Orig­i­nal source pub­li­ca­tion: Soares, D. and F. de Sá-Soares (2014). Infor­ma­tion Sys­tems Secu­rity Man­age­ment Key Issues in Local Gov­ern­ment. Pro­ceed­ings of the Inter­na­tional Con­fer­ence on Elec­tronic Gov­ern­ment 2014—ICE­GOV 2014. Guimarães (Por­tu­gal).
The final pub­li­ca­tion is avail­able here.

Infor­ma­tion Sys­tems Secu­rity Man­age­ment Key Issues in Local Gov­ern­ment

Del­fina Soares and Fil­ipe de Sá-Soares

Uni­ver­si­dade do Minho—Cen­tro ALGO­RITMI, Depar­ta­mento de Sis­temas de Infor­mação, Guimarães, Por­tu­gal

1. Introduction

One of the chal­lenges fac­ing pub­lic admin­is­tra­tion agen­cies con­cerns the need to ade­quately man­age their infor­ma­tion assets. This is par­tic­u­larly crit­i­cal with regard to safe­guard­ing the pri­vacy and data of cit­i­zens, ensur­ing the avail­abil­ity of such data and their integrity and accu­racy [Palanisamy and Muk­erji 2014]. Indeed, much of the infor­ma­tion col­lected, stored and made avail­able by agen­cies, whether refer­ring to their employ­ees or to peo­ple and orga­ni­za­tions to which they pro­vide ser­vices, has a per­sonal and pri­vate nature. Hence, it is essen­tial that there are secu­rity con­trols which pro­tect infor­ma­tion sys­tems (IS) from a myr­iad of threats, such as unau­tho­rized access or mod­i­fi­ca­tion, dis­clo­sure, destruc­tion and repu­di­a­tion [Kraai­jen­brink 2002]. This call for action is increas­ingly press­ing: from 2007 to 2012 data breaches in UK local gov­ern­ment have risen by 1,609% [CFS 2012] and from 2009 to 2013 the num­ber of reported secu­rity inci­dents by USA fed­eral agen­cies more than dou­bled, reach­ing more than 60,000 inci­dents in 2013, of which almost 25,000 involved per­sonal iden­ti­fi­able infor­ma­tion [GAO 2014].

The issues related to infor­ma­tion sys­tems secu­rity (ISS) are recur­rently pre­sented as a major bar­rier or crit­i­cal fac­tor to the devel­op­ment of e-gov­ern­ment [Eyob 2004; Venkatesh et al. 2012]. The per­cep­tion that cit­i­zens may have regard­ing the lack of ade­quate secu­rity lev­els in the elec­tronic processes used within Pub­lic Admin­is­tra­tion agen­cies and between cit­i­zens and those agen­cies, can gen­er­ate lev­els of mis­trust that ulti­mately com­pro­mise the use of pub­lic elec­tronic ser­vices. The estab­lish­ment of a cli­mate of trust can be achieved by using a set of secu­rity mech­a­nisms, rang­ing from risk analy­sis and for­mu­la­tion of secu­rity poli­cies to the imple­men­ta­tion of secu­rity pro­ce­dures and secu­rity tech­nolo­gies such as pass­words, fire­walls, intru­sion detec­tion sys­tems, and encryp­tion [ISO/IEC 2013].

The impor­tance of ISS and the dif­fi­culty of its man­age­ment become even more sig­nif­i­cant in the case where the pro­vi­sion of inte­grated ser­vices to cit­i­zens is based on the inter­op­er­abil­ity between dif­fer­ent IS, espe­cially when its imple­men­ta­tion requires infor­ma­tion trans­fer and shar­ing among var­i­ous agen­cies [Evan­ge­lidis et al. 2002; Kraai­jen­brink 2002].

