Extending the Cyber Capabilities of Small to Midsize Businesses

2023 | HICSS | Citations: 0

Authors: Croasdell, Dave; Lathrop, Logan; Elste, James

Abstract: This project explores disparities in the cybersecurity practices of small to mid ... Expand

Abstract: This project explores disparities in the cybersecurity practices of small to midsize businesses in comparison to larger organizations with more resources to allocate to cybersecurity. While the adoption of technical solutions offers many advantages, SMBs are struggling to maintain good cybersecurity practices in this era of digital transformation. Considering the overall security climate it is clear that SMBs are vulnerable to cyber threats, are being attacked more often and lack the proper resources or knowledge to effectively address threats. This paper proposes a model for SMBs to enhance their cyber capabilities with cybersecurity assessments and regular training provided by the National Guard’s Defensive Cyber Operations Element (DCO-E). Leveraging the capabilities of the DCO-E, in effect a “national cybersecurity squad,” to support a national cyber readiness and education campaign could be an effective method to enhance the cybersecurity of SMBs. The proposed model is supported with a initial survey results showing a promising willingness and support from SMBs. Collapse

Topics: IT security IT security threat business continuity planning

Methods: survey

An Information Security Performance Measurement Tool for Senior Managers: Balanced Scorecard Integration for Security Governance and Control Frameworks

2023 | Information Systems Frontiers | Citations: 0

Authors: Herath, Tejaswini C.; Herath, Hemantha S. B.; Cullum, David

Abstract: As organizations have become increasingly reliant on information systems, senior ... Expand

Abstract: As organizations have become increasingly reliant on information systems, senior managers are keen in assessing the progress of implemented information security strategies. Although the balanced scorecard approach has been suggested for security governance, a critical issue affecting information security practitioners is complexity, as there are many standards and frameworks, with duplication and overlaps to adhere to when organizing the data. Consequently, the article attempts to develop a more inclusive framework for information security governance, a research gap recently identified in the literature. The article maps five governance and control frameworks (COBIT, SABSA, ISG, ITIL, and ISO 27000) to the information security balanced scorecard (InfoSec BSC) to develop a conceptual design of an effective information security performance measurement tool that can be used by senior managers. Using a real-life case application and interviews with a panel of experts, the article identifies IS initiatives, performance measures for each of the mapped objectives derived from governance and control frameworks that may provide guidance for practitioners. Collapse

Topics: data security COBIT IT security ITIL information security management

Methods: qualitative interview case study personal interview survey delphi study

Theories: theory of everything

Stock Market Reactions to IT Endowment at the Onset of COVID-19

2023 | International Conference on Information Systems | Citations: 0

Authors: Kathuria, Abhishek; Karhade, Prasanna; Jaiswal, Ankur; Mani, Deepa

Abstract: The COVID-19 crisis represented an unprecedented test to organizations with res ... Expand

Abstract: The COVID-19 crisis represented an unprecedented test to organizations with respect to its systemic severity and the unique policy response of governments around the world. Policies to curb the pandemic's spread resulted in severe cratering of demand and diverse supply disruptions to firms. Research demonstrates significant heterogeneity in the impacts of the pandemic and ensuing lockdowns on firm performance due to diverse firm characteristics. Our study advances this body of work by assessing the moderating impact of a firm's pre-existing Information Technology (IT) endowment on changes in market and operational performance caused by the pandemic. Impacts of specific classes of IT investments, analyses of the social media activity of the firm, and textual analyses of news articles pertaining to the firm provide insights into underlying mechanisms. More generally, our results provide insights into the resilience accorded by IT in the face of exogenous disasters. Collapse

Topics: pandemic Twitter database system business continuity planning accounting

Methods: longitudinal research difference in differences cross sectional research descriptive statistic robustness check

An Investigation of the Factors that Influence Job Performance During Extreme Events: The Role of Information Security Policies

2023 | Information Systems Frontiers | Citations: 0

Authors: Kisekka, Victoria; Goel, Sanjay

Abstract: Diligent compliance with Information security Policies (ISP) can effectively det ... Expand

