Hybrid work is already a big part of many organizations' structure. This phenomenon presents many new ways of how work is performed and carries new challenges with it. Parallel to that, the importance of working IT securely and coping with IT threats is significant in all fields of work. In this case study, we interview employees at a Swedish IT consultancy company, about their perceptions of hybrid work and their perceived ability to keep information secure in a hybrid work setting. Six employees from the company were selected for interviews. These interviews were then analyzed from the theoretical framework of Protection Motivation Theory which presents ways to explain how individuals are motivated to mediate threats alongside the ISO standard which is used to explain coping behaviors. This study concludes that the employees’ perception regarding the ability to keep information secure while working hybridly is diverse. Furthermore, the office has an important role in perceived security. The final finding reveals that current information security guidelines in ISO need to be updated or expanded to better guide organizations implementing remote work.

Många företag har idag ett stort ansvar att hålla information säker. Med människor som jobbar med informationen hos företag följer därför arbetet med att stärka informationssäkerhetsmedvetenheten, vilket kan göras genom att bland annat implementera ett ledningssystem för informationssäkerhet efter standarden ISO 27001. Det finns däremot flera sätt att påverka informationssäkerhetsmedvetenheten och bland dessa är det genom att påverka kunskap, attityd eller beteende. Denna studie har därför undersökt hur företag arbetar med dessa aspekter i ett företag certifierat genom ISO 27001. För studien har semistrukturerade intervjuer utförts hos ISO 27001-certifierade företag med vidare analys för att besvara studiens frågeställning. Resultaten visar att företagen enhetligt har ett stort fokus på kunskapsaspekten av arbetet med informationssäkerhetsmedvetenhet samt att beteende är något som sällan är problematiskt men följes upp med åtgärder beroende på incidenten. Slutsatserna som presenteras är rekommendationer som när applicerbara ökar informationssäkerhetsmedvetenheten hos företag.  Studien har främst undersökt kunskap, attityd och beteende hos ISO 27001-certifierade företag i Sverige vilket gör att kulturella och dylika faktorer möjligtvis saknas, vilket kan påverka hur applicerbara rekommendationer är för företag utanför Sverige. / Many companies today have a big responsibility to keep their information secure. As there are employees working with information, there is also a need for improvement of the employee’s information security awareness. This can be done through implementation of a management system for information security of the ISO 27001 standard. There are multiple ways to improve the information security awareness and some of these are through improving the knowledge, attitude, and behavior of the employee. This study has investigated how companies that have an ISO 27001 certification improve their employee’s knowledge, attitude, and behavior. The study identified this improvement through a qualitative method using semi-structured interviews, where the respondents are employees at companies that are ISO 27001 certified, the interviewees answers were then analyzed to answer the study’s question at issue. The results show that the companies uniformly focus on the knowledge aspect of information security awareness and that behavior is rarely an issue but that in the case of an incident is investigated. The conclusion presents recommendations as to how companies can improve their employee’s knowledge, attitude, and behavior to information security. The study mainly studied the knowledge, attitude, and behavior of Swedish companies that are ISO 27001 certified, which makes cultural and similar factors are missing which might affect how applicable the recommendations are for companies outside Sweden.

With widespread of harmful attacks against enterprises¿ electronic services, information security readiness of these enterprises is becoming of increasing importance for establishing the required safe environment for such services. Various approaches are proposed to manage enterprise information security risks and to assess its information security readiness. These approaches are, however, not adequate to manage information security risks, as all required information security components of its structural and procedural dimensions have not considered. In addition, current assessment approaches lack numerical indicators in assessing enterprise information security readiness. Furthermore, there is no standard approach for analysing cost versus benefit in selecting recommended protection measures. This thesis aims at contributing to the knowledge by developing comprehensive Enterprise Information Security Risk Management (EISRM) framework that integrates typical approaches for information security risk management, and incorporates main components of key risk management methodologies. In addition, for supporting phases of the proposed EISRM framework, analytical models for enterprise information security readiness assessment and cost-benefit analysis are developed. The practical evaluation, using the proposed enterprise information security readiness assessment model has been performed depending on a developed investigation form that used to investigate nine enterprises inside Saudi Arabia. The results demonstrate the effectiveness of the model in assessing and comparing enterprises information security readiness at all levels of the model, using numerical indicators and graphical representations. The EISRM framework and the analytical models presented in this research can be used by enterprises as single point of reference for assessing and cost effectively improving their information security readiness.

