Dynamics of organizational information security

Dutta, Amitava; Roy, Rahul

doi:10.1002/sdr.405

Cited by 31 publications

(11 citation statements)

References 44 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Dutta and Roy [38] used similar approaches to simulate human factors. However they focus on the transaction level and they view Value as a reservoir rather than as a mechanism to determine action.…”

Section: Simulation Studies For Information Securitymentioning

confidence: 97%

An Experimental Study to Explore Attacker Response to Changes in Security and Reward

Rounds

Pendegraft

Alves-Foss

2013

2013 46th Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

In previous simulation studies, attackers were assumed to respond to changes in reward with an S shaped curve and to changes in security with a declining S shaped curve. This paper reports experimental work that investigates the validity of those assumptions. In general, the results suggest that the assumptions are reasonable. BackgroundMuch of the research in computer security focuses on the technological systems interactions. Walters, Liang, Shi, and Chaudhary [1] focus on the technological portion of wireless networking. Early research surveyed by Browne [2] found that that there were thousands of papers on computer security and risk management, but most were too narrow in scope and too fixated on technological fixes to be of much value.Udo's survey [3] of privacy and security concerns as related to e-commerce focuses on how users perceive threats, and concludes that while many IT users feel that security is a critical issue, they don't believe that the government or any technological fix is capable of securing their privacy. In those areas where the human interaction factor is described, the literature tends to focus on the technology side of the interaction rather than the human side. In their book, Cranor and Garfinkel [4] make the point that overly complex passwords can hurt the overall effectiveness of password security. Besar and Arief [5] and Duggan, Johnson and Grawemeyer [6] discuss the impairment of security by legitimate users, their description of the faults focuses on the technical.Sasse et.al.[7] made the point that the human portion of the security problem is the area of highest leverage. Adams and Sasse [8] stated that rather than avoiding investigating the human factors, we need to embrace them. Mitnick and Simon [9] note that the importance of human factor is critical because it is the basis of many threats. Saltzer and Schroeder [10] who recognize that humans play a role, focus mainly on the technological issues of security rather than the interactions of the system with its users and attackers.The human factor is important because engineers cannot evaluate a security system until they can measure the effectiveness and hence the benefit provided by computer security.Carayon [11] describes a "sociotechnical system" which is the amalgamation of humans and their information system.Many firms engage in cost/benefit analysis of security measures before applying them [12][13] [14]. These analyses are primarily qualitative in nature since there are not many quantitative models of the interaction between attacker and security professional. Gordon and Loeb [15] describe how an information system manager might respond in terms of monetary resources for a selected vulnerability, but they do not discuss how this response will affect the likelihood of future attacks. Authors such as Schneier [16] and Cavusoglu, Cavusoglu, and Raghunathan [17] look at the economics of computer security from the user's point of view but cast little light on how attackers respond. Their work assumes that attackers are u...

show abstract

Section: Simulation Studies For Information Securitymentioning

confidence: 97%

An Experimental Study to Explore Attacker Response to Changes in Security and Reward

Rounds

Pendegraft

Alves-Foss

2013

2013 46th Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

show abstract

“…Evidently, most studies largely focus on economic aspects of IT security decisions by proposing a valueat-risk or return on (security) investment approach (ROSI) [e.g., [33][34][35]. This is also reflected by the slight surplus of predominantly normative studies (56%) based on mathematical modelling (64% proportionately) [2,6,10,33,34,[36][37][38][39][40][41][42][43][44][45][46][47][48][49][50][51][52][53][54]. Whereas two studies pursue a purely qualitative approach [20,55] and six are purely conceptual [56][57][58][59][60][61], eleven studies employ a combination of several approaches [4,14,33,35,37,39,40,41,48,51,62] and three are based on panel data [3,…”

