2020 3rd International Conference on Computer and Informatics Engineering (IC2IE)

IT Infrastructure Security Risk Assessment using the

Center for Internet Security Critical Security Control
Framework: A Case Study at Insurance Company
Heru Winarno, Fatah Yasin, Muhamad Aries Prasetyo, Fathur Rohman, Muhammad Rifki Shihab, Benny Ranti
Faculty of Computer Science,
Universitas Indonesia,
Depok, Indonesia
[email protected], [email protected], [email protected], [email protected], [email protected], [email protected]

Abstract— PT. XYZ is an insurance company that currently application developer staff. At first the application
provides a variety of services using electronic systems in 80 development team assumed that this was a common thing.
service offices throughout Indonesia. At the end of 2019, the Nevertheless they keep checking, that is by tracking the latest
company experienced an IT security incident. The core deployment version and seeing what changes are made. Other
application was hit by a malware attack that caused slow system staff try to see the database whether locking or suspicious
performance and disruption of insurance operational services. activity has occurred.
These events have a negative impact on the company both
operationally and to customers, so that it becomes a serious On the first day there were still standard checks and no
concern of management. Therefore, this research aims to see concrete efforts had been made by the IT team. This complaint
how companies develop infrastructure to ensure the reliability still continues on the second day when the application is felt
and improvement of IT security. The research methodology to be slower, a process that is usually done half an hour can
used is a qualitative approach by collecting data through take more than two hours. The IT team began an analysis of
documentation and interview studies. Based on the results of the the core application server. The core application has several
assessment, there were 16 out of 20 controls that exceeded the nodes so the IT team can alternately restart the service. On the
threshold value. These results illustrate that the security of the third day, the application is felt to be slower and cannot be
IT infrastructure of PT. XYZ is very weak. Therefore, the used for operations while each branch has a production target
company must carry out 13 recommendations for improvement
by the end of the year.
that will be carried out in stages. This research is expected to be
a lesson for other organizations especially insurance companies Surrounding applications such as H2H, web e-Commerce
to improve the reliability and security of IT infrastructure. and other applications that are integrated with the main
Keywords—critical security control center of internet security, application and use the service core cannot run. This causes
malware, risk assessment method, risk assessment, insurance disruption and impacts directly to the customer. Complaints
that arise no longer come from internal employees, but also
I. INTRODUCTION from customers, and complained directly to the CIO and CEO.
The IT team took this problem very seriously and tried to
PT. XYZ is a company engaged in insurance. The restart the application server alternately, the application had
company has provided various services using electronic felt better, but it did not last long. When everyone looks for
systems in 80 service offices throughout Indonesia. changes in the application, the CIO instructs the operational
Technology demands and the growing number of offices has team to see what is happening on the server. After further
made this company do the digital transformation by utilizing checking, it was found that the application server was running
information technology. In the light of digital transformation, very slowly, due to very high memory and processor usage.
information and technology (I&T) have become crucial in the The application team tried to look at the server and found that
support, sustainability and growth of enterprise [1]. The IT no antivirus was installed. The application team and the
department has several main services in supporting the operational team suspect that the server is infected with
company's business, including Core applications using the malware. The two teams rebuilt the server architecture as
company's internal network, e-Commerce web applications before, and installed the new environment. The application
for direct sales to customers, policy management applications can then run fine and return to normal.
for major customers, as well as host-to-host integrated
applications both via the internet and VPN. All manager in the IT department are gathered by
management to find out the cause of the problem and hope
As a company conducting trade transactions using an that the incident does not recur. The next decision is that the
electronic system, the company must follow PP Number 80 of IT department will conduct an assessment of the IT
2019 which regulates trade through electronic systems [2]. infrastructure and fix existing weaknesses. This initiative is in
PT. XYZ needs to make sure that the existing IT infrastructure line with Applegate [3] which states that infrastructure
complies with these regulations. Making the wrong decision managers must reorganize the IT infrastructure they manage
in designing, responding to incidents, or maintaining after an incident occurs.
infrastructure can severely harm a business [3].
PT. XYZ reviews and evaluates the IT infrastructure
PT. XYZ experienced a security incident at the end of
security conditions using the Critical Security Control of the
2019. The incident began when core application users felt a
Center of Internet Security (CIS-CSC) framework in terms of
significant decrease in application performance. Many
complaints come through the helpdesk or directly to the people, process and technology. The people, process and

