Factors Affecting an Organization’s Information Security Performance: The Characteristics of Information Security Officers

2020 ◽  
pp. 77-84
Author(s):  
Ha-Kyeong Oh ◽  
Tae-Sung Kim
Keyword(s):  
Information Security ◽  
Factors Affecting ◽  
Security Officers ◽  
Organization's Information Security

scholarly journals Factors Affecting Information Security Focused on SME and Agricultural Enterprises

2016 ◽  
Vol 8 (4) ◽  
pp. 37-50 ◽  
Author(s):  
V. Bolek ◽  
A. Látečková ◽  
A. Romanová ◽  
F. Korček
Keyword(s):  
Information Security ◽  
Factors Affecting ◽  
Agricultural Enterprises

Metric Based Security Assessment

2008 ◽  
pp. 1396-1415
Author(s):  
James E. Goldman ◽  
Vaughn R. Christie
Keyword(s):  
Information Security ◽  
Assessment Tool ◽  
Maturity Model ◽  
Security Assessment ◽  
Self Assessment ◽  
Security Metrics ◽  
Capability Maturity ◽  
Security Models ◽  
Organization's Information Security ◽  
Systems Security Engineering

This chapter introduces the Metrics Based Security Assessment (MBSA) as a means of measuring an organization’s information security maturity. It argues that the historical (i.e., first through third generations) approaches used to assess/ensure system security are not effective and thereby combines the strengths of two industry proven information security models, the ISO 17799 Standard and the Systems Security Engineering Capability Maturity Model (SSE-CMM), to overcome their inherent weaknesses. Furthermore, the authors trust that the use of information security metrics will enable information security practitioners to measure their information security efforts in a more consistent, reliable, and timely manner. Such a solution will allow a more reliable qualitative measurement of the return achieved through given information security investments. Ultimately, the MBSA will allow professionals an additional, more robust self-assessment tool in answering management questions similar to: “How secure are we?”

scholarly journals COMPETENCY-BASED APPROACH TO MONITORING THE EFFECTIVENESS OF PUBLIC SERVICES PERSONNEL ON INFORMATION SECURITY

2021 ◽  
Vol 45 (4) ◽  
pp. 121-129
Author(s):  
O.A. Voskresenskaya ◽  
◽  
N.M. Sladkova ◽  
Keyword(s):  
Information Security ◽  
Public Services ◽  
Civil Service ◽  
Legal Regulation ◽  
Civil Servants ◽  
Government Agencies ◽  
Security Level ◽  
It Services ◽  
Factors Affecting ◽  
Development Of Competencies

Among the factors affecting the level of digitalization and information security of public services in the Russian Federation, the training level of civil servants in this area has a special place. The object of this paper is the activities of government agencies on the assessment and development of information security competencies of civil servants. The authors apply a competencybased approach to determine the effectiveness of information security in government agencies and focus on monitoring the state of work on assessing and developing competencies in the field of information security of civil servants. The purpose of the study is to develop tools and methods for monitoring the effectiveness of personnel to ensure information security in public services. The methodological base of the study includes the analysis of the regulatory framework, scientific literature in the field of the best domestic and foreign practices, data obtained on the basis of surveys of government representatives. The research results: indicators and methods for assessing the maturity of the work of state bodies on the assessment and development of competencies in the field of information security of civil servants are proposed; the findings of the study on information security level in a number of instances are presented, the most frequent incidents related to ensuring information security by civil servants are given, the relationship between the maturity of information security processes and the level of competence of civil servants in this area is shown. The results of the study may be used in the activities of HR and IT-services, information security divisions of public services, as well as by federal and regional authorities responsible for the development and implementation of state policy in legal regulation on information security in the public civil service. Provided the information security is one of the basic qualification requirements, the prospect of solving problems in this area is seen in the automation of monitoring processes based on the federal unified information system for personnel management of the civil service of Russia.

The influence of organizational culture on information governance effectiveness

2019 ◽  
Vol 29 (1/2) ◽  
pp. 18-41 ◽  
Author(s):  
Ali Daneshmandnia
Keyword(s):  
Organizational Culture ◽  
Information Security ◽  
It Professionals ◽  
Content Type ◽  
For Profit ◽  
Security Officers ◽  
Information Governance ◽  
Competition Result ◽  
Governance Processes ◽  
And Control

