Towards a General Information Security Management Assessment Framework to Compare Cyber-Security of Critical Infrastructure Organizations

Abstract

Part 3: Security and Privacy IssuesInternational audienceThis paper describes the development of an information security framework that aims to comparatively assess the quality of management processes in the context of cyber-security of organizations operating within critical infrastructure sectors. A design science approach was applied to establish a framework artifact that consists of the four dimensions “Security Ambition”, “Security Process”, “Resilience” and “Business Value”. These dimensions were related to the balanced scorecard concept and information security literature. The framework includes metrics, measurement approaches and aggregation methods. In its adapted form, our framework enables a systematic compilation of information security, and seeks to display the security situation of a focal firm against the desired future states, industry benchmarks, and allows for an investigation of interdependencies. The design science research process included workshops, cyclic refinements of the instrument, pretests and the framework evaluation within 30 critical infrastructure organizations. The framework was found to be particularly useful as learning and benchmarking tool capable of highlighting weaknesses, strengths, and gaps in relation to standards

Reviewing qualitative research approaches in the context of critical infrastructure resilience

“…Quantitative data offer an inherent benchmarking dimension, which anyway requires to be complemented by qualitative assessment to ask the right questions for understanding the context, and provide meaningful answers to interpret the scores (Bernroider et al 2016 ). However, qualitative assessment needs also an attentive and accurate planning to avoid unmanageable results.…”

“…However, qualitative assessment needs also an attentive and accurate planning to avoid unmanageable results. In retrospect, it is worth mentioning how Bernroider et al ( 2016 ) admit that questionnaire and terminology might have been more precise in their study if workshops and interviews should have been conducted first. Then, the original questionnaire should have been adjusted considering the respondents’ comments, allowing for a more precise questionnaire to be distributed.…”

“…The framework launches an iterative process of awareness and training development with relevant stakeholders (healthcare authorities, end users-hospitals, industry members, cybersecurity training providers), evaluating the framework via joint exercises and workshops. Bernroider et al (2016) aim at developing and testing a framework that holistically measures the quality of Information Security Management (ISM) in the context of cybersecurity and allows for comparative assessments of organisations in CI sectors, taking ideas from the Balanced Scorecards (BSC) measurement system. Following a design science approach, workshops, cyclic refinements of the instrument, pre-tests, and framework evaluation within 30 critical infrastructure organisations were conducted, involving subject experts and Chief Security Information Officers (CISOs) as the main stakeholders from the information security domain.…”

Implementing Design Science Research Method to Develop a Cyber Security Framework for HEIs in Moldova

“…Unfortunately, recent researches have highlighted an impressive increase in cyber-attacks within HEIs in 2020 [1]- [4], which makes the situation alarming and requires prompt reactions. Insufficient knowledge of the risks associated with information assets can significantly damage the activity of HEIs [5]. It is necessary to consider support assets such as: network devices, applications, human resources, infrastructure; that are used to protect the primary assets of HEIs such as:…”