Blind information security strategy

I N T E R N A T I O N A L J O U R N A L O F C R I T I C A L I N F R A S T R U C T U R E P R O T E C T I O N 2 ( 2 0 0 9 ) 9 5 – 1 0 9

available at www.sciencedirect.com

journal homepage: www.elsevier.com/locate/ijcip

Blind information security strategy

Finn Olav Sveena,b, Jose M. Torresa,∗, Jose M. Sarriegia

a Tecnun (University of Navarra), Manuel de Lardizbal 13, 20018 San Sebastian, SpainbNISlab, Gjovik University College, 2802 Gjovik, Norway

A R T I C L E I N F O

Article history:

Received 7 November 2008

Received in revised form

8 June 2009

Accepted 27 July 2009

Keywords:

Information security strategy

System dynamics

Risk assessment

Learning from incidents

A B S T R A C T

How do enterprises relate to and manage information security controls? This paper

documents a study of twenty enterprises, six of them in the critical infrastructure (CI)

domain. The state of security in the CI enterprises differed little from that in the

other enterprises. Information security was seen as a technical problem with technical

solutions. However, vulnerabilities in processes and human fallibility create a need for

formal and informal controls in addition to technical controls. These three controls are

interdependent. They vary widely in implementation time and resource needs, which

render the task of building security resources a challenging problem. This paper presents

a system dynamics model that illustrates how security controls are interconnected and

are interdependent at a high level. The model is intended to aid security managers in CI

domains to better understand information security management strategies, especially the

complexities involved in managing a socio-technical system where human, organizational

and technical factors interact. The model also demonstrates how the knowledge gained

from proactive security activities can help managers improve the effectiveness of security

controls, risk assessments and incident detection capabilities.c© 2009 Elsevier B.V. All rights reserved.

d

1. Introduction

Security is a multifaceted problem encompassing both logicaland physical issues. Protection is no longer amatter of lockingthe door to leave out unwanted guests. Today, those “guests”enter through fiber optic cables. Technology simplifies ourlives and makes it more efficient. However, technologyevolves rapidly. New technologies are often unproven andpoorly understood even by the designers. Technology isfrequently deployed by people who only have knowledge ofthe technical principles behind it, and scarcely more thanthat. In such an environment there will always be weaknessesto exploit and implementing security will always be resourceintensive, as controls must be created, maintained andaudited to ensure that they are effective.

Information security, which is extremely vital in criticalinfrastructures (CIs) such as energy, transportation and

∗ Corresponding author. Tel.: +34 943219877.E-mail addresses: [email protected] (F.O. Sveen), jmtorres@tecn

1874-5482/$ - see front matter c© 2009 Elsevier B.V. All rights reservedoi:10.1016/j.ijcip.2009.07.003

un.es (J.M. Torres), [email protected] (J.M. Sarriegi).

health, always competes for resources. Information securitycannot be approached as a mere technological issue in thesecomplex systems in which technology, processes and peopleco-exist. Schneier [1] states: “If you think technology can solveall your security problems, then you neither understand theproblems nor the technology”.

The analysis and control of information security effortsin CIs are vital to improving the prevention, detectionand mitigation of vulnerabilities. Technologically-focusedCI security management strategies hide organizational andsocial issues that could, for example, create a formalvulnerability (e.g., not updating a security process) in one CIthat causes a technical vulnerability in another CI [2].

Security experts stress the need to understand the inter-dependencies between information security controls to suc-cessfully protect critical information infrastructures [3,4,1].

.

www.sciencedirect.com



http://www.elsevier.com/locate/ijcip

mailto:[email protected]



http://dx.doi.org/10.1016/j.ijcip.2009.07.003

96 I N T E R N A T I O N A L J O U R N A L O F C R I T I C A L I N F R A S T R U C T U R E P R O T E C T I O N 2 ( 2 0 0 9 ) 9 5 – 1 0 9

However, relatively little work has focused on the impact thatinterdependencies between security controls and their dy-namics have on security strategies [5,2]. A failure to under-stand these interdependencies and their dynamics can resultin ineffective security strategies that cause poor coordinationbetween decision makers and the individuals responsible forrescue, recovery and restoration after incidents.

This paper reports on the results of a survey of twentyenterprises in the Basque Country of Spain. Six of theseenterprises are in the CI domain—two banks, two hospitals,a military contractor and a food producer. Interviews wereconducted with information security professionals in eachenterprise. The goal was to discover the state of theirstrategic work with information security, the security modelsthey used and the drivers for security investments. Weinvestigated whether CI enterprises differed significantlyfrom non-CI enterprises. As discussed later in this paper, ourconclusion is that they do not differ significantly.

We consider the issue of whether or not enterprises havea security strategy in place to be very important. This showsif an enterprise is acting consciously in advance or merelyreacting to the circumstances it encounters. An informationsecurity strategy is like any other business strategy—it is theprocess of building up resources [6,7]. The real managementchallenge is to build and sustain resources, not simply toallocate resources [6,7]. From our point of view, informationsecurity controls are resources like any other resources.

We present a system dynamics (SD) model that showsthe interactions of information security controls and theconsequences for resource building. The model builds on theresource-based view and our empirical research. It attemptsto describe the situation within the surveyed enterprises.Also, the model suggests how information security effortsshould be redesigned to achieve a more comprehensiveapproach to information security. Our position is thatinformation security should be treated as a holistic qualityimprovement process. Investments in technical controlsmust be balanced with investments in formal and informalcontrols with special care given to knowledge creationprocesses.

SD is a modeling methodology for analyzing the structureof complex systems that generates their complex behavior[8,9]. This structure involves feedback, accumulation, andinformation and material delays. SD models can bequalitative or quantitative. The qualitative model of CIsecurity presented in this paper is the integrated result of theinterviews and a more comprehensive group model building(GMB) exercise conducted with the military contractor [10].

GMB is a methodology for collaboratively building SDmodels [11–13]. It is an effective way of de-fragmenting partialmental models found in representative multidisciplinaryteams. GMB usually takes the form of a series of facilitatedworkshops where subject matter experts and modelers worktogether to explore the problem under study and build amodel. A workshop consists of a series of exercises called“scripts” in GMB terminology. Each script attempts to elicitparticular pieces of information. Examples include elicitingstakeholders, eliciting reference modes, developing policysuggestions and developing model structure. GMB elicitspartial mental models, makes them explicit, combines them,

resolves conflicts and ambiguities, and creates new insightsand consensus. The result is new knowledge that is shared bythe participants.

Section 2 of this paper provides a brief overview ofthe data gathered from the twenty enterprises. Section 3describes the typical reactive information security strategythat we encountered at the enterprises. Section 4 discussesthe necessity of implementing formal and informal controlsin addition to technical controls; Section 5 details how thesecontrols are dependent on each other. Section 6 describeshow enterprises may move towards a more proactiveinformation security approach. Section 7 comments on therole of quality improvement systems in information security.The final section, Section 8, provides our concluding remarks.

Note that the terms security and information security areused interchangeably throughout the paper, always referringto information security and not other facets of security.

2. Overview of results

Table 1 summarizes the survey results. The participatingenterprises came from a variety of sectors ranging fromfinance to food production. They varied in size from 70employees to 12,300 employees. Each enterprise is assignedan identifier to preserve confidentiality. Six of the enterprisesfit the CI profile. CI01 and CI02 are banks; the current financialcrisis demonstrates the impact of financial institutionson society. CI03 is a military contractor; the theft ofsensitive information can impact national security. CI04is a government enterprise, which supports democraticinstitutions and makes decisions during crises. CI05 is ahospital; few services are more critical to society than healthcare. CI06 is a food producer; food is the most basic need ofsociety.

