The IS Security Problem GP Dhillon, Ph. D. Associate Professor of IS, VCU

Problem – (1) Billions are being lost –US Fraud Information Center: Internet fraud - losses up from $3.4 million to $4.4 million in 2000 Average loss per person rose from $427 in 2000 to $636 in 2001 –CSI/FBI: Theft of proprietary information- 1.5 billion in 2001 IT security breaches cost companies about $15 billion each year (Source: Datamonitor) –UK Audit Commission Consistently reported a nearly 180% increase in IT abuse cases in their reports published every 3 years.

Problem – (2) Remarkable increases in spending on security Estimated $8.7 billion spending on security measures in 2000 That figure will rise to $30.3 billion in 2005, showing 28% growth year on year. Security breaches take place despite deployment of various technologies 95% had firewalls; 61% had Intrusion Detection Systems; 90% had access control of some sort; 42% had Digital IDs etc. (Source: CSI/FBI 2001 survey) UK Audit commission reported that 25% of organizations did not have computer audit skills 60% of organizations had no security awareness 80% of the organizations did not conduct a risk analysis For example: In UK 98% of the organizations had failed to implement British Standard Institutes’ BS 7799 (now ISO 17799). However 20,000 copies had been sold

Conceptualizing IS security ‘Informal’ information system and security issues "The internal organizational environment" Formal information system and security issues Communication Security Data Security Technical information system and security issues Network Security External organizational environment - legal/regulatory

Types of security breaches and related preventive mechanisms IS Security Internal External Technical Formal Informal Checklists Risk Management Malicious code Formal models (CIA) Security policies (s/w; h/w, network) Evaluation methods (TCSEC, ITSEC etc) Information modeling Responsibility modeling Secure ISD Practically none (except perhaps work by Baskerville and Dhillon) Formal models (CIA) Intrusion detection Firewalls Encryption PKI Legal, regulatory and Public policy None within security except some work in information privacy and internet privacy.

‘Internal’ IS security: some definitions Organizations: evolving social forms of sense making and hence constituted of formal, technical and informal parts Information systems: Information systems and organizations have become indistinguishable from each other. Organizing entails handling information in a purposeful manner. This is achieved in a formal rule based manner, informally or through the use of any technology Computer based IS: This is part of the IS/Organization where information technology has been used for automation. IS security: IS security therefore is not just the security of the technical edifice, but that of the formal and informal systems within an organization as well. Therefore security breaches (negative events) occur because of 1.lack of integrity between formal, technical and informal 2.inconsistencies in expectations and obligations 3.breakdown in normative and rule based structures 4.exploitation of technical vulnerabilities

My argument in managing internal IS security problems To resolve the problem of managing IS security, we need to understand the deep- seated pragmatic aspects of an organization. Solutions to the problem of security can be provided by interpreting the behavioral patterns of the people involved.

Common approaches for managing internal IS security Internal External Technical Formal Informal - Checklists and standards (ISO17799; TCSEC; ITSEC) - Risk Management - Malicious code – virus protection - Formal models (typically for Confidentiality, Integrity and Availability) - Cookbooks – self reflected cookbooks - Security policies (s/w; h/w, network) - Checklists and standards (ISO17799, TCSEC, ITSEC) - Information modeling - Responsibility modeling - Business process security modeling - Secure ISD - Value focused security assessment - Soft system security development - Emergent security planning - Security culture mapping - Value focused security assessment

Concerns with common approaches for managing internal IS security Internal External Technical Formal Informal - Based on “what can be done” principle - Confronted with developmental duality problem - Present an extreme mechanistic orientation R= P * C - Lack of modeling support - Difficult to integrate into mainstream systems development - Restrict autonomy of developers - Numerous ISD methods hence difficult to present a predefined universal security method - No principles offered - No objectives presented - Lack of integration with formal and technical measures

Conclusion Pollution Treatment Plants Embankments Dams Canals