A real-world information security performance assessment using a multidimensional socio-technical approach.
Measuring the performance of information security is an essential part of the information security management system within organisations. Studies in the past mainly focused on establishing qualitative measurement approaches. Since these can lead to ambiguous conclusions, quantitative metrics are be...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Public Library of Science (PLoS)
2020-01-01
|
| Series: | PLoS ONE |
| Online Access: | https://doi.org/10.1371/journal.pone.0238739 |
| _version_ | 1819041226202021888 |
|---|---|
| author | Kaja Prislan Anže Mihelič Igor Bernik |
| author_facet | Kaja Prislan Anže Mihelič Igor Bernik |
| author_sort | Kaja Prislan |
| collection | DOAJ |
| description | Measuring the performance of information security is an essential part of the information security management system within organisations. Studies in the past mainly focused on establishing qualitative measurement approaches. Since these can lead to ambiguous conclusions, quantitative metrics are being increasingly proposed as a useful alternative. Nevertheless, the literature on quantitative approaches remains scarce. Thus, studies on the evaluation of information security performance are challenging, especially since many approaches are not tested in organisational settings. The paper aims to validate the model used for evaluating the performance of information security management system through a multidimensional socio-technical approach, in a real-world settings among medium-sized enterprises in Slovenia. The results indicate that information security is strategically defined and compliant, however, measures are primarily implemented at technical and operational levels, while its strategic management remains underdeveloped. We found that the biggest issues are related to information resources and risk management, where information security measurement-related activities proved to be particularly problematic. Even though enterprises do possess certain information security capabilities and are aware of the importance of information security, their current practices make it difficult for them to keep up with the fast-paced technological and security trends. |
| first_indexed | 2024-12-21T09:21:37Z |
| format | Article |
| id | doaj.art-0a03d8950da544a580d8744843b113f2 |
| institution | Directory Open Access Journal |
| issn | 1932-6203 |
| language | English |
| last_indexed | 2024-12-21T09:21:37Z |
| publishDate | 2020-01-01 |
| publisher | Public Library of Science (PLoS) |
| record_format | Article |
| series | PLoS ONE |
| spelling | doaj.art-0a03d8950da544a580d8744843b113f22022-12-21T19:08:59ZengPublic Library of Science (PLoS)PLoS ONE1932-62032020-01-01159e023873910.1371/journal.pone.0238739A real-world information security performance assessment using a multidimensional socio-technical approach.Kaja PrislanAnže MiheličIgor BernikMeasuring the performance of information security is an essential part of the information security management system within organisations. Studies in the past mainly focused on establishing qualitative measurement approaches. Since these can lead to ambiguous conclusions, quantitative metrics are being increasingly proposed as a useful alternative. Nevertheless, the literature on quantitative approaches remains scarce. Thus, studies on the evaluation of information security performance are challenging, especially since many approaches are not tested in organisational settings. The paper aims to validate the model used for evaluating the performance of information security management system through a multidimensional socio-technical approach, in a real-world settings among medium-sized enterprises in Slovenia. The results indicate that information security is strategically defined and compliant, however, measures are primarily implemented at technical and operational levels, while its strategic management remains underdeveloped. We found that the biggest issues are related to information resources and risk management, where information security measurement-related activities proved to be particularly problematic. Even though enterprises do possess certain information security capabilities and are aware of the importance of information security, their current practices make it difficult for them to keep up with the fast-paced technological and security trends.https://doi.org/10.1371/journal.pone.0238739 |
| spellingShingle | Kaja Prislan Anže Mihelič Igor Bernik A real-world information security performance assessment using a multidimensional socio-technical approach. PLoS ONE |
| title | A real-world information security performance assessment using a multidimensional socio-technical approach. |
| title_full | A real-world information security performance assessment using a multidimensional socio-technical approach. |
| title_fullStr | A real-world information security performance assessment using a multidimensional socio-technical approach. |
| title_full_unstemmed | A real-world information security performance assessment using a multidimensional socio-technical approach. |
| title_short | A real-world information security performance assessment using a multidimensional socio-technical approach. |
| title_sort | real world information security performance assessment using a multidimensional socio technical approach |
| url | https://doi.org/10.1371/journal.pone.0238739 |
| work_keys_str_mv | AT kajaprislan arealworldinformationsecurityperformanceassessmentusingamultidimensionalsociotechnicalapproach AT anzemihelic arealworldinformationsecurityperformanceassessmentusingamultidimensionalsociotechnicalapproach AT igorbernik arealworldinformationsecurityperformanceassessmentusingamultidimensionalsociotechnicalapproach AT kajaprislan realworldinformationsecurityperformanceassessmentusingamultidimensionalsociotechnicalapproach AT anzemihelic realworldinformationsecurityperformanceassessmentusingamultidimensionalsociotechnicalapproach AT igorbernik realworldinformationsecurityperformanceassessmentusingamultidimensionalsociotechnicalapproach |