PEOPLE, PROCESSES AND BEHAVIORS

People, their behaviors and the processes they follow can drive an organization’s success. But they also can be the root of problems.

Featured Articles

ISACA Journal Article

It Is Time to Stop Haunting the Ghost in the Machine!

Author: Guy Pearce

Digitally native enterprises have found that there are better ways to organize their people than the haunted and dated organizational design paradigms that were first practiced long before the rise of the modern...

Additional languages available: 日本語

ISACA Journal Article

Auditing Your Organizational Culture

Author: Kevin M. Alvero

How does an internal audit team conduct a culture audit, especially when the subjectivity of culture can take auditors out of their comfort zones?

Additional languages available: 日本語

ISACA Journal Article

How Social Engineering Bypasses Technical Controls

Author: Allen Ari Dziwa

When the widespread availability of information is enhanced by the excessive compulsion by some people to engage in excessive sharing on social media, social engineers can have a field day.

ISACA Journal Article

Case Study: Adopting RiskOps to Streamline Governance and Risk Management

Authors: Chuck Donina and Kathleen S. Hartzel

This case study provides insight into Highmark Health’s transition to RiskOps and highlights some of its immediate process improvements, including capacity creation to address emerging risk...

Additional languages available: 日本語

ISACA Journal Article

Against the Quantum Threat: Selective Compatibility

Authors: Jean Jacques Raphael, Jean Claude Célestin, and Eric Romuald Djiethieu

Selective compatibility is achieved through a set of technical tools, processes and protocols that allow a conditional connection between several information systems...

Additional languages available: Français

ISACA Journal Article

Quantifying the Qualitative Technology Risk Assessment

Authors: Julie Ebersbach and Michael Powers

Some risk assessments may be entirely quantitative, but most enterprises find an exclusively mathematical approach flawed and subject to manipulation and bias.

ISACA Journal Article

Should Cybersecurity Be Subject to a SOX-Type Regulation?

Author: Mike Tomaselli

Could cybersecurity implementation benefit from a US Sarbanes-Oxley Act of 2002 (SOX)-type approach?

ISACA Journal Article

Building Resilient Security in the Age of the Great Reshuffle

Authors: Prakash Renduchintala, Rohitha Chowdhary and Pradeep Sekar

Enterprises should revisit their strategies for managing the cybersecurity workforce and build resilient environments with a focus on learning and development, job rotation, security culture and investment in people.

Columns

ISACA Journal Article

Letter From the SVP of Publishing

Author: Shannon Donahue

The ISACA Journal is consistently cited by ISACA members as one of the most valued benefits of their membership package.

ISACA Journal Article

Information Security Matters: It’s About (Down) Time

Author: Steven J. Ross

It is important that we stop measuring the cost of cyberattacks only in the number of records breached and start focusing on hours of unavailable systems and data.

ISACA Journal Article

IS Audit in Practice: Auditing Culture

Author: Cindy Baxter

Is there a way that the risk management and audit professions can get through the soft, unquantifiable information to produce actionable recommendations?

ISACA Journal Article

Help Source Q&A

Author: Sunil Bakshi

What are the essential personal skills IS auditors should possess to effectively carry out audit work?

Online Exclusives

ISACA Journal Article

Trustworthy Tactics for Unlocking the Value of Genetic Data

Author: Mick Brady

An enterprise that manages a large amount of sensitive information is subject to a complex patchwork of laws and regulations, including privacy regulations, laboratory regulations, human subject protection requirements and ethical considerations.

ISACA Journal Article

The Changing Information Systems Landscape Creates New IT Risk

Author: Sriram Balalsubramanian

Audit needs to evolve to address the technological advances and changes in the information systems landscape.

ISACA Journal Article

5G Innovations and Cybersecurity Risk

Author: Blake Curtis

It is critical for practitioners to understand 5G’s risk factors such as unique identifiers, software-defined networking (SDN) vulnerabilities, and interoperability’s impact on strong access control.

ISACA Journal Article

A Step-by-Step SoD Implementation Guide

Author: Stefano Ferroni

Segregation of duties is central to achieving compliance with laws and regulations and assuring shareholders that proper governance is applied, and it is included as an activity in COBIT.

ISACA Journal Article

Addressing the Complexities of Cybersecurity at Fintech Enterprises

Author: Komitas Stepanyan

Fintech organizations can become significant players impacting the entire financial system, and regulators cannot afford to let them fail.

ISACA Journal Article

Stop Using the Privacy Paradox as an Excuse to Avoid Privacy by Design

Author: Saravanan Gurumurthy

Organizations should take the lead to follow the privacy by design approach by proactively embedding privacy into the design and operation of technology systems, infrastructure and business practices.

Addressing Intentional Threats picture of lock

ISACA Journal Article

Addressing Intentional Threats Using Risk Assessment

Author: Luigi Sbriz

Cyberspace must be considered a hostile environment. Although it has enormous potential, threats are always present, even in the most protected virtual worlds or within home networks.

Additional languages available: Italiano

ISACA Journal Article

Decentralized Finance—Opportunities, Challenges and Auditing of Smart Contracts

Author: Pinkal Shah

The rapid development of blockchain technology and cryptocurrency has influenced the financial industry by creating a new crypto economy, which has been compounded by next-generation decentralized applications that do not involve a trusted third party.

ISACA Journal Article

Managing Cybersecurity Risk as Enterprise Risk

Author: Tom Schneider

Cybersecurity risk is a critical enterprise concern. Cybersecurity incidents such as ransomware have the potential to bring an organization’s operations to a standstill.