The Application of Role-Based Framework in Preventing Internal Identity Theft Related Crimes: A Qualitative Case Study of UK Retail Companies

2023 | Information Systems Frontiers | Citations: 0

Authors: Okeke, Romanus Izuchukwu; Eiza, Max Hashem

Abstract: This paper aims to examine the challenges of preventing internal identity theft ... Expand

Abstract: This paper aims to examine the challenges of preventing internal identity theft related crimes (IIDTRC) in the UK retail sector. Using an in-depth multiple case studies of a selected number of cross-functional management teams in the UK retail companies, management roles were analysed. We used semi-structured interview as a qualitative data collection technique and used Nvivo aided thematic analysis and interpretivism underpinned by Role-Based Framework (RBF) for analysis. Our findings revealed that vagueness of roles and lack of clarity in sharing data security responsibilities are the major challenges of preventing IIDTRC in UK retail companies. We suggest an application of RBF which provides a conceptual analysis for cross-functional management team to address the challenges of preventing IIDTRC. RBF enables clarity of shared roles where both information security and crimes prevention teams work in unison is required to prevent IIDTRC to maximise internal data security. Contributions for policymakers are offered in this paper. Collapse

Topics: criminality data security IT security outsourcing IT security threat

Methods: case study qualitative interview personal interview survey qualitative content analysis

Theories: organizational role theory

No Rose without a thorn: Board IT competence and market reactions to operational IT failures

2021 | Information & Management | Citations: 6

Authors: Benaroch, Michel; Fink, Lior

Abstract: The continuous escalation in cybersecurity risk and the frequency of operational ... Expand

Abstract: The continuous escalation in cybersecurity risk and the frequency of operational IT failures have drawn attention to the importance of the board of directors’ monitoring function and responsibility for maximizing IT valueprotection. In response, boards have sought to enhance their IT competence levels. We assert that, while higher board IT competence has positive implications in IT value-creation, it could have a negative implication in the IT value-protection context. When firms have a more IT competent board, equity investors’ ex-ante expec­ tations of superior oversight of IT by the board are baked into those firms’ equity prices. When such firms experience operational IT failures, investors would view their boards as relatively ineffective in IT oversight and adjust more sharply the ex-ante expectations built into equity prices. Using agency-theoretic arguments, we develop this reasoning into a hypothesis that board IT competence is negatively associated with firm market performance post operational IT failures. Our analysis of 107 operational IT failures in public U.S. firms provides support for this hypothesis, even after we address the potential endogeneity of board IT competence. Collapse

Topics: IS failure IS value IT risk management IT governance database system

Methods: robustness check descriptive statistic econometric modeling data transformation statistical hypothesis test

Theories: agency theory lemon market theory

30 years of intelligence models in management and business: A bibliometric review

2019 | International Journal of Information Management | Citations: 0

Authors: López-Robles, J.R.; Otegi-Olaso, J.R.; Porto Gómez, I.; Cobo, M.J.

Abstract: The critical factors in the big data era are collection, analysis, and dissemina ... Expand

Abstract: The critical factors in the big data era are collection, analysis, and dissemination of information to improve an organization’s competitive position and enhance its products and services. In this scenario, it is imperative that organizations use Intelligence, which is understood as a process of gathering, analyzing, interpreting, and disseminating high-value data and information at the right time for use in the decision-making process. Earlier, the concept of Intelligence was associated with the military and national security sector; however, in present times, and as organizations evolve, Intelligence has been defined in several ways for the purposes of different applications. Given that the purpose of Intelligence is to obtain real value from data, information, and the dynamism of the organizations, the study of this discipline provides an opportunity to analyze the core trends related to data collection and processing, information management, decision-making process, and organizational capabilities. Therefore, the present study makes a conceptual analysis of the existing definitions of intelligence in the literature by quantifying the main bibliometric performance indicators, identifying the main authors and research areas, and evaluating the development of the field using SciMAT as a bibliometric analysis software. Collapse

Topics: marketing intelligence business intelligence competitive intelligence information management IT security

Methods: bibliometric analysis maturity model design science conceptual analysis cluster analysis

Theories: theory of economic growth

Information Systems as Representations: A Review of the Theory and Evidence

2019 | Journal of the Association for Information Systems | Citations: 28

Authors: Recker, Jan; Indulska, Marta; Green, Peter; Burton-Jones, Andrew; Weber, Ron