The interviews, which were conducted in 2005, weredesigned to collect information about: (i) security drivers inthe enterprises (i.e., why the enterprises needed securityand what initially made them consider security); (ii) typicalsecurity problems experienced by the enterprises; (iii)placement of the security function in the enterprises; (iv)security model used by the enterprises (e.g., if they use aspecific security model such as ISO 17799); (v) use of securityindicators by the enterprises to keep track of the state ofsecurity; and (vi) development, testing and use of contingencyplans by the enterprises.

The typical information security drivers were the intro-duction of new technology as a result of security incidentsand laws and regulations. With regard to technology, specificdrivers included various forms of remote access (e.g., elec-tronic data interchange (EDI) and Internet connections). How-ever, in the majority of the cases, it was not the introductionof new technology, but incidents experienced after its intro-duction that raised the awareness of security issues. Manyenterprises were also concerned with laws and regulationssuch as the Spanish Data Protection Law (LOPD) and the USSarbanes–Oxley Act (SOX). Other enterprises had clients, suchas the military, which required certain security measures tobe in place. A small number of enterprises considered secu-rity in advance on their own volition, and took the appropriatemeasures.

I N T E R N A T I O N A L J O U R N A L O F C R I T I C A L I N F R A S T R U C T U R E P R O T E C T I O N 2 ( 2 0 0 9 ) 9 5 – 1 0 9 97

Table1–Ove

rview

ofresu

lts.

IDSe

ctor

Staff

Initiala

ndprim

ary

secu

rity

drive

rsCom

mon

secu

rity

pro

blem

sOrgan

izationof

secu

rity

Secu

rity

mod

elFo

rmal

method

ofm

easu

rem

ent

Con

tinge

ncy

plan

CI01

Finan

ce15

00Con

cern

sab

out

pos

sibledisas

ters;

major

secu

rity

inciden

t(floo

dingof

server

room

)

Tech

nical

pro

blem

san

dresistan

cefrom

use

rs

Secu

rity

Dep

artm

ent;1

full-tim

ean

d4part-time

employe

es

Plan

ningce

rtifica

tion

Inform

almea

suremen

tson

lyto

justify

budge

tincrea

se

Effectivein

previou

scrises

CI02

Finan

ce28

0Im

por

tantse

curity

pro

blem

sth

atincrea

sedaw

aren

ess

Viruse

s,phishingan

dinform

ationin

widely-distributed

loca

tion

s

Within

theIT

Dep

artm

ent

Intern

alru

les

Extern

al(sco

red

88/10

0)an

dintern

alau

dits

Scor

ed80

/10

0in

extern

alau

dit

CI03

Military

contrac

tor

1300

Clien

t’srequirem

ents;

Introd

uctionof

remote

acce

ssan

dIn

tern

et

Viruse

s,lost

laptops

andinform

ation

leak

agedueto

pen

drive

s

Cen

tralized

,with

man

agem

entan

dIT

wor

kingtoge

ther

ISO

1779

9(close

toco

mpletion

ofce

rtifica

tion

pro

cess)

Mag

erit(risk

asse

ssmen

tmethod

)

Separateforea

chbr

anch

CI04

Gov

ernmen

t70

0Tran

sition

from

IBM

mainfram

eto

MS

Window

sintrod

uce

dpro

blem

s

Unsp

ecified

secu

rity

brea

ches

andlack

ofuse

raw

aren

ess

Within

theIT

Dep

artm

ent;so

ftware

dev

elop

men

tou

tsou

rced

Bas

edon

experience

andco

mmon

sense

Limited

extern

alau

dit;d

oesnot

wan

tce

rtifica

tion

,follow

sbe

stpractices

instea

d

Only

for

inform

ation

system

s

CI05

Hea

lth

service

NA

(150

PCs)

LOPD

andremote

acce

ssviaVPN

Prob

lemsse

curingan

dstor

inginform

ation

Within

theIT

Dep

artm

ent;lega

land

sometech

nical

aspec

tsou

tsou

rced

LOPD

asase

curity

mod

elNomea

suremen

ts,

butinciden

tsare

repor

ted

Only

forpatientfiles

CI06

Food

pro

duction

NA

Virusinciden

tsan

dIn

tern

etco

nnec

tion

sEx

tern

alattack

sth

atfollow

edmarke

ting

campaign

s;insider

attack

s

Within

theIT

Dep

artm

ent;50

%of

man

agem

entou

tsou

rced

ISO

1779

9use

das

agu

ide

Limited

intern

alan

dex

tern

alau

dits

withnorisk

asse

ssmen

ts

Plan

inplace

,butis

not

tested

byex

tern

alen

tity

O01

Res

earch

center

507

Introd

uctionof

remote

acce

ssan

dIn

tern

etUnau

thor

ized

use

ofco

mpan

yreso

urces

;ex

tern

alattack

san

ddifference

sin

use

rnee

ds

Within

theIT

Dep

artm

ent

Ownmod

elba

sedon

experience

and

common

sense

Intern

alrisk

asse

ssmen

t(bas

edon

ownex

perience

)withlimited

extern

alau

dit

Under

dev

elop

men

t,bu

tfocu

seson

preve

ntive

not

correc

tive

action

s

O02

Man

ufacturing

NA

Secu

rity

=an

ti-virus;

nostro

ngse

curity

drive

r

Poor

back

up

man

agem

ent

Within

theIT

Dep

artm

ent

Nomod

elNomea

suremen

tsIn

form

al,o

nly

base

don

back

ups

stor

edat

staff

mem

ber’shom

eO03

Enginee

ring

NA

Hired

apen

etration

tester

(did

not

divulge

why)

whoga

ined

full

system

acce

ss

Viruse

s,sp

aman

dth

eftof

equipmen

tW

ithin

theIT

Dep

artm

ent

Bas

edon

experience

andco

mmon

sense

,withex

tern

alsu

ppor

t

Nomea

suremen

tsNoform

alco

ntinge

ncy

plan,

only

daily

back

ups

O04

Maintenan

ceof

mac

hines

andth

een

viro

nmen

t

NA

Introd

uctionof

remote

acce

ss(Intern

etan

dED

I)

Inform

ationloss

Outsou

rced

;rep

orts

direc

tlyto

upper

man

agem

ent

Intern

ally-d

evelop

edmod

eldes

igned

toco

mply

withLO

PD

Nomea

suremen

ts,

butwillintrod

uce

limited

mea

suremen

tsin

thefu

ture

Noform

alco

ntinge

ncy

plan,

only

back

ups

(con

tinu

edon

next

page

)


Table1(con

tinued

)

IDSe

ctor

Staff

Initiala

ndprim

ary

secu

rity

drive

rsCom

mon

secu

rity

pro

blem

sOrgan

izationof

secu

rity

Secu

rity

mod

elFo

rmal

method

ofm

easu

rem

ent

Con

tinge

ncy

plan

O05

Enginee

ring

and

Man

ufacturing

2000

Introd

uctionof

remote

acce

ssan

dco

nce

rns

abou

tpos

sible

inciden

ts

Inform

ationloss

and

man

agem

entof

back

ups

Within

theIT

Dep

artm

ent

Ownmod

elba

sedon

experience

and

common

sense

(bas

ically

back

ups)

