Search results

Abstract
Information security management is a very important issue for anyone working in the field of technology, or for anyone at risk of security breach, who understands the implications of these vulnerabilities. Many organizations are always on the constant threat of a security breach. It is easy for an organization to experience a data breach that can seriously compromise their data. With the evolving threats of data security, organizations are always working to ensure that their data is protected. Frameworks associated with information security can be pivotal to an organization. Frameworks employed in organizations helps to protect the employee and user information which is essential as it puts employees and clients at ease that their information is secure. Identifying the ideal frameworks for an organization is important. However, this process can be a bit tricky as a lot has to be considered to identify the best framework for the organization.

Proceedings of the International Conference on Computational Intelligence and Security. CIS 2005. Part II. Xi'an, 15 - 19 Dec. 2005. Yue Hao et al.,(Eds.) Lecture Notes in Computer Science Vol. 3802, 508 - 517 ; Usually, information security management practices do not explicitly take account of weak signals, factors that lie below the detection surface, which may, however, constitute a huge security threat. This study analyses what kinds of weak signals are present in information security, followed by a discussion on their detection. Responses to weak signals are also considered as well as certain privacy concerns related to the issue. These issues are of great urgency not only for government officials responsible of public security and dealing with the current wave of terrorism, but also to corporate information security and top managers running the day to day business of their companies.

Purpose– Despite many technically sophisticated solutions, managing information security has remained a persistent challenge for organizations. Emerging IT/ICT media have posed new security challenges to business information and information assets. It is felt that technical solutions alone are not sufficient to address the information security challenge. It has been argued that organizations also need to consider the management aspects of information security. Consequently, literature, especially in the last decade, has witnessed various scholarly works in this direction. Therefore, a synthesis exercise is required to bring clarity on categorizing the issues of organizational information security management (ISM) to take the research forward. The purpose of this paper is to identify management factors that address organizational information security challenges.Design/methodology/approach– Using a mix method approach, the paper adopts the qualitative (keyword analysis and experts' opinion) and quantitative (questionnaire survey) research routes. Exploratory factor analysis is conducted to find out the key factors of organizational ISM.Findings– The paper categorizes various organizational ISM functions into ten factors. Spanning across three levels (strategic, tactical and operational), these factors cover various management issues of organizational ISM.Originality/value– The paper takes the ISM literature forward by statistically validating the key management factors of organizational ISM. The study outcome should help to draw the attention of organizations toward the managerial challenges of organizational ISM.

Proceedings of the International Symposium of Industrial Electronics (ISIE) 2006. Montréal, Canada, 9 - 13 July 2006, 2942 - 2947 ; Digital convergence, the growing complexity of subcontracting networks and the rise in new, unknown risks call for a new paradigm in information security management. Joint operation agreements between organizations as well as demands from third party actors, such as government and environmental activists, require novel information security management procedures that manage the associated information systems as a whole – from the political, social and legal point of view in addition to the traditional information security view. To tackle these uprising issues we propose holistic handling for risk management and information security management and assurance.

The increasing concerns of clients, particularly in online commerce, plus the impact of legislations on information security have compelled companies to put more resources in information security. As a result, senior managers in many organizations are now expressing a much greater interest in information security. However, the largest body of research related to preventing breaches is technical, focusing on such issues as encryption and access control. In contrast, research related to the economic aspects of information security is small but rapidly growing. The goal of this technical note is twofold: i) to provide the reader with an structured overview of the economic approaches to information security and ii) to identify potential research directions.

Testimony issued by the General Accounting Office with an abstract that begins "The Federal Information Security Management Act of 2002 reauthorizes and expands the information security, evaluation, and reporting requirements enacted in the National Defense Authorization Act for Fiscal Year 2001. Concerned that pervasive information security weaknesses place federal operations at significant risk of disruption, tampering, fraud, and inappropriate disclosures of sensitive information, Congress enacted the Government Security Reform Act (GISRA) for more effective oversight. The Federal Information Security Management Act also changes and clarifies information security issues noted in the first-year implementation of GISRA. In particular, the bill requires the development, promulgation of, and compliance with minimum mandatory management controls for securing information and information systems; requires annual agency reporting to both the Office of Management and Budget and the Comptroller General; and defines the evaluation responsibilities for national security systems. To ensure that information security receives appropriate attention and resources and that known deficiencies are addressed, it will be necessary to delineate the roles and responsibilities of the numerous entities involved; obtain adequate technical expertise to select, implement, and maintain controls; and allocate enough agency resources for information security."

The analysis of the sequence of decision-making in the information security management of information and telecommunications system (ITS) was made on the basis of the PDCA. Selection criteria and constraints affecting the decision-making were chosen according to ISO/IEC 27001 «Information technology. Methods of protection. Information security management system» recommendations and the requirements of current legislation of Ukraine. The procedure of analyzing the impact of threats on the properties of the information to be protected and manageability of the ITS system protection was proposed. In the core of the procedure one could find the analysis of vulnerability of Internet protocols interaction used in information and telecommunications system from the different types of attacking effects.In accordance with the principle the cost of protection should not exceed the value of the information being protected. The technique of making managerial decisions concerning the selection of means of protection allows each specific unit of the organization's local information network to contact the external telecommunications system to pick up the software and (or) software and hardware protection with security features implemented, which are adequate to the threats.

The authors present a Case Study conducted in a Portuguese military organization, to answer the following research questions: (1) what are the most relevant dimensions and categories of information security controls applied in military organizations? (2) What are the main scenarios of information security incidents that are expected to occur? (3) What is the decision process used for planning and selection information security controls? This study reveals that: (1) information security within the military organization is built on the basis of physical and human attack vectors, and targeting the infrastructure that supports the flow of information in the organization; (2) the information security controls applied in the military organization are included in ISO/IEC 27001; (3) planning and selection of applied information security controls are made by decision makers and information security specialists. It appears that specialists impose their planning options essentially seeking to select and retrieve past successful information security cases.