The problem addressed by this research is a demand for increased flexibility in access to organisational information, driven by the increasing popularity of mobile devices. Employees increasingly bring private devices to work (Bring Your Own Device, BYOD) or use work devices for private purposes (Choose Your Own Device, CYOD). This puts managers in a difficult position, since they want the benefits of mobility, without exposing organisational data to further risk. The research focuses on management (particularly information security management) issues in the design and implementation of strategies for mobile devices.  There are two objectives. The first is to identify existing information security management strategies for mobile and dual-use devices. The second is to develop a framework for analysing, evaluating and implementing a mobile device strategy. The overall research strategy is inspired by Design Science; where the mission is to develop an artefact, in this case a framework, which will help to solve a practical problem. Methods include literature review, theoretical development, and the collection and analysis of qualitative data through interviews with executives. The main result of this work is the framework, which deals with the complete process, including analysis, design and implementation of a mobile device management strategy. It helps researchers to understand necessary steps in analysing phenomenon like BYOD and gives practitioners guidance in which analyses to conduct when working on strategies for mobile devices. The framework was developed primarily through theoretical work (with inspiration from the mobile security and strategic management literature, and the ISO/IEC 27000 standard), and evaluated and refined through the empirical studies. The results include twelve management issues, a research agenda, argumentation for CYOD and, guidance for researchers and practitioners.

Alla människor är beroende av mat. Sverige har en god livsmedelsindustri där sista steget är dagligvaruhandeln som hjälper till att Sveriges befolkning får mat på bordet. I och med att digitaliseringen ökat i vårt samhälle har det även senaste åren rapporterats i media om dataintrång riktade mot företag i Sverige. 2021 fick Coop stänga ner sina butiker då kassasystem slutade fungera på grund av en utpressningsattack mot leverantören av mjukvaran till kassasystemen som företaget använder.  Ökningen av dataintrång i Sverige har lett till att det blir allt viktigare att skydda informationen hos företagen. Information spelar en stor roll i en organisations affärsverksamhet där informationen kommer i kontakt med både teknik och människor. Det gör att ett aktivt informationssäkerhetsarbete är viktigt för att säkerhetsställa konfidentialiteten, integriteten och tillgängligheten hos företagets information. Genom en kvalitativ studie bestående av intervjuer med ledning och medarbetare på ett företag inom dagligvaruhandeln studerades hur företaget förhåller sig och arbetar med informationssäkerhet. Resultatet från intervjuerna analyserades genom att använda en tematisk analys där teman identifieras ur empirin. Resultaten av studien analyserades och diskuteras utifrån teorin med fokus på informationssäkerhetspolicys, säkerhetsmedvetenhet och organisationskultur. Slutligen diskuteras vikten av utbildning och träning för att öka säkerhetsmedvetenheten i företagets organisationskultur. / All humans need food. Sweden has a well functioning food industry, where the final step in the chain is the grocery trade and where the people can buy their food. As digitalization has increased in our society there have also been reports in the media in recent years about ransomware attacks on companies in Sweden. In 2021 the grocery chain Coop had to close their stores when their cash register system stopped working because of a ransomware attack against the supplier of the software of the system for the company’s cash registers.  The increase of computer breaches in Sweden has made it increasingly important to protect the information at companies. The information plays an essential role in an organization's business processes where it comes in contact with both technology and people. This means that active information security work is important to ensure the confidentiality, integrity and availability of the organization’s information. With the use of a qualitative study consisting of interviews with the management and employees of a company in the grocery trade a study was performed on how the company relates to and works with information security. The result from the interviews was analyzed using thematic analysis where themes were identified from the collected data. The results from the study were analyzed and discussed based on the theory with focus on information security policies, security awareness and organizational culture. Lastly the importance of education and training to increase the security awareness in the company’s organizational culture was discussed.

Enterprise networks present very high value targets in the eyes of malicious actors who seek to exfiltrate sensitive proprietary data, disrupt the operations of a particular organization, or leverage considerable computational and network resources to further their own illicit goals. For this reason, enterprise networks typically attract the most determined of attackers. These attackers are prone to using the most novel and difficult-to-detect approaches so that they may have a high probability of success and continue operating undetected. Many existing network security approaches that fall under the category of intrusion detection systems (IDS) and intrusion prevention systems (IPS) are able to detect classes of attacks that are well-known. While these approaches are effective for filtering out routine attacks in automated fashion, they are ill-suited for detecting the types of novel tactics and zero-day exploits that are increasingly used against the enterprise. In this thesis, a solution is presented that augments existing security measures to provide enhanced coverage of novel attacks in conjunction with what is already provided by traditional IDS and IPS. The approach enables honeypots, a class of tech- nique that observes novel attacks by luring an attacker to perform malicious activity on a system having no production value, to be deployed in a turn-key fashion and at large scale on enterprise networks. In spite of the honeypot’s efficacy against tar- geted attacks, organizations can seldom afford to devote capital and IT manpower to integrating them into their security posture. Furthermore, misconfigured honeypots can actually weaken an organization’s security posture by giving the attacker a stag- ing ground on which to perform further attacks. A turn-key approach is needed for organizations to use honeypots to trap, observe, and mitigate novel targeted attacks.

