SCIT, Autumn 2020: Information Security and Risk Management Report

This report delves into the crucial intersection of information security and risk management, emphasizing the symbiotic relationship between data security and privacy. It employs a secondary research methodology, primarily utilizing literature reviews to analyze existing scholarly sources on the topic. The report examines the importance of information security and privacy for both individuals and organizations, highlighting the risks associated with data breaches and the need for robust privacy controls. The findings emphasize the significance of adhering to privacy laws, such as those in Australia and the Philippines, and the role of human behavior as a critical factor in information security. Discussions cover the need for privacy controls over IT security programs and the importance of employee training in fostering a culture of information security. The report concludes that information security and privacy are inseparable and essential, advocating for stringent measures to protect sensitive information and prevent misuse.

Running head: INFORMATION SECURITY AND RISK MANAGEMENT
INFORMATION SECURITY AND RISK MANAGEMENT
Name of the Student
Name of the University
Author Note

1INFORMATION SECURITY AND RISK MANAGEMENT
Executive Summary
The information security and the information privacy are the two sides of a coin. To
maintain privacy of information, security of information is required. The report deals with the
research methods and approach that is used for the evaluation of the topic. The report deals
with the results that are obtained from the research. The report discusses about the
discussions about the information security and information privacy including the scope and
the limitations of the topic. From the report, it can be inferred that information security and
information privacy are most important. They walk hand in hand and without information
security, the privacy of information is not possible.

2INFORMATION SECURITY AND RISK MANAGEMENT
Table of Contents
Introduction................................................................................................................................3
Research Methods and Approach...............................................................................................3
Literature Review...................................................................................................................4
Results........................................................................................................................................5
Discussions.................................................................................................................................7
Conclusions................................................................................................................................8
References................................................................................................................................10

3INFORMATION SECURITY AND RISK MANAGEMENT
Introduction
Information security is a sequence of practices those are intended in order to keep data
protected from unauthorized access or modifications, both when the data is stored and when
the data is broadcasted from one machine to another machine. It is sometimes known as the
data security. As information has become an essential resource, efforts in order to keep the
information secure have become increasingly essential.
The privacy of information is the privacy of information that is personal and relates to
the personal data that is stored on the systems of computer. The requirement to maintain the
privacy of information is applicable to the personal information those are collected such as
medical records, financial data, records of criminals, records of political and the information
related to business. The privacy of information is known as the privacy of data.
The information security and the information privacy are the two sides of a coin. To
maintain the privacy of information, security is required.
The report deals with the research methods and approach that is used for the
evaluation of the topic. The report deals with the results that are obtained from the research.
The report discusses about the discussions about the information security and information
privacy including the scope and the limitations of the topic.
Research Methods and Approach
The information security and the information privacy is very important for an
individual as well as for a company. It is important to secure the information in order to
maintain the privacy of information (Padyab 2018). The method that is applied in this report
is secondary research.

4INFORMATION SECURITY AND RISK MANAGEMENT
A secondary research is a technique of research that includes data that already exists. The
data exists is summarized and combined in order to maximize effectiveness of research. The
secondary research consists of materials of research those are published in the reports of
research and related documents (Quinlan et al 2019). These documents are easily available on
websites, public libraries and many more. These can be utilised for the purposes of research
and be obtained from them. The research method that is used in this report is literature
review. A literature review is a survey of sources those are scholarly associated to a particular
topic or question of research. A few literature reviews about information security and
information privacy will be carried out.
Literature Review
According to (Anastasopoulou, Kokolakis and Andriotis 2017) the privacy of
information is negotiated when various people interact with the companies and agencies of
governments through the internet. In the background of information privacy and information
security, all the important stakeholders take decisions those are related to privacy. Individuals
or the consumers that purchase online services and products utilising the services of e-
government, face several decisions with consider to utilisation of online services, the
revelation of information those are personal and utilisation of technologies in order to
enhance the privacy. The Governments also determine on the regulations of privacy as well
as on the creation of services that stock up and process the information that is personal of the
citizens. The organizations makes several decisions concerning their investment on various
polices and technologies for the protection of privacy. Motivated by all these challenges and
issues, the authors focuses on various aspects of privacy making of decisions and then
address the issues of behaviour of privacy of a person.
According to (Anwar, Gill and Beydoun 2018) the privacy of information is
concerned with protection of information those are personal. The information privacy is a