978-1-7281-8247-6/20/$31.00 ©2020 IEEE 404

Authorized licensed use limited to: Mukesh Patel School of Technology & Engineering. Downloaded on March 18,2024 at 09:42:31 UTC from IEEE Xplore. Restrictions apply.
 2020 3rd International Conference on Computer and Informatics Engineering (IC2IE)

technology aspects have been widely recognized as three CIS Control can be implemented using the Center for
elements which are key to process improvement [4]. This Internet Security Risk Assessment Method (CIS-RAM)
study aims to see how an insurance company can ensure the guidelines. CIS RAM guides risk assessment by providing
reliability and security of IT infrastructure to maintain IT instructions, templates, examples and methods [8]. CIS RAM
services. The research contributes to both literature and strengthens the CIS CSC risk assessment framework.
practice. For literature, this study investigates the level of IT
B. Defensive Measures
infrastructure security, especially in insurance companies in
Indonesia. For practice, this study can be a lesson for other In the face of cyber attacks that come from the external
organizations especially insurance companies to improve the and internal environment, organizations need to take
reliability and security of IT infrastructure. effective defensive measures [3], including:

II. LITERATURE REVIEW 1. Develop a good security policy and easy to understand
from the user's perspective. Some company security
Business leaders are starting to realize the importance of policies that can be an example are policies regarding the
cyber security. According to a survey conducted by the types of files or documents that can be downloaded by
Computer Security Institute in 2007, 46% of respondents employees, the obligation to activate security features
consisting of companies and governments have experienced
before the computer is connected to the network.
security incidents in the past 1 year [3]. Managers must
2. Install a firewall device.
develop defenses to protect important company assets and
information such as data, infrastructure components and 3. Develop a user authentication scheme to control access
reputation. Maintaining the security of IT infrastructure needs control of the IT infrastructure. Authentication can be in
to pay attention to the situation, business, infrastructure, the form of a password, digital certificate, or biometric.
targets and technology of the company [3]. The security 4. Encrypt the corporate network (VPN).
review and evaluation used has a different approach. 5. Perform system patching and change management.
6. Build intruder detection and network monitoring tools.
According to Applegate [3], a framework for managing a
company's infrastructure security requires design decisions, This action needs to be evaluated continuously according to
implementing policies and developing procedures, and strong the times, given the variety of threats and cyber attacks
execution. Steps that need to be suggested include (i) making evolve very quickly.
planned and deliberate security decisions, (ii) considering the
C. Malware
safety factor as a moving target, (iii) implementing change
practices in a disciplined manner, (iv) always educating Malware or malicious software is a code or program that
users, and (v ) use technical steps in stages according to is designed deliberately to damage or paralyze the functioning
ability. of a system. According to [9] a number of attacks published
recently show that malware can be a quite critical problem for
A. CIS-CSC industry, government, and individuals.
CIS-CSC (Center of Internet Security - Critical Security
Some of the symptoms that indicate that the system is
Control) or also called CIS Controls is a collection of priority
affected by malware are slow computer speed or performance,
activities derived from defense best practices in depth to
system hang, blank screen, computer system restart
mitigate attacks on networks or systems [5].
continuously, erasing entire disk or drive, erratic screen
The application of CIS-CSC needs to pay attention to the behavior, browser homepage change automatically, operating
scale of the organization which is generally divided into three system software modified [10].
parts [5]. First, small and medium organizations that have
limited IT human resources or cyber security. Second, Some malware generally enters via network transmission.
organizations that have individuals who are responsible for Malware infects vulnerable systems, and then spreads to one
managing and protecting IT infrastructure. And third, or more systems; then becoming active on the host computer
organizations that have employed cyber security personnel depends on the nature of the code's content and ultimately
who have specialized in various fields of security. disrupts the host system's services.
CIS Controls v7.1 is divided into three categories namely According to the Indonesia Computer Emergency
basic, foundational, and organizational [5]. The basic Response Team (ID-CERT) report in 2018, Malware was
categories, consisting of CIS 1 to 6, require all organizations ranked 4th with a total of 9855 reports or 6.81% of the total
to implement these controls for cyber defense readiness. The complaints. Fig. 1 shows complaints graph of cyber security
foundational category, which consists of CIS 7 through 16, incidents in 2018.
provides many benefits and good actions for organizations by
implementing it. The final organizational category, which Although a small percentage, if examined based on the
consists of CIS 17 to 20, focuses on people and processes number of reporting, malware attacks are still one of the
involved in the world of cyber security [6]. highest cyber crime in Indonesia after spam.
Dutta [7] create a framework to facilitate the selection of
controls seen from three questions, what, where and why.
Organizations must be able to answer the question: What
controls does a company need for certain security functions?
Where is the adoption of the cyber security environment?
Why is this control effective in stopping attacks?