Svenska gymnasieskolor, både kommunala och fristående, har snabbt adopterat en datorbaserad inlärningsplattform. Det här betyder att varje elev får tillstånd att låna en dator från skolan, vars syfte är att effektivisera skolarbetet. Att flytta undervisningen iväg från papper och penna mot ett mer digitalt arbetssätt medför dock vissa risker gällande informationssäkerhet. Denna uppsats syftar att undersöka, genom en surveyundersökning av 4 olika gymnasieskolor i Sverige, kunskapsnivåerna i informationssäkerhet hos studenter mellan 16 och 19 år gamla, samt även hur denna kunskap lärs ut. Studien var uppdelad i en enkätundersökning av studenter, med 163 respondenter, och intervjuer med 3 anställda på 3 av skolorna. / High schools in Sweden, both public and private, have rapidly been adopting a computerbased learning platform. This means that each student is granted permission to lease a laptop from the school, which is intended to effectivize school work. However, moving the educational platform away from paper and pen and towards a digital platform poses certain risks concerning information security. This paper aims to examine, through a survey of 4 different high schools in Sweden, the education levels of students aged 16 to 19 concerning information security, and also how that education has been conducted. The study was divided into a survey of students, with 163 respondents, and interviews were conducted with 3 key members of 3 of the schools.

The study of organisations’ information security cultures has attracted scholars as well as healthcare services industry to research the topic and find appropriate tools and approaches to develop a positive culture. The vast majority of studies in Saudi national health services are on the use of technology to protect and secure health services information. On the other hand, there is a lack of research on the role and impact of an organisation’s cultural dimensions on information security. This research investigated and analysed the role and impact of cultural dimensions on information security in Saudi Arabia health service. Hypotheses were tested and two surveys were carried out in order to collect data and information from three major hospitals in Saudi Arabia (SA). The first survey identified the main cultural-dimension problems in SA health services and developed an initial information security culture framework model. The second survey evaluated and tested the developed framework model to test its usefulness, reliability and applicability. The model is based on human behaviour theory, where the individual’s attitude is the key element of the individual’s intention to behave as well as of his or her actual behaviour. The research identified a set of cultural and sub-cultural dimensions in SA health information security and services.

The protection of sensitive data and technologies is critical in preserving United States (U.S.) national security and minimizing economic losses. However, during a cyber attack, the operational capability to constrain the exfiltrations of sensitive data and technologies may not be available. A cyber preparedness methodology (CPM) can improve operational capability and cyber security. The CPM enables a corporation to (a) characterize cyber threats; (b) determine the level of preparedness necessary to ensure mission success; (c) facilitate strategic planning for cyber security (CS); and (d) establish priorities for CS investment planning and management decisions. The cyber preparedness framework (CPF) underlies the CPM. A corporation's leadership articulates its fundamental approach to risk management (RM) and mission assurance, and determines its target level of preparedness. Typically, corporations utilize the CPF to (a) characterize the caliber of the threat; (b) assess the technical and operational capabilities to counter the threat; and (c) develop the governance and processes necessary to achieve its cyber preparedness level. The problem that was investigated in this case study was how to construct a CPF for Lockheed Martin (LM) that works in conjunction with a risk management process (RMP). The goal was to extend the CPF into an RMP to construct a risk management framework (RMF) paradigm that can aid similarly large-sized private sector U.S. Government (USG) contractors in implementing the CPM. In this investigation, the author identified the corporate (a) security categorization, (b) cyber threats, (c) cyber threat level, (d) cyber preparedness level, (e) capabilities the corporation should utilize to counter cyber threats, and (f) governance and processes necessary to achieve the cyber preparedness level for a large-sized private sector USG contractor. The results of this investigation were organized in terms of RMP phases. Based on the results, the author constructed an RMF paradigm that can aid similarly large-sized USG contractors in implementing a CPM.

Information security is a complex issue, which is very critical for success of modern businesses. It can be implemented with the help of well-tested global standards and best practices. However, it has been studied that the human aspects of information security compliance pose significant challenge to its practitioners. There has been significant interest in the recent past on how human compliance to information security policy can be achieved in an organization. Various models have been proposed by these researchers. However, there are very few models that have tried to link human commitment attributes with information security governance of an organization. The research problem of this study was to identify the security controls and mechanisms to govern information security effectively. The proposed model was based on agency theory and comprises a relationship between human commitment variables (ethics, integrity and trust) with security governance variables (structural, relational and process) referred as systemic variables in the research. The resulting correlation is further related with governance objectives (goal congruence and reducing information asymmetry) to hypothesize an effective information security in an organization. The research model proposed was tested employing confirmatory factor analysis (CFA) and structural equation modeling (SEM). There were four models tested in this research. The first model (initial measurement model) comprised human variables linked with relational and the systemic variables linked with goal congruence and information asymmetry. This model could not get through the CFA tests. A modified model comprising human and systemic attributes related with goal congruence and information asymmetry, separately, was taken forward to SEM. This model returned low model fitment scores and hence two alternate models were tested. In the first alternative, the human attributes were related with goal congruence and systemic attributes were linked with information asymmetry. In the second alternative, the relationships of the first alternatives were retained and two alternate relationships were introduced - integrity was linked with information asymmetry and structural was linked with goal congruence. Both models are very close to good model fitment scores. However, the second alternative returned better results and hence, was chosen as the final outcome of the research. The model reflects that human attributes and systemic attributes are fairly independent in an effective information security framework, and drive goal congruence and information asymmetry, respectively. However, integrity is an important human commitment for ensuring information asymmetry and the right organizational structure and roles are important for ensuring goal congruence.