Designing Attack Surface in Early Childhood Education System Environment using Risk Assessment and Enterprise Architecture Approach

Dadang Setiawan, Dita Oktaria, Sidik Prabowo, Elizabeth Sastrina Indrasari

Abstract


As digital technologies increasingly permeate the education sector, the need to safeguard sensitive personal data within early childhood education systems becomes paramount. In Indonesia, where the adoption of digital tools in education is rapidly expanding, these systems are particularly vulnerable due to the hybrid nature of their processes, varying levels of digital literacy among stakeholders, and a complex regulatory environment. This research addresses the challenge of securing Indonesia’s early childhood education systems by designing a minimized attack surface through the integration of ISO 27005-based risk assessment and the TOGAF enterprise architecture framework. ISO 27005 provides a systematic methodology for identifying, assessing, and mitigating information security risks, ensuring compliance with the Indonesian Personal Data Protection Law (UUPDP). TOGAF is utilized to structure the enterprise architecture, aligning IT strategies with institutional goals while embedding robust security measures across the digital infrastructure. The research methodology involves identifying critical assets and potential threats, evaluating these threats using ISO 27005, and developing a secure architecture tailored to the unique needs of Indonesian early childhood education systems. The proposed framework is validated through application in a case study involving several Indonesian early childhood education institutions. This approach not only enhances the security posture of these institutions but also aligns with cultural and regulatory considerations, offering a comprehensive solution for protecting vulnerable educational environments in Indonesia.

Full Text:

PDF

References


A. S. . Cerqueira Junior and C. H. . Arima, “Cyber Risk Management and ISO 27005 Applied in Organizations: A Systematic Literature Review”, Rev. Foco, vol. 16, no. 02, p. e1188, Feb. 2023.

W. Hommel, S. Metzger, and M. Steinke, “Information Security Risk Management in Higher Education Institutions: From Processes to Operationalization,” Handle.net, 2015, doi: https://doi.org/2409-1340.

H. Supriyadi and E. Amalia, “Development of Enterprise Architecture in Senior High School Using TOGAF as Framework,” Universal Journal of Educational Research, vol. 7, no. 4A, pp. 8–14, Apr. 2019, doi: https://doi.org/10.13189/ujer.2019.071402.

F. Burmeister, P. Drews, and I. Schirmer, "A Privacy-driven Enterprise Architecture Meta-Model for Supporting Compliance with the General Data Protection Regulation," Proceedings of the 52nd Hawaii International Conference on System Sciences, 2019, pp. 60040.

F. Al-Mudaires, A. Al-Samawi, A. Aljughaiman, and L. Nissirat, “Information security risk management framework for a governmental educational institute / Fajer Al-Mudaires ... [et al.] - UiTM Institutional Repository,” Uitm.edu.my, Apr. 2023, doi: https://ir.uitm.edu.my/id/eprint/77315/1/77315.pdf.

G. Fuentes-Quijada, F. Ruiz-González, and A. Caro, “Enterprise Architecture and IT Governance to Support the BizDevOps Approach: a Systematic Mapping Study,” Information Systems Frontiers, Feb. 2024, doi: https://doi.org/10.1007/s10796-024-10473-2.

Siegfried Rouvrais and Sobah Abbas Petersen, “An Architecture Framework for Higher Education,” Jan. 2024, doi: https://doi.org/10.5220/0012738900003690.

S. Faris and S. El. Hasnaoui, “Toward an Effective Information Security Risk Management of Universities’ Information Systems Using Multi Agent Systems, Itil, ISO 27002, ISO 27005,” International Journal of Advanced Computer Science and Applications, vol. 5, no. 6, 2014, doi: https://doi.org/10.14569/ijacsa.2014.050617.

J. De, D. Imbaquingo, and J. Llumiquinga, “Hybrid Information Security Framework Based on ISO/IEC 27005:2022 and the NIST Framework for the Ministry of Education of Ecuador (TIC),” Lecture notes in computer science, pp. 71–85, Jan. 2024, doi: https://doi.org/10.1007/978-3-031-65285-1_6.

A. F. Guzmán-Castillo, G. Suntaxi, B. N. Flores-Sarango, and D. A. Flores, “Towards Designing a Privacy-Oriented Architecture for Managing Personal Identifiable Information,” Journal of internet services and information security, vol. 14, no. 1, pp. 64–84, Mar. 2024, doi: https://doi.org/10.58346/jisis.2024.i1.005.

G. Culot, G. Nassimbeni, M. Podrecca, and M. Sartor, “The ISO/IEC 27001 information security management standard: literature review and theory-based research agenda,” The TQM Journal, vol. 33, no. 7, pp. 76–105, Mar. 2021, doi: https://doi.org/10.1108/tqm-09-2020-0202.

B. M. Dioubate, W. Daud, and W. Norhayate, “Cyber Security Risk Management Frameworks Implementation in Malaysian Higher Education Institutions,” International Journal of Academic Research in Business and Social Sciences, vol. 12, no. 4, Apr. 2022, doi: https://doi.org/10.6007/ijarbss/v12-i4/12300.

Dražen Oreščanin, Tomislav Hlupić, and B. Vrdoljak, “Managing Personal Identifiable Information in Data Lakes,” IEEE access, pp. 1–1, Jan. 2024, doi: https://doi.org/10.1109/access.2024.3365042.

G. F. Nama, Tristiyanto, and D. Kurniawan, “An enterprise architecture planning for higher education using the open group architecture framework (togaf): Case study University of Lampung,” IEEE Xplore, Nov. 01, 2017. https://ieeexplore.ieee.org/abstract/document/8280610/

A. Sulistiawati and K. D. Hartomo, "Risk Management Analysis of School Management Information Systems Using ISO 31000:2018," Sistemasi: Jurnal Sistem Informasi, vol. 13, no. 5, pp. 2020–2032, 2024.

Hery Dian Septama, Muhamad Komarudin, Puput Budi Wintoro, Mahendra Pratama, Titin Yulianti, and Bambang Sundari, “Enterprise Architecture Planning based on One Data in Indonesian Higher Education,” 2022 Seventh International Conference on Informatics and Computing (ICIC), Dec. 2022, doi: https://doi.org/10.1109/icic56845.2022.10006947.




DOI: https://doi.org/10.32520/stmsi.v13i6.4623

Article Metrics

Abstract view : 15 times
PDF - 3 times

Refbacks

  • There are currently no refbacks.


Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.