Toward a disciplined alignment in information security management

Information security and its management is one of the vital issues in today’s world. Many best practices and techniques are developed for the topic. These tools enable us to protect ourselves from malicious attacks, in theory. In reality, it is not uncommon to see large-scale security breaches happening in industry and public sector. To understand the situation, let us see a case in the Office of Personnel Management (OPM) (Committee on Oversight and Government Reform, 2016).

The OPM is a federal government agency in the USA. The agency implements federal human resources policy, oversight and support for federal government employees, retirees and their dependents. On July 4, 2015, the OPM disclosed that it was found to be attacked by an unknown attacker and over twenty million personnel records, including the background investigation results of counter-terrorism officials, were breached. Michael Hayden, the former director of the CIA, said that “[OPM data] remains a treasure trove of information that is available to the Chinese until the people represented by the information age off. There’s no fixing it” ^[1]. The OPM data breach is one of the most severe incidents in history. In contrast to Mr. Hayden’s argument, the report cannot show clear evidence of the culprit. It only enumerates circumstances, as is often the case in this sort of attack. This anonymity of the attack even emphasizes the shock of this unprecedented incident and its aftermath.

The OPM officials were not without tools to prevent the incident. For example, it was pointed out later that if an integrated circuit (IC) card-based authentication, which was standardized and promoted in advance, had been introduced earlier, the intrusion could have been prevented. Also, the US federal government has published many guidelines called the SP-800 series (NIST, 2008, 2011, 2012, 2013, 2014, 2018) for federal information security management to comply with the Federal Information Security Management Act (PL 107–347). That is, they had an enforcing law, detailed implementation guidelines and a technical solution to establish their security.

The critical factor behind this catastrophic result was strong pressure on their business. After the 911 terror attacks, the U.S federal government, vigorously promoting counter-terrorism policy dramatically increased the number of relevant personnel. “That staffing surge caused a backlog in processing background investigations. The backlog was at least 188,000 by 2004. The Intelligence Reform and Terrorism Prevention Act (PL 108–458) required that 90% of clearance applications had to be resolved within 60 days by 2009, a reduction of 84% from the then 375 days average wait time” ^[2]. Additionally, it was decided around the end of 2004 to consolidate to the OPM the relevant investigation tasks previously held in other departments and agencies. As a result, “it is not uncommon for existing policies to be circumvented in order to achieve business functions while exposing the entire agency to unnecessary risk” ^[3].

The OPM data breach is not a singular case. On June 1, 2015, the Japan Pension Service (JPS) announced that about 1.25 million records of privacy information had leaked out by an advanced persistent threat (Investigation Committee on Information Leakage due to Unauthorized Access, 2015; Verification Committee for the Incident of Information Leakage due to Unauthorized Access at Japan Pension Service, 2015; National Center of Incident Readiness and Strategy for Cybersecurity, 2015). This incident was also technically preventable; the breached information was assumed to be kept in the environment isolated from the internet. However, it was duplicated onto a shared file server accessible from the internet to ensure business efficiency. Japan’s government had plenty of guidelines too and the JPS had appointed several officers as information security authorities. It is interesting to note that the JPS was established for swift and proper management of the enormous amount of pension records. It was rooted in a political event known as the pension record problem, in which a significant amount of records were lost due to inappropriate operation and the JPS was, like the OPM, naturally under strong pressure as a result.

Both cases indicate serious issues in information security management. First, poor management, not technical issues, caused both problems. Second, management guidelines and strong regulations on information security were in place. Third, despite these circumstances, business operations took precedence over information security. This is nothing but a failure of information security management. Technical measures and codified best practices never make a difference if people are indifferent to implementing them.

This concept paper’s discussion unfolds in three principal stages. Initially, Section 2 clarifies the misalignment in risk conceptions between business or managerial stakeholders and security practitioners. This paper hypothesizes that such misaligned risk conception is the critical factor in catastrophic failures. Subsequently, Section 2 examines academic research offering potential pathways to address this divergence. Section 3 then addresses three communication gaps – analyzed as forms of misalignment – between researchers and practitioners. It also proposes strategies, primarily from the researchers’ perspective, to facilitate the effective translation of research findings into practice. Such translation, in turn, offers an opportunity for academic research to contribute to reconciling the misaligned risk conceptions identified in Section 2. Finally, Section 4 proposes a draft research program designed to reconcile these intertwined misalignments. This multi-disciplinary program would fuse insights from information security management standards, algorithmic risk assessment, enterprise architecture (EA), benefits realization management (BRM), project portfolio management (PPM), information security governance, systems engineering and the psychology of information security practices. Figure 1 depicts the structure of our discussion.

This concept paper aims to stimulate discussion and critical analysis of this proposed approach. While the author acknowledges limitations in his expertise and the potentially unfinished nature of this work, it represents an attempt to consolidate established research and best practices within the field. The primary focus is introducing a new perspective that may warrant further academic scrutiny and debate. The proposed research program intends to tackle issues in the managerial mechanism from the standpoint of (1) the misaligned risk conception by introducing tools with theoretically assured properties and (2) facilitating practical communication between practitioners and researchers. Through this two-faceted approach, the research program seeks to mitigate the types of failures exemplified by incidents such as those at OPM and JPS by presenting a mechanism actively fostering the aligned behavior of business and security practitioners.