Abstract: Diligent compliance with Information security Policies (ISP) can effectively deter threats but can also adversely impact organizational productivity, impeding organizational task completion during extreme events. This paper examines employees’ job performance during extreme events. We use the conservation of resources (COR) theory to examine how psychological resources (individual resilience, job meaningfulness, self-efficacy) and organizational resources (incident command leadership, information availability, and perceived effectiveness of security and privacy controls) influence ISP compliance decisions and job performance during extreme events. The results show that a one-size-fits-all approach to ISP is not ideal during extreme events; ISP can distract employees from critical job tasks. We also observed that under certain conditions, psychological resources, such as individual resilience, are reserved for job performance, while others, such as self-efficacy, are reserved for ISP compliance. A post hoc analysis of data from respondents who experienced strain during a real extreme event while at work was conducted. Our discussion provides recommendations on how security and privacy policies can be designed to reflect disaster conditions by relaxing some policy provisions. Collapse

Topics: task productivity self efficacy privacy data security productivity

Methods: survey post-hoc analysis statistical power analysis survey design theory development

Understanding the Digital Resilience of Physicians during the COVID-19 Pandemic: An Empirical Study

2023 | Management Information Systems Quarterly | Citations: 0

Authors: Liu, Yinghao; Xu, Xin; Jin, Yong; Deng, Honglin

Abstract: The COVID-19 pandemic has underscored the urgent need for healthcare entities t ... Expand

Abstract: The COVID-19 pandemic has underscored the urgent need for healthcare entities to develop resilient strategies to cope with disruptions caused by the pandemic. This study focuses on the digital resilience of certified physicians who adopted an online healthcare community (OHC) to acquire patients and conduct telemedicine services during the pandemic. We synthesize the resilience literature and identify two effects of digital resilience-the resistance effect and the recovery effect. We use a proprietary dataset that matches online and offline data sources to study the digital resilience of physicians. A difference-in-differences (DID) analysis shows that physicians who adopted an OHC had strong resistance and recovery effects during the pandemic. Remarkably, after the COVID-19 outbreak, these physicians had 35.0% less reduction in medical consultations in the immediate period and 31.0% more bounce-back in the subsequent period as compared to physicians who did not adopt the OHC. We further analyze the sources of physicians' digital resilience by distinguishing between new and existing patients from both online and offline channels. Our subgroup analysis shows that, in general, digital resilience is more pronounced when physicians have a higher online reputation rating or have more positive interactions with patients on the OHC platform, providing further support for the mechanisms underlying digital resilience. Our research has significant theoretical and managerial implications beyond the context of the pandemic. Collapse

Topics: pandemic electronic health business continuity planning disaster recovery information system use

Methods: longitudinal research experimental group longitudinal survey augmented Dickey–Fuller test time series analysis

MaCuDE IS Task Force Phase II Report: Views of Industry Leaders on Big Data Analytics and AI

2023 | Communications of the Association for Information Systems | Citations: 2

Authors: Lyytinen, Kalle; Topi, Heikki; Tang, Jing

Abstract: This paper represents the Phase II report of the Management Curriculum for the ... Expand