Abstract: Representation theory proposes that the basic purpose of an information system ( ... Expand

Abstract: Representation theory proposes that the basic purpose of an information system (IS) is to faithfully represent certain real-world phenomena, allowing users to reason about these phenomena more costeffectively than if they were observed directly. Over the past three decades, the theory has underpinned much research on conceptual modeling in IS analysis and design and, increasingly, research on other IS phenomena such as data quality, system alignment, IS security, and system use. The original theory has also inspired further development of its core premises and advances in methodological guidelines to improve its use and evaluation. Nonetheless, the theory has attracted repeated criticisms regarding its validity, relevance, usefulness, and robustness. Given the burgeoning literature on the theory over time, both positive and negative, the time is ripe for a narrative, developmental review. We review representation theory, examine how it has been used, and critically evaluate its contributions and limitations. Based on our findings, we articulate a set of recommendations for improving its application, development, testing, and evaluation. Collapse

Topics: knowledge representation affordance systems analysis information system use search engine

Methods: literature sample qualitative coding computational algorithm machine learning literature study

Theories: theory of affordance representation theory

UNDERSTANDING CROWDTURFING: THE DIFFERENT ETHICAL LOGICS BEHIND THE CLANDESTINE INDUSTRY OF DECEPTION

2017 | European Conference On Information Systems | Citations: 0

Authors: Rinta-Kahila, Tapani; Soliman, Wael

Abstract: Crowdturfing, the dark side and usually unnoticed face of crowdsourcing, represe ... Expand

Abstract: Crowdturfing, the dark side and usually unnoticed face of crowdsourcing, represents a form of cyberdeception in which workers are paid to express a false digital impression. While such behavior may not be punishable under the jurisdiction of formal law, its consequences are destructive to the cohesion and trustworthiness of online information. The conceptual work at hand examines the current literature on the topic, and lays the foundation for a theoretical framework that explains crowdturfing behavior. We discuss crowdturfing through three ethical normative approaches: traditional philosophical ethics, business ethics, and codified rules. We apply these lenses to an illustrative example of an online platform orchestrating the trade of paid book reviews on Amazon. The study contributes to theory by explaining the ethical logic behind crowdturfing from the perspectives of the key actors involved in the business. We argue that while crowdturfing cannot stand a critical examination through the deontological, stakeholder, or social contract perspectives, leaning on the teleological logic, the stockholder theory, or certain levels of codified rules can enable the actors involved in the business to operate with clean conscience. An increased understanding of the behavior can help both victim platforms and the Internet community at large to combat this hidden industry. Collapse

Topics: information system use internet technology IT security data security crowdsourcing

Methods: conceptual analysis

Theories: deterrence theory

A Constructive Approach to Information Systems Security Training: An Action Research Experience

2008 | Americas Conference on Information Systems | Citations: 3

Authors: Heikka, Juhani

Abstract: Information systems (IS) security breaches cause significant losses to organizat ... Expand

Abstract: Information systems (IS) security breaches cause significant losses to organizations worldwide. Many approaches have been introduced in order to improve employees’ security behavior. Earlier research shows that only seven out of 59 approaches are based on sound theoretical background, and the research in the area of IS security awareness and security behavior has neglected the use of relevant theories of psychology, pedagogy and management. The lack of utilizing theories may have a negative impact on the effectiveness of IS security training and on understanding how to change and improve employees’ security behavior towards compliance to organizational information security policies. In this paper we describe a theoretically grounded approach to IS security training based on constructivism. The approach is empirically validated in a telecommunications company. The results show that the approach has a positive impact on employees’ security behavior. Collapse

Topics: IT security training cybersecurity awareness IT security data security IT job

Methods: qualitative interview action research personal interview literature study conceptual analysis

Theories: learning theory

Mapping Information Security Standards: A Counter-Terrorism Example

2008 | European Conference On Information Systems | Citations: 0

Authors: Ridley, Gail; Hartnett, Jacky; Jarern-iamsakul, Wilumpa

Abstract: Although practitioners have mapped the alignment between IT-related standards, t ... Expand