405
Authorized licensed use limited to: Mukesh Patel School of Technology & Engineering. Downloaded on March 18,2024 at 09:42:31 UTC from IEEE Xplore. Restrictions apply.
 2020 3rd International Conference on Computer and Informatics Engineering (IC2IE)

A. Assessment Methodology
INCIDENT MONITORING REPORT 2018
Spoofing/Phising
The methodology carried out by PT. XYZ in evaluating to
4% ensure the reliability and security of IT infrastructure is to
Spam describe the current technology architecture, determine target
26% HaKI/IPR
architecture, conduct gap analysis, then determine the
45% roadmap for implementing improvement activities.
The first thing to do is to review documents / guidelines
Response for IT infrastructure development, information gathering
0% related to network infrastructure and IT security,
understanding of current conditions and the constraints faced.
Network Incident
13% Complaint In determining target architecture, what is done is by
Malware Spam conducting an assessment of the current architecture and
7% 5% recommendations for improvement, a group discussion forum
Fig. 1. Complaints Graph of Cyber Security Incidents in 2018 [11]
related to future needs with the architecture, policy, and
application developer teams. Gap analysis is to determine the
III. RESEARCH METHODOLOGY gap between current conditions and existing development
guidelines and define a plan to improve the results of the
Many literature describes the framework for assessing the
assessment. Roadmap for the implementation of improvement
security risks of IT infrastructure, but none of which describes
activities is the making of a gradual improvement plan for the
the framework used by companies especially insurance
next 3 years, at this stage also determined technology
companies and describes the results of the framework and the
candidates / devices that can be used to improve infrastructure
experience gained in using the framework. This paper will
and the required investment value.
review the framework chosen by PT XYZ, assessment results,
and lessons learned from using this framework. The The entire team is gathered and led by the infrastructure
methodology used in this research is the study of documents team to agree on the hardware and software that is included
and qualitative approaches through interviews. in the scope and an assessment of aspects of assessment based
Document studies refer to reports on the results of security on people, process, technology and risk is carried out. This is
assessment. The interviews were conducted with several interesting where PT. XYZ chose the CIS CSC framework to
interviewees including CIO, Head of IT Infrastructure, carry out the evaluation. The CSC CIS framework becomes
Network Engineers, IT Consultants, and IT Staff Security a guide to get the current conditions, then provides target
Specialists. Interview questions focus on: architecture recommendations based on predetermined
threshold values. The next section will discuss how the
1. What are the steps taken by PT. XYZ to improve the framework is used.
security and reliability of IT infrastructure?
B. Implementation of the CIS CSC Framework
2. The method was used to conduct security assessments
and how to conduct the assessment? In using the CIS CSC framework the first thing that needs
to be done by PT. XYZ is determining the CIS CSC
implementation group (IG) [5]. There are three types of
IV. ANALYSIS AND DISCUSSION implementation group, although according to CIS CSC
The evolution of technology is the main driver of the guidelines a company has more than 1000 employees entered
company to make changes and look for new innovations to into IG3 but PT. XYZ chose to join the IG2 group because the
operate and increase business capacity. The technology organization does not have security experts who specialize in
architecture needs to capture the transformation opportunities various aspects of cyber security. Organizations included in
available to companies through the adoption of new the IG2 category are organizations that employ individuals
technologies [12]. When IT plays an important role in who are responsible for managing and protecting information
technology infrastructure, organizations supporting many
business and organization, companies must focus on
departments with different risk profiles based on their
information security. Information security experts encourage
functions and mission, and have regulatory compliance
organizations to carry out information security risks [13]. responsibilities and the main concern is the loss of trust public
Kaup Vijayananda [14] states that there are several industry if a violation occurs. Based on these classifications, PT. XYZ
frameworks that have been recognized for use as guidelines will implement 20 controls and 140 sub controls out of 171
in conducting assessments, some of which are NIST existing sub controls.
Cybersecurity Framework, IS0 27001, COBIT-5 and Critical
Security Controls from the Center of Internet Security (CIS- The next step is to determine Tier Level, which is how an
CSC). The framework has several similar concepts but has organization views cyber security risks and the processes that
different ways of dealing with information security issues. exist to manage those risks [8]. CIS CSC divides into 4 Tier
CIS CSC has easy to understand, good technical granularity, to determine how to do the assessment, namely Tier 1:
and easy to implement [14]. PT. XYZ itself currently has Partial, Tier 2 Risk Informed, Tier 3: Repeatable, Tier 4:
implemented ISO 27001 with the scope of the main Adaptive. PT. XYZ considers the level of organizational
application. In the next section, the assessment process security management capabilities to be in Tier 1, because the
carried out by PT. XYZ and lessons that can be drawn from company does not yet have an IT information security
that experience. development plan. Handling IT information security issues is
still based on events. There has not been an evaluation of
information security risks at the system, device and

