The increasing use of technology is the business sector has created the need for information security (IS) training. Training end-users on information security related items assists in the reduction of information risks that organizations encounter in the conduct of business operations. Furthermore, the absence of end-users training in information security will inevitably subject an entity to increased vulnerabilities that can render organizational security technologies and/or measures inept (Chen, Shaw, & Yang, 2006; Siponen, Mahmood, & Pahnila, 2009).
A security risk is the likelihood that an incident will occur and organizations commit various resources to mitigate security risks and vulnerabilities (Fenz, Ekelhart, & Neubauer, 2011). However, organizational commitment of resources does not alleviate responsibilities to constantly develop, purchase, or modify systems that assist in reducing security risks. The first section of this article will identify instructions that contribute to improving advance information security techniques. These various security techniques support organizational strategies that reduce information risks. Furthermore, this article will evaluate and compare knowledge-based systems used to reduce information risks. Lastly, the article will present a comparison on systems that are capable of managing information and subsequently provide ways to reduce information risks.
Improving Information Security Techniques
End-users are the weakest link regarding information security related items (Spears & Barki, 2010). Contrary to the aforementioned belief, Chen et al. (2006) stated the humans are more important than the technology used to reduce risks associated with information security. Arguably, a c...
... middle of paper ...
...iciency. Region Formation & Development Studies(8), 167-176. Retrieved from http://journals.ku.lt/index.php/RFDS
Senft, S., Gallegos, F., & Davis, A. (2012). Information Technology Control and Audit (4th ed.). Boston, MA, USA: Auerbach Publishers, Incorporated.
Siponen, M., Mahmood, M. A., & Pahnila, S. (2009). Are employees putting your company at risk by not following information security policies? Communications of the ACM, 52(12), 145-147. doi:10.1145/1610252.1610289
Spears, J. L., & Barki, H. (2010). User participation in information systems security risk management. MIS Quarterly, 34(3), 503-A5. Retrieved from http://www.misq.org/
Wangwe, C. K., Eloff, M. M., & Venter, L. (2012). A sustainable information security framework for e-government – case of Tanzania. Technological & Economic Development of Economy, 18(1), 117-131. doi:10.3846/20294913.2012.661196
However, I feel users had a different vision/perspective on security mechanisms and they trusted each other during those times and did not have to worry about protecting their information (this is how exactly, one person’s ignorance becomes another’s person’s - hacker, here bliss). This book helps us to understand the vulnerabilities; its impacts and why it is important to address/ fix those holes.
National Institute of Standards and Technology (NIST): Risk Management Guide for Information Technology Systems. Special Publication 800-30, 2002.
Security helps the organization meet its business objectives or mission by protecting its physical and financial resources, reputation, legal position, employees, and other tangible and intangible assets through the selection and application of appropriate safeguards. Businesses should establish roles and responsibilities of all personnel and staff members. However, a Chief Information Officer should be appointed to direct an organization’s day to day management of information assets. Supporting roles are performed by the service providers and include systems operations, whose personnel design and operate the computer systems. Each team member must be held accountable in ensuring all of the rules and policies are being followed, as well as, understanding their roles, responsibilities and functions. Organizations information processing systems are vulnerable to many threats that can inflict various types of damage that can result in significant losses (Harris, 2014). Losses can come from actions from trusted employees that defraud the system, outside hackers, or from careless data entry. The major threat to information protection is error and omissions that data entry personnel, users, system operators and programmers make. To better protect business information resources, organizations should conduct a risk analysis to see what
In this case, a large health services organization (HSO) in Florida, that has a world-renowned AIDS treatment center had information breach of 4,000 HIV+ patient records, and the list was sent to newspapers, magazines, and the internet. Consequently, this issue was featured in every media vehicle in the world and as CEO, you are requested by the board of trustees to come up a better management information system (MIS) to resolve all information security issues or you will face termination. After hiring an undercover computer security consultant to help determine where the security leak came from, she quickly identifies numerous breaches in computer security and provides a report with the issues identified. The report furnished by the consultant revealed that facility had major problems with the MIS and the staff. In order to determine how to address the issues, the CEO must first answer the following questions: what law is being violated by the employees, why was this law enacted, what are the penalties for such violations, what are the penalties for sharing celebrity information, and should he be updating his resume and looking for another job (Buchbinder, 378).
