Measuring Information Security Performance with 10 by 10 Model for Holistic State Evaluation

Abstract

Organizations should measure their information security performance if they wish to take the right decisions and develop it in line with their security needs. Since the measurement of information security is generally underdeveloped in practice and many organizations find the existing recommendations too complex, the paper presents a solution in the form of a 10 by 10 information security performance measurement model. The model—ISP 10×10M is composed of ten critical success factors, 100 key performance indicators and 6 performance levels. Its content was devised on the basis of findings presented in the current research studies and standards, while its structure results from an empirical research conducted among information security professionals from Slovenia. Results of the study show that a high level of information security performance is mostly dependent on measures aimed at managing information risks, employees and information sources, while formal and environmental factors have a lesser impact. Experts believe that information security should evolve systematically, where it’s recommended that beginning steps include technical, logical and physical security controls, while advanced activities should relate predominantly strategic management activities. By applying the proposed model, organizations are able to determine the actual level of information security performance based on the weighted indexing technique. In this manner they identify the measures they ought to develop in order to improve the current situation. The ISP 10×10M is a useful tool for conducting internal system evaluations and decision-making. It may also be applied to a larger sample of organizations in order to determine the general state-of-play for research purposes.

A real-world information security performance assessment using a multidimensional socio-technical approach

“…The aim is to validate the model used for evaluating the quality of ISMS, i.e. the Information Security Performance 10 by 10 Model (ISP 10×10M), that we proposed in [40]. The model may be used for internal evaluations aimed at establishing the key gaps of existing approaches adopted by organisations.…”

Cyberattacks on Critical Infrastructure: an Economic Perspective

“…Nonetheless economic literature on the subject has been growing in recent years and shedding light on some important aspects of cyber security, including the drivers of organizations' investment in cyber security. According to various authors when determining the amounts of resources spent on cyber security and protection against cyber-attacks firms mainly focus on the aims of protecting customer data and privacy (Louis, Adrian & Evangelos, 2016), the protection of intellectual property, trade secrets or other business assets (Klahr et al, 2017), ensuring business continuity and preventing downtime (Bernik & Prislan, 2016), compliance with laws and regulations (Wakefield, 2012) and protecting the organization's reputation (Lloyd's, 2015).…”

Improving Information Security Performance: The Role of Management Support and Security Operation Center

“…Information Security Performance is about to ensure that three aspects of information security above at acceptable condition, within the company. Company must have objective and goal of information security performance, and assess their current condition whether it is aligned with the goal [16]. Assessing current condition will determine the gap with information security objective (if any) and guide us to fill the gap.…”