Management standards, as compilations of best practices rooted in practitioner consensus, do not inherently carry scientific validation for their immediate effectiveness. It is particularly evident in risk analysis, where the absence of specific, universally accepted, objective methodologies within such standards often leaves practitioners struggling to translate high-level principles into concrete, reliable assessments. For their enduring relevance, a more scientifically grounded formulation is essential. While the precise nature of such a “scientific approach” is open to debate, any utilization of interdisciplinary insights – including those from management science – necessitates establishing a principled and systematic congruence between integrating such knowledge and its practical application. The research program discussed in this paper attempts to realize such principled and systematic congruence. It is this underlying concept that this paper proposes to term disciplined alignment.

This section examines critical issues within information security management, focusing initially on the fundamental misalignment in risk conceptions between managerial or business stakeholders and security practitioners. We will illustrate how this misalignment manifests in challenges such as insecure risk analysis, detachment from business risk considerations and alienation from corporate governance. Subsequently, for each of these problem areas, this section explores existing academic research and established practices from related fields – including attack graph analysis, EA and BRM – to identify potential approaches for mitigating these misalignments and fostering a more unified understanding.

Several well-known standards, such as Information Security Management System (ISMS) standards (ISO/IEC, 2005a; b, 2010) and the SP-800 series, codify the information security management framework. They are based on a common conceptual model, i.e. information security management is generally regarded as a type of risk management. The ISMS standards define the core process consists of the following four steps (ISO/IEC, 2016):

1. Risk identification: Identify risks relevant to the business.

2. Risk analysis: Examine individual and combinatorial risks’ detailed behavior and properties.

3. Risk evaluation: Determine whether the level of risk is acceptable.

4. Risk treatment: Take measures against unacceptable risks.

The combination of identification, analysis and evaluation is called risk assessment. The iteration of this series of steps is the common model in information security management.

The implicit assumption behind this model is that we can understand risks. Risks are supposed to be identifiable, inspectable and comparable with the predefined unacceptable level. On the other hand, risks involve some uncertainty by definition. Therefore, the model cannot be viable without somehow managing that uncertainty. If that uncertainty is handled inappropriately, risk identification, analysis and evaluation results become unreliable and the entire information security management process will be groundless.

At the same time, we must remember that information security management is an aid for smooth execution of the business, not the purpose. As with information security practices, the business requires many resources to run. General business activities and information security management compete for finite resources. If the business case for information security management is poorly supported, other business units will argue that the relevant resources should be spent on their activities.

As the situation above indicates, uncertainty handling is fundamental to information security management’s viability.

Federal organizations are mandated to assess risks periodically (Ross et al., 2006) and audits shall verify their actual performance. In the OPM case, audit reports had warned of widespread non-compliance with security controls for years. Just before the incident, the semiannual internal audit report (of the Inspector General, 2013) identified “deficient security controls” in the Personnel Investigations Processing Systems (PIPS), the system with the most significant security concerns. This problem further “deteriorated” after the incident and the OPM was criticized for leaving the systems without authorizations, including risk assessment (of Audits, 2015). The OPM had opportunities to recognize the risks but prioritized usual business over security.

When business activities conflict with security concerns, a mechanism is needed to ensure security implementation. This mechanism must function even under potentially unbalanced pressure from the business side. Proper security risk analysis is an essential foundation. If risk analysis suggests substantial risk but appropriate treatment is skipped, it indicates blamable negligence. Although not an information security matter, a seismic risk analysis case preceding the Fukushima nuclear accident highlights a crucial aspect of this issue.

The Japan National Diet commission’s investigation report (Fukushima Nuclear Accident Independent Investigation Commission, 2012) states that the commissioners “believe that the tsunami risk was underestimated … Meanwhile, with regard to severe accident countermeasures, the probabilistic safety assessment of tsunamis was deemed uncertain, so the consideration itself was pushed back and measures were not taken. As such, Tokyo Electric Power Co. used probabilistic evaluations in ways that suited them in order to avoid clarifying the tsunami risk.”

Risk is commonly defined as the combination of probability and impact. Underestimating probability can make risks seem insignificant. In information security, accurate statistics are often unavailable, making it easy to downplay risks by emphasizing uncertainty. Thus, risk analysis is susceptible to intentional underestimation.

Reliable information security management requires appropriately handling uncertainty and the analysis result should be robust. However, the well-known ISMS standards and SP-800 series, while organized as risk management frameworks, lack specific risk analysis methods. IEC 31010 (IEC/ISO, 2019), a reference standard, introduces 42 risk analysis methods, but most rely on analyst judgment or unavailable statistics, making it difficult for ordinary staff to obtain objective results. Similar limitations also apply to other local standards, such as ETSI CYBER (ETSI, 2017) in Europe, OCTAVE Allegro (Caralli et al., 2007) in the USA, IT-Grundschutz (für Sicherheit in der Informationstechnik, 2017) in Germany, EBIOS (ANSSI, 2019a, b) in France and MAGERIT (Crespo et al., 2006) in Spain. For example, EBIOS exemplifies a severity level table in which “long-lasting shutdown” is categorized as “critical” and “temporary shutdown” as “serious,” but the distinction between them depends on analyst judgment. Also, MAGERIT elaborates on the calculation rules for risk metrics without providing necessary source statistics. None of these standards eliminate uncertainty or analyst subjectivity, leaving them open to challenge.