The chal­leng­ing com­plex­ity and vari­ety of pub­lic agen­cies, their inten­sive use of infor­ma­tion and infor­ma­tion tech­nol­ogy (IT), and their need to effec­tively pro­tect infor­ma­tion assets, moti­vated us to study the activ­ity of ISS man­age­ment in the realm of Pub­lic Admin­is­tra­tion, focus­ing our atten­tion on Local Gov­ern­ment, given its prox­im­ity to cit­i­zens. Thus, the aim of this study is to iden­tify and pri­or­i­tize the key issues that Local Gov­ern­ment chief infor­ma­tion offi­cers (CIOs) face, or believe they will face in 5 to 10 years, in the domain of ISS man­age­ment.

This paper is orga­nized as fol­lows. After this intro­duc­tion, we explain the study design, giv­ing spe­cial atten­tion to the plan­ning of the research. Then, we present the find­ings that resulted from the first moment of data col­lec­tion in the field. We con­clude with a pre­view of the sub­se­quent steps of this research in progress.

2. Study Design

The iden­ti­fi­ca­tion of the main aspects con­cern­ing the man­age­ment of IS and IT from the per­spec­tive of prac­ti­tion­ers is a topic that has attracted the atten­tion of var­i­ous researchers. As illus­tra­tive of this obser­va­tion, the USA based Soci­ety for Infor­ma­tion Man­age­ment (SIM) com­mis­sioned fif­teen sur­veys between 1980 and 2013 with the aim of uncov­er­ing the key issues that its mem­bers were fac­ing when man­ag­ing IS/IT (cf. [Ball and Har­ris 1982] and [Kap­pel­man et al. 2013] as two exem­pli­fy­ing stud­ies in that series of works). Over that period of time, the inter­est in iden­ti­fy­ing key issues expanded to other coun­tries and diver­si­fied into other areas of research.

In 2013, Poló­nia and de Sá-Soares [2013] pub­lished a study where the key issues that ISS man­agers face, or believe they will face, in the near future were iden­ti­fied and pri­or­i­tized. To the best of our knowl­edge, this was the first key issues study that tar­geted the ISS man­age­ment activ­ity, with those authors sug­gest­ing as future work the pro­mo­tion of sim­i­lar stud­ies by restrict­ing respon­dents to spe­cific indus­tries or sec­tors. This cur­rent work embraces that chal­lenge select­ing as tar­gets Local Gov­ern­ment chief infor­ma­tion offi­cers.

Since our research goal was to repli­cate that study for Local Gov­ern­ment, and with the inten­tion to under­take a com­par­a­tive analy­sis between its results and this work, we built on that research, adopt­ing its main tenets, namely from a method­olog­i­cally point of view. There­fore, we adopted the Del­phi method and resorted to the Q-sort tech­nique.

The Del­phi method con­sists of a series of ques­tion­naires (called Del­phi rounds) directed to a group of experts (the Del­phi panel) in a given phe­nom­e­non. After the ini­tial round, the pro­mot­ers of the Del­phi pro­vide experts with a sum­mary of the aggre­gate opin­ion of the panel and ask them to re-exam­ine their answers to the pre­vi­ous round tak­ing into account that aggre­gate opin­ion. Then, a new round of the Del­phi study takes place. This pro­ce­dure may be fur­ther repeated. The goal of the appli­ca­tion of the Del­phi method is to reach a con­sen­sus among the par­tic­i­pant experts. How­ever, if a con­sen­sus if not achieved, then the Del­phi results may still prove use­ful, since they may uncover diver­gent points of view among respon­dents, pro­vid­ing a basis for fur­ther inquiry into the phe­nom­e­non under scrutiny.

Con­sid­er­ing that our aim was not only to iden­tify the ISS man­age­ment key issues in the view of Local Gov­ern­ment CIOs, but also to rank those issues by order of impor­tance, we also cou­pled the Del­phi method with the Q-sort tech­nique. Con­sist­ing of a sys­tem­atic way of rank-order­ing objects, the Q-sort tech­nique cre­ates the con­di­tions for an eval­u­a­tor to rank a set of objects (in this case issues related to ISS man­age­ment in Local Gov­ern­ment) as a whole, avoid­ing the con­sid­er­a­tion of indi­vid­ual objects with­out tak­ing into account the remain­ing objects, as it is usu­ally the case when clas­si­fy­ing objects via Lik­ert scales.

