Design of a Novel Information System for Semi-automated Management of Cybersecurity in Industrial Control Systems

2023 | ACM Transactions on Management Information Systems | Citations: 0

Authors: Ameri, Kimia; Hempel, Michael; Sharif, Hamid; Lopez, Juan; Perumalla, Kalyan

Abstract: There is an urgent need in many critical infrastructure sectors, including the e ... Expand

Abstract: There is an urgent need in many critical infrastructure sectors, including the energy sector, for attaining detailed insights into cybersecurity features and compliance with cybersecurity requirements related to their Operational Technology (OT) deployments. Frequent feature changes of OT devices interfere with this need, posing a great risk to customers. One effective way to address this challenge is via a semi-automated cyber-physical security assurance approach, which enables verification and validation of the OT device cybersecurity claims against actual capabilities, both pre- and post-deployment. To realize this approach, this article presents new methodology and algorithms to automatically identify cybersecurity-related claims expressed in natural language form in ICS device documents. We developed an identification process that employs natural language processing (NLP) techniques with the goal of semi-automated vetting of detected claims against their device implementation. We also present our novel NLP components for verifying feature claims against relevant cybersecurity requirements. The verification pipeline includes components such as automated vendor identification, device document curation, feature claim identification utilizing sentiment analysis for conflict resolution, and reporting of features that are claimed to be supported or indicated as unsupported. Our novel matching engine represents the first automated information system available in the cybersecurity domain that directly aids the generation of ICS compliance reports. Collapse

Topics: IT security database system website Python electronic authentication

Methods: computational algorithm sentiment analysis natural language processing BERT language model

Accounting for Uncertainty in Deceptive Signaling for Cybersecurity

2023 | HICSS | Citations: 0

Authors: Cranford, E.; Ou, H.; Gonzalez, C.; Tambe, M.; Lebiere, C.

Abstract: Deceptive signaling has proven an effective method that can aid security analys ... Expand

Abstract: Deceptive signaling has proven an effective method that can aid security analysists and deter attacks on unprotected targets by strategically revealing information to an attacker. However, recent research has shown that uncertainty in real-time information processing can have a negative impact on the effectiveness of the defense algorithm. The current research developed a new algorithm, dubbed Confusion Signaling, that aims to account for uncertainty in an abstracted insider attack scenario. The results of cognitive model simulations and a human behavioral experiment reveal interesting and unexpected reactions under uncertainty. We discuss the implications of these findings for signaling algorithms that aim to account for uncertainty using deceptive signaling for cybersecurity. Collapse

Topics: IT security decision making accounting physical security

Methods: computational algorithm experiment simulation machine learning survey

An Information Security Performance Measurement Tool for Senior Managers: Balanced Scorecard Integration for Security Governance and Control Frameworks

2023 | Information Systems Frontiers | Citations: 0

Authors: Herath, Tejaswini C.; Herath, Hemantha S. B.; Cullum, David

Abstract: As organizations have become increasingly reliant on information systems, senior ... Expand

Abstract: As organizations have become increasingly reliant on information systems, senior managers are keen in assessing the progress of implemented information security strategies. Although the balanced scorecard approach has been suggested for security governance, a critical issue affecting information security practitioners is complexity, as there are many standards and frameworks, with duplication and overlaps to adhere to when organizing the data. Consequently, the article attempts to develop a more inclusive framework for information security governance, a research gap recently identified in the literature. The article maps five governance and control frameworks (COBIT, SABSA, ISG, ITIL, and ISO 27000) to the information security balanced scorecard (InfoSec BSC) to develop a conceptual design of an effective information security performance measurement tool that can be used by senior managers. Using a real-life case application and interviews with a panel of experts, the article identifies IS initiatives, performance measures for each of the mapped objectives derived from governance and control frameworks that may provide guidance for practitioners. Collapse

Topics: data security COBIT IT security ITIL information security management

Methods: qualitative interview case study personal interview survey delphi study

Theories: theory of everything

What are the trend and core knowledge of information security? A citation and co-citation analysis

