Model for Assessing Measurable Aspects of Information Security in Higher Education

Abstract

In the higher education sector, there is a growing need to ensure the security and protection of information resources. The implementation of the ISO 27001 standard and the Information Security Management System (ISMS) helps in assessing the risks of security threats and attacks. Organizations, including universities, exhibit varying levels of commitment to information security, leading to variations in the development and implementation of ISMS. This highlights the need for a model to assess the current situation in the field of information security for each business institution. The model creation considers advice from the IT management framework – COBIT. Components are defined that indicate the level of quantitative characteristics and measurable criteria in managing ISMS. The research on the development level of the proposed model was conducted at several universities, applying fuzzy logic to specific elements. This model shows the results in a sequence from the lowest to the highest rating or weighted factor value, representing an assessment of the information security state at an academic institution. The model can also be used to assess the effectiveness of other parameters in areas such as ecology, health, workplace safety, and the economic business sector.