The plan­ning of the Del­phi study involved deci­sions regard­ing the con­sti­tu­tion of the panel, the design of the rounds, the com­mu­ni­ca­tion with the experts and the def­i­n­i­tion of stop cri­te­ria.

In this study the poten­tial con­stituents of the Del­phi panel were Local Gov­ern­ment CIOs. For the sake of fea­si­bil­ity and valid­ity of find­ings in terms of cul­tural and regional sim­i­lar­ity, we decided to instan­ti­ate the panel to the Por­tuguese Local Gov­ern­ment. At the present, Por­tu­gal has 308 Munic­i­pal­i­ties, which form the Local Gov­ern­ment level of Por­tuguese Pub­lic Admin­is­tra­tion, dis­trib­uted by size of elec­torate as illus­trated in Table 1. We sent an email mes­sage to the 308 Munic­i­pal­i­ties pre­sent­ing the study, describ­ing its aims and invit­ing them to par­tic­i­pate in it.

Table 1: Dis­tri­b­u­tion of Munic­i­pal­i­ties by Size of Elec­torate

Regard­ing the design of the Del­phi rounds we had sev­eral options. The first deci­sion con­cerned the use of a pre­de­fined list of issues to present the panel for clas­si­fi­ca­tion or the option for a blank list, where respon­dents would be asked to pro­vide six to ten con­cerns regard­ing ISS man­age­ment. To reduce the cog­ni­tive effort of par­tic­i­pants, and given that we were repli­cat­ing study [Poló­nia and de Sá-Soares 2013], we chose to present respon­dents a pre­de­fined list of issues. We used as pre­lim­i­nary ver­sion of this list the final list of key issues result­ing from study [Poló­nia and de Sá-Soares 2013], which was com­posed of 26 aspects con­cern­ing ISS man­age­ment and cor­re­spond­ing brief descrip­tions. We reviewed the for­mu­la­tion of those issues and descrip­tions, adapt­ing their phras­ing to the con­text of Local Gov­ern­ment, e.g., replac­ing ref­er­ences to cus­tomers by cit­i­zens, top man­age­ment by Town Coun­cil Exec­u­tive, and orga­ni­za­tion by Town Hall. The items com­pos­ing this list were pre­sented to par­tic­i­pants ran­domly ordered in the ini­tial round of the Del­phi. To pre­vent the pos­si­bil­ity of this list still con­vey­ing a vision biased to gen­eral busi­ness, we decided to keep the first round open. This means that respon­dents, after clas­si­fy­ing in terms of impor­tance the 26 items com­pos­ing the ini­tial list of issues, were given the oppor­tu­nity to add issues that they thought were miss­ing from that list and that they con­sid­ered rel­e­vant in the realm of their con­text and expe­ri­ence in man­ag­ing ISS. A third deci­sion was to not remove the less impor­tant issues after each round, unless the num­ber of new issues sug­gested by the panel in the first round would make this option pro­hib­i­tive in terms of effort. In order to expe­dite the col­lec­tion of the data required by each Del­phi round, and to enforce the rules of the Q-sort tech­nique, we used a Web appli­ca­tion to admin­is­ter the Del­phi sur­veys.

The pro­to­col used to com­mu­ni­cate with par­tic­i­pants was also defined. An email mes­sage would be sent to each par­tic­i­pant in the begin­ning of each round. This mes­sage would recall the pur­pose of the study and inform on the period for answer­ing the sur­vey, the Web link and the cre­den­tials required to par­tic­i­pate in the round, an assur­ance for con­fi­den­tial­ity and anonymity, the email and phone con­tacts of the research team, and for the rounds after the first one, a syn­the­sis of the con­sen­sus achieved in the pre­vi­ous round. Two email reminders would be sent to those par­tic­i­pants that had not answered the sur­vey.

