Choice and Chance: A Conceptual Model of Paths to Information Security Compromise

Abstract

N o longer the exclusive domain of technology experts, information security is now a management issue. Through a grounded approach using interviews, observations, and secondary data, we advance a model of the information security compromise process from the perspective of the attacked organization. We distinguish between deliberate and opportunistic paths of compromise through the Internet, labeled choice and chance, and include the role of countermeasures, the Internet presence of the firm, and the attractiveness of the firm for information security compromise. Further, using one year of alert data from intrusion detection devices, we find empirical support for the key contributions of the model. We discuss the implications of the model for the emerging research stream on information security in the information systems literature.

The Impact of Immediate Disclosure on Attack Diffusion and Volume

“…If countermeasures are found, then there is no utility for continued attempts within a firm and overall attack volume does not correspondingly increase with the increased penetration. This supports the conversion from broad untargeted reconnaissance activity to targeted attacks previously theorized (Ransbotham and Mitra 2009). …”

“…When a patch corresponding to a vulnerability is not available, specific countermeasures can provide partial protection against attacks through three types of countermeasures that limit the impact of a vulnerability (Ransbotham and Mitra 2009): (a) access control methods that limit access to the affected software, (b) feature control methods that disable functionality and features in the affected software and devices, and (c) traffic control methods that filter suspicious traffic based on the attack signature. Similar descriptions of countermeasures also appear in (Ransbotham et al 2011).…”

When Private Information Settles the Bill: Money and Privacy in Google's Market for Smartphone Applications

“…When users of firm devices grant too many rights to a smartphone app, they might compromise information security. Their usage could open an opportunity for standardized attack patterns like the "Choice and Chance" attack described by Ransbotham and Mitra (2009). Users' adoption decisions can even affect the privacy of uninvolved friends (Pu and Grossklags, 2016).…”

Examination of the Factors that Influence Teleworkers' Willingness to Comply with Information Security Guidelines

“…A primary concern over the use of teleworking and mobile devices has been security over the integrity of the data (Dinev & Hu, 2007;Ransbotham & Mitra, 2008).…”