Strengthening the Management of Ubiquitous Internet by Refining ISO/IEC 27001 Implementation Using a Generic Responsibility Model

Feltus, Christophe and Khadraoui, Djamel (2017): Strengthening the Management of Ubiquitous Internet by Refining ISO/IEC 27001 Implementation Using a Generic Responsibility Model.

Abstract

The recent emergence of decentralized networks and ubiquitous Internet has highlighted the need for a better management of the companies’ IT architecture and for an improvement of the users of the network’s responsibility. Many standards have recently emerged to face these requirements. By analyzing them, we observe that they all include reference to the user responsibility but also that no common understanding of it exists. These statements have oriented our research toward the elaboration of an innovative, simple and pragmatic responsibility model that includes a user commitment dimension. ISO/IEC 27001:2005 is one of that new standard that aims at providing a framework for improving the information system management and the security of IT architecture. Although this standard is recognized over the globe, many surveys and cases studies provide interesting feedback about its implementation problems. In this paper, we introduce our responsibility model, we depict the responsibility aspects encompassed in ISO 27001 and we propose some improvement perspectives to face these problems and strengthen its implementation.

• Item Type: MPRA Paper
• Language: English
• Keywords: Responsibility, Capability, Accountability, Commitment, ISO 27001, Access rights.
• Subjects: L - Industrial Organization > L2 - Firm Objectives, Organization, and Behavior; L - Industrial Organization > L2 - Firm Objectives, Organization, and Behavior > L21 - Business Objectives of the Firm; L - Industrial Organization > L2 - Firm Objectives, Organization, and Behavior > L29 - Other; L - Industrial Organization > L6 - Industry Studies: Manufacturing; Y - Miscellaneous Categories > Y2 - Introductory Material > Y20 - Introductory Material; Y - Miscellaneous Categories > Y9 - Other; Z - Other Special Topics > Z0 - General > Z00 - General

References

ISO/IEC 38500 (2008), International Standard for Corporate Governance of IT (IT Governance)

ITIL (2001), IT Infrastructure Library – Service Delivery, The Stationery Office Edition, ISBN 011 3308930.

CobiT 4.1, Control Objectives for Information and Related Technology, Information Systems Audit and Control Association, www.isaca.org.

Vernadat FB (1995), Enterprise Modelling and Integration, Chapman & Hall, London, ISBN 0-412-60550-3

ISO/IEC 15504, “Information Technology – Process assessment”, (parts 1-5), 2003-2006

Dulay N, Lupu E, Solman M, Damianou N (2001), A Policy Deployment Model for the Ponder Language , IM’2001, Seattle, IEEE Press.

ISO/IEC 27001:2005, “Information technology – Security techniques – Information security management systems – Requirements”, 2005-10-15.

Certification Europe, The Digital Hub, 157 Thomas Street, Dublin 8, Ireland

Feltus C, Petit M (2009). Building a responsibility model using modal logic-towards Accountability, Aapability and Commitment concepts. In Computer Systems and Applications, 2009. AICCSA 2009. IEEE/ACS International Conference on (pp. 386-391). IEEE.

Smith T (2008). Information Security – What’s New and What’s working, Oceania CACS, Sydney 2008.

Feltus C, Petit M, Ataya G (2008), Definition and Validation of a Business IT Alignment Method for Enterprise Governance Improvement in the Context of Processes Based Organizations, Corporate Governance of IT International Conference, Wellington, New Zealand.

Feltus C, Petit M, Vernadat F (2009), Enhancement of CIMOSA with Responsibility Concept to Conform to Principles of Corporate Governance of IT, 13th INCOM IFAC Symposium, Moscow, Russia

Feltus C, Petit M (2009), Building a Responsibility Model Including Accountability, Capability and Commitment, ARES 2009, Fukuoka, Japan.

Jonathan AF (2007), The uncertain relationship between transparency and accountability. Center for Global, International and Regional Studies. Reprint Series. Paper CGIRS-Reprint-2007-2.