406
Authorized licensed use limited to: Mukesh Patel School of Technology & Engineering. Downloaded on March 18,2024 at 09:42:31 UTC from IEEE Xplore. Restrictions apply.
 2020 3rd International Conference on Computer and Informatics Engineering (IC2IE)

application level. In accordance with this level the steps in Asset Type Asset Name BO Steward
conducting an assessment follow the guidelines of CIS-RAM
with the following steps: Network
DC Firewall CIO Network Engineer
Device
1) Defining the scope and scheduling sessions.
Network DRC Firewall
2) Defining risk assessment criteria. CIO Network Engineer
Device Internet
3) Defining risk acceptance criteria.
4) Risk assessment (control-based)
a. Gather evidence.
b. Model the threats.
c. Risk evaluation.
5) Propose safeguards
a. Evaluate proposed safeguards.
In the defining the scope and scheduling session’s stage,
the information assets will be evaluated, determine the
business owner and steward who will provide evidence and
be interviewed for the valuation of the asset. [8]. Then a
scheduling is done to evaluate. In accordance with the [15] it
will be contained in the document. Table I shows the scope Fig. 2. Balance in Risk Analysis [8]
definition of asset type, asset name, business owner, and
steward. The stage of defining risk acceptance criteria is to
determine the minimum value of the security risk is
The defining risk assessment criteria stage is a numerical
acceptable. The most important thing in this determination is
statement and simple language used by organizations to
to consider that the likely impact must be acceptable to all
evaluate cyber security risks [8]. CIS RAM mentions the
parties affected and this value must be less than or equal to
basis for risk analysis with the formula "RISK =
the value of the results of the recommendation. The risk
POSSIBILITY x IMPACT". The impact of security breaches
acceptance score in the case of this assessment is 4. CIS RAM
is assessed internally and externally, that is, things that cause
provides guidance as shown in Fig. 2.
the organization cannot accomplish its mission or the
organization can endanger others. Impact to our mission is The blue image to calculate the risk score while the green
defined on scenarios that can disrupt the information image to calculate the safeguard risk score. Risk score will be
technology department becoming a business partner for compared with risk acceptance score, if the risk score is
businesses through the provision, improvement and greater then there must be recommendations for
utilization of information technology services. While Impact improvement to reduce the risk. Recommendations for
to Our Obligations is defined in terms of cyber attack improvement will be re-evaluated based on impact and
scenarios that can cause damage or leakage of customer data. likelihood to produce a safeguard risk score, the value must
Each scenario has a range of values from 1 to 3. The scenario be smaller or equal to the acceptance score. If the risk score
that has the lowest risk has a value of 1 while the highest risk is smaller than the acceptance score, the risk can be accepted.
is valued by number 3. The highest value of both impacts will In this assessment safeguard risk scores are not recalculated
be taken as the impact value. Chances are how often that risk but rather provide recommendations for things that need to
will arise. In Tier 1 CIS CSC provides a simple definition be done to reduce these risks.
guide with values from 1 to 3. PT. XYZ gives a value of 1 if
The next step is risk assessment and propose safeguard.
the scenario has never occurred, a value of 2 if the scenario
Risk assessment is performed by studying documents and
has occurred in the past 1 year, and a value of 3 if the scenario
interviews with stewards according to the documentation in
often occurs in the last 1 year.
the first step. Interviews were conducted to provide the
TABLE I. SCOPE DEFINITION likelihood and impact on each sub-control according to the
CIS CSC IG2 guidelines. Each sub control that has a value of
Asset Type Asset Name BO Steward more than 4 is given a recommendation by a consultant for
infrastructure improvement.
Information Arsitektur DC CIO Head Of Operation
Overall assessment results can be seen on Fig. 3. Based
Arsitektur
Information CIO Head Of Operation on the results of the assessment, there were 92 sub-controls
DRC
that exceeded the threshold value. Then the assessment team
Arsitektur makes the value of each control taken from the average value
Information CIO Head Of Operation
Kantor Pusat of the sub control. The result is that there are 16 out of 20
Server LDAP CIO Network Engineer controls that have values above 4. These results illustrate that
IT infrastructure security of PT. XYZ is weak.
Prod DB
Server CIO Database Engineer
Server
Network
DC Router CIO Network Engineer
Device

