Information and Computer Security: Volume 28 Issue 4

An activity theory approach to information security non-compliance

Rima Khatib, Henri Barki

The purpose of this paper is to introduce activity theory (AT) as a new theoretical lens to the field of information security non-compliance by explaining how research in…

Utilizing a privacy impact assessment method using metrics in the healthcare sector

Eleni-Laskarina Makri, Zafeiroula Georgiopoulou, Costas Lambrinoudakis

This study aims to assist organizations to protect the privacy of their users and the security of the data that they store and process. Users may be the customers of the…

Privacy, security, legal and technology acceptance elicited and consolidated requirements for a GDPR compliance platform

Aggeliki Tsohou, Emmanouil Magkos, Haralambos Mouratidis, George Chrysoloras, Luca Piras, Michalis Pavlidis, Julien Debussche, Marco Rotoloni, Beatriz Gallego-Nicasio Crespo

General data protection regulation (GDPR) entered into force in May 2018 for enhancing personal data protection. Even though GDPR leads toward many advantages for the data…

A systematic literature review of the factors affecting smartphone user threat avoidance behaviour

Rika Butler

There is a need for behavioural research within the smartphone context to better understand users’ behaviour, as it is one of the reasons for the proliferation of mobile…

Discovering “Insider IT Sabotage” based on human behaviour

Antonia Michael, Jan Eloff

Malicious activities conducted by disgruntled employees via an email platform can cause profound damage to an organization such as financial and reputational losses. This…

PRISM: a strategic decision framework for cybersecurity risk assessment

Rajni Goel, Anupam Kumar, James Haddow

This study aims to develop a framework for cybersecurity risk assessment in an organization. Existing cybersecurity frameworks are complex and implementation oriented. The…

Information and cyber security maturity models: a systematic literature review

Anass Rabii, Saliha Assoul, Khadija Ouazzani Touhami, Ounsa Roudies

This paper aims to clarify the uncertainty reflected in the current state of information security maturity evaluation where it has not enough matured and converged so that…

From ISO/IEC27001:2013 and ISO/IEC27002:2013 to GDPR compliance controls

Vasiliki Diamantopoulou, Aggeliki Tsohou, Maria Karyda

This paper aims to identify the controls provisioned in ISO/IEC 27001:2013 and ISO/IEC 27002:2013 that need to be extended to adequately meet, data protection requirements…