This thesis analyzes the physical, communicational, and organizational dimensions of information system security process by taking the four-layer approach, which is composed of the policy, model, architecture, and mechanisms into account. Within this scope, according to the results of the security analysis of information systems in METU Informatics Institute, the policy, model, architecture, and mechanisms necessary to prepare a new security process were proposed. As a subcomponent of this proposed security process, the network security of the IS100 course was partially established, and the generated results were evaluated.

Il est aujourd'hui de plus en plus difficile de gérer les énormes quantités de données générées dans le cadre de la sécurité des systèmes. Les outils de visualisation sont une piste pour faire face à ce défi. Ils représentent de manière synthétique et souvent esthétique de grandes quantités de données et d'événements de sécurité pour en faciliter la compréhension et la manipulation. Dans ce document, nous présentons tout d'abord une classification des outils de visualisation pour la sécurité en fonction de leurs objectifs respectifs. Ceux-ci peuvent être de trois ordres : monitoring (c'est à dire suivi en temps réel des événements pour identifier au plus tôt les attaques alors qu'elles se déroulent), exploration (parcours et manipulation a posteriori d'une quantité importante de données pour découvrir les événements importants) ou reporting (représentation a posteriori d'informations déjà connues de manière claire et synthétique pour en faciliter la communication et la transmission). Ensuite, nous présentons ELVis, un outil capable de représenter de manière cohérente des évènements de sécurité issus de sources variées. ELVis propose automatiquement des représentations appropriées en fonction du type des données (temps, adresse IP, port, volume de données, etc.). De plus, ELVis peut être étendu pour accepter de nouvelles sources de données. Enfin, nous présentons CORGI, une extension d'ELVIs permettant de manipuler simultanément plusieurs sources de données pour les corréler. A l'aide de CORGI, il est possible de filtrer les évènements de sécurité provenant d'une source de données en fonction de critères résultant de l'analyse des évènements de sécurité d'une autre source de données, facilitant ainsi le suivi des évènements sur le système d'information en cours d'analyse. / Managing the vast quantities of data generated in the context of information system security becomes more difficult every day. Visualisation tools are a solution to help face this challenge. They represent large quantities of data in a synthetic and often aesthetic way to help understand and manipulate them. In this document, we first present a classification of security visualisation tools according to each of their objectives. These can be one of three: monitoring (following events in real time to identify attacks as early as possible), analysis (the exploration and manipulation a posteriori of a an important quantity of data to discover important events) or reporting (representation a posteriori of known information in a clear and synthetic fashion to help communication and transmission). We then present ELVis, a tool capable of representing security events from various sources coherently. ELVis automatically proposes appropriate representations in function of the type of information (time, IP address, port, data volume, etc.). In addition, ELVis can be extended to accept new sources of data. Lastly, we present CORGI, an successor to ELVIS which allows the simultaneous manipulation of multiple sources of data to correlate them. With the help of CORGI, it is possible to filter security events from a datasource by multiple criteria, which facilitates following events on the currently analysed information systems.