As men­tioned, the Del­phi method con­sists of a set of linked sur­veys aimed to pro­mote con­sen­sus among par­tic­i­pants. Of course, one needs to know when an accept­able level of con­sen­sus was reached or when one should abort the chain of sur­veys if there is no con­sen­sus among the par­tic­i­pants and the launch­ing of new rounds would exhaust the panel and lead its com­po­nents to aban­don par­tic­i­pa­tion. For that mat­ter, we adopted the fol­low­ing three stop cri­te­ria: Kendall’s coef­fi­cient of con­cor­dance W (a non­para­met­ric test whose val­ues fall in the inter­val [0,1], where 0 indi­cates “lack of agree­ment” and 1 means “com­plete agree­ment”) to assess the level of con­sen­sus among par­tic­i­pants in a given round, Kendall’s rank-order cor­re­la­tion coef­fi­cient T (a non­para­met­ric test whose val­ues fall in the inter­val [-1,1], where -1 indi­cates per­fect dis­agree­ment, 1 per­fect agree­ment and 0 inde­pen­dence of vari­ables under analy­sis) to assess the sta­bil­ity of the panel’s rank­ings between rounds, and a max­i­mum num­ber of three rounds for the Del­phi study, regard­less of the level of con­sen­sus exis­tent at the end of third round. Hence, the Del­phi will stop if a round pre­sented a high level of con­sen­sus among par­tic­i­pants that did not showed progress from the pre­vi­ous round or, if this con­di­tion was not ver­i­fied, at the end of the third round.

3. Preliminary Results

In this sec­tion we present pre­lim­i­nary find­ings of this work, namely the results derived from the first round of the Del­phi study.

From the 308 invited Munic­i­pal­i­ties to par­tic­i­pate in this study, in the first round we got answers from 69 CIOs, cor­re­spond­ing to a response rate of 22%. In terms of size of Munic­i­pal­ity by elec­torate, the 69 par­tic­i­pants are dis­trib­uted as shown in Fig­ure 1. This con­fig­u­ra­tion of respon­dents is in line with the dis­tri­bu­tion pre­sented in Table 1, enabling the results to reflect more accu­rately the total pool of experts.

Fig­ure 1: Dis­tri­b­u­tion of Respon­dents by Size of Elec­torate

At the end of the first round the panel ranked the 26 issues as pre­sented in Table 2. This aggre­gate view of the impor­tance of the issues form­ing the ini­tial list of ISS man­age­ment con­cerns has asso­ci­ated a Kendall’s W of 0.134 (p < 0.001). Although the inter­pre­ta­tion of W is not a straight­for­ward task, we will fol­low Schmidt [1997] sug­ges­tion and con­sider that value rep­re­sents weak agree­ment among the panel’s mem­bers. To a cer­tain extent this was expected, since the ini­tial round con­sisted of the first con­tact of the par­tic­i­pants with the list of issues and the respon­dents still did not have avail­able the opin­ion of the panel as a whole to help fos­ter­ing a higher level of con­sen­sus. We note that for the first round, it makes no sense to deter­mine Kendall’s T.

Besides the 26 items com­pos­ing the ini­tial list of issues, we observe in Table 2 the appear­ance of two new issues. These issues were advanced by two par­tic­i­pants, who also pro­vided a brief expla­na­tion for their sug­ges­tions, a sit­u­a­tion made pos­si­ble since the first round was open to the inclu­sion of new items. One of these two new issues is related to the updat­ing of the ISS plan and the other to the exis­tence of an orga­ni­za­tional role or unit in the Town Hall respon­si­ble for man­ag­ing the IS pro­tec­tion efforts. There is no rank asso­ci­ated to each of these issues since the panel has not yet had the oppor­tu­nity to clas­sify them.

