Muliati Sedek

Integrating information quality dimensions into information security risk management (ISRM)

Abstract Information security is becoming an important entity to most organizations due to current trends in information transfer through a borderless and vulnerable world. This gives more concerns and aware organization to apply information security risk management (ISRM) to develop effective and economically-viable control strategies. Even though there are numerous ISRM methods that are readily available, most of the ISRM methods prescribe a similar process that leads to establish a scope of the assessment, collecting information, producing intermediary information, and finally using the collected information to identify their security risks and provide a measured, analyzed security profile of critical information assets. Based on the “garbage in-garbage out” phenomenon, the success of ISRM planning tremendously depends on the quality of input information. However, with the amount, diversity and variety of information available, practitioners can easily deflects with grown information and becoming unmanageable. Therefore this paper contribute as a stepping stone to determine which IQ dimensions constitute the quality of the information throughout the process of gathering information during ISRM. Seems to accurately define the attributes of IQ dimensions, IQ needs to be assessed within the context of its generation. Thus, papers on IQ web were assessed and comparative analysis was conducted to identify the possible dimensions for ISRM. Then, online survey using likert structured questionnaire were distributed among a group of information security practitioners in Malaysia (N = 150). Partial least square (PLS) analysis revealed that dimension accuracy, amount of data, objective, completeness, reliability and verifiability are significantly influence the quality of information gathering for ISRM. These IQ dimensions can guide practitioners in the process of gathering quality and complete information in order to make a plan that leads to a clear direction, and ultimately help to make decisions that lead to success.

Inclination of Insider Threats’ Mitigation and Implementation: Concurrence View from Malaysian Employees

The aim of this paper is to discuss on the insider threat risks and challenges which have been the biggest problem to most organisations. The survey has gauged the employees’ agreements level of recommended practices derived from the “Common Sense Guide to Mitigating Insider Threats” produced by the Software Engineering Institute, Carnegie Mellon University (SEI-CMU). The available research works by Computer Emergency Response Team at Carnegie-Mellon University (CERT) offered an effective and possible approach towards identifying the insider threats risk and challenges by identifying feasible activity for implementation as part of a review process within organisation. The respondents indicate that majority of the companies in Malaysia who participated in the survey are basically agreeable to it and currently implementing the recommended practices. The results suggested that most companies are aware of the threats and ready for effective countermeasures. Three factors i.e. motive, method and opportunity must be recognised, identified and suppressed within the organization boundary. As a conclusion, this research could assist organization to understand the general acceptance of the respondents towards suggested practices and it could be some important facts that finding effective way to implement best practices are the demand for further research.