Search results

The purpose of this paper is to develop a method for information classification. The proposed method draws on established standards, such as the ISO/IEC 27002 and information classification practices. The long-term goal of the method is to decrease the subjective judgement in the implementation of information classification in organisations, which can lead to information security breaches because the information is under- or over-classified.

The results are based on a design science research approach, implemented as five iterations spanning the years 2013 to 2019.

The paper presents a method for information classification and the design principles underpinning the method. The empirical demonstration shows that senior and novice information security managers perceive the method as a useful tool for classifying information assets in an organisation.

Existing research has, to a limited extent, provided extensive advice on how to approach information classification in organisations systematically. The method presented in this paper can act as a starting point for further research in this area, aiming at decreasing subjectivity in the information classification process. Additional research is needed to fully validate the proposed method for information classification and its potential to reduce the subjective judgement.

The research contributes to practice by offering a method for information classification. It provides a hands-on-tool for how to implement an information classification process. Besides, this research proves that it is possible to devise a method to support information classification. This is important, because, even if an organisation chooses not to adopt the proposed method, the very fact that this method has proved useful should encourage any similar endeavour.

The proposed method offers a detailed and well-elaborated tool for information classification. The method is generic and adaptable, depending on organisational needs.

The purpose of this study is to identify factors that determine computer and security expertise in end users. They can be significant determinants of human behaviour and interactions in the security and privacy context. Standardized, externally valid instruments for measuring end-user security expertise are non-existent.

A questionnaire encompassing skills and knowledge-based questions was developed to identify critical factors that constitute expertise in end users. Exploratory factor analysis was applied on the results from 898 participants from a wide range of populations. Cluster analysis was applied to characterize the relationship between computer and security expertise. Ordered logistic regression models were applied to measure efficacy of the proposed security and computing factors in predicting user comprehension of security concepts: phishing and certificates.

There are levels to peoples’ computer and security expertise that could be reasonably measured and operationalized. Four factors that constitute computer security-related skills and knowledge are, namely, basic computer skills, advanced computer skills, security knowledge and advanced security skills, and these are identified as determinants of computer expertise.

Findings from this work can be used to guide the design of security interfaces such that it caters to people with different expertise levels and does not force users to exercise more cognitive processes than required.

This work identified four factors that constitute security expertise in end users. Findings from this work were integrated to propose a framework called Security SRK for guiding further research on security expertise. This work posits that security expertise instrument for end user should measure three cognitive dimensions: security skills, rules and knowledge.

As cyber-attacks continue to grow, organisations adopting the internet-of-things (IoT) have continued to react to security concerns that threaten their businesses within the current highly competitive environment. Many recorded industrial cyber-attacks have successfully beaten technical security solutions by exploiting human-factor vulnerabilities related to security knowledge and skills and manipulating human elements into inadvertently conveying access to critical industrial assets. Knowledge and skill capabilities contribute to human analytical proficiencies for enhanced cybersecurity readiness. Thus, a human-factored security endeavour is required to investigate the capabilities of the human constituents (workforce) to appropriately recognise and respond to cyber intrusion events within the industrial control system (ICS) environment.

A quantitative approach (statistical analysis) is adopted to provide an approach to quantify the potential cybersecurity capability aptitudes of industrial human actors, identify the least security-capable workforce in the operational domain with the greatest susceptibility likelihood to cyber-attacks (i.e. weakest link) and guide the enhancement of security assurance. To support these objectives, a Human-factored Cyber Security Capability Evaluation approach is presented using conceptual analysis techniques.

Using a test scenario, the approach demonstrates the capacity to proffer an efficient evaluation of workforce security knowledge and skills capabilities and the identification of weakest link in the workforce.

The approach can enable organisations to gain better workforce security perspectives like security-consciousness, alertness and response aptitudes, thus guiding organisations into adopting strategic means of appropriating security remediation outlines, scopes and resources without undue wastes or redundancies.

This paper demonstrates originality by providing a framework and computational approach for characterising and quantify human-factor security capabilities based on security knowledge and security skills. It also supports the identification of potential security weakest links amongst an evaluated industrial workforce (human agents), some key security susceptibility areas and relevant control interventions. The model and validation results demonstrate the application of action research. This paper demonstrates originality by illustrating how action research can be applied within socio-technical dimensions to solve recurrent and dynamic problems related to industrial environment cyber security improvement. It provides value by demonstrating how theoretical security knowledge (awareness) and practical security skills can help resolve cyber security response and control uncertainties within industrial organisations.