5INFORMATION SECURITY AND RISK MANAGEMENT
difficult task specifically in the context of digital ecosystems those are heterogeneous. There
is a requirement in order to recognise relevant laws of privacy and standards in order to
design digital ecosystems those are secure. This article provides the outputs research of
information privacy in the digital ecosystems via the lens of privacy regulation of Australia
and the standards. The outputs of the research presents that privacy of information is very
important but it is not appropriately addressed in the digital ecosystems. It is recommended
by the authors of the article that mapping and then reviewing the Information privacy laws
and standards of Australia require an approach that is multilayered at various layers in order
to secure the ecosystems those are digital.
According to (Mahfuth et al 2017) the behaviour of humans inside the organization
can be considered as an important threat and in the security of information, humans can be
considered as the weakest link. Therefore, it is essential to develop culture of information
security to safeguard the assets of organizations from inside and to manipulate the security
behaviour of the employees. This paper focuses on recognising the frameworks and the
definitions to establish and uphold a culture of information security inside the companies.
The authors have also discussed that the employees of the organizations need more
knowledge on information security to preserve a culture of information security inside the
company.
Results
From the literature reviews, it can be said that information security and the
information privacy are most important to a company as ell to an individual. The information
security and information privacy are both sides of a coin and without information security the
information privacy cannot be maintained (Wang, Ying and Zhang 2016). The results from
these literature reviews say that when an individual purchases a services or products from any

6INFORMATION SECURITY AND RISK MANAGEMENT
website or an E-commerce enterprise, it is the responsibility of the enterprise to uphold the
privacy of the individual and keep their personal information safe. The organizations must
use various technologies to enhance privacy of sensitive information of the customers. The
results includes the decisions those are taken by these agencies in order to invest in
technologies to uphold the privacy of their customers. It is very important to maintain the
privacy of the information because if the information goes in wrong hand then the
information will be misused, the customers will be danger, and the company will face legal
actions (Solove 2016). It is also important for the companies and the individuals to abide the
privacy laws such as the privacy laws and standards of Australia. The information privacy is
mainly concerned with the privacy of personal information and the information of the
company. Therefore, the result shows that privacy is privacy laws are very important in order
to secure the digital ecosystems. The results also show that the privacy laws and standards are
very important but they are not addressed appropriately. Therefore, it is recommended to
review the laws and the standards so that the privacy of information of an individuals or a
company is uphold (Waldman 2018).
The result of the literature review is that the main threat are the humans that is the
employees. Therefore, information security is very important in these organization as
information breach that happen any time in the organization due to these employees. The
result also provides an idea that a culture of information security must be maintained in the
organizations so that they can protect the resources of the company from the hands of the
attackers (Dhillon, Oliveira and Syed 2018). The result also shows that proper training must
be provided to the employees of the companies so that they understand information security
and they can maintain a culture of information security in the company.

7INFORMATION SECURITY AND RISK MANAGEMENT
Discussions
Information privacy is important for a company as well as for an individual. If the
information is not kept private then the information will be mishandled. The issues of
information security include snooping, mishandling of information and tracking of location
(Arinze and Ezema 2016). The security of information is also very important for a company
as well as for an individual. The information must be kept secured to uphold privacy of the
information. Therefore, the information security and information walks hand in hand. The
issues of informations security include injection of code, data breach, malware infection and
many. The most common thing between the issues of information privacy and information
security is the mishandling of data and information (Lundgren and Möller 2019). The
attackers obtains these sensitive data and they misuse these data for example, they can take
money out from an ATM by getting the credit or debit card information of the people and it
can also to identity theft. Therefore, information security and information privacy is both
important and should be maintained properly.
The lawmakers of US are more concerned with the privacy controls and protection.
The information is more important than the security programs. The lawmakers of US think
that the information of an individual or a company is very sensitive and they should not be
mishandled or misused (Feng and Xie 2019). The privacy controls and protection will help to
protect the data from the hands of the intruders. There are various types of controls that the
lawmakers devise to support the privacy of the information. The controls are devised so that
the data those are collected should be used responsible so that it does harm the individuals.
There are various types of privacy laws those are in place to uphold privacy and when these
laws are broken punishments are inevitable. The IT security programs are important but not
as important as the privacy controls and protection. Security programs can help the people to
understand the importance of security but privacy controls will help to uphold the privacy and

