Matthijs Van Oers

Leon Strous

Ron Berndsen

Infrastructure Protection in the Dutch Financial Sector

Keywords: Financial sector, protection, payments and securities systems

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

After the September 11, 2001 terrorist attacks in the United States, the Dutch Government sent a letter [START_REF]Brief van de Minister-President, Minister van Algemene Zaken en van de Ministers van Justitie, van Binnen-Landse Zaken en Koninkrijksrelaties[END_REF] to the Dutch Parliament that included an action plan for anti-terrorism and safety [START_REF]Ministry of General Affairs, Actieplan Terrorismebestrijding en Veiligheid[END_REF]. This plan formed the basis for critical infrastructure protection efforts in The Netherlands and resulted in a detailed 2005 report [START_REF]Ministry of the Interior and Kingdom Relations, Rapport Bescherming Vitale Infrastructuur[END_REF] that described the critical sectors, their vulnerabilities, existing protective measures, new measures and follow-up actions. This report was used as the foundation for sector-specific efforts on critical infrastructure protection, including efforts in the financial sector.

Although critical infrastructure protection efforts initially focused on antiterrorism and safety, the goal of critical infrastructure protection has evolved to include resilience in the face of disasters and other events as well as mitigating their risk and impact. For example, the threat of flooding, which is highly relevant in The Netherlands, is considered to lie within the scope of critical infrastructure protection.

Critical infrastructure protection is an essential activity for public and private entities. Issues that need to be addressed in a successful critical infrastructure protection approach are: (i) scope of protection; (ii) appropriate or- ganizational structures; (iii) required levels of protection; and (iv) measures required to achieve the required levels of protection. Solutions that address these issues are by no means straightforward and different solutions exist for different sectors and different countries.

This paper presents a case study of critical infrastructure protection in the Dutch financial sector. The organizational structures for critical infrastructure protection in The Netherlands are provided along with an assessment of their effectiveness. A general model for critical infrastructure protection that is applicable to other sectors is also presented. Note that the emphasis is on sector-specific issues, not on the more general functions of government (e.g., disaster and crisis management by police forces and other emergency services).

Dutch Financial Sector Approach

This section provides an overview of the critical infrastructure protection approach adopted by the Dutch financial sector.

2.1

Sector-Specific Protection

The first phase of critical infrastructure protection efforts in The Netherlands occurred from 2001 to 2005. The government and stakeholders, including The Netherlands Bank (DNB) (also known as the Dutch Central Bank) produced a report [START_REF]Ministry of the Interior and Kingdom Relations, Rapport Bescherming Vitale Infrastructuur[END_REF] that defined and identified: (i) the critical infrastructure as a whole; (ii) critical sectors; (iii) critical products and services in the critical sectors; and (iv) critical points.

Included in the report were major risks and vulnerabilities with regard to the financial sector (e.g., terrorism, natural hazards and cyber crime). Note that financial risk is not within the scope of critical infrastructure protection -the financial risk of individual institutions is specifically addressed by prudential supervisors whereas overall financial stability is primarily the responsibility of the central bank. The Netherlands Bank introduced the concept of the financial core infrastructure (FCI), which comprises the most important institutions in the Dutch financial sector. Figure 1 highlights the main concepts related to financial sector protection in The Netherlands from the broadest to the most specific.

The Dutch critical infrastructure encompasses the sectors that, if disrupted, could have a serious impact in terms of human casualties, economic losses and/or societal upheaval. Within the financial sector, payments and securities are identified as critical products and services. The critical points are defined as the buildings, installations, systems and geographical regions that are necessary for delivering the critical products and services. Note that critical points, which include large data centers that provide services to financial institutions, are not necessarily owned by FCI institutions nor are they under financial regulation. For security reasons, the list of critical points is not publicized by the government.

Critical Products and Services

A financial infrastructure protection working group established in 2005 identified payments and securities as critical products and services in the Dutch financial sector. Although a disruption of the payments and securities infrastructure would not directly lead to human casualties, a major outage could have serious consequences, including societal upheaval.

The payments and securities domain can be categorized as: (i) retail payments; (ii) wholesale payments; and (iii) securities. The distinction is intended to emphasize the differences with respect to products, customers, institutions and regulators.

Retail Payments Domain: This domain consists of payment systems, products and services for consumers and corporations, along with the accompanying infrastructures. Examples of products are debit cards, credit cards, money transfers, cash payments and direct debits. Institutions involved in processing retail products are banks, automated clearing houses (ACHs) and payment settlement infrastructures.

Wholesale Payments Domain: This domain consists of the inter-bank payment infrastructures and actors involved in large value (low volume) payments, foreign exchange and other money market products. Institutions involved in processing wholesale payments include operators of settlement systems, banks and institutions that conduct foreign exchange transactions (e.g., CLS).

Securities Domain: This domain consists of trading platforms for equities and derivatives and the accompanying clearing and settlement infrastructures along with their various actors. The institutions include exchanges (e.g., NYSE Euronext) and clearing and settlement infrastructures (e.g., LCH Clearnet, EMCF and Euroclear).

Note that the payments and securities infrastructure is international in its scope and is very reliant on information and communications technology. Indeed, many financial organizations deliver cross-border services to a multitude of customers. Interested readers are referred to [START_REF]The Payment System[END_REF] for a detailed description of the various products and services at the European level.

Dutch Financial Infrastructure

The 2005 financial infrastructure protection working group established an initial list of critical institutions. However, the working group did not develop a formal method to evaluate institutions on a recurring basis. In the following, we describe the method for listing an institution as an FCI.

The Netherlands Bank is responsible for compiling the FCI list in collaboration with the Ministry of Finance and the Netherlands Authority for Financial Markets. The following qualitative criteria are used in the determination: Disruption of the institution leads to large economic losses or large-scale civil unrest.

The institution is directly supervised and regulated by the appropriate Dutch authorities, namely The Netherlands Bank and the Netherlands Authority for Financial Markets.

Institutions are added to the FCI list if their total transaction volume or value is in the top 80% of all financial institutions. The application of the criteria identified six institutions in the retail payments domain, five in the wholesale payments domain and seven in the securities domain, yielding a total of fourteen institutions in the Dutch FCI list (some institutions are listed in more than one domain). Note, however, that The Netherlands Bank has the discretionary power to add or remove an institution if special circumstances warrant.

An organization identified as an FCI is susceptible to the following additional regulatory requirements:

Compliance with The Netherlands Bank Business Continuity Assessment Framework [START_REF]The Netherlands Bank, Assessment Framework for Financial Core Infrastructure, Business Continuity Management[END_REF]. Participation in the financial sector's Crisis Management Organization to address operational disruptions of the payments and securities infrastructure.

Participation in the Dutch terrorism alert system. Participation in meetings of the Business Continuity Platform for Critical Infrastructure Protection.

Participation in market-wide simulation exercises.

Critical points can be, but are not necessarily part of, institutions in the FCI list. The identification of critical points is primarily the responsibility of FCI institutions as part of their regular risk managements and business continuity processes. Note that specific arrangements are made for critical points that are deemed essential to the entire financial sector (e.g., Swift, which provides secure financial messaging services).

