Abstract
For how long can a business remain without its information systems? Current business goals and objectives highly depend on their availability. This highly dynamic and complex system must be properly secured and managed in order to ensure business survivability. However, the lack of a universally accepted information security critical factors’ taxonomy and indicators make security management of information systems (SMIS) a tough challenge. Effective information security management requires special focus on identifying the critical success factors (CSFs) when implementing and ensuring SMIS. The purpose of this paper is to share a group of 12 CSFs identified in the current information security literature as well as a set of 76 indicators which are easy to calculate and attempt to provide valuable information to organizations seeking information security level measurements.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsPreview
Unable to display preview. Download preview PDF.
References
Ernst&Young.: Global Information Security Survey (2002), www.ey.com
Bjorck, F.: Institutional Theory: A New Perspective for Research into IS/IT Security in Organizations. In: Proceedings of the 37th Hawaii International Conference on System Sciences (2004)
Institute of Electrical and Electronics Engineers: IEEE Standard Computer Dictionary: A Compilation of IEEE Standard Computer Glossaries. New York, NY (1990)
Firesmith, D.G.: Common Concepts Underlying Safety, Security and Survivability Engineering (December 2003), CMU/SEI-2003-TN-033
Burling, M.: The key to compliance, www.net-security.org
Kajava, J., Savola, R.: Towards Better Information Security Management by Understanding Security Metrics and Measuring Processes (2005)
Dhillon, G., Backhouse, J.: Information System Security Management in the New Millennium. Communication of the ACM 43(7) (July 2000)
Von Sloms, S.H., Von Sloms, R.: From Information Security to.... Business Security? Computer & Security 24, 271–273 (2005)
Caralli, R.A., Wilson, W.R.: The challenges of Security Management. Networked Systems Survivability Program, SEI
Anderson James, M.: Why We Need a New Definition of Information Security
Schneier, B.: Monthly Newsletter, www.schneier.com
Dhillon, G.: Managing and Controlling Computer Misuse. Information Management & Computer Security 7/4, 171–175 (1999)
Dhillon, G.: Violating of Safeguards by Trusted Personal and Understanding Related Information Security Concerns. Computer & Security 20(2), 165–172 (2001)
Dhillon, G., Moores, S.: Computer crimes: Theorizing About the Enemy Within. Computer & Security 20(8), 715–723 (2001)
Torres, J.M., Sarriegui, J.M.: Dynamics Aspects of Security Management of Information Systems. In: Proceedings of Systems Dynamic Society Conference, Oxford, UK (July 2003)
Anderson, R.: Why Information Security is Hard: An Economic Perspective (2001)
Reason, J.: Managing the Risk of Organizational Accidents. Ashgate Publishing Ltd., Hants (1997)
Andersen, D., Cappelli, D., Gonzalez, J., Mojtahedzadeh, M., Moore, A., Rich, E., Sarriegui, J.M., Shimeall, T., Stanton, J., Weaver, E., Zagonel, A.: Preliminary System Dynamics Maps of the Insider Cyber-Threat Problem. In: Proceedings of System Dynamics Society Conference, Oxford, UK (2004)
Melara, C., Sarriegui, J.M., Gonzalez, J., Sawicka, A., Cooke, D.L.: A System Dynamics Model of an Insider Attack on an Information System. In: From Modeling to Managing Security: A System Dynamics Approach, Norwegian Academic Press Kristians, Norway (2003)
Wilson, S.: The Future of Vulnerability Management: Information Security Bulletin 8, 69 (2003)
Schneier, B.: Information Security Management. In: Conference in Bilbao, Spain (2005)
Berinato, S., Cosgrove, L.: Six Secrets of Highly Secure Organizations. CIO magazine (September 15, 2004)
Theoharidou, M., Karida, M., Kokolakis, S.: The Insider Threat to Information Systems and the Effectiveness of ISO 17799. Computer&Security 24, 472–848 (2005)
Parker, D.: Fighting Computer Crime. John Wiley & Sons, New York (1998)
Torres, J.M., Sarriegui, J.M., Santos, J.: Searching for Preventive-Corrective Security Balance. In: Proceedings of Systems Dynamic Society Conference, Boston U.S.A (July 2005)
Gonzalez, J., Rich, E.: Helping Prevent Information Security Risks in the Transition to Integrated Operations. Teletronikk 1 (2005)
Sarriegui, J.M., Eceiza, E., Torres, J.M., Santos, J.: Security Management of Information Systems Report (2005)
Bjorck, F.: Implementing Information Security Management System: Empirical Study of Critical Success Factors
Schneier, B.: Applied Cryptography: Protocols, Algorithms and Source Code in C. John Wiley& Sons Inc., New York (1994)
Von Sloms, S.H.: Information Security Governance: compliance management vs. operational management. Computer&Security 24, 433–447 (2005)
Gordon, L., Loeb, M.: Managing Cyber Security Resources. A cost-benefit analysis. McGraw-Hill, New York (2006)
Schneier, B.: Beyond Fears, 1st edn. Copernicus Book, New York (2003)
IBM Global Business Security index survey. Potential threats to information security during 2006 (2005)
Mitnick, K.: The Art of Deception. John Wiley Inc., Indianapolis, Indiana (2002)
Schultz, E.: The human Factor in Security. Computer&Security 24, 425–426 (2005)
Schneier, B.: Managed Security Monitoring: Network Security for the 21st Century. Computer and Security 20, 491–503 (2001)
Magklaras, G.B., Furnell, S.M.: A Preliminary Model of End User Sophistication for Insider Threat Prediction in IT Systems. Computer & Security 24, 371–380 (2005)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2006 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Torres, J.M., Sarriegi, J.M., Santos, J., Serrano, N. (2006). Managing Information Systems Security: Critical Success Factors and Indicators to Measure Effectiveness. In: Katsikas, S.K., López, J., Backes, M., Gritzalis, S., Preneel, B. (eds) Information Security. ISC 2006. Lecture Notes in Computer Science, vol 4176. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11836810_38
Download citation
DOI: https://doi.org/10.1007/11836810_38
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-38341-3
Online ISBN: 978-3-540-38343-7
eBook Packages: Computer ScienceComputer Science (R0)