Abstract: Although practitioners have mapped the alignment between IT-related standards, this work has rarely been reported in the academic literature. In particular the methods used have not been made explicit, which has limited the value of any reported results. The research described in this paper demonstrates a rigorous method for mapping the alignment between two example IT security standards. The two standards were Control Objectives for Information and Related Technology (COBIT), widely used as a comprehensive IT control framework, and the Australian Government Information and Communications Technology Security Manual (ACSI 33) which sets out policies and procedures for IT security for Australian government agencies. Conceptual analysis was used to analyse the alignment between the two standards to reveal some insightful patterns of use and emphasis. As one of the security standards defines the base level ICT security for Australian government agencies, related future work using conceptual analysis has the potential to contribute to improved evaluation of the preparedness of commercial Australian organisations to protect the security of their systems from terrorist activities. This paper illustrates the value of such work within a counter-terrorist setting, where leverage for systems security compliance can be gained from voluntary adoption of a commercial standard. Collapse

Topics: COBIT IT security terrorist incident information systems standardization IT alignment

Methods: qualitative content analysis conceptual analysis

A Review of Information Security Issues and Respective Research Contributions

2007 | ACM SIGMIS Database | Citations: 5

Authors: Siponen, Mikko T.; Oinas-Kukkonen, Harri

Abstract: This paper identifies four security issues (access to Information Systems, secur ... Expand

Abstract: This paper identifies four security issues (access to Information Systems, secure communication, security management, development of secure Information Systems), and examines the extent to which these security issues have been addressed by existing research efforts. Research contributions in relation to these four security issues are analyzed from three viewpoints: a meta-model for information systems, the research approaches used, and the reference disciplines used. Our survey reveals that most information security research has focused on the technical context, and on issues of access to IS and secure communication. The corresponding security issues have been resolved by using mathematical approaches as a research approach. The reference disciplines most commonly reflected have been mathematics, including philosophical logic. Based on this analysis, we suggest new directions for studying information security from an information systems viewpoint, with respect to research methodology and research questions. Empirical studies in relation to the issues of security management and the development of secure IS, based on suitable reference theories (e.g., psychology, sociology, semiotics, and philosophy), are particularly necessary. Collapse

Topics: data security IT security threat reference discipline electronic commerce security policy

Methods: metamodel design science conceptual analysis survey

Theories: semiotic theory

Analysis of modern IS security development approaches: towards the next generation of social and adaptable ISS methods

2005 | Information and Organization | Citations: 32

Authors: Siponen, Mikko T.

Abstract: Various modern approaches to Information Systems Security (ISS) development, inf ... Expand

Abstract: Various modern approaches to Information Systems Security (ISS) development, influenced, e.g., by information systems (IS) development methods, have been presented. While we see these approaches as serious attempts to improve ISS, they have not received much attention in the literature. One reason for this is that these methods have been developed by scholars from different research traditions and disciplines. This article first identifies the disciplines and research communities which underlie the modern ISS approaches. Second, the article reveals the assumptions behind these modern approaches. Finally, the article places these ISS approaches in a five-generational classification. It is argued that the extant ISS methods reside on the first four generations, and future ISS methods should move towards the fifth generation, social and adaptable (empirically grounded) ISS methods. Collapse

Topics: systems development IT security system development method data security usability

Methods: action research conceptual analysis grounded theory simulation case study

Information Security: An Organizational Change Perspective

2004 | Americas Conference on Information Systems | Citations: 7

Authors: Cline, Melinda; Jensen, Bradley

Abstract: This research examines changing information security requirements and the strate ... Expand

Abstract: This research examines changing information security requirements and the strategies organizations are developing to meet the related challenges. This is a topic of considerable importance because organizations must simultaneously provide information to their employees, customers, and business partners while safeguarding it from inappropriate access, use, and disclosure. Sharing information through the Internet is now a prevailing practice (Panda, 1999) with security breaches affecting 90% of all businesses each year and costing some $17 billion (Austin & Darby, 2003). To investigate how organizations are changing in response to new information security requirements, this paper develops a theoretical framework, validates the framework, proposes a set of interesting research questions for further study, and concludes with a suggested methodology. Collapse

Topics: data security IT security threat organizational change IT security

Methods: qualitative interview theory development conceptual analysis qualitative content analysis conceptual modelling