If the remaining uncertainty allows irresponsibly rephrasing risks as ignorable, such discretion becomes a source of abuse. At the same time, it is partly legitimate to argue that security practitioners often prefer excessive security controls (Mersinas et al., 2016). Viable risk analysis should arbitrate the conflict about risk conception between business and security practitioners. Since we cannot eliminate every unknown factor, such arbitration must prevent the remaining uncertainty from undermining the process.

Many academic studies on information security risk metrics exist, e.g. Kordy et al. (2014), Ramos et al. (2017), Pendleton et al. (2017). Risk metrics enable us to compare the level of risks easily. However, we should distinguish the ease of comparison from the validity of the comparison results. Cremer et al. (2022) surveyed data availability and showed the shortage. Verendel (2009) points out the immaturity of the said quantitative metrics. Reliable quantitative risk metrics require that the input data are correct and that the metrics are well-tested, but both requirements are rarely satisfiable. These weaknesses are no different from those seen in the standards mentioned above. While these two issues should be resolved in the long run, we need careful consideration when using these metrics now.

Zio (2018) discusses risk assessment’s limitations and inherent characteristics and delineates it partly as a simulation of rare, critical events. The simulation represents integrated knowledge about the system and environment to be analyzed. Risk analysis based on simulated system behavior is called a model-based approach. Ramos et al. (2017) broadly survey model-based quantitative network security metrics. Although model-based approaches do not address the challenges posed by data and expertise shortages, they offer a valuable advantage: the ability to gain deeper insights into the mechanisms and characteristics of the risks involved. It could suggest, for instance, an effective security control to prevent the risk even when reliable statistics do not back the calculated metric. As Zio (2018) indicates, risk assessment is a means for rational decision-making and the essence of assessment is providing and extracting valuable insights for better decisions. Therefore, we can offset the inherent uncertainty in the analysis result with its practical implication; it is especially true for an approach separating uncertainty systematically from the result.

Attack graph analysis, comprehensively summarized in Zenitani (2023), is an approach worth elaborating on among past studies: a model-based approach for network security analysis generating and analyzing a directed graph called an attack graph. In one definition, it is a generalized and computerized variation of bottom-up fault tree analysis. We can obtain an attack graph from objectively identifiable information such as network topology, system configuration, distribution of vulnerabilities and known exploits. An attack graph is a consolidated depiction of logically possible attacks and the detailed steps of each attack are included there. The strength of this method is that (1) it is an algorithmic method based on objective, non-statistical data and could be suitable for implementation by non-experts and (2) it is a qualitative analysis basically, i.e. it enables security analyses separated from quantitative weighing of the result.

Phillips and Swiler (1998) proposed the first comprehensive framework of attack graph analysis. Since then, many forms of attack graphs have been examined. For example, state enumeration graphs (Jha et al., 2002) are a kind of finite automata. Exploit dependency graphs (Jajodia et al., 2005; Ou et al., 2006) are cyclic AND/OR graphs interpretable as a set of merged fault trees. Bayesian attack graphs (Frigault and Wang, 2008) are the recast forms of exploit dependency graphs as Bayesian networks and enable the probability calculation of malicious events if appropriate statistics are available.

We can choose the most suitable definition of attack graphs depending on data availability. In the absence of reliable data, using qualitative attack graphs like exploit dependency graphs can be a deliberate choice to avoid quantitative evaluation. In that case, we only know whether an attack is logically possible coupled with applicable security control candidates and evaluating the attack probability is delegated to additional weighing steps. Therefore, we can clarify the responsibilities of the business side, who may tend to underestimate risks, by involving them in the risk weighing and holding them accountable for their evaluations.

Decision-makers are not interested in the server malfunctioning incident itself but in the consequential impact on the business. The security experts’ knowledge is valuable for analyzing the incident effectively. The business impact, as mentioned earlier, cannot be clarified without the knowledge of business practitioners within the enterprise. Therefore, the risk assessment process requires joint efforts between the two parties, but such collaboration between people with different expertise is often challenging.

The very similar case, business-IT alignment has been a long-standing concern, with communication being a central issue. Luftman (2000) mentions the lack of mutual understanding and communication as a persistent challenge in achieving alignment. Similarly, Vermerris et al. (2014) found that projects lacking effective communication mechanisms between business and IT stakeholders often resulted in misalignment and lower business value. This is echoed in Hetemi et al. (2022), in which the authors discuss the importance of dialogue and collaborative practices in bridging the communication gap between technical and business teams in IT projects. Their study examines the difference in styles of communication and knowledge controls between the two parties.

