Search results

The aim of this study was first to confirm that a specific bank’s employees were generally more information security-aware than employees in other Australian industries and second to identify the major factors that contributed to this bank’s high levels of information security awareness (ISA).

A Web-based questionnaire (the Human Aspects of Information Security Questionnaire – HAIS-Q) was used in two separate studies to assess the ISA of individuals who used computers at their workplace. The first study assessed 198 employees at an Australian bank and the second study assessed 500 working Australians from various industries. Both studies used a Qualtrics-based questionnaire that was distributed via an email link.

The results showed that the average level of ISA among bank employees was consistently 20 per cent higher than that among general workforce participants in all focus areas and overall. There were no significant differences between the ISA scores for those who received more frequent training compared to those who received less frequent training. This result suggests that the frequency of training is not a contributing factor to an employee’s level of ISA.

This current research did not investigate the information security (InfoSec) culture that prevailed within the bank in question because the objective of the research was to compare a bank’s employees with general workforce employees rather than compare organisations. The Research did not include questions relating to the type of training participants had received at work.

This study provided the bank’s InfoSec management with evidence that their multi-channelled InfoSec training regime was responsible for a substantially higher-than-average ISA for their employees. Future research of this nature should examine the effectiveness of various ISA programmes in light of individual differences and learning styles. This would form the basis of an adaptive control framework that would complement many of the current international standards, such as ISO’s 27000 series, NIST’s SP800 series and ISACA’s COBIT5.

The purpose of this paper is to obtain a list of recommendations addressed by the information technology (IT) governance enablers in relation to IoT implementation. The reason behind this it is the lack of information about these instances which could the organizations to be more effective when implementing IoT.

The objectives will be obtained using the methodology – systematic literature review.

During the research, a list of recommendations was created on each IT governance enabler in relation to IoT implementation, showing the flaws that exist at the literature level for each enabler.

The state of art of this research is a creation of a list of recommendations according to IT governance enablers to be applied on an IoT implementation.

This paper aims to introduce the concept of a framework of cyber-security controls that are adaptable to different types of organisations and different types of employees. One of these adaptive controls, namely, the mode of training provided, is then empirically tested for its effectiveness.

In total, 1,048 working Australian adults completed the human aspects of the information security questionnaire (HAIS-Q) to determine their individual information security awareness (ISA). This included questions relating to the various modes of cyber-security training they had received and how often it was provided. Also, a set of questions called the cyber-security learning-styles inventory was used to identify their preferred learning styles for training.

The extent to which the training that an individual received matched their learning preferences was positively associated with their information security awareness (ISA) level. However, the frequency of such training did not directly predict ISA levels.

Further research should examine the influence of matching cyber-security learning styles to training packages more directly by conducting a controlled trial where the training packages provided differ only in the mode of learning. Further research should also investigate how individual tailoring of aspects of an adaptive control framework (ACF), other than training, may improve ISA.

If cyber-security training is adapted to the preferred learning styles of individuals, their level of ISA will improve, and therefore, their non-malicious behaviour, whilst using a digital device to do their work, will be safer.

A review of the literature confirmed that ACFs for cyber-security does exist, but only in terms of hardware and software controls. There is no evidence of any literature on frameworks that include controls that are adaptable to human factors within the context of information security. In addition, this is the first study to show that ISA is improved when cyber-security training is provided in line with an individual’s preferred learning style. Similar improvement was not evident when the training frequency was increased suggesting real-world improvements in ISA may be possible without increasing training budgets but by simply matching individuals to their desired mode of training.

