The shift towards digitized identities and electronic ID cards presents significant information security management challenges for identity organisations like the NIA. The transition from securing paper records to electronic records and digital assets, such as citizen biometrics, is critical due to the potential implications of security issues on transactions requiring citizen identification and the protection of citizens' privacy. Our study, based on interviews with nine current and former senior managers of the NIA, reveals that the NIA faces unique challenges due to its nature as a public sector organisation and the political context within which it operates. These challenges include taking a holistic view of information security, instilling an information security culture, developing comprehensive information security policies, and ensuring policy compliance. Additionally, the NIA struggles with aligning its information security policies with relevant legislation, managing relationships with other government stakeholders and private sector organisations, and operating within government constraints. These challenges have significant implications for the NIA and other identity organisations facing similar issues. Understanding and addressing these challenges can enhance information security management, safeguard digital assets, and ensure citizen privacy. However, these challenges occur in a context where management continuity is difficult due to political appointments and interference. These challenges are not unique to the NIA, as identity organisations in other developing countries face similar issues. Further research is needed to best address these challenges and ensure secure digitised identification.
Older adults are particularly vulnerable to phishing attacks. Gamification has been shown to be less effective to develop confidence in distinguishing between genuine and phishing emails in this demographic. To overcome this, we present our novel, open source interactive training platform, Phish&Tips, based on a simulated inbox. Our multi-analysis approach provides comprehensive data that enables us to compare participant's self-assessed competence with their performance on the training platform. We present results based on pre- and post-training surveys, focus groups and the analysis of the training platform data (N = 37). Over half the participants demonstrated an improved understanding of various detection strategies and an increase in confidence in being able to interpret emails. However, these results were not evident in the analysis of the platform data. This disparity between participants' perceived knowledge and their performance on the platform highlights the challenges of applying their knowledge effectively.
Addressing the global challenge of digital piracy, this study concludes a research series that explores the multifaceted drivers behind copyright infringement activities. Integrating findings from a PRISMA-guided systematic literature review and the application of behavioural psychology through the Theoretical Domains Framework (TDF), this work identifies key factors of digital piracy, including accessibility, awareness, education and social and cultural influences, alongside a consideration of previous behaviour. Crucially, the research leverages expert reviews analysed through ATLAS.ti, enhancing the development of the Digital Piracy Conceptual Framework (DPCF). The study's findings, derived from interviews with one (1) participant from each of the six (6) sectors, provide sector-specific insights that, while informative, should not be interpreted as broadly generalisable across industries. This detailed approach has refined the DPCF, offering a comprehensive blueprint for devising effective digital piracy intervention strategies, marking a significant step towards mitigating this pervasive issue and protecting intellectual property rights globally.
Risk analysis is a key activity for organisations that are looking to protect their valuable information assets against threats, such as malicious actors. It is one of the essential parts of risk management and is used to justify and prioritise what assets require the attention of which potential security controls. Risk management, and more specifically, risk analysis, is an activity that should be performed continuously. However, recent studies indicate that this is not always the case. As such, this paper investigates risk analysis as it is performed in practice in different Swedish public sector organisations. The results are based on semi-structured interviews with 17 senior security experts, an analysis of standards, and a national method support aiming to fill the gap between standard and practice. The results are presented in three themes: how, when and why risk analysis is performed. Of note, we identify that there is an issue of overlooking specific assets or systems when establishing an organisational-wide risk profile and a general recognition of the necessity for risk analysis, albeit not always in alignment with a classic risk analysis.
Phishing is a danger to both private users and businesses. Industry and academia have proposed several approaches to deal with this threat, many of which developed with a supposedly human-centric design. Yet, to our knowledge, there is no research focused on the misconceptions that users might have on phishing. This glaring gap is a problem, as previous research has shown that not engaging with the mental model of users can lead to lack of effectiveness of an approach in the real world. To address this gap, we conducted a systematic literature review starting from papers published at CHI in the last ten years, and expanding to other venues through a backward and a forward search based on the initial relevant CHI papers. We identified 15 misconceptions about phishing in 21 papers that researchers should address in their solutions to enhance the effectiveness of their approaches.