In the OPM case, there was a considerable gap in the perceptions between those involved in information security and business practices. For several years before the incidents occurred, the OPM’s CISO and internal audit department repeatedly pointed out “material weaknesses” in information security management. In contrast, as quoted in the introduction, the OPM’s operational departments were uncooperative in implementing information security measures hindering their work. Furthermore, it is noteworthy that the US Congress, which was supposed to receive the audit report, supervise and guide the OPM, was also indifferent to information security. The OPM hearings in 2009 were concerned only with processing personnel cases and no questions were raised about information security ^[4].

The US federal government had much guidance on risk assessment. The law and the guidance were carefully examined and information security management practices were mandated under them. Thus, the lack of such a framework was not the problem.

One possible explanation for this misalignment is the immaturity of business risk analysis methods. As discussed in the previous subsection, no objective and reliable risk analysis method is widely used. It is even more true for business risk analysis, which is broader in scope. In the OPM case, the “material weaknesses” pointed out by the audit reports were mainly about non-conformance to the security regulation and were not the direct warning about clear and recent danger. It is unclear if the nature of business risk then was shared within the OPM. At least, the audit reports to Congress did not indicate possible business impacts in detail. The insufficient business risk description could explain the malfunction of the information security management in the OPM case, in addition to the uncertainty in risk analysis.

We need a trustworthy method for business risk estimation. The method should present incontrovertible facts under a vocabulary for both sides as the basis for further discussion. Without such a method, how can security professionals convince business practitioners of the need for cumbersome security controls? Cooperative dialogue between the two parties will be deadlocked easily without its aid.

EA is a method for understanding the complex relationship between IT infrastructure and business activities. Several well-known EA frameworks, such as Department of Defense Architecture Framework (DoDAF) (US Department of Defense, 2010) and Zachman Framework, have been proposed. Following these frameworks will help us describe the entire picture of an enterprise and understand the dependencies among various components, including business processes, digital services and infrastructure.

According to van den Berg et al. (2019), EA can significantly improve the quality of IT investment decisions by providing insights into the strategic fit of IT projects, their relationship with past and future investments and potential risks. Mavengere et al. (2020) highlight using EA modeling techniques to visualize and align business strategy with IT infrastructure, thus enhancing communication and collaboration between business and IT stakeholders. Niemi and Pekkola (2020) further emphasize that EA benefits extend beyond IT, influencing various organizational aspects and improving understanding and decision-making.

Enterprise Information Security Architecture (EISA) extends EA to provide a comprehensive view of security measures and their contributions. The Open Enterprise Security Architecture (O-ESA) (Wahe and Petersen, 2011) is an example of EISA, which primarily focuses on automating security monitoring and configuration management. It is now under the ownership of The Open Group but has not been updated for years. The Open Group also owns The Open Group Architecture Framework (TOGAF) (The Open Group, 2018) and ArchiMate (The Open Group, 2019); both are the de facto standards for EA frameworks. These frameworks are not EISA, but the integration with Sherwood Applied Business Security Architecture (SABSA), an EISA proposed by Sherwood (2005) independently, has been explored (The Open Group, 2011). These efforts give us a vocabulary to depict the whole picture of an enterprise, including security measures and its relevant business activities, while not a risk analysis method.

In the literature, several risk analysis methods are proposed based on business model descriptions parallel to EA. Innerhofer-Oberperfler and Breu (2006) suggested a conceptual EA framework and proposed a top-down dependency analysis method to evaluate the impact and probability of the risk. Breu et al. (2008) extended this study to elaborate on an algorithm for calculating the expected loss. Zambon et al. (2007a, b) proposed a business availability analysis method. Johnson et al. (2006) have combined EA and attack tree (fault tree) analysis. In this approach, an attack tree is represented as an extended influence diagram; thus, it can calculate the probability of incidents’ occurrence. Later on, Sommestad et al. (2008, 2009) proposed leveraging a metamodel designed with the predefined dependencies between attributes to produce the diagram. Johnson et al. (2013) incorporated the uncertainty in an enterprise model as probabilistic perturbation in the Monte Carlo simulation. We can regard these studies as EA-based risk analysis methods, but they are as vulnerable as the aforementioned risk analysis methods due to their dependence on reliable statistics.

Some research deals with business risk analysis as an extension of attack graph analysis. Froh and Henderson (2009) extended the inference rules used in attack graph analysis to accommodate the dependency between services and infrastructure. Johnson et al. (2016) proposed a threat modeling approach named “pwnpr3d,” integrating the idea of EA, attack graph analysis and the Time To Compromise metric. Sun et al. (2017) introduced mission impact graphs as an extension to the attack graph. Cao et al. (2018) refined and verified the approach by Sun et al. (2017) and it depicts the multi-layered form of attack graph analysis parallel to EA.

The theoretical basis of exploit dependency graphs, the adopted form of attack graphs in the above studies, is logic programming based on monotonic logic. Datalog (Ceri et al., 1989) is a restricted logic programming language that matches this class. We can use Datalog to develop libraries for risk analysis while enjoying its powerful expressiveness (Ou et al., 2005). The works by Froh and Henderson (2009) and Johnson et al. (2016) are in line with this intuition and in fact, Johnson et al. (2018) have proposed a domain-specific language called Meta Attack Language (MAL); this is theoretically a variation of Datalog with additional attributes. The expressiveness of this class covers a broad range of Tactics, Techniques and Procedures (TTPs) defined in MITRE ATT&CK (Tayouri et al., 2023).