407
Authorized licensed use limited to: Mukesh Patel School of Technology & Engineering. Downloaded on March 18,2024 at 09:42:31 UTC from IEEE Xplore. Restrictions apply.
 2020 3rd International Conference on Computer and Informatics Engineering (IC2IE)

Fig. 3. Results of IT Infrastructure Security Risk Assessment

security from malware threats as evidenced by the value of

CIS Control 8 Malware Defense, but still has many
weaknesses such as account monitoring and control, secure
configuration control for hardware and software on mobile
devices, laptops, workstations and servers, data recovery
capabilities, implement a security awareness and training
program, secure configuration for network devices, such as
firewalls, routers and switches, incident response and
management. Based on the results of interviews weak
security awareness and lack of security control over mobile
devices, laptops, workstations, servers and network devices
coupled with a lack of security in the network topology can
cause malware to enter the server.
The network topology in Fig. 4 shows that currently there
are no security controls on access to the database server.
There is no zone separation between the DMZ and Server
Farm. There are no security control devices at the application
level for servers that can be accessed from the public /
internet. Firewall configuration is not optimal so that every
device can access the server through all ports.
Fig. 4. Data Center Network Topology
Based on these conditions, there are recommendations for
TABLE II. IMPROVEMENT ACTIVITY ROADMAP improvement by monitoring all data center infrastructure
assets by the network operation center. In addition, it also
Year Activity makes changes to network topology such as creating network
1 Strengthening IT architecture, assets inventory, segmentation, controlling access between DMZs, server
vulnerability management, security baselining, farms and databases using an internal firewall, adding
implementation network devices and additional security security controls such as Network IDPS, Web Application
controls (stage 1), add human resources Firewall, and Internal Network IDS.
2 Implementation network devices and additional security Recommendations for improving the assessment result
controls (stage 2), human resources expertise training and were then consulted with the CIO. Organizations must adjust
certification, security awareness, implementation network the implementation of the CIS Control based on appropriate
devices and additional security controls, increase in human and reasonable considerations according to the organization's
resources, security baselining, security hardening (stage 1),
resources, mission, and risks [5]. CIO's role is to choose
security incident response and handling, strengthening
security monitoring, Information security testing (stage 1)
recommendations that are feasible / not feasible to be
implemented by the company.
3 Implementation network devices and additional security
controls (stage 3), security hardening (stage 2), secure C. Strengthening IT Infrastructure Security Roadmap
coding, information security testing (stage 2) Based on the results of the recommended improvements
13 selected activities that need to be done, of course it can not
An interesting thing that is seen from the assessment be done in a short time and IT investment needs can be met
results is PT. XYZ already has a good ability to maintain

408
Authorized licensed use limited to: Mukesh Patel School of Technology & Engineering. Downloaded on March 18,2024 at 09:42:31 UTC from IEEE Xplore. Restrictions apply.
 2020 3rd International Conference on Computer and Informatics Engineering (IC2IE)