Abstract: This paper represents the Phase II report of the Management Curriculum for the Digital Era (MaCuDE) disciplinary task force on information systems (IS). Aligned with the current work of the AIS (Association for Information Systems) and ACM (Association for Computing Machinery), we focus on the current and future industry driven educational needs and requirements posed by big data analytics (BDA), artificial intelligence (AI), machine learning (ML), and related innovations. In this report, we probe and report on the views of industry leaders regarding BDA/AI education needs. We conducted 18 rich semi-structured interviews with a representative sample of industry leaders situated around key changes and issues related to workforce demands in digital transformation and associated educational needs. We performed a grounded theory based analysis of key themes in reported education needs. We note the shifting meaning of AI and BDA phenomena and identify three main organizational level needs for the digital eracapability improvement and transformation, decision-making strategies and tactics, and changes in operations or products -and connect them to three individual professional competencies necessary to deliver them: fundamental environmental competencies, data information and content, and system design competencies. Based on the analysis we outline several novel competency-based IS curriculum recommendations for the master's and undergraduate level IS education.Architecting for cloud: "And so the thing I noticed, a lot of these companies, when their data is growing so big and their database costs are running so high, they think about going towards Open Source Software, Open Source databases to store all the data and, hence, that creates a demand on the workforce to actually know how to use those. "Understanding data structures, architectures, and governance: "So that's his role, and the key requirement for that role again is Data Architecture, data Engineering and Data Management" Building and managing machine learning models: "Second, of course, is strong competency in the use of Machine Learning packages or models. This field is evolving aggressively." "For developing or programming our own AI solutions, our employees have no deep knowledge of mathematical models and how to build mature and value-creating AI applications." IS management and operations: "The talent sort of wars out there are really, really tough, and finding people who understand that, (how to) generate the data, use the data, think about the data, manipulate it are really, really important. I agree. It used to be you had to have people with Project Management. That was critical and that was everyone competed for that, and now it's that plus the data, the Machine Learning."Based on the data collected in this study, we cannot offer a clear answer to the questions of how BDA and AI affect areas that do not belong to the two main areas of the study. Given, however, how quickly BDA and AI have grown and how substantial related resource requirements are in organizations, it is clear that they already have an impact on several competency needs such as programming language selection, selection of BDA and AI tools based on cloud-based solutions, data architecture, data governance, service repertoires available on platform environments, and special characteristic of BDA and AI projects and how they affect education for project management needs and competencies. Summary of Findings Related to Individual CompetenciesGenerally, we observe a strong alignment and continuity between the recent information systems curriculum recommendations and the findings of this study. The data highlights the continued importance of IS core topics covered in all past curricula, such as data management, systems development, IT infrastructure and architecture (including security), and IS (project) management.The results also highlight also multiple areas that need more emphasis and careful design decisions when schools plan and implement their BDA and AI based programs: Integration of business and technology competencies in ways that allow seamless communication with both business and technology experts  A stronger emphasis on multiple life cycle models and concepts related to data management and data science than in the recent model curricula focused on system life cycles  Heightened focus on new dimensions of data analytics competencies (including communication-related elements such a storytelling and visualization)  The growing importance of ethics as a foundation for ensuring privacy and security of BDA and AI models  Need for more skills in statistics  Understanding the novel requirements that AI solutions set up for IT infrastructure  The importance of competencies in AI systems development and deployment. Collapse

Topics: artificial intelligence big data analytical information system data management decision making

Methods: qualitative interview machine learning meta learning field study personal interview

Conceptualizing Digital Resilience: An Intellectual Capital Perspective

2023 | International Conference on Information Systems | Citations: 0

Authors: Neumannova, Anita; Bernroider, Edward; Obwegeser, Nikolaus

Abstract: In the current era of digital transformations, numerous organizations integrate ... Expand

Abstract: In the current era of digital transformations, numerous organizations integrate information and communication technologies (ICTs) into their core operations. However, such transformations can lead to novel risks that have to be governed in the face of disruptions. The emergence of a new risk landscape has given rise to new concepts aimed at safeguarding ICT-based operations. One of these is digital resilience (DR), a complex concept that has recently received attention from academia and regulatory bodies. However, prior work has often studied it inconsistently and offered different suggestions on how to build DR. To foster a comprehensive understanding of DR within information systems (IS), we have conducted a systematic literature review and conceptualized the problem by drawing on intellectual capital (IC) theory. We contribute to research and organizational practice by offering a novel framework with three main sub-capabilities and a comprehensive range of supporting micro-foundation, which unveils areas for future research. Collapse

Topics: human resource management business model database system implicit knowledge organization structure

Methods: literature sample structured literature research literature study qualitative content analysis

Theories: dynamic capabilities theory

Digital Operational Resilience: The Role of Non-routine Responses in Crisis Situations

2023 | European Conference On Information Systems | Citations: 0

Authors: Neumannova, Anita; Bernroider, Edward; Obwegeser, Nikolaus

Abstract: This study focuses on digital operational resilience (DOR) to ensure the stabil ... Expand

