Framework for critical information infrastructure protection in smart government: a case study in Indonesia

IF 1.6 Q3 COMPUTER SCIENCE, INFORMATION SYSTEMS

Information and Computer Security Pub Date : 2023-09-13 DOI:10.1108/ics-03-2023-0031

Prasetyo Adi Wibowo Putro, Dana Indra Sensuse, Wahyu Setiawan Setiawan Wibowo

{"title":"Framework for critical information infrastructure protection in smart government: a case study in Indonesia","authors":"Prasetyo Adi Wibowo Putro, Dana Indra Sensuse, Wahyu Setiawan Setiawan Wibowo","doi":"10.1108/ics-03-2023-0031","DOIUrl":null,"url":null,"abstract":"Purpose This paper aims to develop a framework for critical information infrastructure (CII) protection in smart government, an alternative measure for common cybersecurity frameworks such as NIST Cybersecurity Framework and ISO 27001. Smart government is defined as the government administration sector of CII due to its similarity as a core of smart technology. Design/methodology/approach To ensure the validity of the data, the research methodology used in this paper follows the predicting malfunctions in socio-technical systems (PreMiSTS) approach, a variation of the socio-technical system (STS) approach specifically designed to predict potential issues in the STS. In this study, PreMiSTS was enriched with observation and systematic literature review as its main data collection method, thematic analysis and validation by experts using fuzzy Delphi method (FDM). Findings The proposed CII protection framework comprises several dimensions: objectives, interdependency, functions, risk management, resources and governance. For all those dimensions, there are 20 elements and 41 variables. Practical implications This framework can be an alternative guideline for CII protection in smart government, particularly in government administration services. Originality/value The author uses PreMiSTS, a socio-technical approach combined with thematic analysis and FDM, to design a security framework for CII protection. This combination was designed as a mixed-method approach to improve the likelihood of success in an IT project.","PeriodicalId":45298,"journal":{"name":"Information and Computer Security","volume":"10 1","pages":"0"},"PeriodicalIF":1.6000,"publicationDate":"2023-09-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"0","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"Information and Computer Security","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1108/ics-03-2023-0031","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"Q3","JCRName":"COMPUTER SCIENCE, INFORMATION SYSTEMS","Score":null,"Total":0}

引用次数: 0

Abstract

Purpose This paper aims to develop a framework for critical information infrastructure (CII) protection in smart government, an alternative measure for common cybersecurity frameworks such as NIST Cybersecurity Framework and ISO 27001. Smart government is defined as the government administration sector of CII due to its similarity as a core of smart technology. Design/methodology/approach To ensure the validity of the data, the research methodology used in this paper follows the predicting malfunctions in socio-technical systems (PreMiSTS) approach, a variation of the socio-technical system (STS) approach specifically designed to predict potential issues in the STS. In this study, PreMiSTS was enriched with observation and systematic literature review as its main data collection method, thematic analysis and validation by experts using fuzzy Delphi method (FDM). Findings The proposed CII protection framework comprises several dimensions: objectives, interdependency, functions, risk management, resources and governance. For all those dimensions, there are 20 elements and 41 variables. Practical implications This framework can be an alternative guideline for CII protection in smart government, particularly in government administration services. Originality/value The author uses PreMiSTS, a socio-technical approach combined with thematic analysis and FDM, to design a security framework for CII protection. This combination was designed as a mixed-method approach to improve the likelihood of success in an IT project.

查看原文本刊更多论文

智能政府中关键信息基础设施保护框架:以印度尼西亚为例

本文旨在开发智能政府中关键信息基础设施(CII)保护框架，这是NIST网络安全框架和ISO 27001等常见网络安全框架的替代措施。智能政府是CII的政府管理部门，因为它与智能技术的核心相似。设计/方法/方法为了确保数据的有效性，本文使用的研究方法遵循预测社会技术系统故障(PreMiSTS)方法，这是社会技术系统(STS)方法的一种变体，专门用于预测社会技术系统中的潜在问题。在本研究中，以观察和系统文献综述为主要数据收集方法，运用模糊德尔菲法(FDM)进行专题分析和专家验证。建议的CII保护框架包括几个方面:目标、相互依赖、功能、风险管理、资源和治理。对于所有这些维度，有20个元素和41个变量。该框架可以作为智能政府(特别是政府管理服务)中CII保护的替代指南。作者使用prests，一种结合主题分析和FDM的社会技术方法，设计了一个CII保护的安全框架。这种组合被设计为一种混合方法，以提高IT项目成功的可能性。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文求助全文

来源期刊

Information and Computer Security COMPUTER SCIENCE, INFORMATION SYSTEMS-

CiteScore

4.60

自引率

7.10%

发文量

期刊介绍： Information and Computer Security (ICS) contributes to the advance of knowledge directly related to the theory and practice of the management and security of information and information systems. It publishes research and case study papers relating to new technologies, methodological developments, empirical studies and practical applications. The journal welcomes papers addressing research and case studies in relation to many aspects of information and computer security. Topics of interest include, but are not limited to, the following: Information security management, standards and policies Security governance and compliance Risk assessment and modelling Security awareness, education and culture User perceptions and understanding of security Misuse and abuse of computer systems User-facing security technologies Internet security and privacy The journal is particularly interested in receiving submissions that consider the business and organisational aspects of security, and welcomes papers from both human and technical perspective on the topic. However, please note we do not look to solicit papers relating to the underlying mechanisms and functions of security methods such as cryptography (although relevant applications of the technology may be considered).