The prior studies mentioned above indicate that, although they could be vulnerable too in the sense mentioned previously and there is still significant room for development, a theoretical foundation for risk analysis supported by powerful expressiveness can enable various risk analyses, including business risks.

While the content discussed above is a prerequisite for meaningful risk analysis and a necessary condition for risk management, it is insufficient. Even when risks are clear and agreed upon, stakeholders still compete for finite resources. Prioritizing information security above all else is unreasonable and decision-makers may legitimately limit risk treatments based on rational considerations. However, the line between reasonable and unbalanced restrictions can be blurry.

In the OPM case, “The Inspector General (IG) also found that the agency’s Office of CIO (OCIO) lacked the authority it needed to manage security matters effectively … and most (of the designated security officers, DSO) are only managing their security responsibilities as a secondary duty to their primary job function …. the OCIO has no authority to enforce security requirements” ^[5].

It is easy to say that the OCIO should have been given sufficient authority in retrospect. Unfortunately, determining the appropriate level of authority before the incident is complex. Remind that security practitioners can also be biased (Mersinas et al., 2016). Instead, we should focus on the fact that the DSO managed its security responsibilities as secondary.

Information security is a foundation for smooth business execution and its importance never subordinates to other business requirements. The DSO should have accurately recognized the danger of operational disruption when information security is compromised. More substantial OCIO authority without ponderation would enforce compliance without addressing the underlying issue. The DSOs’ conception of information security as secondary is unbalanced and is the focal misalignment that should have been addressed.

This sort of misalignment is generally exacerbated by inadequate public awareness of information security, as people tend to disregard what they need help understanding and alienate the tasks associated with those unknowns. It also applies to the members of Congress who did not raise any information security concerns during the OPM hearings. While education is crucial, we should remember that the investment of time and money for education also competes for finite resources.

Overall, we need a mechanism that naturally identifies and corrects hazardous misalignment when businesses mistakenly neglect information security efforts.

Deficits in information security management practices are often attributed to governance failures, prompting calls for reinforced oversight. However, such a simplistic view overlooks the interplay between information security and business objectives, where resources are constantly competed. While immediate empowerment of information security authority might offer a short-term fix, it risks long-term misalignment.

A more sustainable approach lies in fostering a shared understanding that information security enhances corporate value. However, quantifying such contribution is demanding and controversial. This is where BRM can offer valuable insights. BRM, a structured approach not specific to information security, focuses on clarifying the contribution of technical investments, particularly in IT (Peppard et al., 2007). By identifying, planning and managing the delivery of benefits throughout the investment lifecycle, BRM aligns IT projects with strategic business objectives (Serra and Kunc, 2015).

A key tool within BRM is the benefits dependency network (BDN), also known as the benefits map, which visually maps the links between investment objectives, expected benefits, necessary business changes and enabling IT capabilities. This visual aid serves as a communication bridge between IT and business professionals, fostering a shared understanding without reliance on technical jargon.

PPM is another strategic approach that complements BRM. PPM manages multiple projects as a cohesive unit to achieve organizational goals (Meskendahl, 2010). It involves processes such as project selection, prioritization, resource allocation and optimization to maximize the value and strategic alignment of the project portfolio (Reyck et al., 2005).

When combined, BRM and PPM create a dynamic system that aligns diverse perspectives, continuously monitors ongoing projects and optimizes their mix (Thorp, 2003). This system can be highly valuable for information security management, where technical, non-technical and business elements intersect. The system enhances decision-making and consensus-building by continuously capturing and controlling deviations from presumed success.

In the face of uncertainty, achieving absolute accuracy in risk management is impossible. At the same time, inaction due to imperfect information is equally irrational. Rationality lies in the thoroughness and balance of considerations during the decision-making process. A system like BRM and PPM, which maintains a clear focus on concerns, promotes understanding among stakeholders and enables continuous alignment, is a significant step toward improved decision-making and, ultimately, better information security management.

While the previous section introduced numerous research findings and related standards, their practical application in information security often lags. To bridge this gap and make these “tools” practically usable, certain prerequisites are missing. This is not about uncritically adopting academic outputs; research untested in practice risks remaining purely theoretical. Thus, practical validation and filling these voids are necessities that researchers should spearhead efforts to overcome. Accordingly, this section details these missing prerequisites as critical gaps including the initiatives researchers should lead to resolve them.

The field of information security research is vast and diverse, with a wealth of findings that often remain fragmented and difficult to synthesize. Indeed, the various approaches concerning risk analysis, business alignment and governance discussed in Section 2, while individually promising, often exemplify this fragmentation when practitioners seek comprehensive, actionable solutions. While numerous advanced studies exist, few researchers, let alone practitioners, grasp the complete picture.

In practice, information security necessitates combining technical and managerial solutions, spanning risk analysis, treatment and beyond. Encouraging research findings, coupled with the challenges of integrating diverse knowledge, underscore the immense potential of combining these approaches. For instance, we can integrate attack graph analysis with an extended EA framework to conduct comprehensive business impact analyses. These results could then be merged with a BDN work and communicated to stakeholders to formulate project portfolios and guide ongoing implementation and monitoring efforts.

