Academia.eduAcademia.edu

Outline

Title
Abstract
Introduction
Research Design
Design of Rounds
Communication Protocol
Description of the Study
Analysis
Discussion
Conclusion
Limitations
Future Work
References
All Topics
Computer Science
Cybersecurity

Key Issues in Information Systems Security Management

Profile image of Filipe de Sá-SoaresFilipe de Sá-Soares

2013

Abstract

The increasing dependence of organizations on information and the need to protect it from numerous threats justify the organizational activity of information systems security management. Managers responsible for safeguarding information systems assets are confronted with several challenges. From the practitioners' point of view, those challenges may be understood as the fundamental key issues they must deal with in the course of their professional activities. This research aims to identify and prioritize the key issues that information systems security managers face, or believe they will face, in the near future. The Delphi method combined with Q-sort technique was employed using an initial survey obtained from literature review followed by semi-structured interviews with respondents. A moderate consensus was found after three rounds with a high stability of results between rounds. A ranked list of 26 key issues is presented and discussed. Suggestions for future work are made.

Related papers

Challenges for the Comprehensive and Integrated Information Security Management
Juhani Anttila

2017 13th International Conference on Computational Intelligence and Security (CIS), 2017

Information security management needs to be considered from the perspective of individuals, organizations and the society as a whole. The current situation is not satisfactory with regard to the concepts or practices and is becoming more challenging in the future. Further research and development of the managerial methodologies and practices are necessary for the needs of the new business environments, SMEs and startups. This our research focuses on the comprehensive and multidisciplinary framework that aims at providing challenges for the new assorted research initiatives and innovations, and insight and guidance for the implementers who integrate the information security solutions within the management of business systems and processes together with other specialized managerial viewpoints. At present, the studies and practical implementations are very scattered and separate from each other, and difficult to be reconciled. Also effective collaboration of the administrative authorities, business leaders and security specialists, and effective links between the managerial, human and technical viewpoints are emphasized.

View PDFchevron_right
Information systems security management: a critical research agenda
Bernd Carsten Stahl

2008

Abstract Mainstream information systems security (ISS) management research concentrates on ways of successfully securing systems from internal and external threats. Such work is legitimate and important but it often fails to explore alternative views of security. This paper builds on the critical research tradition in information systems to ask whether there are signs of ideology, hegemony and other critical concepts in the security literature and management practice.

View PDFchevron_right
Managing Information Security Risk
Fathoni Mahardika

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

View PDFchevron_right
Information security management objectives and practices: a parsimonious framework
Qingxiong Ma

Information Management & Computer Security, 2008

PurposeAs part of their continuing efforts to establish effective information security management (ISM) practices, information security researchers and practitioners have proposed and developed many different information security standards and guidelines. Building on these previous efforts, the purpose of this study is to put forth a framework for ISM.Design/methodology/approachThis framework is derived from the development of an a priori set of objectives and practices as suggested by literature, standards, and reports found in academia and practice; the refinement of these objectives and practices based on survey data obtained from 354 certified information security professionals; and the examination of interrelationships between the objectives and practices.FindingsThe empirical analysis suggests: four factors (information integrity, confidentiality, accountability, and availability) serve as critical information security objectives; most of the security areas and items covered u...

View PDFchevron_right
Addressing Information Security Risk
Carol Woody

Educause Quarterly, 2005

View PDFchevron_right
Value-focused assessment of information system security in organizations
Jasan Kijanah

ICIS 2001 Proceedings, 2001

Information system (IS) security continues to present a challenge for executives and professionals. A large part of IS security research is technical in nature with limited consideration of people and organizational issues. The study presented in this paper adopts a broader perspective and presents an understanding of IS security in terms of the values of people from an organizational perspective. It uses the value-focused thinking approach to identify 'fundamental' objectives for IS security and 'means' of achieving them in an organization. Data for the study were collected through in-depth interviews with 103 managers about their values in managing IS security. Interview results suggest 86 objectives that are essential in managing IS security. The 86 objectives are organized into 25 clusters of nine fundamental and 16 means categories. These results are validated by a panel of seven IS security experts. The findings suggest that for maintaining IS security in organizations, it is necessary to go beyond technical considerations and adopt organizationally grounded principles and values.

View PDFchevron_right
Is Information Security Under Control?: Investigating Quality in Information Security Management
Linda Wallace

IEEE Security and Privacy Magazine, 2000

View PDFchevron_right
Information Security Management: A Research Project
pramod pandya

Issues in Informing Science and Information Technology, 2004

In an environment of growing information security threats, it is essential to raise the awareness and capabilities of business students entering the workforce to mitigate threats to the enterprise networks. Information security has emerged as the most critical component of any data network. This paper describes a research project jointly undertaken by the author and an undergraduate student in Information Systems to explore some of the technical aspects of information security over the wired and wireless networks.

