Abstract
Information security has become a necessity for all organizations. ITIL, designed for large organizations, has also been gradually adopted by smaller companies and has incorporated practices related to information security management (ISM). This study aims to understand the main risks associated with ISM, considering the context of micro companies. For this purpose, a qualitative model was built based on four case studies of micro companies in the information technology industry. The results show that companies are concerned about information security, given the growth of external threats. However, these companies have a lack of commitment, of resources, and of knowledge that hinder the implementation of an ISM policy. Therefore, it is evident that the challenge of ISM is demanding and should be addressed, considering that the security of an organization should be analyzed in a holistic context, where all perspectives should be considered to reflect the multidisciplinary nature of security.
TopIntroduction
Information is nowadays a key element for the competitiveness of organizations. As studies (Chung et al., 2016; Grander et al., 2021; Phillips-Wren et al., 2021) demonstrate, information satisfies the needs of organizations to recognize the characteristics of a given context and support the decision-making process. Information can be materialized in many different formats. Not all media are digital, although the increasing role of digitization processes is recognized (Ellström et al., 2021; Kraus et al., 2022). Managing all this information effectively has become essential for the sustainability of a business (Etzion & Aragon-Correa, 2016; Serban, 2017). Consequently, information security, as a potentially valuable asset, should no longer be seen as a minor activity in the context of organizations. The protection of these valuable assets associated with information is referred to as information security.
Information security is the protection of information, the systems and devices that use, store, and transmit that information (Kim & Solomon, 2021). Therefore, the goal of information security is to adequately protect information assets to ensure business continuity or operation, minimizing potential losses and maximizing the return on investment. To achieve this purpose, the literature reveals the need to protect three critical aspects of information: confidentiality, integrity, and availability (Qadir & Quadri, 2016; Yee & Zolkipli, 2021). Confidentiality ensures that only authorized people have access to the data; integrity looks at protecting the information from unauthorized changes; and availability seeks to ensure that all information is accessible when it is required. The correct presentation of these three aspects of information ensures credibility and trust in organizations and businesses and can be achieved through the application of controls. Controls can be more or less sophisticated and are the result of a combination of policies, procedures, and organizational structures.
Since it is not possible to ensure total protection of information from all current and potential threats, it is necessary to perform an information security risk analysis to determine the potential threats and vulnerabilities. Furthermore, this knowledge is important for defining the necessary countermeasures to be applied to mitigate the impact of these risks to an acceptable level. In this way, risk analysis is seen by Eling et al. (2021) as a process of identifying the assets, the risks to those assets, and the procedures to mitigate the risks to those assets. It is from the risk analysis that management can make proper decisions regarding information security.
Information security management (ISM) is currently an indispensable element in the various silos of corporate and business management. The Information Technology Infrastructure Library (ITIL), created with the goal of increasing maturity in the management of its processes in information technology, offers a set of best practices for project management in areas such as support, services, infrastructure management, application management, and security management (Soomro & Wahba, 2011). This last component concerning security management only emerged explicitly in 2018 with the publication of ITIL v.4. Furthermore, ITIL v.4 states that organizations must ensure that security aspects are integrated into all other IT Service Management (ITSM) processes. Because it is an IT service-oriented methodology, based on market best practices, the ITIL methodology has been widely used by companies with this focus and business.
Key Terms in this Chapter
Confidentiality of Information: A security purpose that ensures information is not made available or disclosed to unauthorized entities.
Process: Is a set of interrelated or interacting activities that transform inputs into outputs.
Incident Management: Is the practice of minimizing the negative impact of incidents by restoring normal service operation as quickly as possible.
Integrity of Information: A security purpose that ensures information is only modified by authorized personnel and activities.
Availability: A security purpose that ensures the ability of an IT service or other configuration item to perform its agreed function when required.
Service Continuity Management: Is the practice of ensuring that service availability and performance are maintained at a sufficient level in case of a disaster.
Risk: A possible event that could cause harm or loss or make it more difficult to achieve objectives.
Information System: It involves a set of people, procedures, and resources (hardware, software, and data) in the collection, processing, and provision of information in the organizational context.
Incident: An unplanned interruption to a service or a reduction in the quality of a service.
Information Security Management: Is the practice of protecting an organization by understanding and managing risks to the confidentiality, integrity, and availability of information.
Recovery: Is the activity of returning a configuration item to normal operation after a failure.