EMBEDDING CORPORATE SOCIAL RESPONSIBILITY IN INFORMATION SECURITY MANAGEMENT SYSTEM AS HUMAN FACTOR SOLUTION

Size: px

Start display at page:

Download "EMBEDDING CORPORATE SOCIAL RESPONSIBILITY IN INFORMATION SECURITY MANAGEMENT SYSTEM AS HUMAN FACTOR SOLUTION"

Norah Scott
5 years ago
Views:

1 EMBEDDING CORPORATE SOCIAL RESPONSIBILITY IN INFORMATION SECURITY MANAGEMENT SYSTEM AS HUMAN FACTOR SOLUTION NOOR AZEERA BINTI ABDUL AZIZ UNIVERSITI TEKNOLOGI MALAYSIA

2 UNIVERSITI TEKNOLOGI MALAYSIA DECLARATION OF THESIS / POSTGRADUATE PROJECT PAPER AND COPYRIGHT Author s full name : NOOR AZEERA BINTI ABDUL AZIZ Date of birth : 16 th JULY 1988 Title : EMBEDDING CORPORATE SOCIAL RESPONSIBILITY IN INFORMATION SECURITY MANAGEMENT SYSTEM AS HUMAN FACTOR SOLUTION Academic Session : 2011/2012(2) I declare that this thesis is classified as: CONFIDENTIAL RESTRICTED OPEN ACCESS (Contains confidential information under the Official Secret Act 1972)* (Contains restricted information as specified by the organization where research was I agree that my thesis to be published as online open access (full text) I acknowledged that Universiti Teknologi Malaysia reserves the right as follows: 1. The thesis is the property of Universiti Teknologi Malaysia. 2. The Library of Universiti Teknologi Malaysia has the right to make copies for the purpose of research only. 3. The Library has the right to make copies of the thesis for academic exchange. Certified by: SIGNATURE SIGNATURE OF SUPERVISOR ( ) DR. NORAFIDA BINTI ITHNIN Date : 20 JUNE 2012 Date : 20 JUNE 2012 NOTES : * If the thesis is CONFIDENTAL or RESTRICTED, please attach with the letter from the organization with period and reasons for confidentiality or restriction.

3 I hereby declare that I have read this project report and in my opinion this project report is sufficient in terms of scope and quality for the award of the degree of Master of Computer Science (Information Security). Signature :... Name of Supervisor : Dr. Norafida Ithnin Date : JUNE 20, 2012

4 EMBEDDING CORPORATE SOCIAL RESPONSIBILITY IN INFORMATION SECURITY MANAGEMENT SYSTEM AS HUMAN FACTOR SOLUTION NOOR AZEERA BINTI ABDUL AZIZ A project report submitted in partial fulfillment of the requirements for the award of the degree of Master of Computer Science (Information Security) Faculty of Computer Science and Information Systems Universiti Teknologi Malaysia JUNE 2012

5 ii I declare that this project report entitled Embedding Corporate Social Responsibility in Information Security Management System as Human Factor Solution is the result of my own research except as cited in the references. The project report has not been accepted for any degree and is not concurrently submitted in candidature of any other degree. Signature :... Name : Noor Azeera Binti Abdul Aziz Date : JUNE 20, 2012

6 iii This project report is dedicated to my parents; Abdul Aziz Ismail and Rosni Abdullah and to my siblings; Azreen, Akmal, Amin and Amirul for their great and endless support during the period of my study in UTM.

7 iv ACKNOWLEDEMENT Firstly, Alhamdulillah to my creator. I am thankful to my supervisor, Dr. Norafida Ithnin for her patience in supervised and guiding me throughout to complete this project. I also want to express my gratitude to my parents Abdul Aziz Bin Ismail and Rosni Binti Abdullah and family for being here, always supported and gave me advice when I am in need. To my friend, million thanks for be a good friend and always helped me and always shared and discussed the idea with me to get a better result for this project. Finally, I wish to thank everybody for helped me directly or indirectly throughout this project and I am really appreciate your kindness.

