In the wide palette of chemoresistive sensing materials, hybrid nanocomposites have quickly gained [...]
Purpose – This paper aims to demonstrate that learners prefer brain-compatible cyber security educational material, over traditional presentation methods. Design/methodology/approach – A prototype brain-compatible cyber security educational system was evaluated using a survey as a research instrument. Findings – Presenting cyber security material in a brain-compatible manner is an effective way in which to stimulate the learners’ interest, engages them in the learning experience and motivates them to learn. Originality/value – As far as could be determined, no previous studies showed the relevance of brain-compatible pedagogical techniques to cyber security education.
Purpose – The purpose of this paper is to identify variables that influence compliance with information security policies of organizations and to identify how important these variables are. Design/methodology/approach – A systematic review of empirical studies described in extant literature is performed. This review found 29 studies meeting its inclusion criterion. The investigated variables in these studies and the effect size reported for them were extracted and analysed. Findings – In the 29 studies, more than 60 variables have been studied in relation to security policy compliance and incompliance. Unfortunately, no clear winners can be found among the variables or the theories they are drawn from. Each of the variables only explains a small part of the variation in people's behaviour and when a variable has been investigated in multiple studies the findings often show a considerable variation. Research limitations/implications – It is possible that the disparate findings of the reviewed studies can b...
Purpose – The purpose of this paper is to survey the status of information security awareness among college students in order to develop effective information security awareness training (ISAT). Design/methodology/approach – Based on a review of the literature and theoretical standpoints as well as the National Institute of Standards and Technology Special Publication 800-50 report, the author developed a questionnaire to investigate the attitudes toward information security awareness of undergraduate and graduate students in a business college at a mid-sized university in New England. Based on that survey and the previous literature, suggestions for more effective ISAT are provided. Findings – College students understand the importance and the need for ISAT but many of them do not participate in it. However, security topics that are not commonly covered by any installed (or built-in) programs or web sites have a significant relationship with information security awareness. It seems that students learned security concepts piecemeal from variety of sources. Practical implications – Universities can assess their ISAT for students based on the findings of this study. Originality/value – If any universities want to improve their current ISAT, or establish it, the findings of this study offer some guidelines.
Purpose – The internet provides a mechanism by which buyers and sellers meet in order to exchange goods and services online with the utmost convenience. However, there are many risks associated with the internet which, if left unattended, could continue deterring the adoption of e-commerce. These risks ultimately diminish online consumer trust in e-commerce. Web assurance models have been designed in an attempt to encourage online consumer trust through assurance. Unfortunately, many of these models have been inadequate in certain areas and this research aims to improve on them. Design/methodology/approach – It presents a comprehensive empirical survey on trustworthiness issues and e-commerce assurance models and proposes a new compliance-based e-commerce assurance model that integrates adaptive legislation, adaptive e-commerce-related standards and cooperative rating. The intelligent cooperative rating is based on the analytic hierarchy process and page-ranking techniques. Findings – Some findings of this research study influence the thinking that some of the untrustworthy sites are posing as trustworthy sites because they display web seals. The findings can be used as a reference guide to understand e-commerce assurance models, as well as the effectiveness of ensuring the trustworthiness of these models. Practical implications – The research presents deployment analysis on the use of the proposed compliance model through real life scenarios categorized as trustworthy and untrustworthy e-commerce web sites. Originality/value – This research is relevant to information management and computer security in e-commerce as a development of a newly proposed e-commerce assurance model for trustworthiness safety inspections and knowledge generation as a reference guide to understand e-commerce trustworthiness in general and e-commerce assurance models in particular detail.
Purpose – The purpose of the study was threefold: to understand security behaviours in practice by investigating factors that may cause an individual to comply with a request posed by a perpetrator; to investigate if adding information about the victim to an attack increases the probability of the attack being successful; and, finally, to investigate if there is a correlation between self-reported and observed behaviour. Design/methodology/approach – Factors for investigation were identified based on a review of existing literature. Data were collected through a scenario-based survey, phishing experiments, journals and follow-up interviews in three organisations. Findings – The results from the experiment revealed that the degree of target information in an attack increased the likelihood that an organisational employee falls victim to an actual attack. Further, an individual’s trust and risk behaviour significantly affected the actual behaviour during the phishing experiment. Computer experience at work, helpfulness and gender (females tend to be less susceptible to a generic attack than men), had a significant correlation with behaviour reported by respondents in the scenario-based survey. No correlation between the results from the scenario-based survey and the experiments was found. Research limitations/implications – One limitation is that the scenario-based survey may have been interpreted differently by the participants. Another is that controlling how the participants reacted when receiving the phishing mail, and what actually triggered each and every participant to click on the attached link, was not possible. Data were however collected to capture these aspects during and after the experiments. In conclusion, the results do not imply that one or the other method should be ruled out, as they have both advantages and disadvantages which should be considered in the context of collecting data in the critical domain of information security. Originality/value – Two different methods to collect data to understand security behaviours have rarely been used in previous research. Studies that add target information to understand if such information could increase the probability of attack success is sparse. This paper includes both approaches.