Nomea

suremen

ts,

butfu

ture

extern

alau

ditis

planned

Intern

ally-

dev

elop

ed,u

ntested

plan

O06

Man

ufacturing

5800

Merge

dwith

intern

ational

compan

ywhichpush

edse

curity

Isolated

viru

ses

Within

theIT

Dep

artm

ent

Bas

edon

experience

andLO

PDIn

form

alpro

cedures;

limited

extern

alau

dits

Only

forER

Psy

stem

O07

Bro

adca

sting

925

Branch

esco

nnec

ted

vianetwor

ksan

dLO

PDIsolated

viru

sesan

dunau

thor

ized

use

ofco

mpan

yreso

urces

Within

theIT

Dep

artm

ent

Ownmod

elba

sedon

experience

and

common

sense

Inform

altrac

king

ofpolicy

complian

ce

Noform

alplan,b

ut

oneis

being

considered

O08

Man

ufacturing

12,300

Inciden

tsex

perience

dby

competitor

san

dpressure

from

the

mainUSoffice

Only

isolated

viru

ses

Within

theIT

Dep

artm

ent;2ded

icated

system

sad

ministrator

s

Bas

edon

SOX

Noge

neral

secu

rity

indicator

s,bu

tex

tern

alau

ditto

trac

kSO

Xco

mplian

ce

Plan

foralla

ssets

aimed

atreco

very

within

24h

O09

Man

ufacturing

225

Introd

uctionof

remote

acce

ssan

dincrea

sing

dep

enden

cyon

inform

ationsy

stem

s

Viruse

san

dinform

ationleak

age

byem

ploye

es

Within

theIT

Dep

artm

ent

Bas

edon

experience

,co

mmon

sense

and

back

ups

Only

keep

strac

kof

viru

ses

Noco

ntinge

ncy

plan,o

nly

men

tal

mod

el

O10

Man

ufacturing

250

Pres

sure

from

the

mainUSoffice

Chan

gein

pro

cesses

andmen

tality

Multidisciplinaryteam

repor

tingto

CSO

Bas

edon

SOXan

dISO

1779

9Con

trol

ofac

cess,

butnoform

almea

suremen

ts

Holisticplan

focu

sedon

shor

t-an

dlong-term

correc

tive

mea

sures

O11

Res

earch

Institution

200

System

updatean

dse

curity

pro

blem

sViruse

s,phishingan

dac

cess

control

Within

theIT

Dep

artm

ent

Ownmod

elba

sedon

ISO

1779

9In

ciden

trepor

ting

system

Noco

ntinge

ncy

plan,o

nly

amen

tal

mod

elO12

ITse

rvices

150

LOPD

andclient

requirem

ents

(con

fiden

tialityan

dintegrity)

Nomajor

pro

blem

sex

perience

dW

ithin

theIT

Dep

artm

ent

Bas

edon

ISO

1779

9In

ciden

trepor

ting

system

Noco

ntinge

ncy

plan,o

nly

anou

tline

O13

Enginee

ring

and

man

ufacturing

70In

trod

uctionof

remote

acce

ssProb

lemswithviru

ses

(serve

rsan

dem

ail)

Outsou

rced

Totallydep

enden

ton

thesu

bcon

trac

tor

Nomea

suremen

tsof

general

secu

rity;

Subc

ontrac

torhas

aninciden

trepor

tingsy

stem

Noco

ntinge

ncy

plan,o

nly

amen

tal

mod

el

O14

Res

earch

institution

225

Cen

tralizationof

inform

ation

Viruse

s,slow

reco

very

from

back

upsan

dlow

use

raw

aren

ess

Within

theIT

Dep

artm

ent

Ownmod

elat

anea

rly

stag

eof

dev

elop

men

tNomea

suremen

tsCon

tinge

ncy

plan

foralla

ssetsba

sed

ontotalq

uality

man

agem

ent


The most common security problem was viruses, followedby theft and equipment loss. A few enterprises cited problemsposed by the lack of employee security awareness and backupmanagement.

The security function in almost every enterprise waslocated within the IT Department. Only CI01 and CI03 hadseparate departments while O10 used a multidisciplinaryteam with representation from several departments. Manyof the enterprises outsourced a portion of the securitymanagement function; in some cases, the entire securityfunction was outsourced.

Six enterprises used ISO 17799 (renamed as ISO 27001)as a reference model for security; of these enterprises, onlyCI03 employed a certification process. Five enterprises usedLOPD or SOX as guides; one enterprise used a security modelbased on ISO 17799 and LOPD. The remaining enterprisesused security models based on common sense and pastexperience. Only seven of the twenty enterprises conductedinternal or external audits.

Most of the enterprises stated that they either did notmeasure the state of security, or did so informally or onlymeasured certain aspects of security. Two enterprises hadincident reporting systems, but did not implement any othersecurity indicators.

Eight of the twenty enterprises did not have formalcontingency plans. Two had contingency plans related to veryspecific issues. The other enterprises had more holistic plans,but not all of them had tested their contingency plans.

From a holistic perspective, it appears that the typicalenterprise in our study focused on the most salient securityissues and these were the primary drivers behind security.The most salient issues are related to previous securityincidents or external requirements imposed by clients or lawsand regulations. A technical view on security was the mostpredominantly held position. The majority of the enterprisesplaced the security function within the IT Department.No enterprise was certified according to a national orinternational standard, and one enterprise was undergoing acertification process. Most of the enterprises were aware ofISO 17799 but considered it too complex for their use; thus,the standard was not fully implemented and was only used asa reference. Furthermore, very few of the enterprises actuallymeasured the state of security; the prevailing attitude wasthat problems would be fixed if and when they arose.

Did the CI enterprises differ significantly from the non-CIenterprises? All the enterprises had contingency plans andfour of them had holistic plans. No enterprise was certifiedaccording to an external security management standard,although one was close to being certified. Two enterprisesdid not perform any internal or external audits. All buttwo enterprises placed the security function within the ITDepartment. The CI enterprises reported the same securityproblems as the non-CI enterprises.

Overall, the state of security in the CI enterprises wasmarginally better than that in the other enterprises. However,there was little difference with regard to security drivers(previous incidents, pressure from clients, and laws andregulations). This had some unfortunate consequences. Forexample, the healthcare enterprise focused exclusively onpreserving the confidentiality of patient data as dictated by

LOPD. Security meant satisfying LOPD; key issues such asintegrity and availability were almost completely ignored.

The CI enterprises followed the same pattern of develop-ment as the other enterprises. They went through four dis-tinct phases (described in detail in [14]). The phases are: (i)Growth, where the use of information systems is increasing,but the enterprises are not yet dependent on them and thereis no coherent security strategy; (ii) Integration, where the en-terprises depend on information systems, but they are in achaotic state after the rapid growth phase; the informationsystems are consolidated and centralized, and attention ispaid to security, but primarily on technical controls; (iii) For-malization, in which the increasing number of security con-trols in the integration phase makes them harder to manageand security administrators recognize the need to formallymanage the controls; (iv) Involvement, in which the enter-prises recognize that the users are both an obstacle and a keyto achieving security, and security is expanded to include userawareness training and similar issues. Very few of the enter-prises surveyed had reached the involvement phase.

The next section describes a typical enterprise using asimplified SD model. The model is based on the interviewresults and an in-depth GMB exercise with CI03. Existingtheory is used to fill in the gaps where needed.

3. Reactive information security perspective

Asmentioned in the previous section, the enterprises focusedon the most salient security issues. Thus, if incidents areinfrequent, security will most likely not have high priorityuntil a serious incident happens. The variables IncidentFrequency and Incident Severity, and Impact are associated withthe incidents suffered by an enterprise and the consequencesof the incidents, respectively.

The (+) sign next to the arrow from Incident Frequency toImpact expresses the notion that an increase in the frequencyof incidents increases the impact suffered by the enterprise.The same relationship applies in the opposite direction—fewer attacks lead to less impact. Therefore, a change inIncident Frequency causes a change in Impact in the samedirection. This also applies when Incident Severity is changed—higher severity implies a greater impact and vice versa.

The impact also depends on the degree to which anenterprise is vulnerable. The Actual Security Gap representsthe discrepancy between the defensive measures and thesophistication of the threats that exist in the environment.If the Threat Sophistication increases, the Actual Security Gapwidens, potentially increasing the Impact because incidentsoccur with a higher probability. The actual Impact sufferedalso depends on Incident Severity.

Incident Frequency, Incident Severity and Threat Sophisticationare not constants. The discovery of new vulnerabilities andthe development of new attack methods ensure that singleshot solutions will only be temporary.