Ensuring the reliable performance of individual research findings in combination remains a challenge. Exploring optimal, even feasible, combinations is a complex task that demands careful consideration, as highlighted in studies by Chung et al. (2013), Holm et al. (2015), Noel et al. (2016). It is unrealistic to expect practitioners to navigate and integrate them independently. Given the specialized knowledge required to interpret academic literature and assess interoperability, researchers play a crucial and irreplaceable role in identifying effective integrations.

By translating research findings into employable integrations, researchers can empower practitioners to make informed decisions based on a holistic understanding of the information security management landscape and available solutions. This effort would bridge the gap between theory and practice and enhance the overall effectiveness of information security initiatives.

While the information security research community is composed primarily of experts, the field of practice involves diverse stakeholders who may need to gain specialized knowledge in information security. Even if optimal integrations of research findings are identified, their effectiveness hinges on their accessibility and comprehensibility to practitioners.

Developing user-friendly tools and resources that effectively communicate research results to a broader audience is crucial. This includes creating guidance materials tailored for non-experts and developing educational resources to support training initiatives. Li et al. (2019) found that organizational efforts to enhance cybersecurity awareness and provide training significantly influence employees’ cybersecurity behaviors. These efforts should be a collaborative endeavor between researchers and practitioners.

However, as evidenced by the OPM data breach, the mere availability of guidance does not guarantee the successful implementation of information security management. Implementing well-researched and organized methods requires additional steps beyond providing guidance materials (AlGhamdi et al., 2020). These steps may involve addressing the cognitive and affective factors influencing employee compliance behavior (D’Arcy and Lowry, 2019; Bulgurcu et al., 2010).

Management standards, particularly in domains like information security, are often described abstractly to ensure broad applicability across diverse organizations. This inherent generality frequently poses challenges when practitioners attempt to translate these high-level principles into concrete actions tailored to their specific operational realities (Culot et al., 2021; Diesch et al., 2020). Such implementation difficulties can be exacerbated when attempting to fuse or harmonize standards from disparate management domains, such as information security management and BRM, a process which can lead to confusion and ineffective implementation due to overlapping efforts and structural differences between models. The integration of various standards, for instance, can present substantial issues related to differing scopes, requirements, partial overlaps and terminology (Wangenheim et al., 2010). Managerial best practices often rely on tacit knowledge and experience, resembling an art rather than a science.

Researchers can contribute by providing practitioners with a rich repository of detailed case descriptions that illustrate the application of abstract management standards to specific contexts could significantly aid practical implementation, as the current lack of precise methodological indications can translate into inaccuracies and an easy-to-understand toolkit is often missing. At a minimum, failing to offer such elaborated examples and instead assigning the responsibility of detailed concretization solely to practitioners – who may not always be fully competent with the underlying concepts of the standards – risks leading to significant practical difficulties and a fallback to ad-hoc implementations.

Information security is a practical science, seeking solutions within a changing societal landscape rather than pursuing eternal truths. Actual practices must validate the value of studies in this field. Nevertheless, the sensitive nature of information security prevents organizations from openly sharing details about incidents, practices and even policies. The unavailability of public data identified by Cremer et al. (2022) reflects this constraint. This lack of transparency constrains most security studies to lack practice-based validation and depend on conceptual elaboration and numerical experiments. Limited communication between researchers and practitioners impedes advancements and creates a disconnect between research and practice.

From a practitioner’s perspective, this lack of validation introduces uncertainty into their work. When perceived security levels are insufficient, the root cause could lie in implementing standardized best practices or in the design of those practices themselves. Distinguishing between these two is crucial, as the latter necessitates tailoring. It is easier said than done, as understanding the nuances of best practices requires specialized expertise that only some practitioners possess. The DSOs in the OPM case exemplify this issue, as they were chosen among non-security professionals.

Researchers can address this challenge by developing accessible validation benchmarks that incorporate the latest research findings and providing guidance on their interpretation and use in different contexts. Such benchmarks could provide practitioners with a clearer understanding of the expected outcomes of implementing best practices, facilitating the identification of implementation issues and the need for specific tailoring.

The hand-in-hand relationship between researchers and practitioners is the basis of sound information security management research and practice. Here, we try to clarify what researchers can do to build mutual trust. It is a research program devoted to establishing a concrete and robust foundation for fulfilling the aforementioned three gaps.

The initial step is to define and elaborate on how to integrate state-of-the-art research findings in the field of information security into actionable solutions for practitioners. To address the fragmentation of tools and methodologies highlighted in Section 3.1—particularly concerning the array of approaches introduced in Section 2 – this initial step of the research program focuses on establishing a framework for their employable integration. This framework organizes, from a perspective of logical consistency, the interrelationships among the approaches mentioned in Section 2.2 to Section 2.4, ensuring they function effectively when applied to the corresponding issues. The following three tiers are structured accordingly, each corresponding to one of these respective sections:

1. Foundational theory of secured risk analysis: The first tier should establish a rigorous mathematical foundation for categorizing risk descriptions based on their robustness against intentional undervaluation. Separating qualitative analysis from quantitative evaluation could serve as a potential starting point and attack graph analysis is a candidate for further development.

