. The data were collected from 105 firms in Malaysia through online surveys. The partial least squares structural equation modeling technique examined the model's goodness and research hypothesis. The results revealed that operations, directly and indirectly, influence (via mediators) supply chain performance. In contrast, governance directly affects supply chain flexibility and indirect (via mediators) influence on supply chain performance; in addition, systems integration did not, directly, and indirectly, influence supply chain performance. This framework indicates the manufacturing industry and related parties with a better understanding of cyber supply chain risk management. [ABSTRACT FROM AUTHOR]

Recent data breaches underscore the importance of organizational cybersecurity. However, the high costs of such security can force chief financial officers (CFOs) to make difficult financial and ethical trade-offs that have both business and societal implications. We employ a 2 × 2 randomized experiment that varies both an observed scenario CFO's investment decision (invest/not invest in security) and organizational outcomes (positive/negative) to investigate these trade-offs. Participant managers assess the observed CFO's investment behavior and indicate their own intentions to invest. Results indicate that when the observed scenario CFO invests in security, managers primarily follow their peers when making investment decisions. However, when the observed CFO does not invest in security, managers make their own decisions by engaging in more in-depth reasoning that includes assessment of the seriousness of consequences, as well as the ethical and societal considerations. Moderated mediation findings further deconstruct and corroborate these relationships. [ABSTRACT FROM AUTHOR]

Information systems security (ISS) behavioral research has produced different models to explain security policy compliance. This paper (1) reviews 11 theories that have served the majority of previous information security behavior models, (2) empirically compares these theories (Study 1), (3) proposes a unified model, called the unified model of information security policy compliance (UMISPC), which integrates elements across these extant theories, and (4) empirically tests the UMISPC in a new study (Study 2), which provided preliminary empirical support for the model. The 11 theories reviewed are (1) the theory of reasoned action, (2) neutralization techniques, (3) the health belief model, (4) the theory of planned behavior, (5) the theory of interpersonal behavior, (6) the protection motivation theory, (7) the extended protection motivation theory, (8) deterrence theory and rational choice theory, (9) the theory of self-regulation, (10) the extended parallel processing model,and (11) the control balance theory. The UMISPC is an initial step toward empirically examining the extent to which the existing models have similar and different constructs. Future research is needed to examine to what extent the UMISPC can explain different types of ISS behaviors (or intentions thereof). Such studies will determine the extent to which the UMISPC needs to be revised to account for different types of ISS policy violations and the extent to which the UMISPC is generalizable beyond the three types of ISS violations we examined. Finally, the UMISPC is intended to inspire future ISS research to further theorize and empirically demonstrate the important differences between rival theories in the ISS context that are not captured by current measures. [ABSTRACT FROM AUTHOR]

To improve the practical effect of an information system security course for students majoring in information security, a teaching method based on the theory of inventive problem solving (TIPS) that combines case-based teaching and project practice was introduced in the class. Adopting innovative thinking methods, we instructed students on the projects and goals of curriculum design. Using TIPS tools, the students completed complex projects. To test the teaching results, we examined 121 students who received case-based teaching using the TIPS method to design innovative projects. Quantitative data were collected using a statistically analysed anonymised questionnaire, while qualitative data collected from student reflective reports were thematically analysed. Through the in-depth development involved in the teaching of this course, their thinking and problem-solving ability significantly improved. The teaching effect evaluations indicated that this teaching method effectively improved students' practical abilities. This method was found to be conducive to planning students' future careers. [ABSTRACT FROM AUTHOR]

Artificial Intelligence (AI) is changing every technology we are used to deal with. Autonomy has long been a sought-after goal in vehicles, and now more than ever we are very close to that goal. Big auto manufacturers as well are investing billions of dollars to produce Autonomous Vehicles (AVs). This new technology has the potential to provide more safety for passengers, less crowded roads, congestion alleviation, optimized traffic, fuel-saving, less pollution as well as enhanced travel experience among other benefits. But this new paradigm shift comes with newly introduced privacy issues and security concerns. Vehicles before were dumb mechanical devices, now they are becoming smart, computerized, and connected. They collect huge troves of information, which needs to be protected from breaches. In this work, we investigate security challenges and privacy concerns in AVs. We examine different attacks launched in a layer-based approach. We conceptualize the architecture of AVs in a four-layered model. Then, we survey security and privacy attacks and some of the most promising countermeasures to tackle them. Our goal is to shed light on the open research challenges in the area of AVs as well as offer directions for future research.