This dissertation investigated how senior management is motivated to commit to information system security (ISS). Research shows senior management participation is critical to successful ISS, but has not explained how senior managers are motivated to participate in ISS. Information systems research shows pressures external to the organization have greater influence on senior managers than internal pressures. However, research has not fully examined how external pressures motivate senior management participation in ISS. This study addressed that gap by examining how external pressures motivate senior management participation in ISS through the lens of neo-institutional theory. The research design was survey research. Data collection was through an online survey, and PLS was used for data analysis. Sample size was 167 from a study population of small- and medium-sized organizations in a mix of industries in the south-central United States. Results supported three of six hypotheses. Mimetic mechanisms were found to influence senior management belief in ISS, and senior management belief in ISS was found to increase senior management participation in ISS. Greater senior management participation in ISS led to greater ISS assimilation in organizations. Three hypotheses were not supported. Correlation was not found between normative influences and senior management belief, normative influences and senior management participation, and coercive influences and senior management participation. Limitations with the study included a high occurrence of weak effect sizes on relationships within the model and heterogeneity based on industry, organization size, and regulatory requirements in the sample. This study contributes to ISS research by providing a theoretical model to explain how external influences contribute to senior management belief and participation in ISS, and ultimately ISS assimilation in organizations. Empirical evidence supports the mediating role by senior management between external influences and ISS assimilation. The findings also suggest some limitations that may exist with survey research in this area. This study benefits practitioners in three ways. First, it reinforces the argument that senior management support is critical to ISS success. Second, it extends understanding of senior management's role with ISS by explaining how IS and ISS management might nurture senior management belief and participation in ISS through industry groups and business partnerships. Third, the results inform government regulators and industry groups how they can supplement regulatory pressures with educational and awareness campaigns targeted at senior management to improve senior management commitment to ISS.

Many organizations have a problem with synchronizing individual values regarding information security with expectations set by the relevant security policy. Such discordance leads to failure in compliance or simply subversion of existing or imposed controls. The problem of the mismatch in understanding the security policies amongst individuals in an organization has devastating effect on security of the organization. Different individuals hold different understanding and knowledge about IS security, which is reflected on IS security policies design and practice (Vaast, 2007). Albrecthsen and Hovdena (2009) argue that users and managers practice IS security differently because they have different rationalities. This difference in rationalities may reflect the mismatch between the security policies and individuals’ values. In this research, we argue that occurrence of security breach can change individuals’ values in light of security policy of organization. These changes in the values can be reflected on the compliance between individuals’ norms and security rules and standards. Indeed, organizations need to guarantee the compliance between security policy and values of their employees. Thus, they can alleviate or prevent violations of security of organization. However, it is difficult to find a common method that all organizations can adopt to guarantee the synch between security rules and individuals’ norms. The main aim of this research is to investigate how people perceive information security policy and how their perceptions change in response to security breaches. Besides, this research aims to investigate the relationship between individuals’ values and security policy. Thus, organizations can have the intended level of compliance between individual norms and security rules and standards. With the aid of the Repertory Grid technique, this research examines how a security breach shapes people’s values with respect to security policy of an organization. To conduct the argument, this research offers an assessment mechanism that aids the organization to evaluate employees’ values in regard to security policy. Based on that evaluation, the organization can develop a proper mechanism to guarantee compliance between individuals’ norms and security rules. The results of this research show that employees in an organization hold different perceptions regarding the security policy. These perceptions change in response to security incident. This change in perceptions dose not necessarily result in better compliance with the security policy. Factors like the type of breach and people’s experience can affect the amount of change in the perceptions. Contributions, implications, and directions for future research of this study will be discussed.

