No abstract

No abstract

Maturity models are valuable management tools for assessing and managing capabilities and therefore creating a basis for their identification, prioritization, and further development. Numerous maturity assessment methods have been developed to support organizations in applying maturity models. However, these methods are mostly used for unique assessments and only provide a snapshot of the current state of capabilities and their maturity. Certainly, this does not reflect the continuous change of capabilities within dynamic organizational environments. Moreover, the systematic selection of suitable maturity models and the identification of the actions that should be targeted following the maturity assessment require more attention. To fill these research gaps, this study proposes the generally applicable Continuous Maturity Assessment Method (CMAM) that enables comprehensive and continuous maturity assessments. The CMAM comprises five steps that extend and advance existing principles of maturity assessment and can be implemented as an organizational routine. The rigorous development of the CMAM followed basic principles of the design science research methodology, including an evaluation of six organizations in different industry sectors and an extensive industrial case study.

No abstract

Purpose In the past, people were usually seen as the weakest link in the IT security chain. However, this view has changed in recent years and people are no longer seen only as a problem, but also as part of the solution. In research, this change is reflected in the fact that people are enabled to report security incidents that they have detected. During this reporting process, however, it is important to ensure that the reports are submitted with the highest possible data quality. This paper aims to provide a process-driven quality improvement approach for human-as-a-security-sensor information. Design/methodology/approach This work builds upon existing approaches for structured reporting of security incidents. In the first step, relevant data quality dimensions and influencing factors are defined. Based on this, an approach for quality improvement is proposed. To demonstrate the feasibility of the approach, it is prototypically implemented and evaluated using an exemplary use case. Findings In this paper, a process-driven approach is proposed, which allows improving the data quality by analyzing the similarity of incidents. It is shown that this approach is feasible and leads to better data quality with real-world data. Originality/value The originality of the approach lies in the fact that data quality is already improved during the reporting of an incident. In addition, approaches from other areas, such as recommender systems, are applied innovatively to the area of the human-as-a-security-sensor.