Analysing information security in a bank using soft systems methodology

Abstract

Purpose -This paper explores the use of Soft Systems Methodology (SSM) to analyse the sociotechnical information security issues in a major bank.Design/methodology/approach -Case study research was conducted on a major bank. Semistructured interviews with a purposive sample of key stakeholders in the business, comprising senior managers, security professionals and branch employees were conducted.Findings -SSM was particularly useful for exploring the holistic information security issues, enabling models to be constructed which were valuable analytical tools and easily understood by stakeholders, which increased the receptiveness of the bank, and assisted with member validation.Significant risks were apparent from internal sources with weaknesses in aspects of governance and security culture.Research limitations/implications -This research uses a single case study and whilst it cannot be generalised, it identifies potential security issues others may face and solutions they may apply.Practical implications -Information security is complex and addresses technical, governance, management and cultural risks. Banking attacks are changing, with greater focus on employees and customers. A systemic approach is required for full consideration. SSM is a suitable approach for such analysis within large organisations.Originality/value -Demonstrates how important benefits can be obtained by using SSM alongside traditional risk assessment approaches to identify holistic security issues. A holistic approach is particularly important given the increasing complexity of the security threat surface. Banking was selected as a case study since it is both critical to society and is a prime target for attack. Furthermore, developing economies are under-represented in information security research, this paper adds to the evidence base. Since global finance is highly interconnected, it is important that banks in such economies do not comprise a weak link and hence results from this case have value for the industry as a whole. | P a g e

Training Service Staff to Enhance Non-Verbal Behavioral Skills to Increase Customer Profitability in Tourism

“…This methodology encompasses key elements in the study of systems and has been addressed in numerous scientific articles [27][28][29][30]. The SSM is particularly useful for capturing the systemic complexities within an organization [31,32]. The SSM has two phases, which group seven elements.…”

Information Security of New Media Art Platform of Distributed System Based on Blockchain Technology

“…In the above equation, M stands for plaintext, C stands for ciphertext, K stands for the secret key used in the encryption and decryption process, E stands for encryption transformation, and D stands for decryption transformation. Symmetric key algorithms can be divided into two categories: sequence ciphers and block ciphers [10,11].…”

What do we know about information security governance?

“…ISG approaches that ignore the human and individual levels often have little bearing on the organisations’ objectives (Mishra, 2015). To this extent, researchers highlight the importance of achieving a supportive security culture, combining corporate governance and information security, as this approach takes into account the complex socio-technical system (Thomson and Von Solms, 2005; Veiga and Eloff, 2007; Ruighaver et al , 2007; Flores et al , 2014; Damenu and Beaumont, 2017).…”

“…IS scholars widely believe that senior executive and board commitment is critical for effective ISG (Veiga and Eloff, 2007; Mukundan and Sai, 2014; Barton et al , 2016; Damenu and Beaumont, 2017). Fortunately, the staggering number of IS breaches (see introduction) has made executives and boards more aware of the need to protect the business and their corporate information assets (Kayworth and Whitten, 2012; Georg, 2017; Von Solms and Von Solms, 2018).…”