A real-world information security performance assessment using a multidimensional socio-technical approach

Abstract

Measuring the performance of information security is an essential part of the information security management system within organisations. Studies in the past mainly focused on establishing qualitative measurement approaches. Since these can lead to ambiguous conclusions, quantitative metrics are being increasingly proposed as a useful alternative. Nevertheless, the literature on quantitative approaches remains scarce. Thus, studies on the evaluation of information security performance are challenging, especially since many approaches are not tested in organisational settings. The paper aims to validate the model used for evaluating the performance of information security management system through a multidimensional socio-technical approach, in a real-world settings among medium-sized enterprises in Slovenia. The results indicate that information security is strategically defined and compliant, however, measures are primarily implemented at technical and operational levels, while its strategic management remains underdeveloped. We found that the biggest issues are related to information resources and risk management, where information security measurement-related activities proved to be particularly problematic. Even though enterprises do possess certain information security capabilities and are aware of the importance of information security, their current practices make it difficult for them to keep up with the fast-paced technological and security trends.

Impact of work-family balance results on employee work engagement within the organization: The case of Slovenia

“…As research shows [e.g. 47 , 48 ] the family-friendly work environment and safety concerns are an important factor in work engagement. Research [ 2 , 49 , 50 ] has also shown that the length of working time also plays an important role in reconciling work and family life, as those employees who have a longer working day have greater difficulties in work-life balance.…”

Best practice framework for information technology security governance in Indonesian government

“…How people can assess information security for public administration requires a systematic approach that increases based on the needs of continuous improvement [37]. The evaluation model developed by Zuo [38] can be used as a benchmark accompanied by a socio-technical multidimensional approach [39]. The audit implementation relies on advanced standards and frameworks of IT infrastructure organization, management, and security such as Cobit and ISO 17799 [40].…”

Kategorizacija uporabnikov na podlagi njihovega z informacijsko varnostjo povezanega znanja, stališč in vedenja: pilotna študija

“…Pomanjkanje ustrezne informacijske varnosti lahko vodi v izgubo dobička in slab ugled organizacije (Roy Sarkar, 2010). Da bi dobili vpogled v dejansko stanje informacijske varnosti moramo implementirati ustrezne merilne mehanizme (Prislan et al, 2020), kot so kvantitativne in kvalitativne metrike (Fujs et al, 2020(Fujs et al, , 2019. Informacijska varnost se je tradicionalno zago-tavljala s pomočjo tehničnih varnostnih mehanizmov (kot so npr.…”