An enterprise can reduce the Actual Security Gap throughsecurity controls. More Security Controls in Place diminishes theActual Security Gap, which is represented by the (–) sign nextto the arrowhead. Fewer Security Controls in Place increases the


Fig. 1 – Reactive security.

Imapct (EUR/Year)

High

Low

Time(Years)

Imapct (EUR/Year)

High

Low

Time(Years)

Fig. 2 – Perception of security by management.

gap. The (–) sign denotes a causal influence in the oppositedirection.

An enterprise with a security gap is likely to sufferincidents. However, a single, small incident is not enoughto significantly change an enterprise’s perception of security.Many small incidents over time or a few large incidentsin a short time may cause a change in the management’sperception of security (Fig. 2). One of the typical problemsfaced by the surveyed enterprises was viruses, a problem thatwas prominent in 2005 and had been building for some time.However, only a few enterprises had experienced a completework stoppage due to a virus. When the losses are small, itis the perception of the accumulated losses over time thatcounts (right-hand side of Fig. 2). Some of the enterprises hadexperienced larger incidents (e.g., flooding of the server roomat CI01). This immediately raised the awareness of securityissues. Fortunately, the enterprise was not totally unpreparedand followed its contingency plan, enabling operations to berestored within 24 h. The immediate appreciation of the needfor security is illustrated in the left-hand side of Fig. 2.

In the model in Fig. 1, the perception of the state ofsecurity is represented by the link from Impact to DetectedImpact to Perceived Impact Trend. The vertical mark on thearrow denotes a time delay. As explained above, perceptionschange quickly only when serious, high impact incidents

occur. Normally, perceptions are adjusted over time. Hence,the Perceived Impact Trend is negatively affected by the Time toChange Perception of Impact Trend (i.e., the influence is in theopposite direction). If the Time to Change Perception of ImpactTrend increases, the Perceived Impact Trend will take longer toadjust to the Impact. The opposite is also true: a decreasecauses the Perceived Impact Trend to be adjusted faster.

An incident makes an enterprise painfully aware of itssecurity shortcomings. If a large Perceived Security Gap isidentified, more Security Resources are allocated to acquirenew security controls. After a decision is made about thenew security controls (represented by the Initiation Rate), thecontrols must be implemented, which always takes time.This situation is represented in the model by the controlsfirst residing in the Initiated Security Controls and then beinggradually moved over to Security Controls in Place at a speeddecided by the Implementation Rate. The double-lined arrowsdenote flows. The two triangles facing each other on each sideof the double-lined arrows is a stylized valve, which expressesthe ability of the influencing variables to control the rate. Thecloud symbols at the beginning and end of a flow expressthe fact that the controls come from outside sources anddisappear into outside sources when they are no longer used.

When security controls are in place, they prevent incidentsfrom occurring and/or reduce their impact. Thus, we have aclosed feedback loop named Reactive Security (B1). This is abalancing or goal-seeking feedback loop. In this case, the goalof the loop is the Desired Security Level, which expresses therisk acceptance of the enterprise. The lower the risk appetite,the higher the desired security level. If the security levelis perceived to be different from the desired security level,resources are adjusted until a satisfactory level is reached. Animportant consequence of this loop is that the security levelis perceived indirectly. As long as nothing is happening, thesecurity level is perceived to be adequate.

Another consequence of B1 is that if security resourcesare increased in response to incidents, the resources


gradually reduce over time unless incidents occur frequently.Additional (and better) controls reduce the impact ofincidents that over time cause management to perceive thesecurity level as higher than necessary. As mentioned above,there is some inertia in the system: it takes time before thelower risk is perceived through the Perceived Impact Trend.

The loops B2 and B3 act as brakes. The implementationof additional security controls increases costs, which slowsdown the initiation rate of new controls. The moststraightforward and least expensive controls are usuallyimplemented first. As controls become more advanced, theimplementation and maintenance costs increase.

If security strategies are reactive, only the absoluteminimum security level is maintained under the normalcondition of infrequent incidents. It is only when an incidentoccurs that management and staff begin to pay attention.This is natural as they perceive the security level almostexclusively through incidents that have occurred. Whenauditing and risk assessment mechanisms are not in place, itis difficult to tell if the enterprise has a good security postureor is just lucky. The majority of the enterprises intervieweddid not have such mechanisms in place.

Another serious deficiency is that the enterprises invari-ably lag behind developments in the threat environment. Newvulnerabilities are discovered continuously, new attack meth-ods are always being developed, and the frequency and sever-ity of attacks change. It takes time to implement securitycontrols. Waiting for an attack to occur before implementingsecurity controls is equivalent to deliberately leaving the doorto a home open.

4. Security is a complex system

Securing information systems is a complex task that requiresthe implementation of three types of security controls:technical, formal and informal controls [15,16,5]. Someauthors have proposed classifications using different terms(e.g., technology controls, process controls and humancontrols [17]) to refer to similar security controls. In this paper,we use the terms, technical, formal and informal controls,which are defined as follows:

Technical controls: These controls include hardware andsoftware tools that restrict access to buildings, rooms,computer systems and programs in order to prevent improperuse. Examples of technical controls include biometric devices,locks, anti-virus software, firewalls and intrusion detectionsystems.

Formal controls: These controls comprise policies andprocedures that manage the access to and use of information.Formal controls include policies and procedures thatestablish and ensure the effective use of technical controls.Examples of formal controls include system audits, updatemechanisms, risk assessments, identification of securityroles, segregation of responsibilities and implementation ofindicators.

Informal controls: These controls involve actions related todeploying information security in the workforce by creating asecurity culture. Examples of informal controls include train-ing employees, implementing security incentives, increasingthe commitment to security and motivating users.

This trinity of security controls is necessary to achievehigh security performance, especially because the controlsare hierarchically dependent on each other (Fig. 3). A failurein one type of control may open up holes in another.

Unfortunately, the surveyed enterprises based theirinformation security practices almost entirely on technicalsolutions. Practically all the surveyed enterprises located thesecurity function within the IT Department. This is mostlikely a consequence of the technical nature of securityincidents such as virus/worm infections and denial-of-serviceattacks, which have positioned technological solutions overmanagerial solutions.

It is important to note that information security alsoinvolves non-technical aspects. Detecting malicious insidersmay require psychological profiling [18]. A security breachmay lead to legal action against the enterprise as well as theperpetrator. Anderson [19] states: “All the really large frauds– the cases over a billion dollars – have involved lax internalcontrols”. He goes on to cite examples such as the collapseof Barings Bank. Single vector approaches are no longeradequate to counter today’s diverse threats [20]. Securitydepends on well-functioning multidisciplinary teams [3].

The current situation is also reinforced by the fact thatsecurity personnel usually have strong technical backgroundswith limited management expertise. This is a naturalconsequence of the security function being located withinthe IT Department. Only one of the surveyed enterpriseshad a multidisciplinary team that reported directly to uppermanagement. Systems administrators usually fill the securitymanager role. However, they primarily see themselves astechnicians and, therefore, may not hone their analytical,managerial and interpersonal skills. These skills are vital toimplementing formal and informal security controls [17].

A further complication is that implementing and main-taining controls are not straightforward. Each category of con-trols differs from the others in the time it takes to implementthem, how often theymust be renewed, reinforced or audited,as well as the attack mechanisms used to penetrate them.This level of complexity makes it extremely difficult to man-age security. In particular, three loops (B1, B4 and B7) appearin Fig. 3, which expand the security challenge.

Technical controls (e.g., firewalls) are implementedrelatively quickly and often provide immediate resultscompared with formal and informal controls. In other words,the Time to Implement Technical Controls has a low value(minutes, hours or days) comparedwith, for example, trainingusers to defend against social engineering threats, which cantake months or years.

Formal controls (e.g., implementing a system to measurethe effectiveness of security controls) require longer imple-mentation times. It may also take some time before the con-trols become effective and are perceived as being effective. Inother words, the Time to Implement Formal Controls has a highervalue than the Time to Implement Technical Controls.

