A Composite Risk Model for Optimizing Information System Security

Introduction

The task of strengthening information security poses a serious dilemma for universities. On the one hand, universities store valuable and personal information in their systems that must be protected diligently. On the other hand, universities are missioned with promoting inclusiveness, openness and the dissemination of information and knowledge (Doherty, Anastasakis, & Fulford, 2009; Mensch & Wilkie, 2011). Increased security protocols inevitably hinder these missions. Furthermore, being public institutions the challenges that universities face with information security are exacerbated by budgetary and regulatory constraints. The budget, therefore, must be used efficiently to pursue strategies and purchase technological tools that achieve the “best bang for the buck”.

In order to determine the optimal investment scheme while avoiding an overreaching security system, it is important for the security staff to identify the riskiest elements of their information system and determine the best tools to improve the security of these elements. Doing so provides the following benefits to the institution:

• 1.

  It enables the dissemination of academic knowledge without allowing malicious entities from exploiting this welcoming environment. This is achieved by strengthening security only on the riskiest and most sensitive modules, leaving the majority of the information system less restrictive to users;

• 2.

  It enables the information technology (IT) department’s management to place higher emphasis on the technological tools and security policies that affect mainly the components that are in the most need of improved security;

• 3.

  It allows university managers to use this knowledge to improve their understanding of the nature of the information-related threats that they face. For example, it is possible that student hacking and cheating may pose a bigger threat to the university than issues of propriety rights ownership (i.e. industrial espionage), people’s privacy and so forth.

The study described in this chapter has two main goals:

• 1.

  The first goal is to develop a two-step IT risk-management decision support model. This model emphasizes breaches and risks that are related to the human factor, with further stress on inside-users;

• 2.

  The second goal is to apply the decision support model to an academic institution in Israel to identify the security-related investment needs according to the model’s results. To achieve this goal, a two-step risk management model to identify the critical components of an academic institution’s information system is proposed. In the first step, the subsystems of the institution’s information system are identified with the riskiest subsystems further highlighted using a composite risk index model. In the second step, a mixed-integer optimization problem is developed. The goal of the problem is to determine the budget allocate that maximizes the IT security. The model is then applied in a technology-oriented academic institution and its output is used to help security managers identify the riskiest components of their system and decide on how to distribute their investment in improving their system security.

The main finding of the study is the practical recommendation of how to allocate investment among the menu of possible technological tools and workplace culture programs. In addition, two theoretical contributions can be made based on the results of the application. First, the results indicate that student-related hacking is a major security concern to the organization together with the more “traditional” risks motivated by monetary reasons. Second, by comparing the current investment scheme with the model’s recommended investment scheme the results suggest that security officers place more emphasis on technological tools rather than improve workplace culture.