Purpose – The purpose of this research is to explain particular implementation weaknesses of near field communication (NFC) systems done by several institutions which apply for critical purposes and provide practical solutions. Design/methodology/approach – This research is done by literature studies of previous findings in NFC security, observations of some existing implemented systems and experimentations to provide practical solutions. Findings – Unintentional lack of security protection of the NFC cards and tags by some card issuers make them a vulnerable target. The outcomes of this research are proposed solutions on methods to quickly detect vulnerability in NFC tags using an Android-based mobile application. Another solution involves the assembly of a detection device using the portable, low power and powerful Raspberry Pi to analyze the NFC tags or cards and NFC reader vulnerabilities. Research limitations/implications – This research is conducted in Indonesia; therefore, the results and solutions...
Purpose – This paper's purpose is to identify and accentuate the dilemma faced by small- to medium-sized enterprises (SMEs) who use mobile devices as part of their mobility business strategy. While large enterprises have the resources to implement emerging security recommendations for mobile devices, such as smartphones and tablets, SMEs often lack the IT resources and capabilities needed. The SME mobile device business dilemma is to invest in more expensive maximum security technologies, invest in less expensive minimum security technologies with increased risk, or postpone the business mobility strategy in order to protect enterprise and customer data and information. This paper investigates mobile device security and the implications of security recommendations for SMEs. Design/methodology/approach – This conceptual paper reviews mobile device security research, identifies increased security risks, and recommends security practices for SMEs. Findings – This paper identifies emerging mobile device security risks and provides a set of minimum mobile device security recommendations practical for SMEs. However, SMEs would still have increased security risks versus large enterprises who can implement maximum mobile device security recommendations. SMEs are faced with a dilemma: embrace the mobility business strategy and adopt and invest in the necessary security technology, implement minimum precautions with increased risk, or give up their mobility business strategy. Practical implications – This paper develops a practical list of minimum mobile device security recommendations for SMEs. It also increases the awareness of potential security risks for SMEs from mobile devices. Originality/value – This paper expands previous research investigating SME adoption of computers, broadband internet-based services, and Wi-Fi by adding mobile devices. It describes the SME competitive advantages from adopting mobile devices for enterprise business mobility, while accentuating the increased business risks and implications for SMEs.
Numerous medical studies show that tumor growth is accompanied by protein changes that may lead to the peroxidation of the cell membrane with consequent emission of volatile organic compounds (VOCs) by breath or intestinal gases that should be seen as biomarkers for colorectal cancer (CRC). The analysis of VOCs represents a non-invasive and potentially inexpensive preliminary screening technique. An array of chemoresistive gas sensors based on screen-printed metal oxide semiconducting films has been selected to discriminate gases of oncological interest, e.g., 1-iodononane and benzene, widely assumed to be biomarkers of colorectal cancer, from those of interference in the gut, such as methane and nitric oxide.
Purpose – The purpose of this literature review is to analyze current trends in information security and suggest future directions for research. Design/methodology/approach – The authors used literature review to analyze 1,588 papers from 23 journals and 5 conferences. Findings – The authors identified 164 different theories used in 684 publications. Distribution of research methods showed that the subjective-argumentative category accounted for 81 per cent, whereas other methods got very low focus. This research offers implications for future research directions on information security. They also identified existing knowledge gaps and how the existing themes are studied in academia. Research limitations/implications – The literature review did not include some dedicated security journals (i.e. Cryptography). Practical implications – The study reveals future directions and trend that the academia should consider. Originality/value – Information security is top concern for organizations, and this research analyzed how academia dealt with the topic since 1977. Also, the authors suggest future directions for research suggesting new research streams.
Purpose – The purpose of this paper is to identify variables that influence compliance with information security policies of organizations and to identify how important these variables are. Design/methodology/approach – A systematic review of empirical studies described in extant literature is performed. This review found 29 studies meeting its inclusion criterion. The investigated variables in these studies and the effect size reported for them were extracted and analysed. Findings – In the 29 studies, more than 60 variables have been studied in relation to security policy compliance and incompliance. Unfortunately, no clear winners can be found among the variables or the theories they are drawn from. Each of the variables only explains a small part of the variation in people's behaviour and when a variable has been investigated in multiple studies the findings often show a considerable variation. Research limitations/implications – It is possible that the disparate findings of the reviewed studies can be explained by the sampling methods used in the studies, the treatment/control of extraneous variables and interplay between variables. These aspects ought to be addressed in future research efforts. Practical implications – For decision makers who seek guidance on how to best achieve compliance with their information security policies should recognize that a large number of variables probably influence employees' compliance. In addition, both their influence strength and interplay are uncertain and largely unknown. Originality/value – This is the first systematic review of research on variables that influence compliance with information security policies of organizations.