Purpose This paper aims to explore the impact of organizational culture on information governance (IG) effectiveness at higher education institutions (HEIs). IT professionals, such as chef information officers, chief technology officers, chief information security officers and IT directors at HEIs were surveyed and interviewed to learn about whether organizational culture influences IG effectiveness. Several IG activities (processes) were identified, including information security, the function of an IG council, the presence of a Record Information Management department, the role of a compliance officer and information stewards and the use of an automated system or software to identify and maintain information life-cycle management. Design/methodology/approach This study was conducted using Cameron and Quinn’s (Cameron and Quinn, 2011) competing value framework. To evaluate organizational culture, using the competing value framework, four types of organizational culture profiles were used: collaboration, creation/innovation, controlling/hierarchy, and competition/result-oriented. The methodology included quantitative and qualitative techniques through the use of content analysis of data collected from participants. IT professionals, such as chef information officers, chief technology officers, chief information security officers and IT directors at HEIs were surveyed and interviewed to learn about whether organizational culture influences IG effectiveness. Findings Findings revealed organizational culture may influence IG effectiveness positively, especially from cultures of competition/result-oriented and control/hierarchy. Qualitatively, it also emerged that competition/result-oriented and control characteristics of organizational culture were perceived by IG professionals to produce more accurate information. One of the characteristics of organizational culture that became evident in the current study, coming from more than one subject, was the challenge in IG due to the presence of information silos. Trust, on the other hand, has been highlighted as the glue which can enable and drive governance processes in an organization. Research limitations/implications The current study was conducted based on HEIs. While the current study serves as a baseline for studying IG in other institutions, its results cannot be generalized for other type of institutions. The results cannot be generalized for other types of not-for-profit or for-profit organizations. Many of the characteristics of the sample data were specific to HEIs. For instance, financial, manufacturing and health-care institutions present challenges inherent in those institutions. Originality/value Trust has been highlighted as the glue which can enable and drive governance processes in an organization. Respondents of current study have indicated that trust serving several different factors toward IG effectiveness, including freedom to speak freely in the meeting about impact of organizational culture on IG, wiliness of executives of administration, particularly the CIO, to communicate IG matters to institution, sharing information and being transparent, entrusting help desk staff and technical supervisors so users can communicate with them and share their concerns and perceiving “feeling of trust” in the organization, which would benefit the institution, allowing stakeholders to collaborate and work together to overcome issues when facing IG challenges.

Employer Branding and Internet Security

2017 ◽  
pp. 357-378
Author(s):  
Ewa Maria Matuska ◽  
Joanna Grubicka
Keyword(s):  
Information Security ◽  
Cyber Security ◽  
Human Resources Management ◽  
Special Kind ◽  
Internet Security ◽  
Employer Branding ◽  
Strategic Human Resources ◽  
Strategic Human Resources Management ◽  
Organization's Information Security ◽  
Aversive Behavior

This chapter promotes the concept of employer branding (EB) as special kind of value management being part of strategic human resources management (SHRM) and including elements of cyber security. Employees' and organization's shared values (EVPs) bring opportunity to create common sense of identity, which prevents potentially aversive behavior towards company's reputation. Chapter's background positions EB and EVP in process of SHRM, introduces the view of EB as architectural frame for core organizational values, and describes popular Internet tools of EB. The background is closed by descriptions of common Internet threats, their implications to overall organization's information security, as well as useful Internet security systems. Chapter concludes with recommendations regarding enhancing EB by better controlling company's information security. As a new research area is proposed sub-discipline of cyber security in management, with special dedication to SHRM.

scholarly journals Productivity vs security: mitigating conflicting goals in organizations

2017 ◽  
Vol 25 (2) ◽  
pp. 137-151 ◽  
Author(s):  
Peter Mayer ◽  
Nina Gerber ◽  
Ronja McDermott ◽  
Melanie Volkamer ◽  
Joachim Vogt
Keyword(s):  
Information Security ◽  
Goal Setting ◽  
Security Policy ◽  
Negative Effects ◽  
Content Type ◽  
Factors Affecting ◽  
Positive Effects ◽  
Survey Results ◽  
Security Compliance ◽  
Reported Data

Purpose This paper aims to contribute to the understanding of goal setting in organizations, especially regarding the mitigation of conflicting productivity and security goals. Design/methodology/approach This paper describes the results of a survey with 200 German employees regarding the effects of goal setting on employees’ security compliance. Based on the survey results, a concept for setting information security goals in organizations building on actionable behavioral recommendations from information security awareness materials is developed. This concept was evaluated in three small- to medium-sized organizations (SMEs) with overall 90 employees. Findings The survey results revealed that the presence of rewards for productivity goal achievement is strongly associated with a decrease in security compliance. The evaluation of the goal setting concept indicates that setting their own information security goals is welcomed by employees. Research limitations/implications Both studies rely on self-reported data and are, therefore, likely to contain some kind of bias. Practical implications Goal setting in organizations has to accommodate for situations, where productivity goals constrain security policy compliance. Introducing the proposed goal setting concept based on relevant actionable behavioral recommendations can help mitigate issues in such situations. Originality/value This work furthers the understanding of the factors affecting employee security compliance. Furthermore, the proposed concept can help maximizing the positive effects of goal setting in organizations by mitigating the negative effects through the introduction of meaningful and actionable information security goals.

Sign in / Sign up

Export Citation Format

Share Document