2. Library and techniques for business risk analysis: Building upon the mathematical foundation of the first tier, the second tier should enable comprehensive business risk analysis leveraging the robustness established in the previous tier. Business risks encompass a broader vocabulary than simple security incident analysis, necessitating a library of clearly defined relevant elements. This tier should also incorporate business risk analysis algorithms coupled with this library.

3. Concrete process model focusing on consensus-building with explicitly stated grounds: The business risk analysis mentioned above enables discussions among stakeholders in a manner more relevant to the actual value of their business. Still, inherent uncertainties necessitate a focus on consensus-building rather than relying solely on systematic procedures. The consensus-building process should meticulously document the premises and referenced information used in decision-making for future reference and audits. This tier provides a management process model that leverages the robust business risk analysis method defined in the base tiers while securing the preservation of decision inputs. This process model does not immediately imply validation but provides a foundation for enabling objective validation.

Researchers can independently initiate the development of various integrated methodologies based on the three tiers outlined above. The resulting deliverable would be a suite of carefully chosen techniques encompassing the full spectrum of information security management. This comprehensive resource would be a foundation for further communication and collaboration between researchers and practitioners.

As Section 3.2 elaborates, a key element of this research program involves developing and disseminating practical and detailed case descriptions. Given that real-world examples fully embody the integrated methodology proposed herein, such cases will likely emerge only as the research program matures and the initial creation of illustrative hypothetical scenarios is considered essential. These meticulously constructed cases depicting varied security landscapes and management challenges can serve as valuable “living textbooks” for practitioners seeking to translate abstract concepts into their specific operational contexts.

A significant advantage of these hypothetical case studies is their independence from the disclosure sensitivities often associated with real-world corporate security information. This characteristic permits the research community to openly share, rigorously analyze and iteratively refine them. Consequently, such detailed imaginary scenarios can function effectively as reference testbeds, facilitating the testing, validation and further development of the methodologies and tools advanced within this research program.

The proposed integration is just a hypothesis and we need to test it repeatedly and refine it gradually. This iterative improvement is a joint effort of researchers and practitioners. Both parties have their responsibility and role in accomplishing the contribution. Therefore, it is of critical importance to have criteria that verify and validate the implementation of each party’s effort.

Verification criteria examine the practitioners’ implementation of the integrated methodology. It corresponds to the gap in Section 3.3 and should focus on the factors affecting the successful performance, including, for instance, governance structure, internal compliance in the handling of risk register, accuracy and exhaustiveness of configuration management and level of general risk awareness among an enterprise.

Validation criteria provide multi-faceted viewpoints for the definition of successful implementation of information security management. The key question behind the evaluation should be the alignment with the ideal concept and the business value—the former alignment tests practitioners’ level of understanding of the articulated methodology. In contrast, the latter alignment implies that any information security management practice is justified when and only when it contributes to the business value.

While clarifying these criteria requires substantial research, existing studies and best practices can serve as a starting point. These are not novel concepts. It is legitimate to find a similarity with the Verification and Validation model (Hirshorn et al., 2017). Within the proposed research program, the criteria have a specific role in facilitating communication and mutual trust between researchers and practitioners. Therefore, these criteria should be framed as suggestions rather than rigid constraints, functioning as a protocol to reduce miscommunication and foster collaboration.

Here, we present a blend of past studies and best practices as an implemented case of the proposed research program. It is not a recommendation but an experimental suggestion that might work in practice. It is an imaginary best practice of disciplined alignment. This subsection clarifies how the components discussed above work together.

We outline the practical application of the proposed three tiers, showcasing their potential relevance and feasibility.

1. Foundational theory of secured risk analysis: Utilize attack graph analysis with exploit dependency graphs, ensuring a clear separation of qualitative analysis from quantitative evaluation. This is inherent to the mathematical nature of exploit dependency graphs. Moreover, multi-resolution attack graph analysis (Zenitani, 2022) provides a mechanism robust against risk underestimation, as fewer investments in analysis inherently overestimate risk scenarios.

2. Library and techniques for business risk analysis: Attack graph analysis is essentially a logic programming process, where each risk analysis becomes the development of a risk analysis program. Languages like MAL (Johnson et al., 2018) or Datalog can be used for this purpose. EA frameworks (e.g. TOGAF, ArchiMate) provide a core vocabulary for describing the enterprise, while security-specific vocabulary can be drawn from past studies (Ou et al., 2005; Tayouri et al., 2023). The integration of enterprise and security descriptions has been well-documented in previous research (Froh and Henderson, 2009; Sun et al., 2017; Cao et al., 2018). The tool “pwnPr3d,” developed by Johnson et al. (2016), is a working example of such integration.

3. Concrete process model focusing on consensus-building with explicitly stated grounds: The tools from the first two tiers enable qualitative and quantitative risk assessment. Quantitative evaluation requires acceptance of potentially incomplete statistics, necessitating an authorization process. Integrate this process with the definition of outcome/benefit measurement in BRM. Combining PPM with attack graph analysis and enhanced BRM formalizes the information security governance process. This clarifies accountability for risk assessment and facilitates communication between security practitioners and business stakeholders, aided by BDN. Antunes and Guerreiro (2020) also discuss using ArchiMate to incorporate BDN. The entire process should be digitally recorded for post-audits and learning.

