Balancing software and training requirements for information security

Fujs, Damjan (author), Vrhovec, Simon (author), Vavpotič, Damjan (author)

Information security is one of the key areas of consideration to assure reliable and dependable information systems (IS). Achieving an appropriate level of IS security requires concurrent consideration of the technical aspects of IS and the human aspects related to the end users of IS. These aspects can be described in the form of information security requirements. We propose an approach that helps select and balance information security software requirements (iSSR) and information security training requirements (iSTR) according to the information security performance of end users. The approach was tested in an experiment involving 128 IS professionals. The results showed that using the proposed approach helps IS professionals with limited experience in information security make significantly better decisions regarding iSSR and iSTR.

• Language: English
• Keywords: cyber security, experiment, information security standard, requirements engineering, end user training, information security
• Work type: Article
• Typology: 1.01 - Original Scientific Article
• Organization: FRI - Faculty of Computer and Information Science
• Publication status: Published
• Publication version: Version of Record
• Year: 2023
• Number of pages: 13 str.
• Numbering: Vol. 134, art. 103467
• PID: 20.500.12556/RUL-152910
• UDC: 659.2:004
• ISSN on article: 0167-4048
• DOI: 10.1016/j.cose.2023.103467
• COBISS.SI-ID: 163668739
• Publication date in RUL: 11.12.2023

Record is a part of a journal

• Title: Computers & security
• Shortened title: Comput. secur.
• Publisher: Elsevier
• ISSN: 0167-4048
• COBISS.SI-ID: 5878279

Licences

• License: CC BY 4.0, Creative Commons Attribution 4.0 International
• Link: http://creativecommons.org/licenses/by/4.0/
• Description: This is the standard Creative Commons license that gives others maximum freedom to do what they want with the work as long as they credit the author.

Secondary language

• Language: Slovenian
• Keywords: kibernetska varnost, eksperiment, informacijskovarnostni standardi, inženirstvo zahtev, usposabljanje končnih uporabnikov, informacijska varnost