Abstract: This study focuses on digital operational resilience (DOR) to ensure the stability of increasingly integrated digital services, which is currently receiving heightened attention due to ongoing environmental crisis situations. Researchers often relate DOR to planning and preparation activities, such as business continuity or disaster recovery planning. However, some types of organisationssuch as scale-upstend to lack elaborate plans for crisis situations, mainly driven by their rapid growth and resource constraints. Such firms seem to regularly engage in non-routine responses to overcome sudden disruptions, namely heuristics (i.e., swift decisions) and improvisation (i.e., swift actions). We present preliminary results of an in-depth case study demonstrating how a FinTech scale-up applied heuristics and improvisation for its crisis response. We show how the consequences of such non-routine responses go beyond immediate crisis resolution, incurring either negative effects that need to be managed (coping debt) or opportunities to be leveraged (new/revised business processes). Collapse

Topics: business process management electronic finance pandemic business continuity planning disaster recovery

Methods: qualitative interview case study constant comparative analysis field study personal interview

The Value of Centralized IT in Building Resilience During Crises: Evidence from U.S. Higher Education’s Transition to Emergency Remote Teaching

2023 | Management Information Systems Quarterly | Citations: 0

Authors: Park, Jiyong; Son, Yoonseock; Angst, Corey

Abstract: The COVID-19 pandemic forced organizations, including higher education institut ... Expand

Abstract: The COVID-19 pandemic forced organizations, including higher education institutions, to rapidly adjust their operations. In the face of the pandemic, most higher education institutions shut down their campuses and transitioned to emergency remote teaching mode. This study examines digital resilience in higher education institutions through the conceptual lens of disaster response management, by assessing the role played by the centralized governance of information technology (IT) investments. We posit that centralized IT helps organizations maintain customer satisfaction with services during a crisis (e.g., student satisfaction with classes during COVID-19) by facilitating the organization-wide transition to an emergency operational mode and supporting its service operations. Consolidating data on IT investment, governance, and course evaluations from 463 U.S. higher education institutions from 2017-2020, we show that centralized IT helped organizations adapt better to the pandemic in terms of maintaining student satisfaction. Moreover, we found that centralized IT investments geared toward facilitating organizational coordination and providing instructional and technical support played a pivotal role in enabling ERT and improving student ratings during the crisis. These results are corroborated by interviews with CIOs of U.S. higher education institutions. Additional analyses also suggest that the effectiveness of centralized IT governance is contingent upon organizational size, dissimilarity of local units, and the strategic role of the CIO. We also discuss theoretical extensions toward digital resilience as well as practical implications. Collapse

Topics: IT investment pandemic IT centralization covid 19 Chief Information Officer

Methods: qualitative interview experimental group robustness check survey longitudinal research

Virtual integration in SMEs: The digitalization circuitry of dynamic strategic planning for SMEs

2023 | International Journal of Information Management | Citations: 0

Authors: Ojha, Divesh; Patel, Pankaj C.; Parida, Vinit

Abstract: Though digital technology adoption among SMEs is widely studied, a manifestation ... Expand

Abstract: Though digital technology adoption among SMEs is widely studied, a manifestation of digitalization – virtual integration, particularly its strategic benefits for SMEs – remains largely understudied. Virtual integration con­ nects and coalesces the interfaces of digitalization in SMEs. Though the need for externally oriented digitalization in SMEs is widely desired and espoused, virtual integration and the ensuing effect on Dynamic Strategic Planning (DSP) could be key factors in realizing higher performance. Using the information theory lens and knowledgebased view and a two-study empirical setup based on data from manufacturing and services firms, we draw on the Competence–Capability–Performance (CCP) framework. Specifically, we test a model of digitalization circuitry operational through the mediating effects of virtual integration and dynamic strategic planning (DSP). The ensuing interweaving effects of digitalization from virtual integration are manifest in DSP through fluid partnering, business continuity planning, and market acuity. We find that digitalization, manifested in the form of virtual integration, cascades through DSP to improve financial performance. Collapse

Topics: business continuity planning financial performance strategic management virtualization technology supply chain management

Methods: SEM tool theory development structural equation modeling survey statistical hypothesis test

Theories: dynamic capabilities theory knowledge based theory of the firm information theory