8 v ABSTRACT Information Security Management System (ISMS) is an approach to manage the information security. The success of information security is influenced by few factors and human was listed as one of that factor. However there are lacks of human factor solution even though human has been listed as the factor that influence of the success of the information security. Most of the approaches are focusing on the technical solution such as the development of policy and the tools used in the Risk Assessment process and Risk Management process in ISMS. Due to this issue, this project was performed to propose human factor solution in information security. The study was done to identify human factor in information security. Human factors in information security are External Influences, Human Error, Management, Organization of Computer and Information Security (CIS), Performance Management, Policy, Resource Management, Technology and Training. The proposed Human factor solution is done by the enhancement of the ISMS process with the selected Corporate Social Responsibility (CSR) process. The selected CSR processes are Raising Information Security awareness inside the organization, Employee codes of conduct, Engaging with stakeholders, Analyzing relevant human factor and the impact of that factor, Employee involvement and participation, Gaining stakeholder s/employee s feedback, Compensation and performance management and Communication related ISMS process. The enhancement of the ISMS process also has been evaluated and approved by the credibility experts.

9 vi ABSTRAK Sistem Pengurusan Keselamatan Maklumat (ISMS) adalah satu pendekatan bagi menguruskan keselematan maklumat. Kejaayaan perlaksanaan keselamatan maklumat telah dipengaruhi oleh beberapa faktor dan manusia telah disenaraikan sebagai salah satu faktor tersebut. Walaubagaimanapun, penyelesaian faktor manusia masih kurang walaupun manusia telah disenaraikan sebagai salah satu faktor yang mempengaruhi kejayaan perlaksaan keselamatan maklumat. Kebanyakan pendekatan adalah tertumpu kepada penyelesaian teknikal seperti pembangunan polisi dan alatan yang digunakan semasa proses Penilaian Risiko dan proses Pengurusan Risiko dalam proses ISMS. Berkenaan dengan isu tersebut, projek ini telah dijalankan untuk mencadangkan penyelesaian faktor manusia dalam keselamatan maklumat. Kajian telah dibuat dan faktor manusia dalan keselamatan maklumat telah dikenal pasti. Faktor manusia dalam keselamatan maklumat ialah Pengaruh luar, Ralat Manusia, Pengurusan, Pertubuhan Keselamatan Komputer dan Teknologi Maklumat, Pengurusan Prestasi, Polisi, Pengurusan Sumber, Teknologi dan Latihan. Penyelesaian faktor manusia yang telah dicadangkan ialah dengan mempertingkatkan proses ISMS dengan Tanggungjawab Sosial Korporat (CSR) yang telah dipilih. Proses CSR yang telah dipilih ialah Meningkatkan Maklumat kesedaran Keselamatan di dalam organisasi, Kod Kelakuan Pekerja, Penglibatan dengan pihak berkepentingan, Menganalisa faktor yang berkaitan manusia dan kesan-kesannya, Penglibatan dan Penyertaan Pekerja, Memperoleh maklum balas daripada pekerja / pihak berkepentingan, Pampasan dan pengurusan prestasi dan Komunikasi berkaitan proses ISMS. Peningkatan proses ISMS ini juga telah dinilai dan disahkan oleh pakar-pakar yang mempunyai kredibiliti.

10 vii TABLE OF CONTENT CHAPTER TITLE PAGE DECLARATION DEDICATION ACKNOWLEDGMENT ABSTRACT ABSTRAK TABLE OF CONTENT LIST OF TABLE LIST OF FIGURES LIST OF ABBREVIATIONS LIST OF APPENDICES ii iii iv v vi vii xi xii xiii xiv 1 INTRODUCTION 1.1 Introduction Problem Background Problem Statement Project Aim Project Objectives Project Scopes Significance of the Project Organization of Report 5 2 LITERATURE REVIEW 2.1 Introduction Information Security 7

11 viii 2.3 Factors Influencing Information Security Human Factor Organizational Factor Technological Factor Issues in Human Factor Solution Information Security Management System (ISMS) Information Security Management Standard Security Controls Process of Information Security Management Benefits of Information Security Management Definition of CSR Purpose of CSR Component of CSR Stakeholder Engagement Model CSR Process Strategic in CSR Benefits of CSR Summary 41 3 RESEARCH METHODOLOGY 3.1 Introduction Operational Framework Phase Phase Phase Summary 50 4 PROCESS ENHANCEMENT 4.1 Introduction The Relation of ISMS and CSR Selected Process 52