Informal controls (e.g., launching a security awarenesscampaign, explaining the needs and benefits, and gettingthe workforce involved) are difficult to implement and oftentake a substantial amount of time. The goal of an enterpriseis not to implement perfect security, but to provide goodsand/or services. Thus, business pressuresmay delay or negate


Fig. 3 – Trinity of security controls.

attempts at improving security [21]. As such, the Time toImplement Informal Controls has a higher value than both theTime to Implement Formal Controls and the Time to ImplementTechnical Controls.

Building a security culture can take years. Although,technical controls are normally the fastest to implement,they are also the controls that become obsolete most rapidlyand have to be renewed most frequently. In general, formaland informal controls last longer than technical controls.Informal controls contribute to the creation of a “securityculture” where employees take security into account intheir daily work and not just as an afterthought. Thisrequires a change in the mindset of employees and, crucially,of management because management sets the precedent.Instituting a security culture is critical as it impacts theother two classes of controls. In the absence of a securityculture, formal controls may just be words on a piece of paper.Although informal controls are the most expensive and timeconsuming to implement, they last much longer than othercontrols. But they do depreciate—a security culture that is notsupported by the enterprise quickly withers and dies.

Our discussion of security controls is based on commonknowledge in the information security field. Nevertheless,very few of the surveyed enterprises followed a holisticstrategy that included all three classes of security controls;themajority only focused on salient security issues. The three

classes of security controls can be further analyzed bymakingdistinctions within each security control (e.g., controlsagainst internal and external attacks, and controls againstdeliberate attacks and accidents). For the purpose of thispaper, it is not necessary to go into more detail aboutsecurity controls, but it is very important to understand theirinterdependencies.

5. Interdependencies between security con-trols

Technical controls depend on formal controls in order tofunction. Formal controls depend on informal controls tofunction well. For example, password protection is uselessif the password is written on a Post-It note that is stuck tothe monitor. Password access control is a technical measure;sticking the password to the monitor is a breach of formalcontrols.

Formal instructions should be in place to guide users aboutsafe and appropriate behavior. Without such instructions,a lack of user awareness cannot be blamed for a securitybreach; the lack of formal controls is the real reason forthe breach. However, if formal instructions are in place, theuser’s lack of understanding about why a password shouldnot be stuck to a monitor (an informal control) is the direct


Fig. 4 – Hierarchical interdependence of security controls.

cause of the breach. When a formal control is undermined,the error propagates upwards, rendering the technical controlineffective. This hierarchical dependence of security controlsis shown in Fig. 4.

Two more loops thus exist in addition to the threeloops shown in Fig. 3 (B1, B4, B7). These two loops,which significantly affect the ultimate goal of the system(decreasing the impact) are: Technical Depends on Formal (B10)and Formal Depends on Informal (B11) (see Fig. 4). The directlinks from Informal Security Controls and Effective Formal SecurityControls to Actual Security Gap represent defenses against theimpact suffered from non-technical incidents. The attackermay, for example, use impersonation to gain confidentialinformation. However, even if an incident is purely technicaland technical controls are in place, an attackmay still succeedbecause of inadequate formal controls. An example is whenthe failure to install a patch allows a worm to infect thesystem. A low-tech example is a simple door lock. To open thedoor an attacker can attack the technical defense by pickingthe lock. A second option is to attack the formal layer—sloppy key management may allow access to the key. A thirdpossibility is for the attacker to target the informal layer byusing social engineering to have someone with access openthe door.

The effectiveness of implemented technical controls canbe extended and improved by robust formal controls (B10).Likewise, informal controls ease the implementation offormal controls, extending and improving their effectiveness

(B11). A house can be used as a metaphor to explainthis dependency. The informal controls provide a strongfoundation. Formal controls are the load-bearing walls thatare built on the foundation and support the roof, whichconstitutes the technical controls. The foundation, wallsand roof of the house mutually support each other toprovide shelter from rain, wind and cold (i.e., attacks and/orincidents).

Unfortunately, security controls are often viewed asindependent layers where the first line of defense is technicalcontrols. Enterprises usually start by implementing technicalcontrols, followed by formal controls and then barelyimplement informal controls. Informal controls require themost effort and the longest implementation time; this (atleast partially) explains why enterprises often build their“security houses” starting with the roof (technical controls),followed by the walls (formal controls) and leave thefoundation (informal controls) for last.

The difficulty of building strong informal controls (e.g., asecurity culture) is widely recognized. This has led to variousattempts to compensate by building very strong formalcontrols as evidenced by the large number of informationsecurity standards (e.g., ISO 27001:2005 and COBIT). However,implementing strong formal controls is not possible withoutimplementing strong informal controls. There is a differencebetween what is written in the standards and what is actuallyimplemented in enterprises. Moreover, the absence of asecurity culture can sabotage attempts at introducing strong


Technical

Formal

Informal

Fig. 5 – Critical infrastructure security strategy.

formal controls. Compensating for a weak foundation bybuilding thicker walls simply does not work.

We are certainly not advocating a pure bottom-upsecurity approach. Enterprise assets would be vulnerable(albeit somewhat less vulnerable) if very strong informalcontrols were to be implemented without any technical andformal controls. Instead, we stress the importance of payingsimultaneous attention to all three types of controls and toconsider the long-term view. A failure to assign resourcesto build and maintain any of the three types of securitycontrols could result in severe consequences in the futureas the system becomes more susceptible to attacks. Thissecurity approach [2] is based on the assumption that if anattacker identifies and exploits a single vulnerability in any ofthe three controls (the holes in the piece of cheese in Fig. 5represent vulnerabilities), then the enterprise asset could beseverely compromised.

6. Proactive information security perspective

Most of the surveyed enterprises operated in a reactivemode and focused only on the salient security issues. Afterdiscussing the consequences of a reactive security strategy,its complexity and the interdependencies between controls,the fundamental question is: How do we change the securitystrategy to be proactive in nature? We turn to existing theoryto answer this question; where appropriate, we also draw onsources outside the information security domain.

An attractive proactive strategy is to identify vulnera-bilities in advance instead of waiting for them to revealthemselves through incidents. Many enterprises conduct riskassessments to create a better foundation for decision mak-ing. A risk assessment is defined as “an objective analysis ofthe effectiveness of current security controls that protect anorganization’s assets and a determination of the probabilityof losses to those assets” [22].

According to Landoll [22], an information security riskassessment provides the following benefits: (i) checks andbalances: the architects of an information security programand the administrators of the security controls are too closeto the decisions that have been made, and may not beable to perform an objective analysis; (ii) periodic review:

the effectiveness of a security program must be measuredand adjusted based on the changing threat environment andbusiness mission; and (iii) resource allocation based on riskto assets: unless the enterprise understands the risk it faces,resources may be expended in areas where they do little or nogood.

The loop B12 in Fig. 6 illustrates this aspect. (Toavoid complexity, the three classes of security controls arecollapsed into one.) Internal or external risk assessmentsenable an enterprise to discover the Actual Security Gapwithout having to suffer from incidents. The more often riskassessments are performed, the quicker the real security gapis perceived. This is represented by the negative polaritylink from Time to Perceive Security Gap to Perceived SecurityGap from Risk Assessment. B12 is a goal-seeking loop withthe same goal as B1 (Desired Security Level). However, becauseperceiving the security gap involves anticipating the futurewhile contextualizing history, the perception of the state ofsecurity in the enterprise should be more accurate than apure reactive approach.