This study addresses the security of information systems (ISS) as one of the most important issues in organizations and especially municipalities. Instead of exceptions, information security breaches have become a norm, and security of information systems can only be realized when employees completely accept this concept by changing their behavior in line with advanced information security systems. The model of this research is based on institutional theory. This two-way model has introduced organizational citizenship behavior (OCB) and counterproductive work behavior (CWB) in the process of verifying the security of the information system. This research also measures the impact of innovative culture on the information security system. The statistical population of the study consisted of Mashhad Municipal Information Technology experts and data collection tool was a questionnaire. The data support mainly the proposed research model and the results indicate the application of institutional theory in explaining the process of institutionalizing the changes in the security of the information system on the innovative culture of the organization, legitimizing and accepting those changes, and increasing organizational citizenship behavior (reduction of counterproductive work behavior) in employees Which, in the end, will increase the effectiveness of the security of the information system.

For many organizations, increased cybersecurity training and employee awareness building have already played an increasingly significant role in their cyber-security strategies as a means of ensuring their policies are being followed, yet such organizations tend to offer generic, "one size fits all" training and awareness packages that do not sufficiently recognize important differences among employees. Among these are differences in attitude and outlook associated with generational cohorts. Through an examination of how these cohorts view various fac-tors that influence cybersecurity awareness, as well as the cohorts' receptivity to different training methodologies, organizations can exploit generational characteristics to maximize the effectiveness of cybersecurity training for Baby Boomers, Generation X, Millennials, and imminently, Generation Z. A clear understanding of the intrinsic relationship between end-users and cybersecurity technology can help cybersecurity professionals act effectively to protect organizations' critical IT infrastructure. Such effectiveness is more important than ever now, as sudden, massive increase in teleworking brought on by the COVID-19 pandemic, as well as the security challenges associated with this shift, will undoubtedly outlast it. [ABSTRACT FROM AUTHOR]

Information is one of the most valuable resources of a company and considering the increasing number of security breaches and attacks, the need for managing systems security in organisations arises. Across articles and perspectives, there is a broad consensus in the literature that the user remains the weakest link within information systems security. However, there are opposing views on how IS security shall be managed within organisations and which countermeasures prove to be effective. This review aims to analyse and juxtapose the key debates and main perspectives within the IS security literature to provide a general overview of the research landscape in this field. In the first part, concepts underpinned by bounded technical assumptions are analysed and contrasted, structured according to the engineering, managerial and economic perspectives. After that, the primary debates and concepts within the socially embedded view are being explored. In conclusion, this review suggests the use of newer technologies as an area for further research. [ABSTRACT FROM AUTHOR]

The article addresses the problem of estimating the expected losses of a bank when information security threats to functioning computer systems materialize. A scenario approach to solving the problem is developed based on multicriteria decision-making methods, taking into account quantitative and qualitative indicators and expert assessment, and applying the analytic hierarchy process for comprehensive assessment of expected losses in probabilistic terms. That allows to take into account different levels of the hierarchy of criteria and the weight of their impact on the calculated results. The process of estimating the probability of materialization of various threats under accepted standards and situational conditions, the actions of the attacker and the consequences on the bank's functioning is formalized. Expert assessments are grouped with control over the sufficiency of the degree of logic and dispersion of opinions of each expert, compliance with the established requirements for the degree of consistency of opinions of the group of experts, assessment and formalized consideration of the degree of their competence. The process of assessing expected losses is presented as a daily business process of the functioning of the bank's security system. [ABSTRACT FROM AUTHOR]

Data breaches, privacy violations and cyber-attacks are growing problems for companies and governmental organizations. Threat modelling serves as a heuristic procedure of methodological validation of organizations, system designs, software architectures to identify threats. The earlier this happens in the design process, the more cost-effective it is to identify and fix security vulnerabilities and therefore it reduces the possibility of risk happening. Classical literature sources and Internet sources offer different representations of attacker strategies and threat classifications. It is often difficult to apply these schemes to one's own organization and often the size of them is comprehensible only for experts. In order to improve the understanding of security threats, particularly in the management levels, we provide a structured overview of the most common threat classification schemes and propose a classification model focusing on threats that first considers the specific organization and in a further step presents the courses of action of an attacker in this organization. [ABSTRACT FROM AUTHOR]