As an emerging discipline, information governance (IG) presents a number of challenges to organisations and countries. For example, IG has not yet been clearly defined and current proponents present the concepts as records management, information management, enterprise content management, privacy (data protection), freedom of information, corporate governance, information risk, information security and e-discovery, to mention just a few areas. At an organisational level, initiatives focus on one of these aspects, often conflicting with the other elements, and are initiated because of some immediate business challenge, such as the introduction of the Protection of Personal Information Act (data protection or privacy legislation) in South Africa. This is compounded by the fact that the country creates many fragmented policies and pieces of legislation on the same IG aspects which are conducted in a disjointed manner. This study aims to present an integrated IG framework at the country level, comprising key success factors, required instruments (policy and legislation), principles and a proposed list of elements or disciplines, which should be managed in a cohesive manner.

This study adopted the Information Governance Initiative’s pinwheel facets of IG to design an integrated framework of elevating IG to country level. The pinwheel helped to identify different facets of information disciplines and the responsible oversight mechanism for implementation in South Africa. The study relied on data obtained through content analysis of policy documents, legislative frameworks, and literature review regarding the identified facets of IG in South Africa.

The study established that only some aspects/domains/facets of IG are legislated and driven by policy in South Africa. These domains are at different levels of maturity and different stakeholder groups are responsible for each domain; for instance, the National Archives of South Africa is responsible for records management and the State Information Technology Agency is responsible for information technology, while the newly established Information Regulator is responsible for freedom of information and data privacy. There is generally no over-arching structure responsible for overall IG in South Africa as the elements are fragmented in various oversight mechanisms and institutions. As a result, domains compete for limited resources and often lead to “knee-jerk” responses to legislative, legal or risk drivers.

It is concluded that if IG is not regulated and modelled at a country level, it is highly unlikely to filter down to organisations. Implementing IG at country level will go a long way in helping to filter it down to an organisation level.

The study is useful by presenting a framework to ensure that IG is implemented at the country level with a single coordinating body established for oversight mechanisms such as the Information Regulator (which currently has a narrow scope of privacy and freedom of information, although with limited resources).

This paper aims to discuss the still immature concept of information governance (IG) from a records and information management (RIM) perspective and attempts to identify some critical aspects, essential elements and challenges, drawing on lessons learned from corporate experience in a global setup.

After a critical consideration of the notion “information governance” the paper reports some issues which turned out to be major barriers to success during IG implementation within a given organisation.

Practical experience highlights the importance of carefully scoping IG frameworks in larger organisations; in particular, balancing the representation of all relevant stakeholders (especially lines of business) and targeting investment in initiatives that foster an information management culture. Equally critical to success is corporate communication which truly values information as a corporate asset and highlights the importance of information lifecycle management rather than technology under the motto “putting the ‘I’ into IT”.

This paper draws on experience from a single case study to discuss some of the cultural factors that influence the design and implementation of IG in general. However, more empirical research is needed in order to broaden the understanding of the impact of IG programmes in real-world organisations.

When implementing IG programmes in global organisations it should not be limited to an IT perspective alone. The biggest challenge is the fact that no department or discipline alone can achieve the desired results. Success is only possible in an orchestrated scenario with clear value propositions for specific business functions.

Based on a small selection of professional literature on the IG approach, the paper presents findings about issues and pitfalls when setting up and implementing an IG programme. It is hoped that it will inspire more exploratory research of this kind from members of the records management community to encourage them to raise the need for IG in their own organisations.

Despite existing advances in information technology infrastructure services (ITISs), there remains no consensus in the literature regarding what dimensions or criteria are best suited for the measurement of their quality. The purpose of this paper is to fill this gap, proposing a methodological approach to measuring the quality of ITISs, as perceived by users.

Cronbach’s α and item-total correlations were used to measure the reliability of the questionnaire; multiple linear regression analysis was employed to determine the items (criteria) most related to the quality of ITISs; and finally, importance–performance analysis was conducted to determine the most critical criteria in service provision. An exploratory study was conducted to evaluate the quality of ITISs at a Brazilian university.

Control of the activities of the information technology (IT) team, periodic maintenance of hardware and software, the security policy and the skill of the labor affect the quality of services most, relative to the dimensions of infrastructure, people and processes.