International Context

The starting point for critical infrastructure protection is often a nationallydriven program. However, many financial market infrastructures operate across international borders. Indeed, regulation and oversight are often considered per institution and not per country. In the financial sector, oversight is a central bank function whose goal is to mitigate systemic risk while contributing to the smooth operation of the payments system. For example, crisis management of Target2, the European real-time gross settlement system for inter-bank payments, is led by the European Central Bank in collaboration with the other Eurosystem central banks.

In the European context, critical infrastructure protection in the financial sector focuses on the most important institutions in the European Union. This set includes all the institutions that have been identified by their home countries as critical.

Organizational Structures and Measures

After defining the scope of protection, the next step is to determine the organizational structures, adequate level(s) of protection and appropriate protection measures. In most cases, organizations leverage structures that are already in place and modify them as required to incorporate critical infrastructure protection tasks. Developing the right organizational structures for critical infrastructure protection within a sector, however, does present some challenges. Commercial parties are driven by profit and are not always prepared to invest in projects that add costs. Additionally, organizations are reluctant to share information necessary for critical infrastructure protection efforts to external entities, especially competitors. Overcoming these challenges demands a government authority or regulator to take a lead role. Also, the organizational structures should strike a balance between the demand for resources and the ability to obtain tangible results.

The development of measures for protecting critical infrastructures typically draws on experience, relevant events and historical data. This approach, however, is not well suited to dealing with events that manifest themselves only a few times in history such as a pandemic or the September 11, 2001 terrorist attacks. Indeed, the Fukushima nuclear disaster in 2011 demonstrates that historical information does not provide adequate guidance for protecting against unexpected events.

The success of a critical infrastructure protection approach is strongly influenced by the organizational structures and protective measures. The organizational structures can be categorized as: (i) public; (ii) public-private; and (iii) private. The protective measures can be divided into two types: (i) preventative measures that increase the resilience of critical processes; and (ii) corrective or responsive measures that decrease the impact of a crisis.

The Dutch financial sector engages a mixture of organizational structures and measures to enhance FCI resilience (Table 1). Note that this paper focuses Although regulators and policy makers have different scopes, objectives and approaches, all of them have the common goal of financial sector stability. The institutions and organizational structures issue standards (e.g., guidelines, rec-ommendations, principles and expectations) and/or perform supervision and oversight. The supervisors and overseers regularly assess the operational reliability, security and business continuity against the standards.

FCI institutions must comply with the requirements of The Netherlands Bank Business Continuity Management Assessment Framework [START_REF]The Netherlands Bank, Assessment Framework for Financial Core Infrastructure, Business Continuity Management[END_REF]. These principle-based requirements address several areas: strategy and policy, business impact analysis and risk analysis, scenarios and measures, testing and monitoring, management and maintenance, and crisis management and communications. The principal-based requirements leave options for institutions to develop their own solutions, unlike rule-based requirements that prescribe exactly what must be implemented.

Additionally, the Ministry of Finance, The Netherlands Bank and Dutch intelligence community collaborate closely on critical infrastructure protection initiatives. These entities develop policy reports and perform threat analyses on a regular basis.

Public-Private Structures.

There are two main reasons for establishing public-private partnerships for critical infrastructure protection. The first is that critical infrastructures incorporate both private and public investments; protecting these infrastructures is the task of the central government and requires collaboration with private sector asset owners and operators. The second reason is that public-private partnerships facilitate the management of crosssector dependencies. The financial sector, for example, is heavily dependent on the telecommunications and energy sectors. Cooperation is required in order to optimize the level of protection. Cross-sector cooperation can also occur in private partnerships, but experience has shown that some form of public interaction or initiating force is key to success.

The following public-private partnerships have been instituted in the Dutch financial sector:

Business Continuity Platform for the Critical Infrastructure Financial Sector (BC-CIF): The Netherlands Bank initiated and currently chairs this platform whose goal is to share knowledge and best practices on business continuity and crisis management between FCI institutions and with the Ministry of Finance. The platform serves as a coordination point for the financial sector with regard to governmental critical infrastructure protection initiatives. Examples of the shared information are best practices related to outsourcing of critical processes and vendor requirements.

Working Group on Alerting to Terrorism in the Financial Sector (WAFS): This working group was created to facilitate the exchange of information on terrorism threats, anti-terrorism measures and the terrorism alert system. The Netherlands Bank chairs the working group, which includes FCI institutions, intelligence agencies and the Ministry of Finance. The working group has developed and implemented anti- terrorism measures that are activated depending on the threat level. The working group entities are connected to the terrorism alert system (organized, funded and operated by the government), which is designed to alert institutions in the critical infrastructure sectors to terrorist threats. Every critical sector in the Netherlands is connected to this system. Currently, the terrorism alert system is designed to warn of physical threats; however, efforts are underway to extend the system to include cyber threats.

Financial Institutions Information Sharing and Analysis Centre (FI-ISAC):

The goal of FI-ISAC is to exchange information between banks, infrastructures and government organizations in order to prevent and respond to cyber security incidents that could lead to fraud, loss of reputation and other risks. The FI-SAC works closely with the National Cyber Security Centre (NCSC).

Sector Crisis Management: This sector-level structure is designed to perform corrective and responsive actions in the event of a major disruption to the payments and securities infrastructure. The structure comprises the Tripartite Crisis Management Organization (TCO), which incorporates the Ministry of Finance, Netherlands Authority for Financial Markets and The Netherlands Bank as board-level entities. A Consultation Group consisting of board members of FCI institutions, and various Advisory Groups provide recommendations to the TCO. The TCO is supported by a Permanent Secretariat (PS) that helps manage collaboration. Figure 2 presents the crisis management structure for the payments and securities infrastructure. Cross-Sector Cooperation with the Telecommunications Sector:

In order to manage the effects of interdependencies in the financial sector, Platform BC-CIF started a collaboration with the National Continuity Forum for the Telecommunication Sector. An example of this collaboration is a jointly-organized crisis management exercise that seeks to strengthen cross-sector resilience.

Private Structures.

No specific private partnerships related to critical infrastructure protection currently exist in the Dutch financial sector. However, a few structures have been created that indirectly support critical infrastructure protection goals. An example is a task force organized by the Dutch Bankers Association to address cyber crime threats.

Cross-Border Structures and Measures

Nationally-oriented critical infrastructure protection is limited because the majority of the financial market institutions operate across national borders. Indeed, critical infrastructure protection in the financial sector is quite complex with regard to coordination, legal aspects, ambiguities of roles and responsibilities, and vulnerabilities. Currently, the only cross-border collaborations that exist are public-only partnerships involving the European System of Central Banks and the Bank of International Settlements (BIS). These entities coordinate oversight, standard setting and crisis management activities across the Eurozone, European Union as well as globally. An example standard is the CPSS-IOSCO Principles for Financial Market Infrastructures [START_REF]Committee on Payment and Settlement Systems, Payment and Securities Principles for Financial Market Infrastructures, Bank for International Settlements[END_REF].

