Impacto de processos tecnológicos na segurança de sistemas: enfoque em micro, pequenas e médias empresas

• Adolfo Alberto Vanti ^[3] ; Pedro Solana-González ^[1] ; Sidia Maria Callegari-Jacques ^[2]
  1. [1] Universidad de Cantabria

     Universidad de Cantabria

     Santander, España

     
  2. [2] Universidade Federal do Rio Grande do Sul

     Universidade Federal do Rio Grande do Sul

     Brasil

     
  3. [3] Pesquisador CNPq / Proj. Universal, Brasil

  Mostrar afiliaciones +
• Localización: RISTI: Revista Ibérica de Sistemas e Tecnologias de Informação, ISSN-e 1646-9895, Nº. Extra 52, 2022, págs. 1-20
• Idioma: portugués
• Títulos paralelos:
  • Impact of technological processes on system security: focus on micro, small and medium-sized enterprises
• Enlaces
  • Texto completo (pdf)
• Resumen
  • português

    Este trabalho analisou o impacto de processos tecnológicos para o aumento das garantias de segurança de sistemas junto à 180 micro, pequenas e medias empresas situadas no sul do Brasil. Para tal se utilizou de análise quantitativa de níveis de maturidade de processos do modelo COBIT. Se revisou teoricamente as principais versões do COBIT e segurança de sistemas e metodologicamente foram usadas técnicas estatísticas de correlação linear simples de Pearson, correlação não paramétrica de Spearman e regressão linear simples e múltipla. Os achados em gestão estão relacionados com o processo tecnológico de conformidade dos requisitos externos para gerar aumento das garantias de sistemas, entre outros processos que relacionados trouxeram importância secundária ao processo decisório.

  • English

    This work analysed the impact of technological processes to increase system security guarantees for 180 micro, small and medium-sized companies located in southern Brazil. To this end, a quantitative analysis of the process maturity levels of the COBIT model was used. The main versions of COBIT and system security were theoretically reviewed and statistical techniques of simple linear correlation of Pearson, non-parametric correlation of Spearman and simple and multiple linear regression were used methodologically. The findings in management are related to the technological process of compliance of external requirements to generate an increase in system guarantees, among other related processes that brought secondary importance to the decision-making process.