View PDFchevron_right
Assessing federal and commercial information security needs
David Ferraiolo

In a cooperative effort with government and industry, the National Institute of Standards and Technology (NIST) conducted a study to assess the current and future information technology (IT) security needs of the commercial, civil, and military sectors. The primary objectives of the study were to: This study has attempted to identify basic security needs of information technology product users, administrators, developers, and evaluators based on actual organizational practices. Although the findings of this study sho uld not be considered conclusive, it is hoped that they will be considered in the development of future protection requirements, standards, guidelines and evaluation programs.

View PDFchevron_right
Factors affecting Information Systems Security: Field Study
Shahrazad Al Marhoon, Shamma Al Harizi

Research paper, 2019

The aim of this research is to identify the availability levels of fear, neutralization, and Information Systems Security (ISS) and determining the impacts of Fear, and Neutralization on ISS. The primary data of the study collected using manual distributed questionnaire. By using appropriate statistical test, the collected data has been analyzed. The reliability and hypotheses tested using several statistical methods such as multiple and linear regression test. While validity tested using Cronbach's alpha. The findings of the study shown there is a significant statistical effect of fear and neutralization on the information system security which explains (40.3%) of the variation in ISS. Also, ISS availability level is high as the mean is (3.49) and the responses are very close as the Standard Deviation is (0.98). the research suggested to Study more variables that may affect ISS and increase restrictive procedures of information security and make sure that everyone in organizations are understand the sequences of violating them.

View PDFchevron_right

References (26)

  1. Ball, L., and Harris, R. 1982. "SMIS Members: A Membership Analysis," MIS Quarterly (6:1), pp. 19-38.
  2. Beretta, R. 1996. "A critical view of the Delphi technique," Nurse Researcher (3:4), pp. 79-89.
  3. Brancheau, J., and Wetherbe, J. 1987. "Key Issues in Information Systems Management," MIS Quarterly (11:1), pp. 23-45.
  4. Brancheau, J., Janz, B. D., and Wetherbe, J. C. 1996. "Key Issues in Information Systems Management: 1994-95 SIM Delphi Results," MIS Quarterly (20:2), pp. 225-242.
  5. Delbeq, A. L. 1986. Group Techniques for Program Planning: A Guide to Nominal Group and Delphi Processes, Wisconsin: Green Briar Press.
  6. Dickson, G. W., Leitheiser, R. L., Wetherbe, J. C., and Nechis, M. 1984. "Key Information Systems Issues for the 1980's," MIS Quarterly (8:3), pp. 135-159.
  7. Duffield, C. 1993. "The Delphi technique: a comparison of results obtained using two expert panels," International Journal of Nursing Studies (30:3), pp. 227-237.
  8. Linstone, H. A., and Turoff, M. (Eds.) 1975. The Delphi Method: Techniques and Applications, Massachusetts: Addison Wesley.
  9. Luftman, J. 2005. "Key Issues for IT Executives 2004," MIS Quarterly Executive (4:2), pp. 269-285.
  10. Luftman, J., and Ben-Zvi, T. 2010a. "Key Issues for IT Executives 2009: Difficult Economy's Impact," MIS Quarterly Executive (9:1), pp. 49-59.
  11. Luftman, J., and Ben-Zvi, T. 2010b. "Key Issues for IT Executives 2010: Judicious IT Investments Continue Post-Recession," MIS Quarterly Executive (9:1), pp. 263-273.
  12. Luftman, J., and Ben-Zvi, T. 2011. "Key Issues for IT Executives 2011: Cautious Optimism in Uncertain Economic Times," MIS Quarterly Executive (10:4), pp. 203-212.
  13. Luftman, J., and Derksen, B. 2012. "Key Issues for IT Executives 2012: Doing More with Less," MIS Quarterly Executive (11:4), pp. 207-218.
  14. Luftman, J. and Kempaiah, R. 2008. "Key Issues for IT Executives 2007," MIS Quarterly Executive (7:2), pp. 99-112.
  15. Luftman, J., and McLean, E. R. 2004. "Key Issues for IT Executives," MIS Quarterly Executive (3:2), pp. 89-104.
  16. Luftman, J., Kempaiah, R., and Nash, E. 2006. "Key Issues for IT Executives 2005," MIS Quarterly Executive (5:2), pp. 81-99.
  17. Luftman, J., Kempaiah, R., and Rigoni, E. H. 2009. "Key Issues for IT Executives 2008," MIS Quarterly Executive (8:3), pp. 151-159.
  18. Marsden, J., Dolan, B., and Holt, L. 2003. "Nurse practitioner practice and deployment: electronic mail Delphi study, "Journal of Advanced Nursing (43:6), pp. 595-605.
  19. Martino, J. P. 1972. Technological forecasting for decision making, New York: American Elsevier Publishing Co.
  20. Niederman, J., Brancheau, J. C., and Wetherbe, J. C. 1991. "Information Systems Management Issues for the 1990's," MIS Quarterly (15:4), pp. 475-500.
  21. Okoli, C., and Pawlowski, S. D. 2004. "The Delphi method as a research tool: an example, design considerations and applications," Information & Management (42:1), pp. 15-29.
  22. Parker, D. B. 1998. Fighting Computer Crime: A New Framework for Protecting Information, New York: John Wiley & Sons.
  23. Preble, J. 1984. "The Selection of Delphi Panels for Strategic Planning Purposes," Strategic Management Journal (5:2), pp. 157-170.
  24. Procter, S., and Hunt, M. 1994. "Using the Delphi survey technique to develop a professional definition of nursing for analysing nursing workload," Journal of Advanced Nursing (19:5), pp. 1003-1014.
  25. Schmidt, R. C. 1997. "Managing Delphi surveys using nonparametric statistical techniques," Decision Sciences (28:3), pp. 763-774.
  26. Westerman, G., and Hunter, R. 2007. IT Risk: Turning Business Threats into Competitive Advantage, Boston: Harvard Business School Press.