Table 2 summarizes the cross-border collaborations and structures related to critical infrastructure protection in the financial sector. Clearly, cross-border coordination is still in its infancy and is an area that needs improvement.

Challenges

In general, critical infrastructure sectors are relatively easy to identify (e.g., energy, telecommunications, finance and health care). However, in some sectors, it is difficult to identify the critical services and processes, institutions and components. This is often the case in a highly networked infrastructure where small components can be essential to the overall function.

A large number of critical components in a sector can render it difficult to manage effectively. Alternatively, a small number of critical components can induce neglect and complacency with regard to overall critical infrastructure protection efforts. It is important to recognize these situations and strike the right balance when prioritizing assets.

In the case of a major disaster that impacts multiple sectors such as energy and telecommunications, services from the various sectors tend to recover at different rates. This may create serious problems when one sector is dependent on another. Due to resource limitations, sectors must set priorities according to the most critical societal functions and contractual obligations.

To increase the resilience of the critical infrastructure, it is recommended to maintain the transparency of priorities to the extent possible. Transparency facilitates preparatory efforts that lessen the impact of a disaster and helps clarify the lines of responsibility of public and private sector entities.

Finally, critical infrastructures are becoming more complex, more interconnected and, in many cases, they extend beyond national borders. These developments increase the difficulty in defining organizational structures for critical infrastructure protection. Indeed, there is an urgent need to address this issue going forward.

Analysis

Significant critical infrastructure protection efforts have been undertaken in the Dutch financial sector. The question is whether these efforts have resulted in effective organizational structures for critical infrastructure protection.

Assaf [START_REF] Assaf | Models of critical information infrastructure protection[END_REF] has shown that intervention with regard to critical infrastructure protection efforts ranges from pure state provisions to pure market-driven provisions. The types of intervention are identified as: command and control, delegation to agency, delegation to agency plus negotiations, enforced self-regulation and voluntary self-regulation.

The choice of the level of intervention is based on the distinction between two regulatory models for critical infrastructure protection, the national security model and the business continuity model. The national security model focuses on security and public safety, and leads to critical infrastructure protection with a preference for government intervention. The business continuity perspective is based on neoliberal economic values. Business continuity is viewed in terms of return on investment and risk management; thus, the model results in a preference for market provisions. Although the two models may align in extreme cases, they have competing sets of values that result in differ-ent regulatory interventions. Also, as mentioned above, the differences in goals and approaches between the private sector and the public sector can also be explained from an externality perspective.

A hybrid critical infrastructure protection approach is implemented in the Dutch financial sector. For some critical infrastructure protection functions, strong government intervention exists (e.g., supervision and oversight based on legal provisions). For other functions, voluntary self-regulation exists (e.g., determining business continuity best practices and vendor requirements). This hybrid approach also addresses accountability and transparency associated with critical infrastructure protection efforts. If a high degree of accountability is needed, strict government intervention must exist; self-regulation is appropriate if trust is the most important component of the public-private partnership.

The validity of the hybrid critical infrastructure protection approach adopted by the Dutch financial sector is further strengthened by Dunn-Cavelty and Suter [START_REF] Dunn-Cavelty | Public-private partnerships are no silver bullet: An expanded governance model for critical infrastructure protection[END_REF]. They argue that public-private partnerships in which the public parties have a strong role are not always optimal. Indeed, information sharing is considered to be the most important requirement for critical infrastructure protection. Information sharing requires complementary goals, mutual trust, clear distribution of risks, clear sharing of responsibilities and authority, and market-and success-oriented thinking [START_REF] Kouwenhoven | Public-private partnership: A model for the management of public-private cooperation[END_REF]. Because of concerns related to confidential information and the divergent goals of national security versus business continuity, a strong government role may hinder effective information sharing in some critical infrastructure protection functions. Indeed, an approach where the government takes on a "meta role" is sometimes required. In such a scenario, the government is not focused on monitoring the collaborating organizations, but instead coordinates and stimulates functional networks so that the organizations can fulfill the tasks required by the state.

In the Dutch financial sector, The Netherlands Bank assumes the coordination and stimulation roles for several tasks (e.g., Platform BC-CIF). Meanwhile, the financial sector uses FI-ISAC for sharing information related to cyber security. Thus, for aspects that require a national security model, a more government-interventionist organization has been chosen by the Dutch financial sector. On the other hand, for business continuity, where information sharing is key, a low-interventionist, public-private partnership model has been selected.

Proposed Model

Our model for determining organizational structures for critical infrastructure protection is derived from the Dutch financial sector efforts described above. The model, which is illustrated in Figure 3, incorporates three steps: Define: The initial step in a critical infrastructure protection program is to define the scope of protection, critical processes, products and services. Additionally, a global risk analysis must be performed to identify the major vulnerability concerns. This step is project-based and requires the collaboration of public and private sector entities. Organize: After the definition step, it is necessary to set up the organizational structure. The organization of public-only and public-private partnerships in a sector should cover four themes: (i) anti-terrorism; (ii) business continuity based on an all-hazard approach; (iii) information and communications technology; and (iv) crisis management. These themes typically cannot be addressed by one organization because they require different decision-making mandates and/or expertise. It is, however, important to manage the intersection of the themes. The institutions that are in charge of these organizational structures should be aware of topics that cross multiple themes and a model of collaboration should be considered, ranging from pure government intervention to pure self-regulation. After these organizational structures are established, efforts to protect the infrastructure can proceed.

Determine Protection Level, Prioritize and Implement: The next phase involves determining the protection levels and priorities and proceeding with the implementation. These tasks are executed by dedicated critical infrastructure protection structures (hexagon in Figure 3).

During the determination of protection levels, preventative, corrective and response measures are also identified based on risk analysis. Following this, the priorities for implementing protection measures are determined. The setting of priorities is often influenced by statistical information about events, threats and risks, cost-benefit tradeoffs, political and societal influences, and the latest crisis. After the priorities are set, the FCI institutions implement the required protection measures.

It is important to note that the latest crisis invariably exerts an influence on critical infrastructure protection efforts. After the attacks of Septem-ber 11, 2001, anti-terrorism efforts were increased. When the Mexican Flu broke out, The Netherlands took strong efforts to protect its citizens from the pandemic threat. The current focus is protecting the critical infrastructure from cyber attacks. These efforts are important and our intention is not to imply that they have received too much attention. Rather, we highlight this issue because it is important not to become myopic and dismiss other potential risks.

The proposed model is intended to be applied as a cyclical feedback loop. Changes within a step can propagate to affect subsequent steps. Therefore, it is essential to perform periodic reviews and updates to account for changes in the infrastructure and threat landscape.

The participation of at least one institution (e.g., regulator, government agency or private entity) that takes the lead in organizing the initial phase of a public-private partnership is a requirement. The institution should focus first on initiating collaboration in the sector and addressing the major concerns. After the initial coordination, a tailored approach for determining the appropriate public-private partnership can be developed.