Stahl BC, Wood C (2006), Forming IT Professionals in the Internet Age: A Critical Case Study, In: Yoong, Pak & Huff, Sid (eds.): Managing IT Professionals in the Internet Age. Idea Group, Hershey, PA: 120 – 139

Mowday RT, Porter LW, Steers RM (1982), Employee-Organization Linkages: The Psychology of Commitment, Absenteeim, and Turnover. New York: Academic Press. Journal of Occupational Psychology, 63, pp. 1 – 18.

Buchanana B, II. (194), Building organizational Commitment: The Socialization of Managers in work organizations, Administrative science Quart. 19, 533–546.

Hall D (1977), Organizational Identification as a function of Career Pattern and Organizational Type, Administrative Science Quarterly, 17, pp. 340 – 350.

Lio K (1995), Professional Orientation and Organizational Commitment among Employees: an Empirical Study of Detention Workers, Journal of Public Administration Research and Theory, 5, pp. 231 – 246

Niehoff BP, Enz CA, Grover RA (1990), The Impact of Top-Management Actions on Employee Attitudes and Perceptions, Group & Organization Studies, 15, 3.

Florkowski G, Schuster M (1992), Support for Profit Sharing and Organizational Commitment: A Path Analysis, Human Relations, 45, 5, pp. 507 – 523.

Blau GJ (1985), The measurmement and Prediction of Career Commitment, Journal of Occupational Psychology, 58, pp. 277 – 288.

Meyer JP, Allen NJ (1984), Testing the ‘Side-Bet Theory’ of Organizational Commitment: Some Methodological Considerations, Journal of Applied Psychology, 69, pp. 372 – 378

Porter LW, Steers RM, Mowday RT, Boulian PV (1974), Organizational Commitment, Job Satisfaction, and Turnover Among Psychiatric Technicians, Journal of Applied Psychology, 59, pp. 603 – 9.

Dobson J, Martin D (2006), “Enterprise Modeling Based on Responsibility”, TRUST IN Technology: A Socio-Technical Perspective, Clarke, K., Hardstone, G., Rouncefield, M. and Sommerville, I., eds., Springer.

Sommerville I, Lock R, Storer T, Dobson J (2009), Deriving Information Requirements from Responsibility Models, 21st International Conference, CAiSE 2009, Amsterdam, The Netherlands, June 8-12. ISBN 978-3-642-02143-5.

Yu ES, Liu L (2001), Modelling Trust for System Design Using the i* Strategic Actors Framework. Workshop on Deception, Fraud, and Trust in Agent Societies Held During the Autonomous, Eds. Lecture Notes In Computer Science, vol. 2246. Springer-Verlag, London, 175-194.

He Q, Antón AI (2003), A Framework for Privacy-Enhanced Access Control Analysis in Requirements Engineering, REFSQ'03, Austria.

Roeckle H, Schimpf G, Weidinger R (2000), Process-oriented approach for role-finding to implement role-based security administration in a large industrial organization. RBAC '00. ACM, New York, NY, 103-110

Feltus C, Petit M, Sloman M (2010), Enhancement of business it alignment by including responsibility components in RBAC. Business/IT Alignment and Interoperability BUSITAL 2010, 61.

Di Renzo B, Feltus C (2003), Process assessment for use in very small enterprises: the NOEMI assessment methodology, European Software Process Improvement (EUROSPI’2003), Ed. Richard Messnarz, Graz, Austria. ISBN 3-901351-84-1.

Di Renzo B, Feltus C, Prime S (2004), NOEMI, Collaborative management for ICT process improvement in SME: experience report, European Software Process Improvement (EUROSPI’2004), in Norvegian University of Science and Technology (NTNU), Trondheim, Norway. ISSN: 1503-416

Ernst & Young’s 2008 Global Information Security Survey, http://www.ey.com/