Table 2: Results after First Round of Del­phi
† Issues sug­gested by par­tic­i­pants
na (not applic­a­ble)

At this inter­me­di­ate stage of the research process any analy­sis and dis­cus­sion of the find­ings, although pos­si­ble, should be always con­sid­ered as ten­ta­tive and sub­ject to even­tual dis­con­fir­ma­tion by sub­se­quent data col­lec­tion and analy­sis phases. With this lim­i­ta­tion in mind, a first approach to the analy­sis of the ranked list of issues is to divide them into four groups, accord­ing to the dis­tance each issue is placed from the first issue ranked by using the cor­re­spond­ing aver­age. Hence, the first group of most impor­tant issues includes items ranked 1 to 4 (up to 1.5x aver­age of first ranked issue), the sec­ond group of impor­tant issues are the items ranked 5 to 10 (up to 2.0x aver­age of first ranked issue), the third group of medium impor­tance issues the items ranked 11 to 21 (up to 2.5x aver­age of first ranked issue) and the group con­tain­ing the least impor­tant issues includ­ing items 22 to 26 (up to 3.0x aver­age of first ranked issue). Tak­ing into account the rank of each issue and the asso­ci­ated aver­age of the Q-sort clas­si­fi­ca­tion allows a more detailed under­stand­ing of the posi­tion­ing of each issue.

Con­sid­er­ing the group con­tain­ing the most impor­tant issues, we observe that respon­dents placed near the top of the list two issues con­cern­ing two basic require­ments of ISS–avail­abil­ity (issue 1) and con­fi­den­tial­ity (issue 4), accom­pa­nied by the capa­bil­ity to detect ISS anom­alies (issue 3) and, as the sec­ond most impor­tant issue, the abil­ity to con­trol the use of elec­tronic devices that can manip­u­late sen­si­tive infor­ma­tion of the Town Hall, sug­gest­ing a high con­cern with the chal­lenge of main­tain­ing a secu­rity per­ime­ter in the con­text of an ever grow­ing IT mobile world.

Another approach to the analy­sis of the ranked list is to com­pare it with the final rank­ing obtained in [Poló­nia and de Sá-Soares 2013]. To facil­i­tate this com­par­i­son, we included that rank­ing in Table 2 (cf. col­umn 4). The first reg­u­lar­ity observed is that the same issue ranked first, empha­siz­ing the impor­tance given to the abil­ity to recover IS and infor­ma­tion both for firms and Town Halls alike. In the first four ranked issues we find other sim­i­lar­i­ties between the stud­ies (although not as strik­ing as for issue 1), but also a sub­stan­tial dif­fer­ence regard­ing issue 2 in this study, which ranked 17^th in [Poló­nia and de Sá-Soares 2013]. The sec­ond most rel­e­vant dis­tinc­tion between the two stud­ies is the issue placed sev­enth (25^th in [Poló­nia and de Sá-Soares 2013]), regard­ing ban­ning access to Inter­net con­tent with poten­tial risk of caus­ing ISS breaches. Four addi­tional dif­fer­ences are note­wor­thy between the stud­ies: mak­ing con­tract ven­dors and ser­vice providers respon­si­ble in case of ISS breaches (10^th in this study against 26^th in [Poló­nia and de Sá-Soares 2013]), get­ting the com­mit­ment of top exec­u­tives to the ISS effort (14^th against 3^rd in [Poló­nia and de Sá-Soares 2013]), val­i­dat­ing the effec­tive­ness of the imple­mented ISS mea­sures (16^th against 4^th in [Poló­nia and de Sá-Soares 2013]) and align­ing ISS poli­cies with the strat­egy of the orga­ni­za­tion (19^th against 5^th in [Poló­nia and de Sá-Soares 2013]). If these find­ings are main­tained along the study, this may sug­gest sig­nif­i­cant dif­fer­ences in terms of con­text and set of chal­lenges con­fronting Local Gov­ern­ment CIOs, requir­ing in-depth inquiry to iden­tify the under­ly­ing rea­sons.

4. Next Steps

Accord­ing to research plan, we launched the sec­ond round of the Del­phi study. The panel rank­ing of issues obtained at the end of the first round was made avail­able to respon­dents with the aim of con­verg­ing to a higher level of con­sen­sus. The two new issues are also part of the updated list of issues, now closed and total­iz­ing 28 ISS man­age­ment con­cerns.

