دانلود مقاله سیستم مدیریت پایدار ریسک فناوری اطلاعات با استفاده از مدل سیستم پایدار (VSM)
چکیده
مقدمه
پیش زمینه
کاربرد مدل سیستم پایدار (VSM) در حاکمیت فناوری اطلاعات
روش شناسی
یافته ها
نتیجه گیری
اعلامیه ها
منابع
Abstract
Introduction
Background
The Application of Viable System Model (VSM) in IT governance
Methodology
Findings
Conclusion
Declarations
References
چکیده
در سال‌های اخیر، برخی استانداردها و چارچوب‌ها، ساختارهای مدیریت ریسک را برای مدیریت و کنترل ریسک فناوری اطلاعات که جزء اصلی حاکمیت سازمانی فناوری اطلاعات است، پیشنهاد کرده‌اند. متأسفانه این چارچوب‌ها نگاهی گذشته نگر به تحلیل تهدید دارند و کمتر به تهدیدات آتی در محیط کسب و کار توجه می‌کنند و راه‌حل های سازگاری را پیشنهاد نمی‌کنند. در عین حال، چارچوب ریسک فعلی مبتنی بر مدل سازی سیستم علمی قوی نیست. در این تحقیق، محقق مدل سیستم پایدار (VSM) را به عنوان یک چارچوب سازگار و جامع که مبتنی بر مدل‌سازی علمی با رویکرد سیستماتیک برای مدیریت و کنترل ریسک فناوری اطلاعات در محیط کسب و کار پیچیده امروزی است، پیشنهاد کرد. این پژوهش به روش اقدام پژوهی سیستماتیک در زمینه بانکداری ایران انجام شد. نتایج نشان داد که با استفاده از VSM به عنوان چارچوبی برای مدیریت ریسک فناوری اطلاعات، می‌توان به سازگاری معیارهای ریسک فناوری اطلاعات با توجه به تهدیدات آتی توسط این چارچوب دست یافت. یک چارچوب جامع مدیریت ریسک (دیدگاه گذشته نگر و آینده نگر) با رویکردی سیستماتیک می تواند با این مدل سازی سیستم به دست آید.
توجه! این متن ترجمه ماشینی بوده و توسط مترجمین ای ترجمه، ترجمه نشده است.
Abstract
In recent years, some standards and frameworks proposed the risk management structures for managing and controlling IT risk that is the main component of enterprise governance of IT. Unfortunately, these frameworks have a retrospective view of threat analysis and less pay attention to future threats in the business environment, and do not propose adaptable solutions. At the same time, the current risk framework is not based on a strong scientific system modeling. In this research, the researcher proposed the Viable System Model (VSM) as an adaptable and comprehensive framework that is based on scientific modeling with the systematic approach for managing and controlling IT risk in today’s complex business environment. This research did in a systematic action research methodology in the banking context in Iran. The results showed that by applying the VSM as a framework for managing IT risk, adaptability of IT risk criteria according to the future threats can be achieved by this framework. A comprehensive risk management framework (retrospective and prospective view) with a systematic approach could be achieved by this system modeling.
Introduction
The development of new technologies in IT caused the increased complexity of this feld in recent years. Due to this complexity, the risk related to IT becomes more critical and if these risks ignored, it could be dangerous for achieving business objectives. Nowadays, IT risk management system became the main concern of senior managers of organizations. Meanwhile, many organizations that have not a good understanding of IT risk management systems have spent a lot of money to reduce IT risks, but they just waste their money and not successful in managing the IT risks. “Many organizations struggle with risk assessment and some believe that it shouldn’t be practiced at all! Many do some form of risk assessment, but often badly, or incompletely. Some just don’t bother, preferring an approach which relies on standards and baselines to manage the common risks, some just ignore the problem and trust to hope. (Coles and Moulton 2003)".
Risk is a combination of the probability of an event and its impacts (negative and positive) in business, which is usually referred to as the negative impacts that could be afected the business goals. Information Security Risk (ISR) is defne by ISO 31000 as “a combination of two factors: probability and consequences. It asks two basic questions: what is the probability that a particular information security event will occur in the future? And what consequences would this event produce or what impact would it have if it actually occurred? Information security risks often emerge because potential security threats are identifed that could exploit vulnerabilities in an information asset or group of assets and therefore cause harm to an organization” (Fazlida and Said 2015).
Conclusion
In this research, by applying the soft system models such as the VSM as an adaptable framework for managing IT risk, we can guarantee the adaptability and viability of the IT risk management system. The VSM has a strong scientifc foundation, which based on system science, cybernetics approach, and variety engineering and is a good candidate as a framework for IT risk management system because the dynamic changes of business /IT environment require an adaptable framework for managing IT risks for aligning and integrating IT risk strategy with the business risk strategy.
By using the variety engineering (Ashby law) in VSM, the front line employee is encouraged to manage the IT risk (creating autonomous system 1) and this can be helpful to increase the quality of IT risk management systems by managing risk at the front line (detecting and mitigating risk at the source). The results show us the best approach to manage the IT risk is building an autonomous system (system1) to deal with risk at the front line and VSM brings these benefts for us in system 1. By the communication channels between subsystems in VSM, a big picture of the current IT risk profle shared between the operational units (S1) and the management system and this can be helpful to establish a holistic approach in the IT risk management system. Therefore, the results show us that VSM can propose a holistic approach for IT risk management system, which has not been paying attention to this important point in any other risk framework. Not paying attention to a holistic approach in a risk management system can be a threat of duplicating risk analysis (wasteful work) in diferent units, which are working in the isolated environment.