Purpose - Opportunities for malicious cyber activities have expanded with the globalisation and advancements in information and communication technology (ICT). Such activities will increasingly affect the security of businesses with online presence and/or connected to the Internet. Although the real estate sector is a potential attack vector for and target of malicious cyber activities, it is an understudied industry. This paper aims to contribute to a better understanding of the information security threats, awareness, and risk management standards currently employed by the real estate sector in South Australia.Design/methodology/approach - Current study comprises both quantitative and qualitative methodologies, which include 20 survey questionnaires and 20 face-to-face interviews conducted in South Australia. Findings - There is a lack of understanding about the true magnitude of malicious cyber activities and its impact on the real estate sector, as illustrated in our findings of 40 real estate organisations in South Australia. Our findings and the escalating complexities of the online environment underscore the need for regular ongoing training programs for basic online security (including new cybercrime trends) and the promotion of a culture of information security (e.g. when using smart mobile devices to store and access sensitive data) among staff. Such initiatives will enable staff employed in the (South Australian) real estate sector to maintain current knowledge of the latest. Originality/value - This is the first academic study focusing on the real estate organisations in South Australia. Our findings will contribute to the evidence on the information security threats faced by the sector as well as in develop sector-specific information security risk management guidelines.
Businesses have derived various benefits from offshore outsourcing of information and communication technology services while accepting and managing perceived risks with respect to the service quality of information security delivered in the supply chain. In this empirical research, taking India as a case which tops the global information technology outsourcing supply chain world ranking, we examine the perceptions of Indian software services provider (service provider) employees with respect to information security service quality delivered to customers and its impact on the service provider organisational performance. Using the existing dimensions and instruments for service quality and organisational performance, our study provides a framework suitably modified to reflect the context of information security. We have used SmartPLS, a structural equation modeling technique, to analyse field survey data collected from across different Indian cities and companies. Significant finding of our research is that information security service quality in an IT offshore outsourcing company providing software services has an impact on the service provider organisation performance, which can be predicted. In addition we also establish that there is positive relationship collectively between elements of information security service quality and organisation performance. We conclude that there is an urgent and serious need for software outsourcing business enterprises to focus on, amplify and commit to information security service quality at strategic, tactical, and operational levels if they wish to achieve revenue expansion, completely satisfied customers and create long term trusted relationships.
Purpose – This paper aims to educate the youth about information security. Cyber technologies and services are increasingly becoming integrated into individual’s daily lives. As such, individuals are constantly being exposed to the benefits and risks of these technologies. Cyber security knowledge and skills are becoming fundamental life skills for today’s users. This is particularly true for the current generation of digital natives. Design/methodology/approach – Within the design science paradigm, several case studies are used to evaluate the research artefact. Findings – The authors believe that the presented artefact could effectively convey basic information security concepts to the youth. Research limitations/implications – This study had a number of limitations. First, all the learner groups who participated in this study were too small to enable analysis of findings for statistical significance. Second, the data compiled on the long-term effectiveness of the game for Group B was incomplete. This limitation was the result of School B’s ethical concerns regarding learners being a vulnerable target audience. Originality/value – This paper presents and evaluates a brain-compatible, information security educational game that can be used to introduce information security concepts to the youth from a very young age.
Purpose – This paper presents the design, development and trialling of the mobile execution environment (MEE), a secure portable execution environment designed to support secure teleworking. Teleworking is an established work practice, yet often the information security controls in the teleworking location are weaker than those in a corporate office. Security concerns also prevent organisations allowing personnel to telework. Design/methodology/approach – The design science research methodology was applied to develop the MEE, and this paper is structured using the process elements of the methodology. Findings – In this paper, the problem addressed and the design objectives are defined. The design and implementation is discussed, and the testing and trialling approach adopted to demonstrate the MEE is summarised. An evaluation of the demonstration results against the design objectives is presented. Research limitations/implications – The MEE is part of an ongoing research project using open source software; the structure and functionality of the software can limit or influence the direction of the research. Practical implications – The MEE provides a secure portable execution environment suitable for transaction-oriented work performed remotely; e.g. teleworkers performing customer support work. Social implications – The paper contributes to encouraging the implementation of teleworking. Originality/value – The MEE builds on the concept of a portable executable operating system that uploads onto a PC through an external port. The MEE extends this concept by providing a hardened secure computing environment that is uploaded from a secure storage device or a standard thumb drive (USB flash drive).