Positive examples of situations in which young adults new at work experience feeling secure in the role as novice in the work force are here focused. The aim is to analyze how young adults who are new to the labor market express having a sense of security in the workplace. The long-term goal is to strengthen the conditions for the health and wellbeing of workers entering the retail labor market.

Thirteen individual in-depth telephone/video-interviews were conducted with young adults (aged 18–28) working within the retail sector in Sweden. Using a thematic interview schedule, the interviews focused how the interviewees contextualizing stories on being novice at the labor market. The study is based on those parts of the material in which stories on feeling secure was expressed.

The analysis resulted in two themes: A sense of security is related to carrying out work safely and a sense of security is related to receiving support. The first theme illuminates how work is structured and safety training respectively contributes to a sense of security and the latter reveal how social support from a variety of sources (managers, colleagues and others outside the work environment) contributes to a sense of security when new at work.

Using a health promoting perspective, the study complements the existing perspectives of challenges faced by novices as they enter working life. Also, the study highlights the importance of including relations outside the workplace when searching for the understanding of the experiences of being new at work. The study indicates that focusing on the sense of security by well-structured work, safety training and social support might contribute to the strive for a sustainable working life for young adults.

The paper seeks to provide a foundational understanding of the socio‐technical system that is computer network intrusion detection, including the nature of the knowledge work, situated expertise, and processes of learning as supported by information technology.

The authors conducted a field study to explore the work of computer network intrusion detection using multiple data collection methods, including semi‐structured interviews, examination of security tools and resources, analysis of information security mailing list posts, and attendance at several domain‐specific user group meetings.

The work practice of intrusion detection analysts involves both domain expertise of networking and security and a high degree of situated expertise and problem‐solving activities that are not predefined and evolve with the dynamically changing context of the analyst's environment. This paper highlights the learning process needed to acquire these two types of knowledge, contrasting this work practice with that of computer systems administrators.

The research establishes a baseline for future research into the domain and practice of intrusion detection, and, more broadly, information security.

The results presented here provide a critical examination of current security practices that will be useful to developers of intrusion detection support tools, information security training programs, information security management, and for practitioners themselves.

There has been no research examining the work or expertise development processes specific to the increasingly important information security practice of intrusion detection. The paper provides a foundation for future research into understanding this highly complex, dynamic work.

The purpose of this paper is to investigate security decision-making during risk and uncertain conditions and to propose a normative model capable of tracing the decision rationale.

The proposed risk rationalisation model is grounded in literature and studies on security analysts’ activities. The model design was inspired by established awareness models including the situation awareness and observe–orient–decide–act (OODA). Model validation was conducted using cognitive walkthroughs with security analysts.

The results indicate that the model may adequately be used to elicit the rationale or provide traceability for security decision-making. The results also illustrate how the model may be applied to facilitate design for security decision makers.

The proof of concept is based on a hypothetical risk scenario. Further studies could investigate the model’s application in actual scenarios.

The paper proposes a novel approach to tracing the rationale behind security decision-making during risk and uncertain conditions. The research also illustrates techniques for adapting decision-making models to inform system design.

In the past, people were usually seen as the weakest link in the IT security chain. However, this view has changed in recent years and people are no longer seen only as a problem, but also as part of the solution. In research, this change is reflected in the fact that people are enabled to report security incidents that they have detected. During this reporting process, however, it is important to ensure that the reports are submitted with the highest possible data quality. This paper aims to provide a process-driven quality improvement approach for human-as-a-security-sensor information.

This work builds upon existing approaches for structured reporting of security incidents. In the first step, relevant data quality dimensions and influencing factors are defined. Based on this, an approach for quality improvement is proposed. To demonstrate the feasibility of the approach, it is prototypically implemented and evaluated using an exemplary use case.

In this paper, a process-driven approach is proposed, which allows improving the data quality by analyzing the similarity of incidents. It is shown that this approach is feasible and leads to better data quality with real-world data.

