Search

Purpose: The purpose of this paper is to propose a theory of information security intelligence and examine the effects of managers' information security intelligence (MISI) on employees' procedural countermeasure awareness and information security policy (ISP) compliance intention. Design/methodology/approach: A survey approach and structural equation modeling is utilized. Partial least squares (WarpPLS 6.0) and nonlinear algorithm are employed to analyze and examine the hypotheses. In total, 324 employees from companies in South Korea participated in the survey, which was conducted by a professional survey service company. Findings: MISI positively affects employees' awareness of information security procedural countermeasures; information security knowledge and problem-solving skills have positive effects on procedural countermeasures awareness; MISI increases employees' compliance intention through procedural countermeasure awareness; and information security procedural countermeasures positively affect employees' ISP compliance intention. Research limitations/implications: This study proposes a theory of information security intelligence and examines its impacts on employees' compliance intentions. The study highlights the mediating role of information security procedural countermeasures between information security intelligence and employees' compliance intentions. Practical implications: Managers should improve and explicitly demonstrate information security knowledge and problem-solving skills to increase employees' ISP compliance intention. To protect the organization's intellectual capital, managers should champion the development and promotion of PCM, rather than leave these functions to the information security group. Originality/value: This is the first empirical study to propose and validate MISI. [ABSTRACT FROM AUTHOR]

The benchmarking of information security policies has two challenges. Organizations are reluctant to share data regarding information security and no two organizations are identical. In this paper, we attempt to propose an artifact for a benchmarking method of information security policy, which can resolve the above challenges. We employ design science methodology, activity theory and international standards to design the artifact as a proof of concept. The artifact facilitates the implementation of efficient information security policies. Organizations can utilize the artifact to analyze and benchmark information security policies. We illustrate the completeness and reliability of the artifact through a case study using information security policies from six companies. [ABSTRACT FROM AUTHOR]

• Identifying benchmarking peer for establishing an information security policy. • Feature engineering based on Vague Soft Set. • Improvements of Gaussian process classification by integrating Vague Soft Set. • Combined use of Gaussian process and Vague Soft Set performs best among classifiers. Benchmarking methodology provides organizations with appropriate information security policy. However, selecting an appropriate organization as a benchmarking peer can be a challenge due to firms' heterogeneous implementation and usage of information systems. Our goal is to develop and propose methods to appropriately identify a benchmarking peer organization by incorporating machine learning methods and mathematics set theory. We incorporate vague soft set, entropy, dynamic time warping, and Gaussian process. We use log data from information security management systems in multiple companies to validate our methods. Our experimental results indicate that the combined use of Gaussian process, vague soft set, and dynamic time warping can be more effective in identifying an appropriate benchmarking peer than conventional machine learning methods. [ABSTRACT FROM AUTHOR]

This study analyzes the determinants of information security that influence the adoption of Web-based integrated information systems (IIS) by government agencies in Peru. The study introduces Web-based information systems designed to formulate strategic plans for the Peruvian government. A theoretical model is proposed to test the impact of organizational factors such as deterrent efforts, severity efforts, and preventive efforts and individual factors such as perceived information security threats and security awareness on intentions to use Web-based IIS. The empirical results indicate that deterrent efforts and deterrent severity have no significant influence on use intentions of IIS, whereas preventive efforts play an important role in such intentions. Information security awareness and perceived information security threats as individual factors have a significant effect on intentions to use the system. This suggests that organizations should implement preventive efforts by introducing various information security solutions, and improve information security awareness while reducing perceived information security threats. [ABSTRACT FROM PUBLISHER]