Protecting Information in a Connected World: A Question of Security and of Confidence in Security

Ghernaouti-Hélie, Solange; Simms, D. J.; Tashi, Igli

doi:10.1109/nbis.2011.38

Cited by 8 publications

(5 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…(Wangen and Snekkenes, 2013) Not understanding each other properly will lead to problems in discussions and interpretations of discourse (Ahmad et al, 2015;Arhin and Wiredu, 2018;Richmond et al, 2005;Shedden, 2016;Wangen and Snekkenes, 2013) Discourse interpretation "As collections of canonical practices, they 'inevitably and intentionally omit the details' (Brown and Duguid, 1991, p. 40), making them too abstract to be directly applicable to a specific organizational context." (Niemimaa and Niemimaa, 2017, p. 12) Guidelines are difficult to interpret and adapt as they often omit details (Bayuk, 2010;Bergström, 2020;Bergström et al, 2021;Brown and Duguid, 1991;Niemimaa and Niemimaa, 2017;Fibikova and Müller, 2011;Ghernaouti-Helie et al, 2011;Park et al, 2010) Difficult to adapt guidelines Source: Created by author…”

Section: Methodsmentioning

confidence: 99%

“…Standards, though, describe the activities holistically, meaning it is not a blueprint for how to apply them in organizations. One example of a problem is the difficulty of creating classification schemes that follow organizational requirements while still being usable (Bergström, 2020; Fibikova and Müller, 2011; Ghernaouti-Helie et al , 2011). It is also concluded that there is a gap between formal and actual processes in information security management, which information classification is part of (Bergström et al , 2021).…”

Section: Insights From Practice On Information Classification Problemsmentioning

confidence: 99%

See 1 more Smart Citation

Problems in information classification: insights from practice

Andersson

2023

ICS

View full text Add to dashboard Cite

Purpose This study aims to identify problems connected to information classification in theory and to put those problems into the context of experiences from practice. Design/methodology/approach Five themes describing problems are discussed in an empirical study, having informants represented from both a public and a private sector organization. Findings The reasons for problems to occur in information classification are exemplified by the informants’ experiences. The study concludes with directions for future research. Originality/value Information classification sustains the basics of security measures. The human–organizational challenges are evident in the activities but have received little attention in research.

show abstract

Section: Methodsmentioning

confidence: 99%

Section: Insights From Practice On Information Classification Problemsmentioning

confidence: 99%

Problems in information classification: insights from practice

Andersson

2023

ICS

View full text Add to dashboard Cite

show abstract

“…According to a Forrester report, information classification is an overlooked activity amongst security and risk professionals (Kindervag et al, 2015), something also acknowledged in existing research (Oscarson and Karlsson, 2009;Shedden et al, 2016). Ghernaouti-Helie et al (2011) stated that the need for information classification is widely understood; however, the ICS 29,2 activity is often not carried out. There are many reasons for this, including the difficulty of defining and applying sufficiently robust models, covering the requirements of information classification and at the same time providing well-needed flexibility.…”

Section: Information Classification Methods 209mentioning

confidence: 99%

Developing an information classification method

Bergström

Karlsson

Åhlfeldt

2020

ICS

View full text Add to dashboard Cite

Purpose The purpose of this paper is to develop a method for information classification. The proposed method draws on established standards, such as the ISO/IEC 27002 and information classification practices. The long-term goal of the method is to decrease the subjective judgement in the implementation of information classification in organisations, which can lead to information security breaches because the information is under- or over-classified. Design/methodology/approach The results are based on a design science research approach, implemented as five iterations spanning the years 2013 to 2019. Findings The paper presents a method for information classification and the design principles underpinning the method. The empirical demonstration shows that senior and novice information security managers perceive the method as a useful tool for classifying information assets in an organisation. Research limitations/implications Existing research has, to a limited extent, provided extensive advice on how to approach information classification in organisations systematically. The method presented in this paper can act as a starting point for further research in this area, aiming at decreasing subjectivity in the information classification process. Additional research is needed to fully validate the proposed method for information classification and its potential to reduce the subjective judgement. Practical implications The research contributes to practice by offering a method for information classification. It provides a hands-on-tool for how to implement an information classification process. Besides, this research proves that it is possible to devise a method to support information classification. This is important, because, even if an organisation chooses not to adopt the proposed method, the very fact that this method has proved useful should encourage any similar endeavour. Originality/value The proposed method offers a detailed and well-elaborated tool for information classification. The method is generic and adaptable, depending on organisational needs.

show abstract

“…Information classification is not a new concept for an organization dealing with sensitive information. However, many organizations still struggle to establish their information classification [8], [7], [14], [20] schemes. Park et.…”

Section: Related Workmentioning

confidence: 99%

A Framework for the Information Classification in ISO 27005 Standard

Agrawal

2017

2017 IEEE 4th International Conference on Cyber Security and Cloud Computing (CSCloud)

View full text Add to dashboard Cite

Information Security Risk Management (ISRM) process involves several activities to conduct a risk management (RM) task in an organization. ISRM activities require access to various information related to the organization. An organization often needs to share information related to an ISRM process with the stakeholders involved in the activity. Therefore, it is important to manage the information which is critical to the operations of the organization. The presence of an information classification scheme can enable the proper handling of the information involved in the RM task. We selected ISO/IEC27005:2011 risk management standard to assess various information generated during the process of applying this standard in an organization. The purpose of this study is to propose a framework to show various information objects involved in ISO27005 risk management standard and classify the information based on the guideline provided by UNINETT scheme. A case scenario of a health clinic is developed to identify ISRM related information objects using the proposed framework and classify the information using UNINETT scheme.

show abstract

Protecting Information in a Connected World: A Question of Security and of Confidence in Security

Cited by 8 publications

References 3 publications

Problems in information classification: insights from practice

Problems in information classification: insights from practice

Developing an information classification method

A Framework for the Information Classification in ISO 27005 Standard

Contact Info

Product

Resources

About