I den tidiga IT-historien utgick data från att endast kunna angripas genom att befinna sig på fysisk plats för att kunna genomföra ett intrång och tillförskaffa sig data eller information. I äldre actionfilmer syns ofta någon rysk eller amerikansk spion som överför data från en fysisk dator till en lika fysisk disk. I takt med den ökade globaliseringen finns också ett ökat behov av tillgång till data och information på olika platser samt på olika sätt. För att tillfredsställa ett ökande behov av tillgänglighet och rörlighet har IT-världen fått skapa nya lösningar vilka uppfyller det behovet. Första steget var i och med införandet av internet och numera med nya olika molnlösningar tillgängliga för företag, privatpersoner och även angripare via internet. Moderna tekniker frambringar också i princip alltid nya risker och hot. Där det tidigare i mänskligheten användes lås för dörrar, måste nu beaktning tas där vilken typ av kryptering, virusskydd och andra åtgärder krävs för att skydda privat information. Cloud Computing och användningen av molntjänster som Software as a Service (SaaS), Plattform as a Service (PaaS) och Infrastructure as a Service (IaaS) fortsätter att öka vilket kan bidrar med många fördelar för företag (Balco, Drahošová & Law, 2017; Basishtha & Boruah, 2013; SCB, 2018; Sultan, 2011; Shahzad, 2014). Dock ger inte en flytt av data, från marken upp till molnet, en garanti för säkerhet eftersom molnets tillgänglighet och förflyttning av data utanför företagets gränser ställer frågor kring informationssäkerheten och kommer med många utmaningar samt risker (Kavitha & Subashini, 2011; Dorey & Leite, 2011). I och med utökad globalitet borde det väl vara passande att data lagras på olika platser i världen. Men hur säkert är det egentligen när ett företag baserat i exempelvis Finland har viktig data lagrad på andra sidan jordklotet? Eftersom ”Molnet” fortsätter att öka finns ett behov att undersöka hur, var och när användning av molnet kan bidra till att öka informationssäkerheten samt även varför och under vilka omständigheter. Studien kommer fokusera på användningen kring informationssäkerheten inom SaaS och vilka aspekter som påverkar om företag kan tillförskaffa ökad informationssäkerhet. SaaS har valts ut då molntjänsten är mest frekvent förekommen inom företag. Studiens rapport är uppbyggd på följande sätt: kapitel två tar upp relevanta begrepp samt bakgrund till ämnet. Därefter i kapitel tre beskrivs problemområdet samt rapportens syfte och frågeställning. I kapitel fyra presenteras studiens vetenskapliga metod vilken har använts för att samla in och analysera data. I kapitel fem presenteras analysen av arbetet vilket har lett fram till kapitel sex slutmodell. Slutligen följer en diskussion kring studien.

This thesis focuses on the analysis of current information system of the selected points to its possible shortcomings and errors. Information obtained from the analyzes will lead to appropriate solutions to problems. The aim of the current system is customized to meet the needs of its users, so that the information system should be flexible, intuitive and clear

The aim of this dissertation thesis is to develop new methodology of information systems penetration testing based on analysis of current methodologies and the role of penetration tests in context of IS/IT governance. Integral part of this aim is evaluation of the methodology. The first part of the thesis is devoted to the presentation of history and current state of research in selected area, definiton of basic terms and introduction of role of the penetration tests. This part is followed by the review of relevant sources and comparative study of current methodologies with a goal to identify their weaknesses. Results from this study are further used as a basis for new methodology development. Classification of IS penetration tests types and testing scenarios are also included. The second part includes design of new methodology, at first its history, structure and principles are presented, then its framework is decribed in high level of detail. In the third part the reader can find (theoretical and practical) validation. The biggest scientific contribution is the methodology itself focused on managment of penetration tests (which is the area currently not sufficiently descibed). Secondary contribution is the extensive review and the comparative analysis of current methodologies. Contribution to the economic and technical (practical) application we can mainly see in the development of new methodology which enables companies to improve management of penetration tests (especially planning, operational management and implementation of countermeasures).

This thesis is focused on the information systems; it describes the available innovations applied on the established information systems. It describes the methods that are suitable for testing the effectiveness of the information systems. The practical part includes the current state of the chosen information system of a company, further it tests the effectiveness of the information system and finally it evaluates the received information and recommends the possible changes that would lead to the higher effectiveness of the work of the information system.

This theses concerns with social engineering and defense against it. Social engineering attacks represents significant threat for organizations and their information systems, especially because they target weakest link in information systems security, its users. That way attacker can easily bypass even highly sophisticated security system. This theses tries to deal with question, how to effectively secure human factor of information system.

A thesis deals with the assessment of the information system in an engineering company, the assessment of its efficiency and the proposal of the ICT modification to improve this system. Furthermore, the thesis deals with the proposal of the information system changes in the company and the elimination of the risks related to these changes. An analytical part also deals with the company analysis, the analysis of the company processes and the analysis of the current information system. .