First, business practices required a computer incident response team (CIRT) to ensure that there is a capability to provide help to users when a security ...
Program will use a risk management approach to develop and implement Information Security policies, standards, guidelines, and procedures that address security objectives in tandem with business and operational considerations. The Information Security Program will develop policies to define protection and management objectives for information assets. The Information Security Program will also define acceptable use of PCS information assets. The Information Security Program will attempt to reduce vulnerabilities by developing policies to monitor, identify, assess, prioritize, and manage vulnerabilities and threats. The management activities will support organizational objectives for mitigating, responding to and recovering from identified vulnerabilities and threats.
Firstly, they should ensure that organizations comply with information technology regulations. Secondly, they should ensure that IT staff are well equipped with technical knowhow to ensure they can pinpoint any forms of threats and take appropriate actions in advance. Lastly, the government, private sector, and other stakeholders should share information concerning diverse forms of threats to facilitate in the establishment of effective measures for addressing any forms of security threats (Moore & Shenoi,
The computer is considered one of the most important technological advances of the twentieth century. Security and privacy issues have been in existence long before the computer became a vital component of organizations' operations. Nevertheless, the operating features of a computer make it a double-edged sword. Computer technologies with reliable error detection and recording capabilities, permit the invasion of a supposedly secure environment to occur on a grand scale and go undetected. Furthermore, computer and communications technology permit the invasion of a persons' privacy and likewise go undetected. Two forces threaten privacy: one, the growth of information technology with its enhanced capacity for surveillance, communication, computation, storage and retrieval and two, the more insidious threat, the increased value of information in decision making. Information has become more vital in the competitive environment, thus, decision makers covet it even if it viol!
Whitman, M., & Mattord, H. (2010). Management of information security. (3rd ed., p. 6). Boston, MA: Cengage Learning.
NSIT 800-30, Risk Management Guide for Information Technology Systems. This document describes a forma approach to risk assessment that includes threat and vulnerability identification, control analysis, impact analysis, and a matrix depiction of risk determination and control recommendations. When security professionals apply a qualitative or quantitative risk assessment, an organization management can begin the process of deciding what steps, if any, need to be implemented to manage the risk identified in the risk assessment. There are four general approaches to risk assessments (Gregory, 2010):
Data breaches have gone up significantly and hackers are coming up with innovative techniques of breaching the data security network. There are several challenges associated with cybersecurity management as there are a multitude of threats arising from various sources. Cybersecurity threat can have different levels of impact on an organization or a business and varies based on the industry type. According to the Securitas USA survey, manufacturing, healthcare and insurance, finance, information, and utilities saw cybersecurity as the topmost threat for their businesses (Securitas USA,
Zeleny, M (ed.) 2000, The IEBM handbook of information technology in business, Thomson Learning, London.
Nowadays, the information is the most treasured asset in an organization, due to it along with the experience represents the input necessary to take appropriate decisions and consequently to have success in the business. Almost all the information and knowledge related with the processes business, goods and services offered by a company, is processed, managed and stored through technology and information systems, thus the security of information has become increasingly important and plays a critical role in the enterprise government.
"Risk management is the part of analysis phase that identifies vulnerabilities in an organization's information system and take carefully reasoned steps to assure the confidentiality, integrity, and availability of all components in the organization's information system" (Management of Information Security - second Ed, Michael E. Whitman and Herbert J. Mattord)
Physical security cannot be wholly successful without the human factor element and the active support of these user groups. For example, when the aim is to protect a critical facility from attack or to provide access control for an office building it is necessary to engage people on the proper use of any security systems that are in place, for instance security alarms. If the alarm goes off and employees have no idea what it signifies