• Referencias bibliográficas
  • Aguiar, J., Pereira, R., Vasconcelos, J., & Bianchi, I. (2018). Na overlapless incident management maturity model for multi-framework...
  • Alkhaldi, F., Hammami, S., & Uddin, M. A. (2017). Understanding value characteristics toward a robust IT governance application in private...
  • Argyris, C. (1996). Toward a comprehensive theory of management. In A. Edmondson & B. Moingeon (Eds.), Organizational learning and competitive...
  • Bernard, P. (2012). COBIT® 5 – A Management Guide. Amersfoort, NL: Van Haren Publishing.
  • Beyer, J., & Trice, H. (1987). How an organization’s rites reveal its culture. Organizational Dynamics, 15(4), 5-24. https://doi.org/10.1016/0090-2616(87)90041-6
  • Bonabeau, E. (2002). Predicting the unpredictable. Harvard Business Review, 80(3), 109-116.
  • Buccafurri, F., Fotia, L., Furfaro, A., Garro, A., Giacalone, M., & Tundis, A. (2015). An analytical processing approach to supporting...
  • Bulgurcu, B., Cavusoglu, H., & Benbasat, I. (2010). Information security policy compliance: An empirical study of rationality-based beliefs...
  • Davenport, T. H., & Prusak, L. (1998). Working knowledge: How organizations manage what they know. Boston: Harvard Business School Press.
  • Debreceny, R., & Gray, G. (2013). IT governance and process maturity: A multinational field study. Journal of Information Systems, 27(1),...
  • Dhillon, G., & Backhouse, J. (2000). Technical opinion: information system security management in the new millennium. Communications of...
  • Europol (2020). How COVID-19-related crime infected Europe during 2020. https://www.europol.europa.eu/publications-documents/how-covid-19-related-crime-infected-europe-during-2020....
  • Farazzmanesh, F., & Hosseini, M. (2017). Analysis of business customers’ value network using data mining techniques. Journal of Information...
  • Gao, F., Rau, P. L. P., & Zhang, Y. (2018). Perceived mobile information security and adoption of mobile payment services in China. In...
  • Gerl, A., von der Heyde, M., Groß, R., Seck, R., & Watkowski, L. (2021). Applying COBIT 2019 to IT Governance in Higher Education. In...
  • Gleiser, I. (2002). Caos e Complexidade: A evolução do pensamento econômico. RJ: Campus.
  • Grassegger, T., & Nedbal, D. (2021). The role of employees’ information security awareness on the intention to resist social engineering....
  • Hadlington, L., Binder, J., & Stanulewicz, N. (2021). Exploring role of moral disengagement and counterproductive work behaviours in information...
  • Hofstede, G. (1984). Culture´s consequences: international differences in work-related values. London: Sage Publications.
  • Information Technology Governance Institute - ITGI (2003). Board briefing on IT governance (2nd ed.). IL: IT Governance Institute.
  • Information Technology Governance Institute - ITGI (2007). CobiT 4.1: Framework, control objectives, management guidelines, maturity models....
  • Instituto Brasileiro de Governança Corporativa - IBGC (2015). Código das melhores práticas de governança corporativa (5th ed.). São Paulo:...
  • Instituto Brasileiro de Governança Corporativa - IBGC (2020). O que é governança corporativa. São Paulo: IBGC.
  • ISACA (2012). COBIT 5 – Modelo corporativo para governança e gestão de TI da organização. Rolling Meadows, IL: ISACA.
  • ISACA (2018). What is COBIT 5? Rolling Meadows, IL: ISACA.
  • ISACA (2021). Design guide and toolkit: Designing an information & technology governance solution. Rolling Meadows, IL: ISACA.
  • ISO/IEC 27002: 2007. Tecnologia da Informação – Código de prática para a gestão da segurança da informação. Rio de Janeiro: Associação Brasileira...
  • ISO/IEC 27032: 2012. Information technology: Security techniques: Guidelines for cybersecurity. Geneva: International Organization for Standardization.
  • Justitiaa, A., Zaman, B., & Putra, D. (2021). Evaluating the quality of a help-desk complaint management service using six-sigma and COBIT...
  • Kaplan, R. S., & Norton, D. P. (2004). Strategy maps: Converting intangible assets into tangible outcomes. USA: Harvard Business School...
  • Klir, G. J., Clair, U. H. S., & Yuan, B. (1997). Fuzzy Set Theory: Foundations and Applications. London: Prentice-Hall.
  • Malatji, M., Marnewick, A. L., & Von Solms, S. (2021). Cybersecurity capabilities for critical infrastructure resilience. Information...
  • Mintzberg, H. (1994). The rise and fall of strategic planning. New York: Free Press.
  • Mintzberg, H., Ahlstrand, B., & Lampel, J. (1998). Strategy safari: A guided tour through the wilds of strategic management. New York:...
  • Morgan, G. (1986). Images of Organization. London: Sage.
  • Morin, E. (2003). Introdução ao pensamento complexo (4th ed.). Lisboa: Instituto Piaget.
  • OECD (2018). G20/OECD principles of corporate governance. Paris, France: OECD Publishing. https://doi.org/10.1787/9789264236882-en
  • Peters, T., & Waterman, R. (1982). In Search of Excellence: Lessons from America’s best-run companies. USA: Harper Business.
  • Porter, M. (1990). Vantagem competitiva: criando e sustentando um desempenho superior. Rio de Janeiro: Campus.
  • Prahalad, C. K., & Hamel, G. (1990). The core competence of the corporation. Harvard Business Review, 68(3), 79-91.
  • Raisinghani, M. S. (2000). Knowledge management: A cognitive perspective on business and education. American Business Review, 18(2), 105-112.
  • Rohn, E., Sabari, G., & Leshem, G. (2016). Explaining small business InfoSec posture using social theories. Information and Computer Security,...
  • Safa, N. S., Von Solms, R., & Furnell, S. (2016). Information security policy compliance model in organizations. Computers & Security,...
  • Schein, E. (1992). Organizational Culture and Leadership. San Francisco: Jossey-Bass.
  • Shamala, P., Ahmad, R., Zolait, A. H., & bin Sahib, S. (2015). Collective information structure model for Information Security Risk Assessment...
  • Simon, H. A. (1961). Administrative behavior (2nd ed.). New York: Macmillan.
  • Simon, H. A. (1996). The sciences of the artificial (3rd ed.). Cambridge: MIT Press.
  • Slayton, R. (2021). Governing uncertainty or uncertain governance? Information security and the challenge of cutting ties. Science, Technology,...
  • Spears, J. L., & Barki, H. (2010). User participation in information systems security risk management. MIS Quarterly, 34(3), 503-522....
  • Trice, H., & Beyer, J. (1984). Studying organizational cultures through rites and ceremonials. The Academy of Management Review, 9(4),...
  • Weill, P., & Ross, J. W. (2005). IT governance: How top performers manage IT decision rights. USA: Harvard Business Review Press.
  • Wilkin, C., & Chenhall, T. (2010). A review of IT governance: A taxonomy to inform accounting information systems. Journal of Information...
  • Wright, P., Kroll, M. J., & Parnell, J. A. (1998). Strategic management: concepts and cases. New Jersey: Prentice Hall.
  • Young, R. F., & Windsor, J. (2010). Empirical evaluation of information security planning and integration. Communications of the Association...
  • Zadeh, L. A. (1965). Fuzzy sets. Information and Control, 8(3), 338-353. https://doi.org/10.1016/S0019-9958(65)90241-X