Purpose – The purpose of this study was to develop and test SCoP. Users find comparing long meaningless strings of alphanumeric characters difficult. While visual hashes – where users compare images rather than strings – have been proposed as an alternative, people are unable to sufficiently distinguish more than 30 bits, which does not provide adequate security against collision attacks. Our goal is to improve the situation. Design/methodology/approach – A visual hash scheme was developed using shapes, colours, patterns and position parameters. It was evaluated in a series of pilot user studies and improved iteratively, leading to SCoP, which encodes 60 distinguishable bits. We tested SCoP further in two follow-up studies, simulating verifying in remote electronic voting and https certificate validation. Findings – Participants attained an average accuracy rate of 97 per cent with SCoP when comparing two visual hash images, one placed above the other. From the follow-up studies, SCoP was seen to be more promising for the https certificate validation use case, with direct image comparison, while a low average accuracy rate in simulating verifiability in remote electronic voting limits its applicability in an image-recall use case. Research limitations/implications – Participants achieved high accuracy rates in unrealistic situations, where the images appeared on the screen at the same time and in the same size. Studies in more realistic situations are therefore necessary. Originality/value – We identify a visual hash scheme encoding a higher number of distinguishable bits than previously reported in literature, and extend the testing to realistic scenarios.
Purpose – The purpose of this research is to explain particular implementation weaknesses of near field communication (NFC) systems done by several institutions which apply for critical purposes and provide practical solutions. Design/methodology/approach – This research is done by literature studies of previous findings in NFC security, observations of some existing implemented systems and experimentations to provide practical solutions. Findings – Unintentional lack of security protection of the NFC cards and tags by some card issuers make them a vulnerable target. The outcomes of this research are proposed solutions on methods to quickly detect vulnerability in NFC tags using an Android-based mobile application. Another solution involves the assembly of a detection device using the portable, low power and powerful Raspberry Pi to analyze the NFC tags or cards and NFC reader vulnerabilities. Research limitations/implications – This research is conducted in Indonesia; therefore, the results and solutions may lack generalizability. However, the findings may occur in other countries which newly apply NFC technology. Practical implications – System implementer should become more aware about the security issue of old NFC tags like MIFARE Classic. Price should be considered after tag security. People also need to be aware of identity or money theft using NFC-enabled smartphones, as many identity cards and electronic money are now relying on NFC technology. Social implications – People also need to be aware of identity or money theft using NFC-enabled smartphones, as many identity cards and electronic money are now relying on NFC technology. Originality/value – This research fulfills an identified need to evaluate the security aspect of a system that uses NFC as one of the main technologies. The results and solutions also provides cheap, easy and practical tools to analyze NFC security.
Purpose – The aim of this paper is to study the critical role of trust in electronic commerce extensively in the context of establishing initial trust between trading partners. Ongoing trust between partners can quickly be eroded through security or other trust violations. This paper examines whether customers are willing to transact with an eCommerce vendor in light of security and trust violations. Design/methodology/approach – The paper draws upon research in professional trust relationships and adapts it to the e-commerce context to create a process view of trust violation and repair. Using a design science framework, this paper employs agent-based modeling as the simulation technique to study the implications of security and trust violations on the willingness of customers to continue transacting with the vendor. The simulations are conducted for a variety of trust violations and reconciliation actions. Findings – While some of the results are predictable, the key finding for managers is that moderate reconciliation tactics are effective for all cases but the most severe trust violations, where trust is irrevocably broken. This has clear financial implications, particularly in cases where vendors may operate with small margins in competitive markets. Originality/value – Given the increasing push toward mobile and Internet-based commerce, and the large range of possible trust violations and security incidents in online purchases, coupled with increasing competition among vendors, it becomes imperative for vendors to provide effective tactics to repair customer trust violations when they arise.
Purpose – The purpose of this paper is to investigate the human-based information security (InfoSec) vulnerabilities in three Australian government organisations. Design/methodology/approach – A Web-based survey was developed to test attitudes, knowledge and behaviour across eight policy-based focus areas. It was completed by 203 participants across the three organisations. This was complemented by interviews with senior management from these agencies. Findings – Overall, management and employees had reasonable levels of InfoSec awareness. However, weaknesses were identified in the use of wireless technology, the reporting of security incidents and the use of social networking sites. These weaknesses were identified in the survey data of the employees and corroborated in the management interviews. Research limitations/implications – As with all such surveys, responses to the questions on attitude and behaviour (but not knowledge) may have been influenced by the social desirability bias. Further research should establish more extensive baseline data for the survey and examine its effectiveness in assessing the impact of training and risk communication interventions. Originality/value – A new survey tool is presented and tested which is of interest to academics as well as management and IT systems (security) auditors.
