Security mistakes in information system deployment projects
Author:
Sommestad Teodor,Ekstedt Mathias,Holm Hannes,Afzal Muhammad
Abstract
PurposeThis paper aims to assess the influence of a set of human and organizational factors in information system deployments on the probability that a number of security‐related mistakes are in the deployment.Design/methodology/approachA Bayesian network (BN) is created and analyzed over the relationship between mistakes and causes. The BN is created by eliciting qualitative and quantitative data from experts of industrial control system deployments in the critical infrastructure domain.FindingsThe data collected in this study show that domain experts have a shared perception of how strong the influence of human and organizational factors are. According to domain experts, this influence is strong. This study also finds that security flaws are common in industrial control systems operating critical infrastructure.Research limitations/implicationsThe model presented in this study is created with the help of a number of domain experts. While they agree on qualitative structure and quantitative parameters, future work should assure that their opinion is generally accurate.Practical implicationsThe influence of a set of important variables related to organizational/human aspects on information security flaws is presented.Social implicationsThe context of this study is deployments of systems that operate nations' critical infrastructure. The findings suggest that initiatives to secure such infrastructures should not be purely technical.Originality/valuePrevious studies have focused on either the causes of security flaws or the actual flaws that can exist in installed information systems. However, little research has been spent on the relationship between them. The model presented in this paper quantifies such relationships.
Subject
Library and Information Sciences,Management Science and Operations Research,Business and International Management,Management Information Systems
Reference35 articles.
1. Adams, A., Sasse, M. and Lunt, P. (1997), “Making passwords secure and usable”, in Thimbleby, H., OConnaill, B. and Thomas, P. (Eds), Proceedings of HCI on People and Computers XII, Springer‐Verlag, London. 2. Alves‐Foss, J. and Barbosa, S. (1995), “Assessing computer security vulnerability”, ACM SIGOPS Operating Systems Review, Vol. 29 No. 3, pp. 3‐13. 3. Anderson, R. (2008), Security Engineering: A Guide to Building Dependable Distributed Systems, Wiley, New York, NY. 4. Aslam, T., Krsul, I. and Spafford, E. (1996), “Use of a taxonomy of security faults”, Proceedings of the 19th National Information Systems Security Conference, Baltimore, MD, pp. 551‐60. 5. Besnard, D. and Arief, B. (2004), “Computer security impaired by legitimate users”, Computers and Security, Vol. 23 No. 3, pp. 253‐64.
Cited by
7 articles.
订阅此论文施引文献
订阅此论文施引文献，注册后可以免费订阅5篇论文的施引文献，订阅后可以查看论文全部施引文献
|
|