Conclusions

The Dutch financial sector provides a concrete example of a sector-wide approach for critical infrastructure protection. The measures implemented by individual institutions along with sector-wide efforts appear to be very effective for safeguarding critical assets. The appropriate use of public-private relationships has fostered communication and information exchange, as well as the protection of sensitive information where necessary. Government intervention has been selected for functions in which national security is the primary consideration. On the other hand, a market-oriented approach is employed for functions that rely on sharing and trust. The basic model derived from the Dutch financial sector can be used as a template by other sectors -or other countries -to determine the organizational structures that can achieve effective critical infrastructure protection.

Our future research will conduct further analysis of critical infrastructure protection in the Dutch financial sector and refine the model as appropriate. Also, it will attempt to model and analyze cross-sector and international collaborative activities related to critical infrastructure protection.

Figure 1 .

 1 Figure 1. Financial sector protection concepts.

Figure 2 .

 2 Figure 2. Crisis management structure.

Figure 3 .

 3 Figure 3. Model for determining organizational structures.

Table 1 .

 1 Summary of national organizational structures and measures. The financial sector is subject to many regulators and policy makers. The most relevant global entities are the Bank for International Settlements (BIS), Financial Stability Board (FSB) and International Organization of Securities Commissions (IOSCO). At the European level, the entities include the European System of Central Banks (ESCB), European Banking Authority (EBA) and European Securities Markets Authority (ESMA). The Dutch entities include The Netherlands Bank (DNB), Ministry of Finance and Netherlands Authority for Financial Markets (AFM).

	Structure	Category	Measures
		Preventative	Preventative
		Prudential Supervision;	Business Continuity Assessment
	Public	Oversight;	Framework; Supervisory Standards
		The Netherlands Bank
		Ministry of Finance;	Policy Reports; Threat
		Intelligence Agencies	and Vulnerability Analysis
		Preventative	Preventative
		Business Continuity Platform	Information Sharing
			Best Practices
			Consultation on Standards
		Terrorism Alert Working Group Anti-Terrorism Measures;
			Terrorism Alert System
		Cross-Sector Collaboration	Cross-Sector Exercises
	Public-Private
		FI-ISAC	Cyber Crime Data Exchange
		Sector Crisis Management	Market-Wide Simulation Exercises
		Corrective/Responsive	Corrective/Responsive
		Sector Crisis Management	Crisis Management Decision-
			Making and Communication;
			Disaster Recovery Planning
	Private	None	None

on the financial sector; therefore, other actors (e.g., Ministry of Interior and Ministry of Justice and Security) are not included because their relevance to the organization and implementation of critical infrastructure protection is not sector-specific. The same is true for protection measures such as the organization of special anti-terrorism police forces and the strategic stockpiling of oil and diesel in case of shortages.

Public Structures.

Table 2 .

 2 Cross-border organizational structures and measures.

	Structure	Category	Measures
		Preventative	Preventative
		Oversight	CPSS-IOSCO Principles for
			Financial Market Infrastructures;
	Public		Crisis Management Exercises
		Corrective/Responsive	Corrective/Responsive
		Eurosystem Crisis Management	Crisis Management Decision-
			Making and Communication
	Public-Private	None	None
	Private	None	None


Renáta Kunstová
email: kunstova@vse.cz

Process Support of Business and IT Management in Czech Companies

Keywords: Model of management, business processes, IT processes, IT services

Defined, monitored and measured processes are significant preconditions for a well process-managed company. They are also important conditions for delivering information technology resources as services. The model, which is based on service management, is described at the beginning of this paper. The main part of this paper focuses on the results of an extensive survey. This survey dealt with an investigation into whether companies operating on the Czech market have defined business and IT processes, and if these processes are monitored, measured and continuously optimized.

Introduction

Information systems, and information and communication technologies (IS/ICT, or in short IT) are important factor for successful companies. Their purpose is to support business activities. The alignment between business needs and IT capabilities became a main area of top management concern because if IT supports business strategies and processes, then IT brings competitive advantage. The business/IT alignment depends on many factors, such as the level of communication between business and IT managers, their cooperation in strategic planning, definition of IT and business metrics, which are monitored etc. [START_REF] Luftman | Assessing Business-IT Alignment Maturity[END_REF][START_REF] Řepa | Building the Process-managed Organization by Means of Services[END_REF] The business/IT alignment is also influenced by a current trend to solve everything through services. Software as a Service, Infrastructure as a Service, Platform as a Service etc. are new business models, which changed the usual approaches to the management of enterprise IS/ICT. Service-oriented approaches increase commitment to process orientation, and put emphasis on managing the relationship between business and IT [START_REF] Řepa | Service-oriented Business Process Management[END_REF]. Companies need to satisfy the following preconditions to take full advantage of new serviceoriented models:

• management of business processes, • management of IT processes, • delivering IS/ICT resources through IT services.

The members of the Department of Information Technology at the University of Economics in Prague deal with the management of enterprise IT. The service-oriented approach to IT and business management is illustrated in the SPSPR model, see Fig. 1. The acronym "SPSPR" is formed from the first letters of key words: Strategy -Process -Service -Process -Resource. These words refer to layers of the model. The layers of this model can be assigned to appropriate levels of management. The strategic management layer and the business processes layer belong to the strategic level of management. The IT Services layer corresponds to the tactical level of management. The IT processes layer and IT Resources layer relate to the operational level of management.

The SPSPR model was first published in 2001 [START_REF] Voříšek | Management of Business Informatics -Opportunities, Threats, Solutions[END_REF]. On the basis of our experiences with its implementation, the model was continuously updated from that time. The implementation of IT services, according to the SPSPR model, includes the following phases:

• definition of processes, services and resources and their metrics,

• operational management of processes, services and resources, • monitoring and measuring of processes, services and resources, • optimization of processes and services according to the business strategy, and to the consumption of resources. The basic principle of the SPSPR model is a linking of business processes and IT processes through IT services. The other principle is that business and IT processes are measured and monitored. This allows the quick identification of emerging issues and allows management the opportunity to react immediately and to change the performance of processes. From a top down view it is seen that business strategy is realized through business processes, business processes are executed by IT services, IT services are managed by IT processes and IT processes use IT resources. The SPSPR model contributes to business/IT alignment.

Within our current grant project, "Advanced Principles and Models for Enterprise ICT Management", we are working on the proposal of the overall conceptual model for corporate performance management. The SPSPR model is one of the fundamental elements. The conceptual model follows on our previous work (for instance 1, 2, 3, 9, 10, 13, 14, 15, 19, 20 and 22), current business requirements and the results of our surveys.

As mentioned above, the important precondition of a well managed serviceoriented company is a process-oriented management of business and IT processes. Within the survey we verified if companies operating on the Czech market have implemented process management. The results of this survey are discussed in this paper.