The originality of the approach lies in the fact that data quality is already improved during the reporting of an incident. In addition, approaches from other areas, such as recommender systems, are applied innovatively to the area of the human-as-a-security-sensor.

Cryptocurrencies, such as Bitcoin, generate innovative and fast exchanges without any physical form and facilitate online payments; thus, they may bring about revolutions of the future economic system. Recent investigations reveal that China, the second largest Bitcoin market, accounts for a huge volume of Bitcoin trading and mining, which can cast distinct influences on future values of Bitcoin. Therefore, it would be of great significance to probe into the repurchase intention of Bitcoin of the Chinese individuals.

One hundred and forty-three questionnaires were collected from Chinese respondents. SPPS was employed for data analysis of the proposed hypotheses.

The results show that expectation has a positive impact on perceived enjoyment and perceived ease of use. A positive relationship between perceived ease of use and perceived enjoyment was confirmed. The findings also reveal that expectation, perceived enjoyment and perceived ease of use have significant impact on satisfaction. Moreover, it is found that perceived enjoyment, perceived ease of use and satisfaction significantly influence the repurchase intention of Bitcoin.

This study encourages future comparative studies to be conducted. Besides, it is recommended to find out other possible antecedents of repurchase intention. Moreover, this study suggested negative effects of Bitcoin to be explored.

In a practical standpoint, this study provides valuable suggestions about cryptocurrencies use and regularization. For instance, education and learnability issues of novice users need to be considered. Further, the regularization/implementation of cryptocurrencies/blockchain technologies is also suggested.

This is the pioneer endeavor which investigates the repurchase intention of Bitcoin. The findings explore some of the possible antecedents which influence repurchase intention of Bitcoin. These findings provide valuable insights and enrich the existing body of literature in the domain of Bitcoin.

Expected learning outcomes: To respond to the case question, students would analyze macro- and microeconomic differences to determine HC Securities’ preferred global strategy and appropriate market entry mode. The case demonstrates how instability in a local market, in this case Egypt, can force a company to go global. It also demonstrates how two superficially similar markets, Singapore and Hong Kong, provide different opportunities for HC Securities and require different global strategies: Singapore provides a jumping-off point to its predominantly Muslim neighbors Malaysia and Indonesia, whereas Hong Kong gives access to China and could provide a new customer base of Asian investors willing to invest in Africa and the Middle East.

Brief overview of the case: The case introduces the Egyptian investment company HC Securities, which is facing challenges related to Egypt’s political instability and economic slowdown. HC Securities’ CEO, Mr. Choucri, feels expansion to one of the Asia-Pacific countries could help with the company’s growth and stability. He identifies Hong Kong and Singapore as the most compelling locations because of their sophisticated economies and growth potential in the investments industry. This case provides information about each market, allowing students to respond to the question “What should Choucri do to assure a market-based solution for his company?”

Student level and proposed courses: The case is appropriate for use in undergraduate courses in international business or strategic management.

Teaching Notes are available for educators only. Please contact your library to gain login details or email support@emeraldinsight.com to request teaching notes.

International Business.

One important characteristic of cryptocurrencies has been their high and erratic volatility. To represent this complicated behavior, recent studies have emphasized the use of autoregressive models frequently concluding that generalized autoregressive conditional heteroskedasticity (GARCH) models are the most adequate to overcome the limitations of conventional standard deviation estimates. Some studies have expanded this approach including jumps into the modeling. Following this line of research, and extending previous research, our study analyzes the volatility of Bitcoin employing and comparing some symmetric and asymmetric GARCH model extensions (threshold ARCH (TARCH), exponential GARCH (EGARCH), asymmetric power ARCH (APARCH), component GARCH (CGARCH), and asymmetric component GARCH (ACGARCH)), under two distributions (normal and generalized error). Additionally, because linear GARCH models can produce biased results if the series exhibit structural changes, once the conditional volatility has been modeled, we identify the best fitting GARCH model applying a Markov switching model to test whether Bitcoin volatility evolves according to two different regimes: high volatility and low volatility. The period of study includes daily series from July 16, 2010 (the earliest date available) to January 24, 2019. Findings reveal that EGARCH model under generalized error distribution provides the best fit to model Bitcoin conditional volatility. According to the Markov switching autoregressive (MS-AR) Bitcoin’s conditional volatility displays two regimes: high volatility and low volatility.