Model za procjenu kritičnih informacijskih sustava primjenom višekriterijskoga odlučivanja s elementima za analizu i procjenu rizika u financijskim institucijama

doctoral thesis

• Title (english): A MODEL FOR THE EVALUATION OF CRITICAL INFORMATION SYSTEMS USING MULTICRITERIA DECISION-MAKING WITH ELEMENTS FOR RISK ANALYSIS AND ASSESSMENT IN FINANCIAL INSTITUTIONS
• Author: Davor Maček
• Mentor: Ivan Magdalenić (mentor)
• Mentor: Nina Begičević Ređep (komentor); MBZ: 277814
• Committee member: Nikola Ivković (predsjednik povjerenstva); MBZ: 306480
• Committee member: Marin Golub (član povjerenstva); MBZ: 206824
• Committee member: Nikola Kadoić (član povjerenstva); MBZ: 328945
• Granter: University of Zagreb; Faculty of Organization and Informatics; Varaždin
• Defense date and country: 2021-11-15, Croatia
• Scientific / art field, discipline and subdiscipline: SOCIAL SCIENCES; Information and Communication Sciences
• Universal decimal classification (UDC): 004 - Computer science and technology. Computing. Data processing

Abstract

Financijske institucije, posebno banke, izrazito su važne za stabilnost i funkcioniranje gospodarstva svake zemlje, ali i cjelokupne svjetske ekonomije. Problemi u poslovanju neke od banaka, pogotovo onih sistemski važnih, mogu imati značajne posljedice po funkcioniranje kako nacionalnih tako i svjetske ekonomije. Neki od gorućih problema s kojima se banke danas suočavaju jesu učestali kibernetički napadi na njihovu infrastrukturu i informacijske sustave te ozbiljne posljedice koje takvi napadu uzrokuju. S obzirom kako se današnje poslovanje banaka gotovo u potpunosti oslanja na komunikaciju preko interneta sa drugim poslovnim entitetima, tako su banke sve izloženije brojnim sigurnosnim prijetnjama i neizostavnim rizicima. Zbog nedostatka svih relevantnih informacija te vremenskih i ostalih resursnih ograničenja, često nije moguće prikupiti i obraditi sve neophodne informacije o nekom informacijskom sustavu kako bi se isti moglo adekvatno procijeniti u prihvatljivom roku, a što organizaciju stavlja u stanje povećanog sigurnosnog rizika. Proučavanjem relevantne literature te postojećih modela i tehnika koji se koriste u praksi, utvrđeno je kako ne postoji rješenje za navedeni problem višekriterijskog odlučivanja u uvjetima rizika u domeni informacijske sigurnosti za kritične poslovne IT sustave. Tako je predložen model za učinkovitije donošenje informirane odluke o stanju sigurnosti nekog kritičnog informacijskog sustava odabirom odgovarajućeg IT rješenja. Model je razvijen primjenom istraživačke metodologije znanstvenog dizajna (eng. Design Science Research Methodology, DSRM) koja se koristi u inženjerstvu i informacijskim znanostima u svrhu izrade odgovarajućih artefakta. Pri tome su se najznačajniji elementi za analizu i procjenu rizika informacijske sigurnosti integrirali u višekriterijski model odlučivanja. Generički elementi za analizu i procjenu rizika korišteni su kao evaluacijski kriteriji u višekriterijskom modelu u svrhu procjene, rangiranja i odabira kritičnih poslovnih informacijskih sustava. Glavni znanstveni doprinos višekriterijskog modela uz omogućavanje učinkovitijeg donošenja odluke o stanju sigurnosti kritičnih IT sustava očituje se i u tome da omogućava organizaciji kvalitetniju reakciju na brojne sigurnosne prijetnje i rizike. Dodatni doprinos postignut je i u sistematizaciji znanja i koncepata o metodama za višekriterijsko odlučivanje pogodnih za primjenu u domeni informacijske sigurnosti zajedno sa metodama za analizu i procjenu rizika.

Abstract (english)

Financial institutions, peculiarly banks, are extremely important for the stability and functioning of the economy of each country, but also of the entire global economy. Problems in the operations of some banks, especially those of systemic importance, can have significant consequences for the functioning of both, the national and world economies. Some of the vital problems that the banks face today are frequent cyber attacks on their infrastructure and information systems, and the serious consequences caused by such attacks. Given that today's banking business relies heavily on Internet communication with other business entities, banks are increasingly exposed to numerous security threats and imminent risks. Due to the lack of all relevant information and time and other resource constraints, it is often not possible to collect and process all the necessary information about an information system so that it can be adequately evaluated within an acceptable timeframe, which puts the organization into a state of increased security risk. So, one of the research questions defined was how to enable more efficient (in terms of cost and time) decision-making on the security status and selection of appropriate critical information systems in a financial institution? By studying the relevant literature and the existing models and techniques used in practice, it was found that there is no solution to the stated problem of multicriteria decision-making in conditions of risk in the domain of information security for business-critical IT systems. Thus, a model was proposed for more efficient decision-making on the security status of a critical information system by selecting the appropriate IT solution. The model was developed using the Design Science Research Methodology (DSRM). In order to create a new model, first, it was necessary to conduct a systematic literature review (SLR) of papers on the applicability of multicriteria decision-making (MCDM) methods in a domain of information security risk assessment. Such SLR was conducted with very rigorous inclusion and exclusion criteria. By discovering which MCDM methods are suitable for creation of a new model, it was necessary to conduct the next research phase in order to identify all the information security risk assessment (ISRA) criteria that are relevant for integration into a new hybrid MCDM model. The Delphi technique was used to conduct the research by examining relevant information security experts from various financial institutions. Upon receipt of appropriate feedback on ISRA criteria, it was necessary to conduct another research in order to discover mutual influences and dependencies between those ISRA elements. That was one of the crucial research phases in order to get criteria weights of ISRA elements. So, the most important elements for the analysis and assessment of information security risks were integrated into adequate methods for multicriteria decision-making. Generic criteria for risk analysis and assessment were used as evaluation criteria in the new multicriteria model for the purpose of evaluation, ranking and selection of critical business information systems. The model was validated in relevant case studies. By confirming hypotheses, the main goal of the research, i.e. making an informed decision on the security status of critical information systems in a financial institution and increasing the efficiency and quality of the assessment process and selection of such systems, was successfully achieved.

• Keywords: Informacijska sigurnost; procjena rizika; višekriterijsko odlučivanje; kritični IT sustavi; financijske institucije; sustavni pregled literature; utjecaji; zavisnosti; hibridni model
• Keywords (english): Information security; risk assessment; multicriteria decision-making; critical IT systems; financial institutions; influences; dependencies; systematic literature review (SLR); hybrid model
• Language: croatian
• URN:NBN: urn:nbn:hr:211:400660
• Promotion: 2021
• Study programme: Title: Postgraduate doctoral study in Information Science; Study programme type: university; Study level: postgraduate; Academic / professional title: doktor/doktorica znanosti, područje društvenih znanosti, polje informacijske i komunikacijske znanosti (doktor/doktorica znanosti, područje društvenih znanosti, polje informacijske i komunikacijske znanosti)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Open access
• Created on: 2021-12-03 17:19:56