Related papers

A SHORT LITERATURE REVIEW IN INFORMATION SYSTEMS SECURITY MANAGEMENT APPROACHES A SHORT LITERATURE REVIEW IN INFORMATION SYSTEMS SECURITY MANAGEMENT APPROACHES
DANMARCK SUMAOANG

This study provides a short literature review in information systems security (ISS) approaches either technical or non-technical in nature. Although, the benefits and uses of the technical information systems security approaches are valuable, there is still a need to investigate the alternative non-technical approaches or at least, to find a way to combine them in a more appropriate and thus, successful way. In doing so, this paper presents the available methods and techniques in information systems security in an attempt to shed some light into how these alternative approaches could be used in benefit of information systems security. managing security, Siponen (2001) supports the need for IS security approaches to provide a holistic modelling support which can be integrated into modern IS development approaches, and the lack of approaches which focus on socio-organizational roles of IS security.

View PDFchevron_right
Mini Track:'Information Systems Security Management
Marios Koufaris

2005

The confluence of information and communication technologies and increased reliance of businesses on such advances has brought a range of information system security issues to the fore. It has indeed become difficult for organizations to protect their information resources with confidence. Perhaps this is the reason why incidents of security breach, computer crime and fraud have increased. The past research and practice has mainly relied on technical means to address the security concerns. Although desirable, an exclusive reliance on ...

View PDFchevron_right
Koskosas I. A SHORT LITERATURE REVIEW IN INFORMATION SYSTEMS SECURITY MANAGEMENT APPROACHES 5 Business Excellence and Management Volume 3 Issue 2 / A SHORT LITERATURE REVIEW IN INFORMATION SYSTEMS SECURITY MANAGEMENT APPROACHES
Nhalyn Romances

This study provides a short literature review in information systems security (ISS) approaches either technical or non-technical in nature. Although, the benefits and uses of the technical information systems security approaches are valuable, there is still a need to investigate the alternative non-technical approaches or at least, to find a way to combine them in a more appropriate and thus, successful way. In doing so, this paper presents the available methods and techniques in information systems security in an attempt to shed some light into how these alternative approaches could be used in benefit of information systems security. managing security, Siponen (2001) supports the need for IS security approaches to provide a holistic modelling support which can be integrated into modern IS development approaches, and the lack of approaches which focus on socio-organizational roles of IS security.

View PDFchevron_right
Factors Affecting the Objectives of Information Security Management
Qingxiong Ma

2008

The issue of information security management (ISM) had been widely studied with different approaches and from different perspectives. To have the right security objectives is the primary step to achieving an effective security program. Based on the contingency theory, a conceptual model of factors that determine ISM objectives was proposed. To validate this model, a webbased survey with open-ended question was conducted. The responses from 120 certified information security practitioners were categorized and analyzed. The paper contributes to theory as it extends previous studies applying the technological, organizational and environmental framework to include factors that impact ISM. Further, it contributes to practice as it increases the awareness and importance of ISM.

View PDFchevron_right
A comprehensive model of information security factors for decision-makers
Helmut Krcmar

Computers & Security, 2020

Decision-making in the context of organizational information security is highly dependent on various information. For information security managers, not only relevant information has to be clarified but also their interdependencies have to be taken into account. Thus, the purpose of this research is to develop a comprehensive model of relevant management success factors (MSF) for organizational information security. First, a literature survey with an open-axial-selective analysis of 136 articles was performed to identify factors influencing information security. These factors were categorized into 12 areas: physical security, vulnerability, infrastructure, awareness, access control, risk, resources, organizational factors, CIA, continuity, security management, compliance & policy. Second, an interview series with 19 experts from the industry was used to evaluate the relevance of these factors in practice and explore interdependencies between them. Third, a comprehensive model was developed. The model shows that there are keysecurity-indicators, which directly impact the security-status of an organization while other indicators are only indirectly connected. Based on these results, information security managers should be aware of direct and indirect MSFs to make appropriate decisions.

View PDFchevron_right

Related topics

  • Business
  • Computer Science
  • Information Systems Security
  • Information Systems Management
  • Information Security Management
  • Q-Sort
  • Security Information and Event M...
  • Information Security Management ...
    • 580 California St., Suite 400
    San Francisco, CA, 94104
    © 2025 Academia. All rights reserved