Analysing information security in a bank using soft systems methodology

Temesgen Kitaw Damenu (Department of Computing, Edge Hill University, Lancashire, UK)
Chris Beaumont (Department of Computing, Edge Hill University, Lancashire, UK)

Information and Computer Security

ISSN: 2056-4961

Publication date: 10 July 2017

Abstract

Purpose

This paper aims to explore the use of soft systems methodology (SSM) to analyse the socio-technical information security issues in a major bank.

Design/methodology/approach

Case study research was conducted on a major bank. Semi-structured interviews with a purposive sample of key stakeholders in the business, comprising senior managers, security professionals and branch employees were conducted.

Findings

SSM was particularly useful for exploring the holistic information security issues, enabling models to be constructed which were valuable analytical tools and easily understood by stakeholders, which increased the receptiveness of the bank, and assisted with member validation. Significant risks were apparent from internal sources with weaknesses in aspects of governance and security culture.

Research limitations/implications

This research uses a single case study and whilst it cannot be generalised, it identifies potential security issues others may face and solutions they may apply.

Practical implications

Information security is complex and addresses technical, governance, management and cultural risks. Banking attacks are changing, with greater focus on employees and customers. A systemic approach is required for full consideration. SSM is a suitable approach for such analysis within large organisations.

Originality/value

This study demonstrates how important benefits can be obtained by using SSM alongside traditional risk assessment approaches to identify holistic security issues. A holistic approach is particularly important given the increasing complexity of the security threat surface. Banking was selected as a case study because it is both critical to society and is a prime target for attack. Furthermore, developing economies are under-represented in information security research, this paper adds to the evidence base. As global finance is highly interconnected, it is important that banks in such economies do not comprise a weak link, and hence, results from this case have value for the industry as a whole.

Keywords

Citation

Damenu, T.K. and Beaumont, C. (2017), "Analysing information security in a bank using soft systems methodology", Information and Computer Security, Vol. 25 No. 3, pp. 240-258. https://doi.org/10.1108/ICS-07-2016-0053

Publisher

:

Emerald Publishing Limited

Copyright © 2017, Emerald Publishing Limited

To read the full version of this content please select one of the options below

You may be able to access this content by logging in via Shibboleth, Open Athens or with your Emerald account.
To rent this content from Deepdyve, please click the button.
If you think you should have access to this content, click the button to contact our support team.