Security mistakes in information system deployment projects

Abstract

Purpose -This paper aims to assess the influence of a set of human and organizational factors in information system deployments on the probability that a number of security-related mistakes are in the deployment. Design/methodology/approach -A Bayesian network (BN) is created and analyzed over the relationship between mistakes and causes. The BN is created by eliciting qualitative and quantitative data from experts of industrial control system deployments in the critical infrastructure domain. Findings -The data collected in this study show that domain experts have a shared perception of how strong the influence of human and organizational factors are. According to domain experts, this influence is strong. This study also finds that security flaws are common in industrial control systems operating critical infrastructure.Research limitations/implications -The model presented in this study is created with the help of a number of domain experts. While they agree on qualitative structure and quantitative parameters, future work should assure that their opinion is generally accurate. Practical implications -The influence of a set of important variables related to organizational/human aspects on information security flaws is presented. Social implications -The context of this study is deployments of systems that operate nations' critical infrastructure. The findings suggest that initiatives to secure such infrastructures should not be purely technical. Originality/value -Previous studies have focused on either the causes of security flaws or the actual flaws that can exist in installed information systems. However, little research has been spent on the relationship between them. The model presented in this paper quantifies such relationships.

The Cyber Security Modeling Language: A Tool for Assessing the Vulnerability of Enterprise System Architectures

“…An overview is given in Table I. Data described in [52] and [53] combined with four domain experts' judgment [51].…”

When the mobile app is free, the product is your personal data

“…In this scenario, MCDM techniques provide the ranking of different alternatives and the best alternatives be always recommended as the best solution to the decision makers (Wang et al, 2009). As many problems involves the uncertainties so we find the probabilities value/weightage of all the different alternatives of the element (Sommestad et al, 2011;Zhu et al, 2016). Prioritization of risk involves the multiple conflicting criteria with finite set of alternatives (Wang et al, 2009).…”

30 Years of Independent Macedonian State

“…It helps in protecting information and communications through the use of codes and technical coding. The crypt is confidential information where the message can only be decrypted and read by the person for whom the message is strictly intended without falling into other people's hands (Sommestad et al, 2010). Even if the above knowledge reaches the hands of others, they will never be able to perceive and comprehend it in context.…”