12 ix 4.4 The Enhancement of ISMS Process with the Selected CSR Process Raising Information Security Awareness inside the Organization Employee Codes of Conduct Definition of ISMS Scope Definition of Security Policy Engaging with Stakeholders Risk Assessment Risk Management Selection of Controls Statement of Applicability Implement and Operates the ISMS Gaining Stakeholder s/employee s Feedback Monitor and Review the ISMS Maintain and Improve the ISMS Communication Related ISMS Process Evaluation of the Enhancement of ISMS with selected CSR Summary 66 5 ANALYSIS AND RESULT 5.1 Introduction Analysis of the Selected CSR Process as Appropriate Human Factor Solutions Analysis of the Selected CSR Process Towards Human Factor Process A: Raising Information Security Awareness inside the Organization Process B: Employee Codes of Conduct Process C: Engaging with Stakeholders Process D: Analyzing Relevant Human Factor and the Impact of that Factor Process E: Employee involvement and participation Process F: Gaining Stakeholder s/employee s Feedback 84

13 x Process G: Compensation and Performance Management Process H: Communication Related ISMS process The Conclusion of Expert s Feedback Analysis The Contribution of Selected CSR process in Human Factor Solution The Enhancement of ISMS Process with Selected CSR Process as Human Factor Solution Conclusion 98 6 DISCUSSION AND CONCLUSION 6.1 Introduction Project Achievement Project Constraint Future Works Chapter Summary 102 REFERENCES 103 APPENDIX A 106 APPENDIX B 119 APPENDIX C 122 APPENDIX D 155

14 xi LIST OF TABLE TABLE NO. TITLE PAGE 2.1 Human Factor in Information Security The Simplification of Human Factor The Description of Human Factor ISMS Process List of Stakeholders Existing CSR Process List of CSR Process CSR Process The Summary of Research Methodology process Matrix Mapping between ISMS Process and Human Factor Matrix Mapping between CSR Process and Human Factor Expert s Feedback for Process A: Raising Information Security Awareness inside the Organization Expert s Feedback for Process B: Employee Codes of Conduct Expert s Feedback for Process C: Engaging with stakeholders Expert s Feedback for Process D: Analyzing Relevant Human Factor and the Impact of that Factor Expert s Feedback for Process E: Employee involvement and participation Expert s Feedback for Process F: Gaining Stakeholder s/ Employee s Feedback Expert s Feedback for Process G: Compensation and Performance Management Expert s Feedback for Process H: Communication Related ISMS process The Contribution of selected CSR process in Human Factor Solution 92

15 xii

16 xii LIST OF FIGURES FIGURE NO TITLE PAGE 2.1 Connection of Human Factor PDCA Cycle when Implementing ISMS CSR Implementation Process How Strategy is linked to CSR Operational Framework The Enhancement of ISMS Process with the Selected CSR Process Expert s Feedback towards the Selected CSR Process as Appropriate Human Factor Solutions Final Process of the Enhancement of ISMS Process with Selected CSR Process 97

17 CHAPTER 1 INTRODUCTION 1.1 Introduction In today s environment, the exchange of information through product or service creation and delivery; interactions between staffs as well as with customers, creates information flow. In any forms of information sharing and exchange, security has always been one of the most important issue focused by the organizations involved. Information must be well protected and managed accordingly, following the level of importance placed on it by the organization. However, according to some research, most of the solutions in managing information are focus on the technical solution and ignore the human factor that may influence the information security. This chapter will identify the problem background, define the objectives and limitations of the research.