Using of IT to Support Business

As the implementation of process-oriented management relies on the use of IT in companies [START_REF] Doucek | Dynamic Modelling of the Software Development Process[END_REF][START_REF] Shen | Business process re-engineering in the logistics industry: a study of implementation, success factors, and performance[END_REF], we checked the status of IT in Czech companies on the basis of statistical data. We used the data which is freely available on the website of the Czech Statistical Office [4]. We found that although the trend of the use of IT is growing long-term in Czech companies, only two thirds had a corporate computer network, less then a quarter of companies use the electronic exchange of structured data within business processes between companies and fifteen percent of companies regularly share business information electronically with suppliers or customers. In comparison with EU27 data, also published at [4], the Czech Republic is below the EU27 average in most indicators (see Fig. 2). The indicators published above reflect the percentage of the total number of companies in the country. Indicator values were ranked in descending order. This means that the shorter the column on the graph, the better the ranking. Belgian companies present the most extensive use of IT in business. Denmark ranks first in electronic purchases and sales. Third place is occupied by Germany. The Czech Republic ranks nineteenth. It is below the EU27 whose position is 14. Further details about the ranking of the Czech Republic in comparison to other European countries are in [6, 7 and 8].

From this comparison it is evident that the Czech Republic does not have a good standing among other countries of the European Union. On the other hand, the realization of electronic purchases, electronic sales, electronic data exchange and the integration of business processes demonstrates the existence of processes in companies. Therefore, we decided to realize our own survey which will provide information about features of processes such as monitoring, measurement, managing and optimization.

Survey Methodology

As the management of business and IT processes is a one of the conditions for successful management of services, our survey focused on processes. The goal of our survey was to investigate, if companies operating on the Czech market are interested in their processes, if they have their processes described and implemented in day-today operations and if these processes are managed, measured and optimized.

The basic structure of our investigation is shown in Fig. 3. In accordance with the basic principles of the SPSPR model, we differentiated between business processes (the main processes supporting the business goals of the company) and IT processes (the processes of the company's own management of IS/ICT). A company which would agree with these statements for business and IT processes meets the assumptions for providing IT as a service and business/IT alignment.

Company is interested in its processes

Processes are managed and measured

Processes are continuously optimized

Company is interested in its processes

Processes are managed and measured Processes are continuously optimized

Fig. 3 Basic structure of investigation

The survey hypotheses were as follows: 1. Hypothesis: If a company has specified business processes, then it has specified IT processes too. 2. Hypothesis: If a company has specified business processes, then it manages, measures and optimizes them.

3. Hypothesis: If a company has specified IT processes, then it manages, measures and optimizes them.

Survey Realization

The survey was a starting the point of our following work so it had to extensive and national in nature. We chose a professional company to receive a large sample of quality data. The questionnaire contained questions to verify the hypotheses related to our work on a conceptual model for corporate performance management. Hence, this paper focuses only on a part of the survey. The survey was realized in October 2010 and the survey data was analyzed in 2011.

Data Collection

On the basis of the offers submitted by several professional companies, we contacted Ipsos Tambor, s.r.o. (http://www.ipsos.cz). This company is a part of an independent international company (http://www.ipsos.com), which has offices in 66 countries and ranks fifth among global research companies. The company chosen recommended using the CATI (Computer-Assisted Telephone Interviewing) method for data collection. This method increases the accuracy and comparability of data collected, and the speed and efficiency of their collection. All interviews are recorded and a research company can listen to these interviews.

The company ensures the highest quality of interviewing through control mechanisms and practices. The operators of the professional company first contacted every respondent and asked them for their consent to participate in the survey. Then respondents received a questionnaire and answered the questions in a controlled phone call. The operators had the questionnaire available with detailed instructions.

Data Sample

The data sample was based on statistical data published by the Czech Statistical Office with the following demands. 1. The survey had to cover all industry sectors, except for companies operating in the IT industry. Among the industry sectors, in which the company operates, the following should be preferred: banking and insurance, telecommunications, utilities, government and public services. These companies, highly dependent on IT, should be about a third of all surveyed companies. 2. The survey has to involve only companies with the following number of employees: 10 -49, 50 -249, 250 and more. According to the expected use of our work, we preferred companies with 50 -249 employees.

Companies were selected by quota sampling. The total number of surveyed companies was limited by the purchase price of the professional data collection. The survey involved respondents from 600 companies operating on the Czech market. The basic characteristics of these companies were very different.

Questionnaire Structure

The questionnaire was divided into six sections. The author focuses only on the first and the third section, which are related to this paper. The first section of the questionnaire contained questions designed to detect essential characteristics of the company and its respondent. Respondents always marked one item from the list. We discovered the following characteristics:

• How many employees does your company have?

• In which industry sector does your company operate?

• What is your company's establishment?

• What is your job position?

The third section of the questionnaire contained the main research questions. The first set of questions related to business processes, the second set of questions related to IT processes. The questions and possible answers are shown in Table 1. The respondents received Question 2 and 3 only if they had chosen the second or third answer on Question 1.

Survey Results

We received the data collected in the form of a Microsoft Excel table. The analysis was performed using statistical functions. Data was analyzed in several phases. At first, the absolute and relative frequency of individual characteristics was measured. Then the analysis of processes according to basic characteristics was performed. At the end dependences were examined by contingency tables. The strength of the correlation between the features analyzed was calculated by C-Pearson, V-Cramer and Cohen's "kappa" coefficients.

Analysis by Company Size

The total number of participating companies was 600. The largest group of respondents, 63% (in absolute numbers it was 380 companies), was from mid-size companies with 50 -249 employees. Twenty percent of respondents (120 companies) were from companies with 250 and more employees. The remaining 17% of respondents were from small companies with 10 -49 employees (100 companies).

Ninety six respondents (16%) answered that their company has no specified business processes and 134 respondents (22%) answered that their company has no specified IT processes. The largest group were companies with partly defined processes (business processes -282 companies, 47%; IT processes -318 companies, 53%). Two hundred and twenty two companies (37%) have fully specified business processes, 25% (148) of companies have fully specified IT processes.

With the increasing number of employees (see Fig. 4), the probability that the processes are not specified significantly decreases. This trend appeared for business and IT processes too.

Analysis by Industry Sector

Due to the fragmentation of companies in different industry sectors, the numbers of companies from various industry sectors were accumulated according to their dependence on IT. The number of companies which are highly dependent on IT (banking, insurance, utilities, telecommunication services, government and public services) was 204 (34%). The number of companies with medium dependence on IT (manufacturing, retailing, accommodation and catering, real estate, healthcare, wholesale business) was 202 (34%). The number of low dependence on IT companies (construction, education, culture and recreation, mining industry, forestry and fishing, agriculture) was 194 (32%). The survey did not establish a link between the level of a company's dependence on IT and whether the company has specified processes and / or their parts. The number of companies in each group was almost the same, the percentage distribution was very similar too -see Fig. 5.

Analysis by Company's establishment

The largest group of companies were companies founded in the Czech Republic without offices abroad -488 (81%), affiliates of multinational companies presented 79 (13%) of companies and the remaining 33 (6%) companies were Czech companies now with offices abroad -see Fig. 6.

