Information Security Risk Assessment Using Situational Awareness Frameworks and Application Tools

Chandra, Nungky Awang; Ramli, Kalamullah; Ratna, Anak Agung Putri; Gunawan, Teddy Surya

doi:10.3390/risks10080165

Cited by 9 publications

(2 citation statements)

References 43 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This lack of achievement in the compliance clause is due to a lack of compliance with LAZNAS. The compliance clause poses the threat of data breach and business continuity [16], which will affect business continuity if this is not addressed immediately. Therefore, enhancing employee training and awareness programs for information security, and improving incident response and recovery procedures are recommended.…”

Section: 472mentioning

confidence: 99%

Information Technology Security Audit at the YDSF National Zakat Institution Using the ISO 27001 Framework

Kamal,

Muhamad,

Sudianto

et al. 2024

SISFOKOM

View full text Add to dashboard Cite

In this era of cyber crimes, data security is an important aspect that needs special attention from an organization. This is reinforced by the ratification of Law Number 27 of 2022 on personal data security. The National Zakat Amil Institute (LAZNAS) Yayasan Dana Sosial al Falah (YDSF) as an institution with a legal entity and having data on more than 100,000 donors and partners, it also has an obligation to protect the personal data of donors and partners. The focus of this research is to evaluate and audit information technology at the LAZNAS YDSF, especially regarding the security aspect of information technology. Evaluations and audits were carried out using the ISO 27001 framework as a standardization of information technology security at the international level. In this study, information technology audits were conducted using quantitative methods. The assessment was carried out on seven main clauses that are priorities for the LAZNAS YDSF based on management priorities: compliance clauses, risk management, policies, assets, physical and environmental management, access control, and incident management. Data were collected using a questionnaire distributed to all the LAZNAS YDSF managers and employees. Fifty-five respondents, ranging from management to staff, were involved in filling out the questionnaire, ranging from management to staff. Based on the recapitulation of answers from respondents, it was found that the risk management and access control clauses had good results, with scores of 2,727 and 2,796. The compliance and incident management clauses have scores of 2.381 and 2.53, respectively; therefore, improvement efforts need to be made. By evaluating and auditing information technology that refers to the ISO 27001 standard, it is hoped that LAZNAS YDSF can protect and maintain the confidentiality, integrity, and availability of information, and manage and control information security risks.

show abstract

Section: 472mentioning

confidence: 99%

Information Technology Security Audit at the YDSF National Zakat Institution Using the ISO 27001 Framework

Kamal,

Muhamad,

Sudianto

et al. 2024

SISFOKOM

View full text Add to dashboard Cite

show abstract

“…Studies show that the ISO 27001 framework has been used to construct information security risk assessment methodologies [18] and capability maturity model assessment tools for organizations [19]. One study categorized the ISO 27001 controls based on their effectiveness in supporting organizations in evaluating and enhancing their ISMS conduct, as well as providing an understanding of relevant security flaws [20].…”

Section: B the Iso/iec 27001:2022 In The Iso 27000 Family Of Standardsmentioning

confidence: 99%

Information Security Failures Measured and ISO/IEC 27001:2022 Controls Ranked by General Data Protection Regulation Penalty Analysis

Suorsa,

Helo

2023

2023 11th International Conference on Cyber and IT Service Management (CITSM)

View full text Add to dashboard Cite

Selecting the most important information security controls is a critical and difficult process. Therefore, the decision-making on how to manage risks and threats has to be supported with data-driven performance measurement metrics. This paper identifies and explores the failures and impacts of information security, as well as the most effective controls to mitigate information security risks in organizations. The method of the study was root cause analysis. All year 2020 GDPR penalty cases (n=81) based on misconduct, as defined in GDPR Article 32: "Security of processing" were matched with ISO/IEC 27001:2022 controls, which were used as failure identifiers in the analysis. As a result, the study presents both, the top 10 most frequent and the top 10 most expensive information security failures corresponding to ISO/IEC 27001:2022 controls. Furthermore, the study also illustrates the correlation of these controls.

show abstract

ISO/IEC 27001 Standard: Analytical and Comparative Overview

Alrehili,

Alhazmi

2024

Lecture Notes in Networks and Systems

View full text Add to dashboard Cite

Information Security Risk Assessment Using Situational Awareness Frameworks and Application Tools

Cited by 9 publications

References 43 publications

Information Technology Security Audit at the YDSF National Zakat Institution Using the ISO 27001 Framework

Information Technology Security Audit at the YDSF National Zakat Institution Using the ISO 27001 Framework

Information Security Failures Measured and ISO/IEC 27001:2022 Controls Ranked by General Data Protection Regulation Penalty Analysis

ISO/IEC 27001 Standard: Analytical and Comparative Overview

Contact Info

Product

Resources

About