A Literature Review On Information Security Compliance Behaviour

Confidentiality is the protection of information from unauthorized access. This is the assurance that information provided has not been made known to unauthorized persons, processes or devices. The application of this security service suggests information labeling and need-to-know imperatives are core aspects of the system security policy. Information, in today’s world, has value and everyone has information they wish to keep secret. Information such as credit card details, trade secrets, personal information, government documents, and many more. It was stated (Securitas Operandi™, 2008) that, we are bound to keep many secrets – corporate, staff, and personal secrets. We must keep this confidential information under wraps and earn the trust of employers, colleagues, and regulators every day. Mechanisms to enforce this include cryptography, which is, encrypting and decrypting data, access controls such as

D 'Arcy, J., Hovav, A., & Galletta, D. (2009). User awareness of security countermeasures and its impact on information systems misuse: a deterrence approach. Information Systems Research, 20(1), 79-98

Security and ethical employees will continue to be a vital aspect of ensuring the success of an organization. There will always be a need for ethical IT security professional as hackers will continue to force organizations to make adjustments in their business models to protect their employees, data and customers. Many organizations and managers believe application security requires simply installing a perimeter firewall, or taking a few configuration measures to prevent applications or operating systems from being attacked. This is a risky misconception. By understanding threats and respect impacts, organizations will be equipped to maintain confidentiality, availability and

As such, our company’s people resources pose the greatest risk for security breach. Our way to help mitigate risk in this area is to keep communication lines open in this area and to continually mandate security knowledge training, with mandatory updates on a regular basis. When the employees are informed of company policy when facing a security matter, they are better equipped to act in the best or right way. In this way knowledge is power – or at least empowerment to act in the best interest of the company’s information security.

In today’s IT world every organization has a responsibility to protect the information and sensitive data they have. Protecting data is not only responsibility of security and IT staff but every individual is involved in protecting the information. The risks to information security are not digital only, but it involves technology, people and process that an organization may have. These threats may represent the problems that are associated to complex and expensive solution, but doing nothing about these risks is not the solution.

Statistics show that most security breaches are direct results of insider misconduct rather than being hacked. According to the most recent Verizon Data Breach Investigations Report, about “285 million records were compromised in 2008.” Seventy-four percent of the incidents were from inside sources. Users are more likely to be victims of computer virus infections, inquisitive students/co-workers, and hardware failures than to be victims of an Internet security attack.

While running businesses, owners must be aware of crucial security threats that their organizations are exposed to in order to formulate

While all of these technologies have enabled exciting changes and opportunities for businesses, they have also created a unique set of challenges for business managers. Chief among all concerns about technology is the issue of information security. It seems to be almost a weekly occurrence to see a news article about yet another breach of security and loss of sensitive data. Many people will remember high profile data breaches from companies such as T.J Maxx, Boston Market, Sports Authority, and OfficeMax. In the case of T.J. Maxx, a data breach resulted in the loss of more than 45 million credit and debit card numbers. In many of these incidents, the root cause is a lack of adequate security practices within the company. The same technologies that enable managers can also be used against them. Because of this, businesses must take appropriate steps to ensure their data remains secure and their communications remain

Information security is vital in organizations; more so in this era where terrorism and hacking are the order of the day. The cost of ensuring a reliable information security is high (Gulati, p.2-3). However, cyber-attacks can vary in costs and outweigh the process of security measures in place to protect information (Manske, p.55). The cost of reputation after an attack can be a major blow to the running of an organization. For instance, if an attacker access credit card information the customers may withdraw from the company or refrain from its services. Court cases against the loss of confidential information may spoil the reputation of a company . When the computer systems have been accessed illegally, the systems must be inspected, fixed and re-secured. Hackers publicly expose the hacked information; clients, sellers and investors may avoid associating with the

The analysis of 2,260 breaches and more than 100,000 incidents at 67 organizations in 82 countries shows that organizations are still failing to address basic issues and well-known attack methods. The (DBIR, 2016) shows, for example, that nearly two-thirds of confirmed data breaches involved using weak, default or stolen passwords. Also shows that most attacks exploit known vulnerabilities that organizations have never patched, despite patches being available for months – or even years – with the top 10 known vulnerabilities accounting for 85% of successful exploit “Organizations should be investing in training to help employees know what they should and shouldn’t be doing, and

Information security professional’s job is to deploy the right safeguards, evaluating risks against critical assets and to mitigate those threats and vulnerabilities. Management can ensure their company’s assets, such as data, remain intact by finding the latest technology and implementing the right policies. Risk management focuses on analyzing risk and mitigating actions to reduce that risk. Successful implementation of security safeguards depends on the knowledge and experience of information security staff. This paper addresses the methods and fundamentals on how to systematically conduct risk assessments on the security risks of information systems.

Safety of information is the most valuable asset in any organization particular those who provide financial service to others. Threats can come from a variety of sources such as human threats, natural disasters and technical threats. By identifying the potential threats to the network, security measure can be taken to combat these threats, eliminate them or reduce the likelihood and impact if they should occur.

Each day our world and our lives depend more on information systems, systems that can guarantee that our informations are secure and available just for our own purpose. Lots of companies work just if critical information which is stored on their databases. It is the responsibility of these companies to guarantee with their costumers that this data is secure. Lots of those companies are concerned about their databases and try to improve their security however. According to last year 's Internet Security Report from Symantec, almost no company, whether large or small, is immune to cyber attacks. Five of every six large companies (2500+ employees) were targeted with spear-phishing attacks in 2014, a 40 percent increase over the previous year[1]. Normally, companies are aware of theses attacks and are trying to invest more and more in security. It’s important to point out that attacks are not just from the outside; breaches and even data leakage can be accomplished by inside employees. So, it’s really important to protect against inside and outside attacks.

This article also talks about the economics of information security theory, but this article interprets the theory to prove a specific point. This article presents an economic model that establishes the ideal amount to invest to protect a given set of information. The model takes into account the susceptibility of the information to a security breach and the potential loss to an organization if the breach occurs. It is stated that for a specified potential loss, a firm should not compulsorily focus its assets on information sets with the highest

To be more specific, a modern enterprise is surrounded by numerous hazards, which, if properly exploited, may lead to devastating outcomes for a company, especially if the company is involved in the financial segment of the economy. Today’s business practice vividly illustrates that a single leak of information may cause bankruptcy, substantial distrust of customers and even criminal persecution by the government (Chwan, 2013).