immediately. For this reason, a roadmap for the framework. In addition, PT XYZ is interested in seeing IT
implementation of improvement activities needs to be made security from other frameworks as a comparison.
where PT. XYZ determined the implementation of these
activities could be carried out in the next 3 years. Roadmap ACKNOWLEDGEMENT
on Table II illustrates how the implementation of the
This study was funded by the 2020 PUTI Research Grant,
recommendations for improvement is carried out in stages
Universitas Indonesia.
and prioritized based on the most important needs in
accordance with the CIO's decision.
REFERENCES
V. LESSON LEARNED
The lessons that can be drawn from what has been done [1] P. Copy and D. Lanter, COBIT 2019 Framework - Introduction and
in this activity are: methodology, ISACA, 2019.
[2] "PP NOMOR 80 TAHUN 2019: Perdagangan Melalui Sistem
1. Critical Security Control from the Center of Internet Elektronik [Government Regulation Number 80 of 2019 concerning
Security can be used as a framework for evaluating the Trading through Electronic Systems]," 18 February 2019. [Online].
Available:
security of IT infrastructure. https://jdih.setneg.go.id/viewpdfperaturan/P18728/PP%20Nomor%
2. In the case of PT. XYZ, who adopted the Implementation 2080%20Tahun%202019.
Group 2 category, had many recommendations and [3] L. Applegate, R. Austin and D. Soule, Corporate Information
Strategy and Management: Text and Cases, McGraw-Hill, 2009.
things that needed to be done. According to the results of
[4] M. &. P. A. &. P. A. Prodan, "Three New Dimensions to People,
the interview, CIS Control should be chosen again Process, Technology Improvement Model," Advances in Intelligent
according to the organization's ability to implement this. Systems and Computing, pp. 481-490, 2015.
3. The recommendations given are considered very well [5] Center for Internet Security, "CIS Controls, Version 7.1," 2019.
and can help in improving the organization's ability to [6] NNT, "Understanding The Basic CIS Controls: CSC 1-6.,"
[Online]. Available:
provide services, but to implement all of these https://www.newnettechnologies.com/understanding-the-basic-cis-
recommendations requires adequate financial, human controls-csc-1-6.html. [Accessed 19 4 2020].
resources, and human resource capabilities. According [7] A. Dutta and E. Al-Shaer, "“What”, “Where”, and “Why”
to J. D. Hietala [16] organizations have limited budgets Cybersecurity Controls to Enforce for Optimal Risk Mitigation," in
to handle new security projects and can take advantage IEEE Conference on Communications and Network Security (CNS),
of existing investments in security systems management Washington DC, 2019.
tools and IT. In this position the role of the CIO is very [8] Center for Internet Security, "CIS Risk Assessment Method".
important to choose the recommendations to be accepted [9] A. M. Abuzaid, M. M. Saudi, B. M. Taib and Z. H. Abdullah, "An
Efficient Trojan Horse Classification (ETC)," International Journal
and priorities to be worked on or the recommendations of Computer Science Issues, vol. 10, no. 2, p. 96, 2013.
are not implemented so that it becomes a risk borne by
[10] M. J. Joshi and B. V. Patil, "Computer Virus: Their Problems &
the organization. Major attacks in Real Life," International Journal of P2P Network
Trends and Technology, vol. 3, no. 4, p. 206, 2013.
4. The strategy that can be taken to ensure the availability
[11] A. P. C. E. R. T. (APCERT), "APCERT Annual Report 2018,"
of funds and human resources is to make a roadmap for APCERT Secretariat, 2018.
working on recommendations. The roadmap also
[12] The TOGAF Standard, Version 9.2, US: The Open Group, 2018.
functions as a CIO commitment to improve the security
[13] N. Al-Safwani, Y. Fazea and H. Ibra-him, "ISCP: In-depth model
of IT infrastructure. for selecting critical security controls," in Computers & Security,
2018.
5. According to interviews, the use of security tools can
help improve the security of IT infrastructure and [14] V. Kaup Vijayananda, "Implementing CIS Cybersecurity Controls
for the Department of Residence, Iowa State University," 2018.
improve the efficiency of IT HR participation through
[15] Center for Internet Security, "CIS RAM Workbook Version 1.0,"
the automation features offered. 2018.
[16] J. D. Hietala, "Implementing the Critical Security Controls," 2013.
VI. CONCLUSION
The purpose of this research is to explore how an
insurance company assuring the reliability and security of IT
infrastructure. This research has outlined ways to identify and
evaluate information security risks. CIS CSC has sequential,
clear and straight forward steps in evaluating information
security risks. This research also has limitations because it is
a case study research, the results are less generalizable. Apart
from that, this research can be used as a lesson learned from
the condition of information security advancement in
insurance companies in Indonesia.
In the future, it is interesting to explore another security
assessment method such as COBIT-5. That is because PT.
XYZ has implemented COBIT-5 as an IT governance

409
Authorized licensed use limited to: Mukesh Patel School of Technology & Engineering. Downloaded on March 18,2024 at 09:42:31 UTC from IEEE Xplore. Restrictions apply.