The Proposed Framework, Information Security Human Factor Framework

Principles of Information Security, Fourth Edition Michael E. Whitman and Herbert J. Mattord Vice President Editorial, Career Education & Training Solutions: Dave Garza Director of Learning Solutions: Matthew Kane Executive Editor: Steve Helba Managing Editor: Marah Bellegarde Product Manager: Natalie Pashoukos Development Editor: Lynne Raughley Editorial Assistant: Jennifer Wheaton Vice President Marketing, Career Education & Training Solutions: Jennifer Ann Baker Marketing Director: Deborah S. Yarnell Senior Marketing Manager: Erin Coffin Associate Marketing Manager: Shanna Gibbs Production Manager: Andrew Crouth Content Project Manager: Brooke Greenhouse Senior Art

Security and ethical employees will continue to be a vital aspect of ensuring the success of an organization. There will always be a need for ethical IT security professional as hackers will continue to force organizations to make adjustments in their business models to protect their employees, data and customers. Many organizations and managers believe application security requires simply installing a perimeter firewall, or taking a few configuration measures to prevent applications or operating systems from being attacked. This is a risky misconception. By understanding threats and respect impacts, organizations will be equipped to maintain confidentiality, availability and

As such, our company’s people resources pose the greatest risk for security breach. Our way to help mitigate risk in this area is to keep communication lines open in this area and to continually mandate security knowledge training, with mandatory updates on a regular basis. When the employees are informed of company policy when facing a security matter, they are better equipped to act in the best or right way. In this way knowledge is power – or at least empowerment to act in the best interest of the company’s information security.

Objective • Human resources policies and practices should reduce the human risk factors in information technology (IT) security and information access controls. Decrease the risk of theft, fraud or misuse of information facilities by employees, contractors and third-party users.

Information Security Specialists were a silo a decade ago and centralized. “The term ‘information security’ means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide integrity, confidentiality, and availability.” (Greene, 2014, p. 65) At SVCC, it’s now everybody’s responsibility regardless of their job description or department within this agency.

To start, all organizations that participated in the study agreed that the simple step of intensifying IT awareness and providing training for employees would help information security. However, this is not the typical one-time training session, it was argued that organizations should continuously educate and conduct training programs. The systems are constantly changing and intruders are constantly finding ways around. It is important to have frequent training and emphasize the importance to hone users skills to prevent attacks and understand procedures if an attack were to occur. Nevertheless, there is still a downfall. It is also possible for organization’s own employee to carry out ‘insider threat damages,’ which has been found to be the biggest threat to information security. Evidently, it is not possible to protect information even with the best software, but with more educated users, the smaller the chances of being hacked externally. Furthermore, if employees fail to properly handle

Ulrich Schwantz (Rideout, 2011). The argument was that Artur83 created an independent file after viewing a photo of the completed product – he did not modify an existing file – and that the complaint was unclear if Dr. Schwantz was trying to say the Penrose triangle, a concept published in 1958, was his intellectual property (Rideout, 2011). Ultimately, Dr. Schwantz dropped the DMCA, but it still serves as a precedence for the debate between original and similarity.

There are eight key interview questions (Appendix D) and several sub-questions to be covered, which was guided by four research objectives:

Why is an information security policy so important in today’s world? According to Al-Hamdani organizations have many items that make them successful including its departments (marketing, accounting, etc.), its processes, its employees and even its clients. One way to protect the organization and everything that makes it successful is to have an information security program that outlines all of the policies that should be followed and enforced. The security policy will help

Consequently, one perspective is that employees constitute an insider threat to their organizations (Warkentin and Willison, 2009). For that reason, organizations want to defense their resources through the use of socio-organizational requirements. In this paper, the author conducted a survey of 124 IS professionals and managers which revealed that IS security policy behavioral compliance intention was influenced by reasons such as self-efficacy, response efficacy, attitude toward compliance, perceived vulnerability, and subjective norms. This information helps to assure his argument by the data analysis implementation using the partial least squares (PLS) technique. Furthermore, the author’s research model was aimed to enhance our knowledge of the IS security compliance in organizations.

Legend has it that the Mongol warrior leader, Kublia Khan, enticed the gatekeeper for access through the Great Wall into China. That simple act of bribery gave Khan’s forces the ability to invade China. The gatekeeper, a person, was the weakest link in China’s security back in 1275 A.D. The same holds true in 2016. Today, people are the weakest link in an organization’s security plan. That security plan is inclusive of information security as well. An information security program needs to include: “policy, education and training, awareness, and technology” to ward off

In this research, attitude, PBC and intention played important roles, but not subjective norms. Rather, a new element called “level of technological awareness” was added (Applying the Theory of Planned Behavior). The research conducted in IT field utilizes TPB to understand the relationship between the factors that lead to unethical use of IT. (The Behavioral Roots of Information Systems Security: Exploring Key Factors Related to Unethical IT use). The theoretical model suggested by TPB has been used in the research to assess employees’ acceptance of the information security system (Future Research – Utilizing The Technology Acceptance Model to Assess the Employee Adoption of Information Systems Security

It is hard to accept that nowadays, organizations get along without having an astute and decisive information system. Providing a reliable and coherence information system requires a solid security framework that ensures confidentiality, integrity, availability, and authenticity of the critical organizational assets. Human factors play a significant role for information security. In particular, human characteristics behavior impacts information security and ultimately associated risks.

Information security professional’s job is to deploy the right safeguards, evaluating risks against critical assets and to mitigate those threats and vulnerabilities. Management can ensure their company’s assets, such as data, remain intact by finding the latest technology and implementing the right policies. Risk management focuses on analyzing risk and mitigating actions to reduce that risk. Successful implementation of security safeguards depends on the knowledge and experience of information security staff. This paper addresses the methods and fundamentals on how to systematically conduct risk assessments on the security risks of information systems.

Review of the literature shows relevant constructs, methodologies, and findings related to the study. Meanwhile, the proposed conceptual framework and hypotheses development shows the relationship of the variables constructed in this study.