The Development of a Security Evaluation Model Focused on Information Leakage Protection for Sustainable Growth

Abstract

This research establishes a security evaluation model from the insider leakage perspective and suggests an objective evaluation measurement. Organizational security risks are fused and compounded both inside and outside the organization. Although multiple security controls are implemented to minimize an organization’s security risk, effective security control requires management to preemptively check the organization’s security level. Existing criteria for evaluating security level are limited to external security risks and have improper limit points for dealing with security risks that are fused and compounded within an organization. The focus of this study is the prevention of technical information leakage. Furthermore, we propose a method for measuring the level at which the objectivity of certain items is secured. We compiled 26 detailed evaluation items, considering the security requirements to prevent technical information leakage. We not only performed suitability, reliability, and factor analyses and statistical validation, but also established a method to measure the security level. This measurement method ensures the effectiveness and objectivity of the evaluation of security level, mitigating the risks of security incidents caused by insiders. The results serve as a reference for organizations when designing security evaluation criteria and automated tools based on our evaluation model for future research.

Risk Assessment of Insider Threats Based on IHFACS-BN

“…This paper compiles 43 enterprise insider threat incidents in China and other nations (including the United States and Israel) between 2009 and 2021. Then, based on the direct and indirect causes in the incident reports and concerning related studies [41][42][43][44][45][46], the HFs of insider enterprise threats were categorized and aggregated according to the item categories of the IHFACS model. Second, a workshop on information security within enterprises was held to compensate for the dearth of sample data, with the participation of experts in the field, such as senior project supervisors, network management managers, and IT engineers from various businesses.…”

Internal Resource Allocation to Information Security of Smart Cities Using Evolutionary Game Model

“…e concept of smart cities is derived from the tenets of digital media: by utilizing various novel techniques or innovative concepts, smart cities aim to connect and integrate various systems and services in cities through the reasonable allocation of urban resources to optimize urban management and improve residents' quality of life [1][2][3][4][5]. In a smart city, various novel technologies (such as the Internet of things (IoT), cloud computing, and virtual reality) are applied to di erent industries [6][7][8]. Furthermore, the city realizes the dynamically re ned management and e ectively improves residents' quality of life by establishing ubiquitous broadband connectivity, integrating the application of intelligent technologies, implementing extensive resource sharing, and further attaining comprehensive and thorough enhanced ability and perception [9][10][11].…”

7S Model for Technology Protection of Organizations

“…Bae et al (2016) revised and supplemented the K-ISMS to construct a set of evaluation items related to industrial security that could assess security certification systems in all the industries [24]. Currently, Kim et al (2020) presented a security assessment diagnostic model emphasizing the prevention of information leaks from the perspective of insider threats [6]. Previous studies have discussed various ways to diagnose and improve a company's technology leakage and suggested a novel diagnostic model suitable for the company's characteristics or environment.…”

“…However, their limitation lies in the fact that their diagnostic items are skewed toward information security-they present a highly comprehensive review of content related to information security. While several academic studies have presented diagnostic models distinct from the existing information security management systems, they are characterized by a specific focus, such as having content that is geared toward small and medium-sized enterprises (SMEs) or the leakage of information [5,6]. In other words, the existing technology protection diagnostic items either preclude or have a skewed focus toward topics such as administrative, personnel, and technical security measures, which makes the items unsuitable for the general technology protection diagnosis of companies.…”