Even­tu­ally, the final rank­ing of issues may sug­gest post-Del­phi research efforts, such as inter­views or focus groups, aimed to get a bet­ter under­stand­ing of the posi­tion of cer­tain ISS man­age­ment con­cerns in the con­text of Local Gov­ern­ment. These efforts may pro­vide a more sub­stan­tive inter­pre­ta­tion of the final results, help­ing to clar­ify the role of fac­tors such as secu­rity gov­er­nance, over­all e-gov­ern­ment archi­tec­ture, inter­op­er­abil­ity frame­works, cen­tral­iza­tion of e-gov­ern­ment ser­vices, trans­parency pres­sures, and open gov­ern­ment data ini­tia­tives, to name a few.

Ackowledgments

This work has been sup­ported by FCT—Fun­dação para a Ciên­cia e Tec­nolo­gia within the Pro­ject Scope: PEst-OE/EEI/UI0319/2014.

References

• Ball, L. and R. Har­ris (1982). SMIS Mem­bers: A Mem­ber­ship Analy­sis. MIS Quar­terly 6(1), 19–38.

  CFS (2012). UK data leaks rise 1,000% in five years. Com­put Fraud Secu­rity 9, 20.

  Evan­ge­lidis, A., J. Ako­mode, A. Taleb-Ben­diab and M. Tay­lor (2002). Risk Assess­ment & Suc­cess Fac­tors for e-Gov­ern­ment in a UK Estab­lish­ment. Pro­ceed­ings of the 1^st Inter­na­tional Con­fer­ence on Elec­tronic Gov­ern­ment, 395–402. Aix-en-Provence (France).

  Eyob, E. (2004_. E-gov­ern­ment: break­ing the fron­tiers of inef­fi­cien­cies in the pub­lic sec­tor. Elec­tronic Gov­ern­ment an Inter­na­tional Jour­nal 1(1), 107–114.

  GAO (2014). Infor­ma­tion Secu­rity: Fed­eral Agen­cies Need to Enhance Responses to Data Breaches. GAO-14-487T. http://www.gao.gov/assets/670/662227.pdf

  ISO/IEC (2013). ISO/IEC 27002:2013—Infor­ma­tion tech­nol­ogy—Secu­rity tech­niques—Code of prac­tice for infor­ma­tion secu­rity con­trols. ISO.

  Kap­pel­man, L., E. McLean, J. Luft­man and V. John­son (2013). Key Issues of IT Orga­ni­za­tions and Their Lead­er­ship: The 2013 SIM IT Trends Study. MIS Quar­terly Exec­u­tive 12(4), 227–240.

  Kraai­jen­brink, J. (2002). Cen­tral­iza­tion Revis­ited? Prob­lems on Imple­ment­ing Inte­grated Ser­vice Deliv­ery in The Nether­lands. Pro­ceed­ings of the 1^st Inter­na­tional Con­fer­ence on Elec­tronic Gov­ern­ment, 10-17. Aix-en-Provence (France).

  Palanisamy, R. and B. Muk­erji (2014). Secu­rity and Pri­vacy Issues in E-Gov­ern­ment. Cyber Behav­ior: Con­cepts, Method­olo­gies, Tools, and Appli­ca­tions, 880–892. Her­shey: IGI Global.

  Poló­nia, F. and F. de Sá-Soares (2013). Key Issues in Infor­ma­tion Sys­tems Secu­rity Man­age­ment. Pro­ceed­ings of the 34^th Inter­na­tional Con­fer­ence on Infor­ma­tion Sys­tems. Milan (Italy).

  Schmidt, R.C. (1997). Man­ag­ing Del­phi sur­veys using non­para­met­ric sta­tis­ti­cal tech­niques. Deci­sion Sci­ences 28(3), 763–774.

  Venkatesh, V., F. K. Y. Chan and J. Y. L. Thong (2012). Design­ing e-gov­ern­ment ser­vices: Key ser­vice attrib­utes and cit­i­zens’ pref­er­ence struc­tures. Jour­nal of Oper­a­tions Man­age­ment 30(1-2), 116–133.