Business

Czech companies without offices abroad

Czech companies with offices abroad

Affiliates of multinational companies

Processes are not specified Parts of processes are specified Processes are fully specified Respondents from multinational companies often answered that their company has business and IT processes fully specified. Czech companies with offices abroad have parts of processes specified. Czech companies without offices abroad also have most often parts of processes specified, but the percentage distribution is lower. The comparison of business processes against IT processes within each group by company establishment show that business processes are more often fully specified and IT processes are more often specified in parts. The worst situation was in Czech companies without offices abroad.

Analysis by Management Level of Processes

Eighty four percent of all companies surveyed (47 % of companies which have defined parts of the business processes, and 37 % companies with fully defined business processes, i.e. 504 companies) were also examined to find whether their processes are measurable, managed and continuously optimized. Twelve percent of these answered that they have defined business processes and / or their parts, but nobody measures, manages or optimizes them. The companies more often continuously optimize business processes than they measure and manage them (see Fig. 7). Questions relating to the measurement and optimization of IT processes were referred only to 466 respondents (53% of companies which have defined parts of the IT processes and 25% of companies with fully defined IT processes) -see Fig. 8. The percentage of continuously optimized, measured and managed IT processes is lower than business processes. The IT processes are three times more often continuously optimized than measured and managed.

It could be assumed that the measured, managed and continuously optimized processes will be applied mainly by those companies in which the sector is highly dependent on IT, but the survey results did not support that implication. No significant dependences were found upon investigation of the relationship between the characteristics of the companies and the conducting of the company's processes. The number of employees in the company, and the company's dependence on IT, was distributed uniformly.

An increasing trend was seen depending on the company's dislocation. Companies with offices abroad have a higher percentage of measured, managed and optimized processes, and companies which are a part of a multinational company have an even higher percentage. Fig. 8 Division of companies according to the conducting of IT processes

Analysis of Relations between Business Processes and IT Processes

This phase of the analysis was started by comparing the relative frequency, of the characteristics of business and IT processes observed. The co-occurrence of single characteristics is demonstrated in Table . 2. The largest percentage of all combinations is partially specified business and IT processes (35%). The smallest percentage (1%) is the combination of fully specified business processes and unspecified IT processes. Inter-rater reliability was determined by Cohen's kappa coefficient. The results investigated are in Table 3. The most significant agreement is in the relation between the managing and measuring of business and IT processes. If business processes are managed and measured, IT processes are managed and measured too. This dependency was confirmed by the chi-square test with Pearson's contingency coefficient, 0.53 (the maximum value is 0.707), and Cramer's V coefficient, 0.62. The weak rate agreement is within the conducting of business processes (0.38 kappa). The survey had the following finding: if the company manages and measures business processes, it does not mean that business processes are also optimized. Other measures of dependence are in the range of kappa, 0.41 -0.56. It is interpreted as moderate agreement [START_REF] Landis | The measurement of observer agreement for categorical data[END_REF].

Discussion

The hypotheses were tested on the data sample from six hundred respondents. We investigated the probability of confirming these hypotheses, and a relationship with external factors arising from the characteristics of companies and respondents.

The first hypothesis, "If a company has specified business processes, then it has specified IT processes too", was proved with Cramer's V coefficient, 0.50 and Pearson's coefficient, 0.58 (the maximum value is 0.82). The dependence was reduced by the factors that companies usually have fully or partially specified business processes rather than IT processes. A significant difference is shown between the Czech companies and affiliates of foreign corporations. Multinational companies had specified business and IT processes rather than Czech companies.

The second hypothesis, "If a company has specified business processes, then it manages, measures and optimizes them", was confirmed by 336 (i.e. 56%) of the companies. The third hypothesis, "If a company has specified IT processes, then it manages, measures and optimizes them", was confirmed by 266 (i.e. 48%) of the companies.

Companies which confirmed all three hypotheses have, with a high probability, implemented process management and therefore they are prepared to provide IT as a service, or they already do it this way. The number of these companies was 259 (i.e. 43%). These companies were Czech company without offices abroad, with 50 -250 employees, operating in different industry sectors.

Current trends in the business environment give attention to services. A serviceoriented approach emphasises on the management of processes. Our research focused on the level of process-oriented approaches in Czech companies. We realized an extensive national survey for this purpose.

Although this study was limited to the Czech market, the research provides sufficient data to show that Czech companies converge slowly on process management. The implementation of the SPSPR model is possible but on the basis of the results of the described survey, we should focus on the specified group of companies.

An important conclusion arising from the survey is that the systematic management, measurement and optimization of business processes are far from usual in Czech companies. If a company is engaged in business processes, it does not mean that it has implemented process management in the area of IT. The implementation of IT services will require these companies to change their approach to the management of the business and IT processes.

Fig. 1

 1 Fig.1The SPSPR model

Fig. 2

 2 Fig. 2 Countries according to the sum of the rank position in the selected indicators

Fig 4

 4 Fig 4 Processes specification according to number of employees

Fig 5

 5 Fig 5 Processes specification according to industry sector -dependence on IT

Fig 6

 6 Fig 6 Processes specification according to company's establishment

Fig. 7

 7 Fig. 7 Division of companies according to the conducting of business processes

Table 1 . Research questions and possible answers 1st set of questions 2nd set of questions Question 1 How are business processes specified (i.e. defined and described) within a company? How are IT processes specified within a company?

 1

	Answer 1.1	Processes are not specified.	Processes are not specified.
	Answer 1.2	Parts of processes are specified.	Parts of processes are specified.
	Answer 1.3	Processes are fully specified.	Processes are fully specified.
	Question 2	Are business processes managed	Are IT processes managed and
		and measured?	measured?
	Answer 2.1	Yes	Yes
	Answer 2.2	No	No
	Question 3	Are business processes	Are IT processes continuously
		continuously optimized?	optimized?
	Answer 3.1	Yes	Yes
	Answer 3.2	No	No

Table 2 . Percentage distribution observed characteristics of business and IT processes IT Processes are not specified Parts of IT processes are specified IT Processes are fully specified Business processes are not specified

 2

	12%	4%	1%

Table 3 .

 3 Reliability determined by Cohen's kappa coefficients

	Validated addiction

Acknowledgments. This paper was supported by the "Advanced Principles and Models for Enterprise ICT Management" grant, from the Czech Science Foundation under the number P403/10/0092.


Peggy E Chaudhry
email: peggy.chaudhry@villanova.edu

Sohail S Chaudhry
email: sohail.chaudhry@villanova.edu

Ronald Reese
email: ronald.reese@villanova.edu

Darryl S Jones
email: djones21@villanova.edu

Enterprise Information Systems Security: A Conceptual Framework

Keywords: Enterprise information systems, security, conceptual model

Over the past half a century, organizations have implemented information systems for managing their business processes. These information systems have now evolved into what are more commonly known as enterprise information systems.

An important facet of implementing enterprise information system in an organization is the development of security related issues within the information system for the business processes. In this paper, we review the relevant literature related to the security policies that are associated with the use of enterprise information systems within organizations. Based on this literature review, we identify four major issues which are security policy documentation, employee awareness, top management support, and access control. A conceptual framework based on these four issues is then presented within the context of corporate governance for the security of the enterprise information systems. We conclude our work with the future direction for this research.