A forward-looking enterprise that regularly performs riskassessments gains other benefits as well. By implementingsecurity controls in advance, the detection capability isimproved because the enterprise has a better idea ofwhat to look for. From a practical perspective, this caninclude installing an intrusion detection system with amore specific configuration. In the model, this dynamic isrepresented by the loop Detection (R1). As Security Controlsin Place increases, the Detection Capability also increases,resulting in an increase in the Detected Impact. Although,major incidents are usually detected, small incidents suchas port scans may pass under the radar. Small incidents areseemingly insignificant, but they serve as an early warningsystem. As the detection capability of an enterprise increases,it detects more incidents (i.e., Detected Impact increases)and the Perceived Impact Trend improves, and with it, thePerceived Security Gap. The enterprise should then be able tomake informed decisions about security investments (SecurityResources) and the controls to implement. R1 is a reinforcingloop where the enterprise continually improves and adaptsits security controls according to the threat environment.This is necessary because the Threat Sophistication continuallyincreases [23].

In general, a proactive security approach also enhancesreactive mechanisms. A risk assessment activates loop B12,which puts the minimum of security controls in place. Thisactivates the reinforcing loop R1 via an improved detectioncapability due to the security controls implemented as aresult of the risk assessment.

7. Quality improvement

Due to the rapidly changing threat environment [23], securitycontrols rapidly become obsolete. Security must, therefore,be treated as a continuous process [1]. Some informationsecurity management standards have adopted the Plan-Do-Check-Act (PDCA) cycle from the domain of qualitymanagement. An example is ISO 17799 [24], which hasbeen renamed as ISO 27001 (Control Objectives) and ISO


Fig. 6 – Proactive security strategy.

27002 (Controls). Calder and Watkins [24] state that “theISMS [information security management system] should beintegrated with the quality assurance system to the greatestextent possible”.

Calder and Watkins [24] describe the PDCA cycle asfollows. The first stage (Plan) has eight steps: (i) define thescope of the ISMS; (ii) define the information security policy;(iii) define a systematic approach to risk assessment; (iv)conduct a risk assessment to identify (within the context ofthe policy and the ISMS scope) the important informationassets of the enterprise and the risks to them; (v) assess therisks; (vi) identify and evaluate options for the treatment ofthe risks; (vii) select the control objectives and controls to beimplemented for each option; and (viii) prepare a statementof applicability.

The second stage (Do) has five steps: (i) formulate a risktreatment plan and its documentation; (ii) implement therisk treatment plan and the planned controls; (iii) initiatethe appropriate training for the affected staff and awarenessprograms for the workforce; (iv) manage operations in linewith the ISMS; and (v) implement procedures that enable theprompt detection of and response to security incidents.

The third stage (Check) involves the continuous monitor-ing, review, testing and auditing of the ISMS and the securitycontrols.

The fourth stage (Act) requires management to reviewthe ISMS, and the testing and auditing outcomes regularly.Improvements to the ISMS should also be identified,documented and implemented.

The PDCA cycle represents a continuous, incrementalapproach to quality improvement. It includes not only theimplementation of appropriate controls, but subsequentfollow-ups to: (i) check that the controls work as intended;(ii) improve the controls, and (iii) check that the controls arestill sufficient and appropriate. This is a fundamental andnecessary starting point to operate in the current challengingsecurity environment.

Although standards are a good starting point, anenterprise should go beyond standards to achieve continuousquality improvement [25]. Standards are sanctioned bynational and international bodies, and approval times canbe lengthy. Hence, standards tend to lag behind the latestdevelopments in their fields. In order to succeed, enterprisesshould therefore become learning enterprises [26].

Risk assessments can provide a foundation for continuousimprovement. They should be conducted at regular intervalsand care should be taken to learn as much as possible fromthem. The outputs of a risk assessment provide a basis forselecting and implementing security controls; they also serveas important inputs for the next risk assessment. Landoll [22]describes several secondary benefits: (i) transfer of knowledgefrom the risk assessment team to the enterprise staff; (ii)increased communication about security issues betweenbusiness units (security is multidisciplinary and potentiallytouches all the business units in an enterprise); and (iii)increased security awareness within the enterprise.

The enterprises in our study did not appear to appreciatethis wisdom. The majority of the enterprises did not carry outinternal or external risk assessments. Only two of the six CIenterprises (CI02 and CI03) performed risk assessments.

Fig. 7 models the risk assessment process as a learningmechanism. If the Perceived Security Gap from Risk Assessmentincreases, the enterprise learns more and the Learning Rateincreases. The body of information security knowledge inthe enterprise also increases, which enhances the perceptionof the security gap (i.e., the Perceived Security Gap from RiskAssessment increases if it is less than the Actual Security Gap).These variables form the loop Learning from Risk Assessment(R2), which continually reinforces the ability of the enterpriseto detect security gaps.

A second learning mechanism is an effective incidentlearning system. It is not a given that the implementedcontrols will actually work [17]. Routines and instructionsshould, therefore, be in place to identify incidents that occurdue to missing or ineffective controls. This is not unique to


Fig. 7 – Quality improvement process.

security. Industrial safety incident learning systems providevaluable feedback on which controls actually do work [27].One successful incident learning system is NASA’s AviationSafety Reporting System, which logs information aboutthousands of incidents every year. Every report is analyzedand the information is distributed to airline companies,aircraft manufacturers, airport authorities and regulators,enabling them to improve operations and equipment [27].Aviation incidents still do occur, but enterprises that useaviation incident learning systems perform better than thosewho do not. A poorly-functioning national reporting systemin Taiwan may be one reason why its accident rate is higherthan that in the US and Western Europe [28].

Only two of the surveyed enterprises explicitly mentionedthat they had incident reporting systems. A large majority ofthe interviewees stated that they did not believe in perfectsecurity, but they did not take the logical next step. If perfectsecurity is impossible to achieve, an incident will occursooner or later. Enterprises must, therefore, have incidentreporting systems and contingency plans in place. Thesurveyed enterprises either did not have contingency plansor had very limited plans. The reinforcing loop Learning fromIncidents (R3) represents the process of knowledge creationand acquisition from incidents. Increased Detection Capabilityleads to a higher Detected Impact. If detected incidents areinvestigated properly, they add to the enterprise’s knowledgebase. A higher Detected Impact increases the Learning Rate,which increases the Security Knowledge and, ultimately, theDetection Capability of the enterprise.

R2 and R3, together with B13 and B14, represent thecontinuous quality improvement process in our model. Thelearning processes are fundamental, but R2 and R3 are notactivated automatically; they require conscious, deliberateactivities aimed at learning and capturing knowledge. Wehave little evidence of successful quality improvement inthe field of information security; in fact, there is evidencethat the opposite is taking place. In their study of computersecurity incident response teams (CSIRTs), Killcrece et al. [23]

state: “Because of the amount of detailed work done byincident handlers and the increasing work loads, manyof the authors of the books and articles reviewed in theliterature identified staff burnout as a problem for CSIRTs”.In the surveyed enterprises, the security administrators wereprimarily the systems administrators and also held incidenthandling responsibilities. Their potential workload was veryhigh, causing them to focus on issues that were perceivedas most important in a short-term perspective. As far asincident handling was concerned, their task was to get thesystem up and running as soon as possible. The majority ofthe enterprises surveyed did not prioritize debriefs and otherquality improvement activities. Many CSIRTs may not be inan ideal situation, but at least they have dedicated incidenthandling resources.

An environment such as that described above is notconducive to learning. The seminal work of Nonaka andTakeuchi [29] shows that new knowledge is created via asocial process of interaction. In an environment where theemployees are overworked there is less time for interactionand common reflection on problems. Other improvementactivities, such as creating software tools to aid employees,are also difficult to accomplish [30]. This has lead to theprevalence of ad hoc solutions.