Section: Literature Analysismentioning

confidence: 99%

“…The investment nuances that are most often considered in these specific investment studies, but also in publications that pursue a more generic approach, are the specific area or content and the optimal level of investment [4,10,33,34,47,53,56,60,62]. Only a single study is dedicated towards to the decision regarding the source or origin of the investment [48] and a total of six studies consider the fundamental decision whether to invest at all [31,38,44,47,54,55].…”

Section: Literature Analysismentioning

confidence: 99%

A Holistic View on Organizational IT Security: The Influence of Contextual Aspects During IT Security Decisions

Heidt

Gerlach

Buxmann

2019

Proceedings of the Annual Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

Decisions regarding organizational IT security are often approximated by models drawing on normative statistical decision theories even though several IS researchers and studies in cognate disciplines have argued for the importance of contextual aspects. Based on findings in organizational and behavioral science and 25 expert interviews, this paper proposes a framework, postulating that IT security (investment) decisions are largely influenced by such contextual aspects: organizational, environmental, economic, and not least of all by cognitive and behavioral aspects of decision-makers. Subsequently, we review organizational IT security literature building on Straub and Welke's Security Risk Planning Model and the previously postulated conceptual framework. This critical literature review highlights the scarcity of studies analyzing IT security decision-making from a behavioral, environmental, and organizational perspective and thus argues for the importance and future consideration of contextual aspects regarding IT security decisions.

show abstract

“…V návaznosti na System Dynamics Review, vědeckého promotora Systémové dynamiky, je možné pozorovat šest oblastí, ve kterých dochází k vědecké kooperaci informačních a komunikačních technologií a Systémové dynamiky. Jedná se o oblasti informační bezpečnosti, komunikace informací, komunikačních sítí, sdílení znalostí, e-mailové komunikace a v neposlední řadě již zmíněné analýzy informačního systému (Georgantzas & Katsamakas, 2008;Kanungo & Jain, 2008;Luna-Reyes et al, 2008;Otto & Simon, 2008;Pavlov, Plice & Melville, 2008;Dutta & Roy, 2008). Další výzkum je možné koncipovat do analýz, nakolik se Systémová dynamika integruje a je využívána při ICT projektech -nejen za účelem nastavení systémového rámce, optimalizace procesů, ale i k efektivnějšímu přenosu informací a tvorby znalostí.…”

Section: Diskuze Mezinárodních Souvislostíunclassified

Systems Approach to Scientific Investigation in Informatics

Mildeová

Dalihod

2017

AIP

View full text Add to dashboard Cite

Úroveň rozvoje informatiky je kauzálně spjata s úrovní vědeckého vývoje v oblasti. Úspěšná vědecká práce je založena nejen na investigativním stylu myšlení, znamená myslet v souvislostech a vidět kontext řešeného výzkumného problému-umět aplikovat systémové přístupy. Mezi systémové přístupy patří disciplína Systémová dynamika; komunita praktikující Systémovou dynamiku se stala nejsilnější školou systémových přístupů s mnoha členy z akademického prostředí i z reálné praxe. Cílem článku je ukázat možnosti modelů systémové dynamiky jako vhodných nástrojů pro podporu systémového přístupu k vědeckému zkoumání v informatice. Multidisciplinární a kvantitativní pojetí, které je pro Systémovou dynamiku typické, je dle autorů vhodné k systémovému řešení složitých problémů současné informatické praxe. Provedená rešeršní činnost a zkoumání principů Systémové dynamiky včetně etap tvorby jejích modelů tyto autorské argumentace potvrzují.

show abstract

Dynamics of organizational information security

Abstract: In recent times, it has become evident that information security is not

Cited by 31 publications

References 44 publications

An Experimental Study to Explore Attacker Response to Changes in Security and Reward

An Experimental Study to Explore Attacker Response to Changes in Security and Reward

A Holistic View on Organizational IT Security: The Influence of Contextual Aspects During IT Security Decisions

Systems Approach to Scientific Investigation in Informatics

Contact Info

Product

Resources

About