Organizations are more dependent than ever on the reliable operation of their information systems, which have become a key to their success and effectiveness. While the growing dependence on information systems creates an urgent need to collect information and make it accessible, the proliferation of computer technology has also spawned opportunities for ill-intentioned individuals to violate the information systems' integrity and validity. One of the most common control mechanisms for authenticating users of computerized information systems is the use of passwords. However, despite the widespread use of passwords, little attention has been given to the characteristics of their actual use. This paper addresses the gap in evaluating the characteristics of real-life passwords and presents the results of an empirical study on password usage. It investigates the core characteristics of user-generated passwords and associations among those characteristics. [ABSTRACT FROM AUTHOR]

The goal of this article is highlighting the importance of human capital in enhancing the protection and the information security for the economic institution, as it contains the majority of its information and it can build a protective system and effective for its information, especially, the sensitive ones. Use the descriptive approach in the theoretical part of the study in order to define the both variables : The human capital and information security. However, in the practical side, distribute 50 questionnaire form in Mobile complex which combines the Regional Directorate Mobilis Bechar and Bechar Agency. Then, take back 35 valid from them. These later were discharged in the statistical program Spss24. Then, the statistical data were extracted that serve the study like the Mathematical averages and standard Deviations to study the existence of dimensions; and One - Way anova exam to study the influence, and Spearman to study the correlation. In addition to this, the analytical approach is used to analyse the data obtained. Finally, the results were that in Mobile institution, there is human capital and information security. Also, the human capital affects the information security. [ABSTRACT FROM AUTHOR]

Data breaches, privacy violations and cyber-attacks are growing problems for companies and governmental organizations. Threat modelling serves as a heuristic procedure of methodological validation of organizations, system designs, software architectures to identify threats. The earlier this happens in the design process, the more cost-effective it is to identify and fix security vulnerabilities and therefore it reduces the possibility of risk happening. Classical literature sources and Internet sources offer different representations of attacker strategies and threat classifications. It is often difficult to apply these schemes to one's own organization and often the size of them is comprehensible only for experts. In order to improve the understanding of security threats, particularly in the management levels, we provide a structured overview of the most common threat classification schemes and propose a classification model focusing on threats that first considers the specific organization and in a further step presents the courses of action of an attacker in this organization. [ABSTRACT FROM AUTHOR]

The influence of security rank on the technology portfolio and configurations of firewall and IDS was researched through game theory by this paper. It shows that the higher the security rank the bigger deterrence to hackers whose intrusion probability would be decreased. The security rank is not always improved when only one of the technology configurations is improved, and it is improved when both of the two technology configurations are coordinated with each other, which illustrates that the higher the security rank the higher requirement of security technology portfolio and configuration. The equilibrium strategy is also compared to the one without considering security rank, and the latter is an extremity of the former, which could not be reached or with no need to get. [ABSTRACT FROM AUTHOR]

Advances in technology have made it possible to capture vast amounts of financial and non-financial information, whilst at the same time shifting more control from the producers and assurers of information to the recipients of information. As a result, threats to Information System (IS) have grown exponentially, which has made IS security audits even more cumbersome. Assessing the effectiveness of internal controls is an important objective of an IS audit, which is distinct from a financial audit that deals with the accuracy of financial statements. Security auditing has been a part of the auditing profession since the late 1970's, when information technology was first leveraged at a mass scale in organizations for improving efficiency and productivity. Over time, however, as technology has advanced, audits have become increasingly cumbersome. Rapid innovation in technology has forced the auditing profession to lag behind trying desperately to catch up with technology. In this paper, we examine the evolution of IS security auditing and discuss how technology is impacting the audit profession. [ABSTRACT FROM AUTHOR]

Along with the rapid development and wide application of information technology, human society has entered the information era. In this era, people live and work in cyberspace. Cyberspace is the collection of all information systems; it is the information environment for human survival. Therefore, it is necessary to ensure the security of cyberspace. This paper gives a comprehensive introduction to research and development in this field, with a description of existing problems and some currently active research topics in the areas of cyberspace itself, cyberspace security, cryptography, network security, information system security and information content security. [ABSTRACT FROM AUTHOR]