One mechanism that can work to the detriment ofquality improvement systems has been described by Wiik,et al. [30] in the information security domain and byRepenning and Sterman [31] in the process improvementdomain. Wiik, et al. [30], who have studied a CSIRT for a majorEuropean research network, describe how it can fall intoa “capability trap”. Working harder to alleviate short-termpressures takes resources away from long-term improvementefforts. The team falls into a “vicious circle” (or cycle),where resources are continuously moved from long-termimprovements to cope with short-term pressure. The lackof long-term improvements over time increases the short-term pressure. Wiik, et al. have shown that the solutioninvolves a worse-before-better scenario, which makes an exit


from the vicious circle all the more difficult. After studyingthe CSIRT literature, Gonzalez [32] states: “One might safelyconclude that inmany CSIRTs reactive fire-fighting dominatesto the detriment of proactive work and security qualitymanagement services”.

CSIRTs only represent a part of the information securitysolution, but in enterprises where the incident handlingteam is overworked, it is likely that the general informationsecurity team is also overworked. Our own research supportsthe hypothesis that the staff in most Information SecurityDepartments are overworked. Indeed, in smaller enterprises,the Information Security Department may have just oneindividual who has to handle all security-related matters inaddition to a long list of other chores. A common responseis: “We have a firewall, a logging system, anti-virus softwareand an intrusion detection system. All of them provide veryinteresting information... but I have no time to analyze it!” [33]

Enterprises in other fields have had more success. Busi-nesses that succeed in implementing total quality man-agement programs invariably outperform their competitors[34–37]. The seminal work by Repenning and Sterman [31]on process improvement has shown that most of the prob-lems encountered are due to internal dynamics, not exter-nal causes. The other lesson from Repenning and Stermanis that in order to implement an effective security learningprogram, the environment in which the program will operatemust be taken into account. This leads us to believe that itis possible to implement effective information security qual-ity improvement programs in enterprises. Note, however, thatimplementing such a quality improvement program may bedifficult because security often interferes with business pro-cesses, which could cause the program to be disregarded (oreven undermined) by managers and staff [38].

In cases such as those outlined above, R2 and R3 operate asvicious circles. For example, a reduced Detected Impact impliesa reduced Learning Rate, which leads to a small increase inSecurity Knowledge. This leads to small increase in DetectionCapability and, thus, a lower Detected Impact because the threatenvironment is continuously evolving.

R2 and R3 represent learning processes that enable anenterprise to perform better risk assessments and detectmore incidents; also, the knowledge gained as a result ofthese two processes helps enhance the effectiveness ofsecurity controls. If the problems described above can beovercome and R2 and R3 can be made to operate as “virtuous”circles, the increased Security Knowledge should enhance theEffectiveness of Controls, which ultimately reduces the SecurityGap.

Instead of investing in completely new controls, anenterprise could learn how to better use the existing controls.Accordingly, we have two more balancing loops, B13 andB14. Upon analyzing loop B13, we observe that an increasein Security Knowledge increases the Effectiveness of Controls,which decreases the Security Gap. This decreases the PerceivedSecurity Gap from Risk Assessment, which reduces the LearningRate and slows the increase in Security Knowledge. The loopadjusts Security Knowledge to match the Threat Sophistication.The B14 loop is similar. Increased Security Knowledge increasesthe Effectiveness of Controls, which decreases the Security Gap.This decreases the Impact, which lowers the Detected Impact,

reduces the Learning Rate and, ultimately, slows the increasein Security Knowledge.

When loops R2 and R3 are operating in a negative manner,a reduction in the Detected Impact may be caused by areduction in Detection Capability. Furthermore, when R2 and R3work as vicious circles, B13 and B14 may actually widen theSecurity Gap. When loops R2 and R3 are operating virtuously,reductions in the Detected Impact and the Perceived ImpactTrend are likely to be due to an improvement in security(reduced Actual Security Gap) and not random fluctuations inIncident Frequency and Incident Severity. Most of the commonattacks facing an enterprise are far less advanced than thelatest attacks. Consequently, the true state of security canbe masked if the enterprise only focuses on the most salientsecurity issues.

Proactive and reactive security processes strengthen eachother; knowledge created by one process enhances theother. However, it is important that both processes are wellstructured. An ad hoc approach makes it difficult for anenterprise to learn much from a risk assessment or fromincidents. Moreover, an ad hoc risk assessment may onlyexamine the most salient issues, while ignoring the subtleones. When there are no routines for incident handling, ateam will have to be put together in a hurry; the absenceof routines would make it difficult to relay importantinformation and lessons learned to key personnel. Learningfrom an incident requires careful analysis, which may notbe prioritized if the objective is to get the systems upand running as soon as possible. We advocate a measuredapproach where proactive risk assessments are conductedand reactive incident learning systems are implemented.In fact, implementing a system to facilitate learning fromincidents can be considered to be a proactive approach. Thecomplexity of modern information systems [17] and evolvingthreats make it unlikely that a risk assessment would be ableto identify all the vulnerabilities.

Human beings are natural learners. But, how fast we learnand what we learn depend on the learning resources andthe nature of the learning process. An unstructured learningprocess could lead enterprise managers back to their oldreactive security habits.

Although, our presentation is novel, our SD model mostlyintegrates previous research. For example, with the adoptionof the PDCA cycle, ISO 17799 (now ISO 27001) advocateslearning processes as those described above. Many of thesecurity administrators that we interviewed were aware ofthe standard, but considered it (and other standards) to betoo complex and time consuming to use.

8. Conclusions

Security management in the surveyed enterprises wasnot yet elevated to the strategic level. The enterprises,including those in the CI domain, engaged a technology-based paradigm for information security. The enterprisesmainly focused on technical solutions and did not adopt aholistic view. The approaches were reactive and improvisedand, in many cases, lacked indicators and a risk assessmentfoundation. This is a consequence of the understanding that


the enterprises have of security. The primary informationsecurity drivers at the surveyed enterprises were incidents,laws and regulations, and client requirements. As a result, thesecurity solutions applied at the enterprises often addressedthe symptoms instead of the root cause.

The results are somewhat troubling. A comment made bya systems administrator exemplifies the security mindset—when asked about information security, this individualanswered, “Oh yes, that’s McAfee”. The survey sample sizewas small (20); wemay have been unlucky and picked some ofthe worst enterprises in the region. Still, the enterprises weredrawn from a variety of sectors and the results are consistentacross the board.

An effective security management strategy should relyon the simultaneous implementation of technical, formaland informal controls. However, before this is done, it isimportant to consider all three classes of security controlsand understand their interdependencies. Enterprises shouldundertake systematic risk assessments and have functioningincident learning systems. Moreover, the two processesshould interact in a structured and beneficial manner.Without well-functioning learning systems, enterpriseswould be unable to build and maintain the most crucialresource in information security—knowledge. The lack ofknowledge exposed itself in many ways. For example, oneenterprise was developing a contingency plan, but the planwould only include preventive measures. The lack of basicknowledge was astonishing—a contingency plan comes intoeffect after preventive measures have failed!

Laws and regulations (e.g., LOPD and SOX) provedto be key information security drivers for the surveyedenterprises. Some enterprises were required by their clientsto institute certain security processes. While externalinterventions had an overall positive effect, our investigationindicated a possible downside: enterprises were focused oncomplying with laws, regulations and client requirementswhile ignoring other important security issues. Indeed,the emphasis on securing assets and processes subject tothese external drivers often spurs expensive and inefficientinvestments [39].

Many enterprises had created their own security modelsbased on ISO 17799, but felt that it was much toocomplex. Certification was not pursued because it was timeconsuming and deemed to be (somewhat) unnecessary. Itmay be productive for standards bodies to create simplerstandards involving only key components to promote broaderimplementation by enterprises.

Our study did not discern any significant differencesbetween CI enterprises and non-CI enterprises with respectto information security. The principal security drivers wereactual incidents and external requirements. One financialinstitution (CI01) and the military contractor were moreproactive than the other four CI enterprises, but some non-CI enterprises also exhibited proactive behavior. In the caseof CI01, the tradition of evaluating financial risk may havespilled over into information security. The military contractorsimply had to comply with client requirements. The levelsof security management at the remaining four CI enterpriseswere essentially the same as those at the non-CI enterprises.Perhaps the situation is different in sectors like energy and

transportation that have longstanding safety and securitycultures.