Intr oduction

Enterprise Information Systems (EIS) are companywide Information Technology (IT) systems that companies use to combine multiple business functions information into one data warehouse. They "enable a company to integrate the data used throughout its entire organization [START_REF] Davenport | Putting the Enterprise into the Enterprise System[END_REF]" Enterprise information systems can include data from the various functions of an organization such as Finance (Accounts Receivable and Payable, General Ledger, Profitability Analysis, and the like.); Human Resources (Payroll, Personnel Planning, Travel Expenses, etc.); Operations and Logistics (Inventory, Purchasing, Shipping, etc.); and Sales and Marketing (Order Management, Pricing, Sales Management, etc.) [START_REF] Davenport | Putting the Enterprise into the Enterprise System[END_REF]. The plethora of information technologies developed and improved over the last few decades has made business decisions easier for managers who now have all of the relevant information available from one access point without the fear of missing or overlapping information.

A problem that results from this convenience is that all company information is now available in one location. This centrality makes a company's intellectual property, one of its core competitive advantages, more vulnerable. Security breaches (malicious or unintentional) can result in continuity disruption, poor reliability of information, lowered effectiveness and efficiency of processes, and can even have legal implications. The current events of external information security problems related to information access, such as the hacker who obtained the personal information of 77 million consumers at Sony's PlayStation Network is testimony to the problems that companies will continue to face with security breaches [START_REF] Sherr | Sony Faces Lawsuit Over PlayStation Network Breach[END_REF]. Likewise, the malware files attached to the NASDAQ's Directors Desk is clearly another recent example of outside hackers creating security violations [START_REF] Barret | NASDAQ Acknowledges Security Breach[END_REF]. However, in this paper, we are not addressing so-called "Hack attacks" but will be evaluating the risk of internal information security dilemmas, such as employees of the firm either intentionally or unintentionally compromising the data stored.

Overall, firms must safeguard their employee access to the "keys to the kingdom" (e.g., accounts and passwords) that protect an array of information ranging from credit card data, human resource personnel data, internal financial reports and research and development plans [4]. For example, in 2010, an employee of the General Services Administration of the U.S. government unintentionally compromised the social security numbers of its 12,000 staff members to a private email address that made the government agency provide identify theft coverage and credit monitoring to its employees [START_REF] Kalish | Security Breach of Employee Data at GSA[END_REF].

More research on this topic is important because of the paradigm shift that we are currently facing. Until recently, most of the concern regarding security in enterprise information systems was more of a technical nature (e.g., viruses, worms, Trojans, etc.), however, more research is finding that human interaction with the systems is the real cause of most breaches [6], [7], and [8]. In fact, Sachlar Paulus, Senior Vice-President of Product and Security Governance of SAP (a global EIS provider) has stated that "The weakest link is still people … the biggest problems occur wherever technology comes into contact with people who need to administer, manage, or even use IT security functionality [START_REF] Walsh | The ERP Security Challenge[END_REF]."

The purpose of this paper is three-fold. First, we will briefly review the past work that has been done regarding security in Enterprise Information Systems and provide a succinct literature review. Next, we present a new conceptual framework that businesses can use to properly secure their data through Enterprise Information Systems. Finally, the paper concludes with a brief synopsis of plans for future research.

Liter atur e Review

Up until the last few years, most of the research done on corporate dealings with security in EIS focused mainly on the technical aspect of IT such as firewalls and anti-virus software which rely more on technology than the employees using the systems [START_REF] Siponen | An Analysis of the Traditional IS Security Approaches: Implications for Research and Practice[END_REF]. In fact, as recent as 2005, Siponen [START_REF] Siponen | An Analysis of the Traditional IS Security Approaches: Implications for Research and Practice[END_REF] believed "the importance of the socio-organizational nature of (E)IS is not recognized seriously enough by traditional Information Systems Security methods." Researchers are now starting to realize that the human interaction with the EIS of the firm is just as important, if not more, than the technical -and that information security cannot be achieved solely through these technological tools [11].

The threat of external hackers and malicious attackers of information systems are still a major issue for information security and widely reported in the current events and highlighted in practicing managers' publications, for example, see [START_REF] Mcnulty | Boss, I Think Someone Stole Our Data[END_REF]. However, many researchers now believe the biggest threat to information security remains internal [6], [13], and [14]. Swartz [15] outlined several cases in which employees stole data while still working for their company, yet the majority of employee security breaches occur accidently or unintentionally [7] and [8]. In April 2011, Cyber-Ark® Software [4], substantiated this concern with the results of its "Snooping Survey" with respondents from Europe, the Middle East, Africa (EMEA), and the United States, with the upper echelon of managers of several companies as illustrated in Table 1. This recent survey of 1,400 IT staff and C-level professionals (i.e., the CEO, CFO, COO) in both the EMEA and U.S. reveals a significant amount of these firms are aware of security breaches, or more alarmingly "don't know" if a problem exists [4]. There are currently many theories on the best way to combat these issues. These range from the importance of cultivating an information security policy to significance of employee training and awareness. Overall, just a few researchers have developed frameworks in order to help companies remain as secure as possible [14], [16], and [START_REF] Knapp | Information Security Policy: An Organizational-Level Process Model[END_REF].

Infor mation Secur ity Policy

An information security policy is the set of rules, standards, practices, and procedures that the company employs to maintain a secure IT system. This policy can contain items such as when and how an employee should access secure information and how often their passwords should be changed. It has been said that the "credibility of the entire information security program of an organization depends upon a well-drafted information security policy [START_REF] Kadam | Information Security Policy Development and Implementation[END_REF]." Also, many experts now think that the development of an information security policy is one of the most practical ways to preserve protected systems [START_REF] Knapp | Information Security Policy: An Organizational-Level Process Model[END_REF] and [19]. Knapp et al. [START_REF] Knapp | Information Security Policy: An Organizational-Level Process Model[END_REF] believe that "the development of an information security policy is the first step toward preparing an organization against attacks from internal and external sources." Sengupta et al. [START_REF] Sengupta | A Formal Methodology for Detecting Managerial Vulnerabilities and Threats in an Enterprise Information System[END_REF] affirms that ineffective implementation of security policy leads to weaknesses in enterprise information systems security.

One important factor that most researchers agree must be adhered to in policy development is the support of top level management [21] and [22]. The best way to get employees to comply with information security policies is to engrain the policy into the organizational culture of the company. The goal is to have employees follow and safeguard the policy as a second nature, not because the workers are being policed or audited [13]. Knapp et al. [START_REF] Knapp | Information Security Policy: An Organizational-Level Process Model[END_REF] actually developed an information security policy process that companies can use to develop and analyze their current programs. While security policies, procedures, and controls are the most implemented security measures, Hagen et al. [23] found through a survey of Norwegian organizations that they are not the most effective in information security.

