Designing Extended Zero Trust Maturity Model – From Technical to Socio-Technical

2023 | International Conference on Information Systems | Citations: 0

Authors: Tokerud, Simen; Jansen, Jarand; Niemimaa, Marko; Järveläinen, Jonna

Abstract: Recent successful cybersecurity attacks have exploited trust to compromise orga ... Expand

Abstract: Recent successful cybersecurity attacks have exploited trust to compromise organizational information systems. Scholars and practitioners agree that the issue originates from the organizational perimeter security approach, within which perimeter trust is assumed. To improve the situation, building security principles on the idea that trust is not inherent but earned has been proposed, coined as Zero Trust. However, the current discussions spearheaded by technology-minded practitioners have focused mostly on trust at the network security and architecture levels, largely omitting the organizational aspects of security. To address this gap, we build on socio-technical approach and maturity models to develop a novel artifact with security experts, addressing the need for organizational Zero Trust through the Extended Zero Trust Maturity Model. Our research contributes to discussions on holistic information security management by extending the principles of Zero Trust from technical into socio-technical approach and responds to calls to reconsider foundational assumptions of IS security. Collapse

Topics: data security information security management IT security spreadsheet phishing

Methods: maturity model design science qualitative interview literature study case study

Strategic roles of IT modernization and cloud migration in reducing cybersecurity risks of organizations: The case of U.S. federal government

2022 | Journal of Strategic Information Systems | Citations: 0

Authors: Pang, Min-Seok; Tanriverdi, Hüseyin

Abstract: Many organizations run their core business operations on decades-old legacy IT s ... Expand

Abstract: Many organizations run their core business operations on decades-old legacy IT systems. Some security professionals argue that legacy IT systems significantly increase security risks because they are not designed to address contemporary cybersecurity risks. Others counter that the legacy systems might be “secure by antiquity” and argue that due to lack of adequate documentation on the systems, it is very difficult for potential attackers to discover and exploit security vulnera­ bilities. There is a shortage of empirical evidence on either argument. Routine activity theory (RAT) argues that an organization’s guardianship is critical for reducing security incidents. However, RAT does not well explain how organizations might guard against security risks of legacy IT systems. We theorize that organizations can enhance their guardianship by either modernizing their legacy IT systems in-house or by outsourcing them to cloud vendors. With datasets from the U.S. federal agencies, we find that agencies that have more legacy IT systems experience more frequent security incidents than others with more modern IT systems. A 1%point increase in the proportion of IT budgets spent on IT modernization is associated with a 5.6% decrease in the number of security incidents. Furthermore, migration of the legacy systems to the cloud is negatively associated with the number of security incidents. The findings advance the literature on strategic information systems by extending RAT to explain why the “security by antiquity” argument is not valid and how organizations can reduce the security risks of legacy IT systems through modernization and migration to the cloud. Collapse

Topics: cloud computing IT security IT investment IT workforce data center

Methods: theory development robustness check instrumental variables estimation longitudinal research autocorrelation analysis

Theories: activity theory