In summary, CI and non-CI enterprises appear to betrapped in a vicious circle. Because no systems are in place tomeasure and track risk, the risk is invisible to management.Since management cannot see the risk, it does not allocateresources to control the risk.

The model presented in this paper integrates informationsecurity theory and practice. It is, therefore, both normativeand explanatory. However, there are some limitations. Onelimitation is the lack of knowledge about the degrees to whichthe three classes of security controls depend on each other.Another problem is that limited data is available about therelationship between the actual security gap and impact.Further study is necessary to understand the impact of riskassessments and incident learning systems and how theyinteract. It is also important to know the challenges faced bythese processes, how to avoid potential vicious circles andturn them into virtuous circles. Having more insight aboutthese relationships would improve the basis for securitypolicy design and implementation. This would also enableus to further develop the qualitative model presented in thispaper into a simulation model.

Finally, the SD model has been very beneficial inunderstanding the dynamics of information security. Inparticular, it has enabled us to express and analyze thevarious interactions, interdependencies and time delays thatexist in information security systems. Information securityin CI enterprises is much more complex than the simplediagrams utilized in this paper. However, the simple diagramsprovide a framework for constructing complex models.They also provide useful, intuitive mechanisms for securityprofessionals and managers to reason about security withoutgetting bogged down in the details.

Acknowledgements

We would like to thank the reviewers for comments thathave enabled us to improve this paper. We also wish tothank Susan Alustiza for reviewing the English grammarand spelling. Last, but not least, we are very grateful to theenterprises that participated in our survey.

R E F E R E N C E S

[1] B. Schneier, Secrets and Lies, John Wiley, New York, 2000.[2] J. Torres, J. Sarriegi, Dynamic aspects of securitymanagement

of information systems, presented at the Twenty-SecondInternational Conference of the System Dynamics Society,2004.

[3] R. Anderson, Why information security is hard—An eco-nomic perspective, in: Proceedings of the Seventeenth An-nual Computer Security Applications Conference, 2001, pp.358–365.

[4] K. Mitnick, The Art of Deception, John Wiley, Indianapolis,Indiana, 2002.

[5] G. Dhillon, S. Moores, Computer crimes: Theorizing about theenemy within, Computers and Security 20 (8) (2001) 715–723.


[6] K. Warren, Competitive Strategy Dynamics, John Wiley, NewYork, 2002.

[7] K. Warren, Strategic Management Dynamics, John Wiley,New York, 2008.

[8] J. Forrester, Industrial Dynamics, Productivity Press, Cam-bridge, Massachusetts, 1961.

[9] J. Sterman, Business Dynamics: Systems Thinking andModeling for a Complex World, McGraw-Hill/Irwin, Boston,Massachusetts, 2000.

[10] J. Sarriegi, J. Santos, J. Torres, D. Imizcoz, E. Egozcue, D. Liberal,Modeling and simulating information security management,presented at the Second International Workshop on CriticalInformation Infrastructure Security, 2007.

[11] G. Richardson, D. Andersen, Teamwork in group modelbuilding, System Dynamics Review 11 (2) (1995) 113–137.

[12] J. Vennix, D. Andersen, G. Richardson, J. Rohrbaugh, Modelbuilding for group decision support: Issues and alternativesin knowledge elicitation, European Journal of OperationalResearch 59 (1) (1992) 28–41.

[13] J. Vennix, Group model-building: Tackling messy problems,System Dynamics Review 15 (4) (1999) 379–401.

[14] J. Santos, N. Serrano, J. Torres, J. Sarriegi, Empiricalstudy of information systems security management inBasque Country SMEs, presented at the Eighth InternationalConference of the Decision Science Institute, 2005.

[15] R. Botha, T. Gaadingwe, Reflecting on 20 SEC conferences,Computers and Security 25 (4) (2006) 247–256.

[16] G. Dhillon, Managing and controlling computer misuse,Information Management and Computer Security 7 (4) (1999)171–175.

[17] B. Schneier, Beyond Fear, Copernicus Books, New York, 2003.[18] E. Shaw, The role of behavioral research and profiling in

malicious cyber insider investigations, Digital Investigation3 (1) (2006) 20–31.

[19] R. Anderson, Security Engineering, John Wiley, New York,2001.

[20] S. Campbell, How to think about security failures, Communi-cations of the ACM 49 (1) (2006) 37–39.

[21] S. Gorling, Themyth of user education, presented at the VirusBulletin Conference, 2006.

[22] D. Landoll, The Security Risk Assessment Handbook,Auerbach Publications, Boca Raton, FL, 2006.

[23] G. Killcrece, K. Kossakowski, R. Ruefle, M. Zajicek, Stateof the practice of computer security response teams(CSIRTs), Technical Report CMU/SEI-2003-TR-001, SoftwareEngineering Institute, Carnegie Mellon University, Pittsburgh,Pennsylvania, 2003.

[24] A. Calder, S. Watkins, IT Governance: A Manager’s Guide toData Security and BS 7799/ISO 17799, Kogan Page, London,United Kingdom, 2005.

[25] F. Sveen, J. Torres, J. Sarriegi, Learning from your elders: Ashortcut to information security management success, in:Proceedings of the Twenty-Sixth International Conference onComputer Safety, Reliability and Security, 2007, pp. 224–237.

[26] P. Senge, The Fifth Discipline, Currency Doubleday, New York,1990.

[27] C. Johnson, Failure in Safety Critical Systems: A Handbookof Incident and Accident Reporting, University of GlasgowPress, Glasgow, United Kingdom, 2003.

[28] P. Lee, T. Weitzel, Air carrier safety and culture: Aninvestigation of Taiwan’s adaptation to Western incidentreporting programs, Journal of Air Transportation 10 (1) (2005)20–37.

[29] I. Nonaka, H. Takeuchi, The Knowledge-Creating Company,Oxford University Press, Oxford, United Kingdom, 1995.

[30] J. Wiik, J. Gonzalez, K. Kossakowski, Limits to effectivenessof computer security incident response teams, presented atthe Twenty-Third International Conference of the SystemDynamics Society, 2005.

[31] N. Repenning, J. Sterman, Nobody ever gets credit for fixingproblems that never happened: Creating and sustainingprocess improvement, California Management Review 43 (4)(2001) 64–88.

[32] J. Gonzalez, Towards a cyber security reporting system—Aquality improvement process, in: Proceedings of the Twenty-Fourth International Conference on Computer Safety, Relia-bility and Security, 2005, pp. 368–380.

[33] J. Torres, J. Sarriegi, J. Santos, Explaining security manage-ment evolution through the analysis of CIOs’ mental mod-els, presented at the Twenty-Third International Conferenceof the System Dynamics Society, 2005.

[34] G. Easton, S. Jarrell, The effects of total quality managementon corporate performance: An empirical investigation,Journal of Business 71 (2) (1998) 253–307.

[35] K. Hendricks, V. Singhal, Quality awards and themarket valueof the firm: An empirical investigation, Management Science42 (3) (1996) 415–436.

[36] K. Hendricks, V. Singhal, Does implementing an effectiveTQM program actually improve operating performance?Empirical evidence from firms that have won quality awards,Management Science 43 (9) (1997) 1258–1274.

[37] K. Hendricks, V. Singhal, Firm characteristics, total qualitymanagement and financial performance, Journal of Opera-tions Management 19 (3) (2001) 269–285.

[38] E. Schultz, The human factor in security, Computers andSecurity 24 (6) (2005) 425–426.

[39] R. Caralli, The critical success factor method: Establishing afoundation for enterprise security management, TechnicalReport CMU/SEI-2004-TR-010, Software Engineering Institute,Carnegie Mellon University, Pittsburgh, Pennsylvania, 2004.

Documents

Blind information security strategy