8INFORMATION SECURITY AND RISK MANAGEMENT
protect the data from unauthorized people (Force 2017). However, a company must have a
security and privacy policy in place in order to protect its information assets and protect the
information stored in the assets. Therefore, the lawmakers are right to be more concerned
about the privacy controls and protection rather than the IT security programs.
There are several laws or privacy those are developed in order to uphold the privacy
of information and punish the people that break these laws of privacy. The various acts and
laws include The Data Privacy Act 2012 is an act of Philippines would monitor and maintain
the privacy of information and protect the data of the country (Anwar, Gill and Beydoun
2018). The data directive was adopted by the parliament of Europe in 1995 that upholds and
protects the information and the data of the country. In UK, the Data protection Act 1995 is
also a privacy law. The United States has the largest number of information privacy laws and
acts. It includes US Privacy Act, US Electronic Communications Privacy Act, US Computer
Fraud and Abuse act, US Computer Security Act and many more. The Computer Misuse Act
of Australia is also an important act of data and information privacy (Nwankwo 2016). Any
people irrespective of caste, gender community is subjected to harsh punishment that they
should be sent to jail and huge sum money must be fined. These controls will be effective in
order to uphold the privacy and the people those are breaking these laws must be subjected to
harsh punishment so that they do not make the same mistake twice.
Conclusions
From the report, it can be inferred that information security and information privacy
are most important. They walk hand in hand and without information security, the privacy of
information is not possible. The report discusses about the methods of research those are used
in this report. The research method is secondary method of research and literature review is
done on information security and information. The literature is carried out on the topic

9INFORMATION SECURITY AND RISK MANAGEMENT
various insights have been drawn from the literature review. The results of the research show
that privacy of the customers, the individuals must be upheld, and the organizations must
invest in privacy policies. The result also shows that information security culture must be
maintained companies and the individuals and companies must abide by the privacy laws and
acts. The report discusses about the various issues of information privacy and information
security. The report focuses on the various Privacy acts and laws all over the world and
discusses about the effectiveness of these legislations.

10INFORMATION SECURITY AND RISK MANAGEMENT
References
Anastasopoulou, K., Kokolakis, S. and Andriotis, P., 2017, July. Privacy decision-making in
the digital era: A game theoretic review. In International Conference on Human Aspects of
Information Security, Privacy, and Trust (pp. 589-603). Springer, Cham.
Anwar, M., Gill, A. and Beydoun, G., 2018. A review of Australian information privacy laws
and standards for secure digital ecosystems.
Anwar, M.J., Gill, A.Q. and Beydoun, G., 2018, January. A review of information privacy
laws and standards for secure digital ecosystems. In ACIS 2018-29th Australasian
Conference on Information Systems.
Arinze, U.C. and Ezema, M.E., 2016. Information Privacy: Issues, Concerns and
Strategies. Information Privacy, 6(9).
Dhillon, G., Oliveira, T. and Syed, R., 2018. Value-based information privacy objectives for
Internet Commerce. Computers in Human Behavior, 87, pp.292-307.
Feng, Y. and Xie, Q., 2019. Privacy Concerns, Perceived Intrusiveness, and Privacy Controls:
An Analysis of Virtual Try-On Apps. Journal of Interactive Advertising, 19(1), pp.43-57.
Force, J.T., 2017. Security and Privacy Controls for Information Systems and
Organizations (No. NIST Special Publication (SP) 800-53 Rev. 5 (Draft)). National Institute
of Standards and Technology.
Lundgren, B. and Möller, N., 2019. Defining information security. Science and engineering
ethics, 25(2), pp.419-441.

11INFORMATION SECURITY AND RISK MANAGEMENT
Mahfuth, A., Yussof, S., Baker, A.A. and Ali, N.A., 2017, July. A systematic literature
review: Information security culture. In 2017 International Conference on Research and
Innovation in Information Systems (ICRIIS) (pp. 1-6). IEEE.
Nwankwo, I.S., 2016. Information Privacy in Nigeria. In African Data Privacy Laws (pp. 45-
76). Springer, Cham.
Padyab, A., 2018. Exploring Impacts of Secondary Information Use on Individual
Privacy (Doctoral dissertation, Luleå University of Technology).
Quinlan, C., Babin, B., Carr, J. and Griffin, M., 2019. Business research methods. South
Western Cengage.
Solove, D.J., 2016. A brief history of information privacy law. Proskauer on privacy, PLI.
Waldman, A.E., 2018. Privacy as trust: information privacy for an information age.
Cambridge University Press.
Wang, W., Ying, L. and Zhang, J., 2016. On the relation between identifiability, differential
privacy, and mutual-information privacy. IEEE Transactions on Information Theory, 62(9),
pp.5018-5029.