Employee Awareness

"Creation and maintenance of security awareness include both individual and collective activities, i.e. education and awareness-raising initiatives, e.g. emails, pamphlets, mouse pads, formal presentations, and discussion groups" [23]. Many researchers now believe that employee awareness is one of the best ways to protect a company's data [16] and [24]. In fact, empirical research found that awareness creation is the most effective information security measure [23]. "Information security training and management support are possibly the most important components of an effective information security program. Training can increase security awareness, understanding, and thus, participation [25]." Systems are better protected by employees that have an enhanced understanding of the possible consequences of security breaches and are aware of ways to combat these breaches. In addition, the extent to which employees' perceive that compliance with existing security policies are mandatory, is directly related to employees' motivation to take security precautions [6].

As illustrated in the recent Nasdaq and Sony PlayStation network cases, the increased security benefits are not only important to the sponsoring company, but its supplier and customer businesses as well [START_REF] Sherr | Sony Faces Lawsuit Over PlayStation Network Breach[END_REF] and [START_REF] Barret | NASDAQ Acknowledges Security Breach[END_REF]. Pollitt [26] actually reported a case in which a UK communications company offered free security training to customers to give them an understanding of the true risks of information security. Similar to the development and implementation of security policies, it is imperative for employee awareness to actually be an effective tool in combating poor security and top level management support is essential.

Access Control

Another commonly covered method to maintain information security is to limit employee access to certain information by roles. Access control is defined as the process a company takes to limit the access an employee has to various functions of the business; particularly functions not relevant to their position or containing more information than they should have access to [START_REF] She | Security for Enterprise Resource Planning Systems[END_REF]. She and Thuraisingham [START_REF] She | Security for Enterprise Resource Planning Systems[END_REF] stated that many companies now use Role Based Access Control (RBAC), which is a way to limit employee access by permissions, roles, users, and constraints. In the 2011 Cyber-Ark survey, an alarming 30% of their respondents identified as IT and Cprofessionals (n=514 managers from the U.S. and EMEA) admitted to accessing information from a system that was not relevant to their role in the firm [4]. D'Aubeterre et al. [16] developed a framework to generate higher security awareness in which RBAC is an integral function. By breaking employees into roles and profiles, it is easier to determine what employee has access to which information. For example, an Accounts Payable employee should only have access to processing invoices [START_REF] Allen | ERP Security Tools[END_REF]. "Monitoring user access to mission-critical information and detecting unauthorized access to high-risk data are critical steps all companies should take to better protect their sensitive information [15]." In addition, because of organizational changes or modifications of security policy, access rules have to be frequently updated. This process needs to be controlled in an efficient, adaptable and secure manner [START_REF] Rinderle -Ma | Comprehensive life cycle support for access rules in information systems: the CEOSIS project[END_REF].

Top Level Management Support

Michael Maccoby's book, "The Leaders We Need: And What Makes Us Follow," further supports the old adage of "leading by example" that is increasingly important in today's environment and he states that, "the threats and opportunities facing us have never been greater. Rapid globalization and new technologies are transforming the economy and the way we work [START_REF] Maccoby | The Leaders We Need: And What Makes Us Follow[END_REF]." Although Maccoby's work is not directed to IT security leadership, it is apparent that employees must perceive that top level management believes that information system security is important to the success of the company and it is engrained into the corporate culture. The overarching objective of information security management is to convert the organization's security policy into a set of requirements that can be communicated to the organization, measured, and imposed [31]. Basically, the better the top management support of information security, the greater the preventative efforts a firm (and its employees) will make [14]. Overall, top management support is essential to security governance success [32].

Corporate Governance

The research of Weill and Ross [33] on IT governance in 300 companies found that "IT governance is a mystery to key decision-makers at most companies" and that only about one-third of the managers' surveyed understood how IT is governed at his or her company (p. 26). Engulfing all of these methods for security protection is the idea of corporate governance. "Corporate governance refers to organization controls such as reporting structure, authority, ownership, oversight, and policy enforcement [32]." For information security, this is the way top level management and the board decide to run the IT department, and in turn, information system security. This is where the true decisions on how to attack a possible weakness are made. These managerial decisions include items such as how to implement a security policy and where and how employee awareness trainings will be held. Solms [START_REF] Von Solms | Information Security Governance: Compliance management vs. operational management[END_REF] posits that "Information Security Governance is now accepted as an integral part of good IT and Corporate Governance (Information Security Governance)." Khoo et al. [35] stated that information security governance is a subset of corporate governance that relates to the security of information systems, and because the board of directors is ultimately in charge of corporate governance information security must start at the top [21]. To facilitate management in the governance of information security, Da Veiga and Eloff [32] developed a more comprehensive approach that combined key items from a few of the best current corporate governance frameworks.

Conceptual Fr amework

We have developed a conceptual model in Figure 1 for EIS security that encompasses the major themes found in our literature review. In its simplest form, we draw the analogy that the company's EIS security is the roof that protects four main pillars: security policy, security awareness, access control, and top level management support. The basic solid foundation of this 'house' is the company's corporate governance. As noted by Weill and Ross [33], the best performing firms in their study carefully planned their usage of IT. They further assert that, "60% to 80% of seniors executives in those companies have a clear understanding of and can describe their IT governance" (p. 26). The decisions that the leaders of the company make are the base of the entire system and will dictate the stability of it. Resting on the foundation, are the walls/pillars that support the roof. These four pillars are the processes that management and the board of directors can choose to implement to make the system as secure as possible. Having all four pillars is the best way to make the enterprise information system secure, however removing any one of these columns can truly diminish the stability/security of the entire system. Below is a pictorial representation of the model.

Figure 1. Conceptual Model for Enterprise Information System Security

A summary of the research assertions in previous studies that led us to conceptualize the model in Figure 1 is provided below in Table 2.

The research in this paper has focused on how and what organizations execute to disseminate information related to security issues that evolve around the business processes with the enterprise information systems. By analyzing the relevant literature, we identified four major themes that impact the security issues within organizations. These four factors are identified as security policy documentation, access control, employee awareness, and top level management support. Based on these four factors, a conceptual framework ingrained with the relevant literature was presented within the context of corporate governance for enterprise information systems.

It is the expectations of this research that the conceptual framework developed will assist businesses protect Enterprise Information System data that could potentially be breached through socio-organizational problems. To test the framework, two future phases of this research are planned. The next phase will consist of multiple in-depth interviews with IT officers using a cross-section of companies. The companies will be of different sizes and industry sectors to get a fully holistic view of actual practices in place. Finally, with the combination of the literature review conducted for this paper, the framework presented, and the information from the interviews, a survey instrument will be developed and distributed to a larger population of IT officers to further study the various issues that have been exposed in this research within the context of enterprise information systems security.

Table 1 .

 1 Have you accessed any cases on insider sabotage or IT security fraud conducted at your workplace?

		EMEA	%	US	%	C-Level	%
	Yes	121	21%	137	16%	11	16%
	No	303	54%	452	53%	44	63%
	Don't Know	139	25%	269	31%	15	21%
	Grand Total	563	100%	858	100%	70	100%

Source: Cyber-Ark Snooping Survey,

April 11, 2011

Enterprise Information System Security