18 2 1.2 Problem Background Information security refers to the protection of the confidentiality, integrity and access to information (Kruger and Kearney, 2006). One issue of the information involves the need for security. This need for information security is due to the importance of information to company, stakeholders and also to the individuals. In order to secure the information, different approaches are used. Unfortunately, evidence suggests that, regardless of the number of technical controls in place, organizations will still experience security breaches (Schultz, 2005; Besnard and Arief, 2004). In fact, the 2007 CSI Computer Crime and Security Survey reported that although 98% of users have anti-virus software, 52% were still infected with viruses (Richardson, 2007). Information security is not only a technical problem, but is also a people problem (Schulz, 2005). However, most of the approaches are more focused on the technical issues (Tsiakis, 2009). Proposing only technical solutions are inadequate to provide effective and comprehensive solution to secure information. This is due to the human factor issues of the information security other than the technical issue. The organization also should focus on this issue because the human factor will affect the security process even though the organization has implemented the best technical solution (Posthumus and von Solms, 2004). Information Security Management System (ISMS) is an approach to secure the information. However most of the processes and tools used in this approach are focusing on the technical solution such as the development of policy, Callio, Casis and others (ENISA, 2005). In order to solve or reduce this issue, some actions should be taken to balance the human factor and the technical solution in information security. The enhancement of the Information Security Management System (ISMS) process with the selected Corporate Social Responsibility (CSR) process may help the organization to manage and protected the information from misuse by others.

19 3 CSR is good in managing people because the management and practices of CSR towards employees, suppliers, community and customers are well defined based on established socially responsible behavior (Virgilio, 2002; Juno Consulting, 2005; Stranberg, 2009). Consequently, CSR was selected because ISMS or ISO 27001:2005 standard is one of the standards that are related to CSR or ISO Clause 6 (Bowens, 2011). Besides, the implementation of the CSR process is also based on the PDCA cycle which is similar to the implementation of the ISMS process (Hitachi Group, 2007; Hohnen, 2007; Maon, 2008; Tsiakis, 2009). The similarity of the implementation method make both processes are suitable to be enhanced in some of specific process in developing a human factors solution (Tsiakis, 2009). 1.3 Problem Statement Human factor is one of the factors that will influences the success of the ISMS process. Unfortunately, human factor solutions in information security is lacking as more focus are given to technical solution. As a consequence, information and assets of both employee and the organization is open for attacks of the kind overlooked by technical solutions. 1.4 Project Aim The aim of this project is to propose an effective human factor solution in information security to organization by enhancing the ISMS process with selected CSR process.

20 4 1.5 Project Objectives There are three objectives to be achieved in this project. The objectives are: i. To study ISMS process and CSR process in managing Human Factor in Information Security and analyze which part of CSR process can be contributed to ISMS process. ii. To propose a Human Factor solution by enhancing ISMS process with the selected CSR process. iii. To evaluate the enhancement of the ISMS process with the selected CSR process as a Human Factor Solution in Information Security. 1.6 Project Scopes The scopes of the project are: i. This research focuses on ISMS process. ii. This research only focuses on the CSR process that has been proposed by other researchers as a possible method to solve human factor issues in information security. iii. The enhancements of the ISMS process will be evaluated by distributing the questionnaire to the credible experts. 1.7 Significance of the Project Information security is about people, yet in most cases protection is focused on technical countermeasures. Human characteristics and behaviors that create, exploit, or contribute to the exploitation of system vulnerability is overlooked.

21 5 When a security breach caused by human factor happens, blame cannot be blamed on the individual alone but management process must be reviewed as well. Upon the completion of this research, a more efficient ISMS process which can guide organizations to better manage the human factors within information security will be delivered. As a result, organizations can further promote secure practices among staffs, stakeholders and customers. 1.8 Organization of Report The report consists of six chapters. The description of each chapter will be discussed in the following sentences. Chapter 1 consists of overview of the study, problem background, problem statement, objectives, scope and significance of this study. Chapter 2 reviews of the literature related to the research area. It discusses human factor, information security, ISMS, and CSR. Chapter 3 consists of the research methodology used. Chapter 4 focuses on the process enhancement. Chapter 5 discusses the analysis, results and experts feedback. Chapter 6 is the concluding chapter which discusses the achievements, challenges and constraints of the project.

EFFECTIVENESS OF CRM SYSTEM FOR CUSTOMER SERVICE REPRESENTATIVES (CSR) TRAINING AT TELEKOM MALAYSIA

EFFECTIVENESS OF CRM SYSTEM FOR CUSTOMER SERVICE REPRESENTATIVES (CSR) TRAINING AT TELEKOM MALAYSIA BADRUL AZIZ BIN MUHAMMAD UNIVERSITI TEKNOLOGI MALAYSIA iii EFFECTIVENESS OF CRM SYSTEM FOR CUSTOMER SERVICE