In addition to the above three tiers integration, a public repository hosting vocabulary from the second tier can also serve as a library of imaginary cases, depicting EISAs of hypothetical enterprises. These cases provide templates for practitioners and enable researchers to conduct numerical experiments for metrics development, algorithm research and design pattern exploration.

The verification and validation criteria are given as a part of the handbook explaining the usage of the above three tiers of deliverables. Regarding criteria, it is better to have an online observatory to continuously gather information about the verification and validation benchmarking results among practitioners. It enables researchers to identify the problems in the designed system and practitioners to quickly comprehend their conformance level or maturity to the best practice.

The description above is not a definitive solution, but a potential path forward. The theoretical tools are available, but further academic scrutiny and debate are necessary to fully realize the working mechanism.

Let us review what we have discussed up to here. Firstly, we have put our attention on the OPM case. It depicted the catastrophic failure of information security management. Subsequently, we have enumerated the issues in information security management and the researchers’ efforts to tackle those issues. The main concern was the misaligned conception of information security between security practitioners and business staff. Then, we have examined further the gaps between information security researchers and practitioners. The gaps impede positive collaboration in continuously advancing research and practice. Lastly, we have proposed a draft of a research program to reconcile those misalignments.

The focus is on the misalignment between security practitioners and business staff and that between researchers and practitioners. At the very beginning, we must accept that we cannot eliminate all the uncertainties. We can only behave, at best, rationally to cope with the inherent uncertainty in the world. At the same time, every person struggles to thrive and has the right to choose one’s action based on their standpoint, which is rational behavior. The failure in management is often a by-product of conflicts among those different rationalities. Integrating each stakeholder’s perspective in a way overcoming the conflicts shall contribute to the organizational mission at its best performance.

The alignment in stakeholders’ conceptions and behaviors is the foundation of the best risk management and should be scientifically disciplined if we want to replicate it everywhere in need. Such an attempt to make a new discipline requires the definition of alignment and evaluation criteria for the level of alignment, the process model for consensus-building and the method for explicit and objective descriptions of decision-making materials. The combination of making employable integration of existing studies and defining verification and validation criteria is a starting point of this research. It is a mixture of science and practice, enables further collaboration between researchers and practitioners and facilitates cooperation between business and security practitioners towards a disciplined alignment.

This article is presented as a concept paper, aiming to stimulate discussion by proposing an initial framework for disciplined alignment in information security management and a corresponding research program to develop this notion further. As introduced herein, the concept represents a foundational proposal rather than a fully matured theory. While this paper outlines its essential components and intended direction, the proposed framework’s precise definition, scope and operationalization warrant ongoing academic discourse and refinement through practical application.

As a concept paper, this article does not report empirically validated research findings. Rather, it represents an organized articulation of the author’s critical perspectives and awareness of the issues, structured primarily to invite further discussion and debate. Consistent with this conceptual nature, the gaps between research and practice identified in Section 3 are based on the author’s experience and a broad review of existing literature rather than a systematic empirical investigation or a formalized literature review protocol. Consequently, the list of gaps presented does not intend to be exhaustive and other significant impediments to the practical application of research findings in practice may exist. The primary purpose of identifying these gaps was to highlight critical areas the proposed research program could contribute to developing the aforementioned guiding principle. Future empirical research is beneficial to further validate, refine and expand upon the gaps discussed herein, which inform its ongoing development.

Similarly, the practical feasibility, effectiveness and potential challenges of implementing the proposed three-tiered integration and the associated processes – and its further articulation – will require substantial future study. The research program intends to lay a foundation and provide a structured direction for such endeavors rather than presenting a complete, validated solution or a finalized theoretical construct.

This article refers to the OPM data breach to discuss the issues in the information security management concept. We pointed out three issues: vulnerability to intentional sophism in information security risk analysis, immaturity in business risk analysis methods and the tendency of information security decoupling from corporate governance. These reflect the misalignment between security and business practitioners’ conceptions. Although information security researchers have made several approaches to these challenges, there is plenty of room for further development. There are also gaps between researchers and practitioners that inhibit the productive collaboration of the two parties. Those gaps are the lack of employable integration of existing studies, the lack of detailed case descriptions and the lack of verification and validation criteria with the communication process of actual cases. A draft research program is proposed to overcome these issues and build mutual trust among researchers and practitioners. It urges the employable integration of existing studies and clarifies the verification and validation criteria for practices to facilitate the reconciliation of risk misconceptions between business and security practitioners. All these efforts shall contribute to the broader collaboration toward the disciplined alignment of managerial activities.

The author wishes to acknowledge Dr Keisuke Tanaka, Professor in the Department of Mathematical and Computing Science, School of Computing, Tokyo Institute of Technology, for reviewing and providing constructive advice on the drafts of this article. Several AI tools, including Google Gemini, Grammarly and DeepL, have assisted in writing this article.