Building a Maturity Model of Information Security Governance for Technological Colleges and Universities in Taiwan

Abstract:

This study used a questionnaire survey to investigate the maturity of information security governance (ISG). The main objective is to assess the maturity of ISG, exploring the factors concerned, and building an ISG maturity model . Questionnaires were sent to 93 CIOs in schools, and 85 were returned. The return ratio is 91.4% excluding three invalid, and with 82 effective questionnaires, the effective sample return rate is 88.2%. In order to improve the maturity of ISG for Taiwanese technological colleges and universities, this study aims to build an ISG maturity model to look for relevant features of maturity of ISG. According to the Information Security Governance and Maturity Assessment Tool, this study found that schools with low rates of maturity take up 59.8%, medium 31.7%, and high 8.5%. With discriminant analysis, the maturity of ISG can be distinguished by low, medium, and high rates. With correlation analysis, this study finds that 33 items have significant correlation with ISG maturity. With analysis of variance (ANOVA), post hoc range test and ANOVA multiple comparison least significant difference (LSD), this study finds that there are significant differences between the items of ISG maturity. This study also finds the ISG maturity of schools is lower. They can improve their ISG maturity according to this model.

• Periodical: Applied Mechanics and Materials (Volumes 284-287)
• Pages: 3657-3661
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.284-287.3657
• Online since: January 2013
• Authors: Chir Neng Hung, Ming Dar Hwang, Yuan Chen Liu
• Keywords: Academic Governance, Information Security, Information Security Governance, Information Technology Governance, Maturity Model, Maturity of Information Security Governance

References

[1] Abbas Toloie Eshlaghy, Alireza Pourebrahimi, Babak Zendehdel Nobari, Presenting a Model for Ranking Organizations Based on the Level of the Information Security Maturity, Computer and Information Science, Vol. 4, No. 1, (2011) 72-78.

DOI: 10.5539/cis.v4n1p72

[2] CGTF, Information Security Governance: A Call to Action, Corporate Governance Task Force Report, 2004. (Information on http://www.cccure.org/Documents/Governance/InfoSecGov4_04.pdf)

[3] EDUCAUSE, Information Security Governance Assessment Tool For Higher Education, (2004). (Information on http://net.educause.edu/ir/library/pdf/SEC0421.pdf)

[4] Entrust, Information Security Governance (ISG): An Essential Element of Corporate Governance (2004). (Information on http://download.entrust.com/resources/download.cfm/21431/)

[5] ITGI, Information Security Governance: Guidance for Boards of Directors and Executives Management (2nd ed.), IT Governance Institute (2006). (Information on http://www.isaca.org/Knowledge-Center/Research/Documents/InfoSecGuidanceDirectorsExecMgt.pdf)

[6] John P. Pironti, Developing Metrics for Effective Information Security Governance, Information Systems Control Journal, Vol. 2, (2007) 1-5.

[7] Kenneth J. Knapp, R. Franklin Morris Jr., Thomas E. Marshall, Terry Anthony Byrd, Information Security Policy: An Organizational-level Process Model, Computer & Security, (2009) 1-16.

DOI: 10.1016/j.cose.2009.07.001

[8] Marthie Lessing, S.H. von Solms, Building a World Class Information Security Governance model, Proceedings of IST-Africa 2008 Conference.

[9] Peter Weill, Jeanne W. Ross, IT Governance on One Page, MIT Sloan School of Management Center for Information Systems Research , CISR WP No.349 (2004).

[10] Richard Boes, Tom Cramer, Vicky Dean, Roger Hanson, Nan Mckenna, Campus IT Security: Governance, Strategy, Policy, and Enforcement, EDUCAUSE Center for Applied Research (2006:17). (Information on http://net.educause.edu/ir/library/pdf/ERB0617.pdf)

[11] Rolf Moulton, Robert S. Coles, Applying Information Security Governance, Computers & Security (22:7), (2003) 580-584.

DOI: 10.1016/s0167-4048(03)00705-3

[12] Rossouw von Solmsa, Sebastiaan H. von Solms, Information Security Governance: A model based on the Direct-Control Cycle, Computers & Security, Vol. 25, (2006) 408-412.

DOI: 10.1016/j.cose.2006.07.005

[13] Shaun Posthumus, Rossouw von Solms, A Framework for the Governance of Information Security, Computers & Security, Vol. 23, (2004) 638-646.

DOI: 10.1016/j.cose.2004.10.006

[14] Taiwan's Science and Technology Advisory Group of Executive Yuan, An Integrated Study on Information Security Development Policy: Information Security Governance Mechanism and the Continuous Developing Plan, Science and Technology Advisory Group of the Executive Yuan in Taiwan (2008), 7-43.

[15] Taiwan's Science and Technology Advisory Group of the Executive Yuan, 2010 Information and Communication Security Policy White Paper, Taiwan's Executive Yuan (2010).

[16] Zuraini Ismail, Maslin Masrom, Rabiah Ahmad, Haniza Sharif, Addressing Information Security for Academic Environment: A Confirmatory Factor Analysis, MASAUM Journal of Computing (1:2), (2009) 109-115.