The results indicate what dimensions and items should be considered by IT managers to improve the quality of ITISs. Special attention should be paid to the effective use of equipment, software and network infrastructure: it should be ensured that these are in good working order and can be utilized by users who expect to be trained to take advantage of their functions.

This paper shows how to integrate relevant techniques to assess the quality of ITISs. An original set of criteria to evaluate the quality of ITISs, derived from a systematic review of the literature, is suggested.

The purpose of the study is to explore the factors associated with the extent of security/cybersecurity audit by the internal audit function (IAF) of the firm. Specifically, the authors focused on whether IAF/CAE (certified audit executive [CAE]) characteristics, board involvement related to governance, role of the audit committee (or equivalent) and the chief risk officer (CRO) and IAF tasked with enterprise risk management (ERM) are associated with the extent to which the firm engages in security/cybersecurity audit.

For analysis, the paper uses responses of 970 CAEs as compiled in the Common Body of Knowledge database (CBOK, 2015) developed by the Institute of Internal Auditors Research Foundation (IIARF).

The results of the study suggest that the extent of security/cybersecurity audit by IAF is significantly and positively associated with IAF competence related to governance, risk and control. Board support regarding governance is also significant and positive. However, the Audit Committee (AC) or equivalent and the CRO role are not significant across the regions studied. Comprehensive risk assessment done by IAF and IAF quality have a significant and positive effect on security/cybersecurity audit. Unexpectedly, CAEs with security certification and IAFs tasked with ERM do not have a significant effect on security/cybersecurity audit; however, other certifications such as CISA or CPA have a marginal or mixed effect on the extent of security/cybersecurity audit.

This study is the first to describe IAF involvement in security/cybersecurity audit. It provides insights into the specific IAF/CAE characteristics and corporate governance characteristics that can lead IAF to contribute significantly to security/cybersecurity audit. The findings add to the results of prior studies on the IAF involvement in different IT-related aspects such as IT audit and XBRL implementation and on the role of the board and the audit committee (or its equivalent) in ERM and the detection and correction of security breaches.

The purpose of this paper is to ease the ISO 31000 standard understanding and provide mechanisms that allow organizations to adopt and adapt this standard to their reality.

The research methodology adopted in this research was the design science research methodology.

Key finding is that enterprise architecture (EA) models and EA tools can help reduce the complexity of the ISO 31000 standard and improve the communication between stakeholders.

The research proposal serves the purpose of supporting the evidence collection for an enterprise risk management (ERM) initiative in an as-was, as-is, or to-be perspective.

Traditional ERM efforts operate on silos, limiting the sharing of risk information and the achievement of an organization-wide view of risks. EA can provide a common way to model complex business systems, from the strategic level to implementation details. This paper proposes the use of an EA model and an EA tool (Atlas) to represent ISO 31000, allowing a better understanding on the value of assets that can be affected from the manifestation of some risks over time.

Blockchain is expected to impact reporting and auditing processes. Indeed, the increasing use of blockchain could affect the nature and extent of information available to auditors and how audits are performed. This paper aims to investigate how auditors are assessing the relevance of the current auditing standards in light of the emergent use of blockchain technology.

Based on qualitative content analysis, this paper analyzed semi-structured interviews with auditors to understand their shared perception of how the current auditing standards address blockchain’s emergence.

The findings reveal a growing demand for information technology (IT) auditing standards, as well as a mismatch in timing between the quickly changing IT environment and the regulators’ slowness in releasing new standards or updating standards.

The findings reflect the external auditors’ points of view and cannot be generalized to all countries, but future studies should address the development of specific IT-related auditing standards to better fit the fast-evolving technology environment in ways that consider the other stakeholders’ points of view, including those of the standard setters.

The results of this study show that auditors consider the current auditing standards for IT to be too vague, and they need more guidance on both auditing blockchain and using technologies as audit tools.

The original contribution of this study lies in the in-depth understanding it provides of the adequacy of the current auditing standards to audit companies using blockchain, which is an under-researched topic.