2023 | Information & Management | Citations: 0

Authors: Shiau, Wen-Lung; Wang, Xiaoqun; Zheng, Fei

Abstract: Information technology brings business success opportunities, but also causes po ... Expand

Abstract: Information technology brings business success opportunities, but also causes potential safety hazards to orga­ nizations. In response to the increasing academia and industry concerns regarding information security (ISec), this study systematically explored extant ISec research and identified eight core knowledge groups, including (1) intrusion detection, (2) privacy protection, (3) secure machine learning, (4) cryptosystem, (5) data service se­ curity, (6) malware analysis, (7) security decision-making, and (8) security management. The detection of research hotspots shows that data service security and risk management garner the most current research attention. Furthermore, we establish a comprehensive ISec framework to help systematically understand and achieve ISec. Collapse

Topics: privacy decision making intrusion detection system malware database system

Methods: co-citation analysis cluster analysis literature sample hierarchical clustering multidimensional scaling

An Empirical Examination of Technology and Security Services in Sharing Economy

2022 | Americas Conference on Information Systems | Citations: 0

Authors: Ahmed, Ali; Akar, Ezgi

Abstract: Sharing economy platforms such as Airbnb, Uber, Lyft, and many others have beco ... Expand

Abstract: Sharing economy platforms such as Airbnb, Uber, Lyft, and many others have become increasingly popular. However, over the years, these markets have become highly concentrated. On Airbnb, not only homeowners but property management companies have started offering rental services and saturating the short-term rental market space. In this research, we study whether offering technology-and security-based services brings a competitive advantage to a property and increase its bookings. Using a dataset from Airbnb, we show that not all technology services positively impact bookings. On the one hand, internet and video streaming services (such as Netflix, Amazon Prime, etc.) increase monthly reviews received by a property, however, on the other hand, gaming consoles and music systems negatively impact the number of reviews. We also find that security services such as self-checkin and security cameras have a strong positive relationship with the reviews. Our findings suggest that hosts must strategically offer various technology and security services and eliminate any unnecessary services that harm the guest's interest in a property. Collapse

Topics: Airbnb digital service sharing platform internet technology Netflix

Methods: regression analysis method

Identifying the Design Inhibitors of In-store Shopping Apps

2021 | International Conference on Information Systems | Citations: 0

Authors: Nthubu, Boineelo R; Fayoumi, Amjad; Dalcher, Darren

Abstract: In-store mobile shopping apps can reduce queues in supermarkets and improve the ... Expand

Abstract: In-store mobile shopping apps can reduce queues in supermarkets and improve the consumer's shopping experience, yet their usage rates remain low. Despite the advances in mobile commerce literature, only scant research discusses the design inhibitors of instore mobile shopping apps. This paper uses the Theory of Technology Usage Inhibitors to investigate inhibitors in designing in-store mobile shopping apps. We adopt a topic modelling approach to analyse 1800 Apple store reviews to identify the most significant inhibitors in a UK supermarket in-store mobile shopping app. Our findings identify redundancy, malfunctioning, overcharging, fiddliness, poor support, difficulty registering and objecting benefits as the critical design inhibitors. Our study expands the theory of technology usage inhibitors (Cenfetelli 2004) in the context of in-store shopping apps by identifying and conceptualising design-based inhibitors that discourage use. This paper contributes important design insights and recommendations to support app designers and retailers in effectively designing in-store shopping apps. Collapse

Topics: mobile application information system use online review physical security user behavior

Methods: topic model case study theory development design guideline literature study

Critical risk considerations in auto-ID security: Barcode vs. RFID

2021 | Decision Support Systems | Citations: 0

Authors: Tu, Yu-Ju; Zhou, Wei; Piramuthu, Selwyn

Abstract: Automated identification (auto-ID) has been widely used in practice for more tha ... Expand

Abstract: Automated identification (auto-ID) has been widely used in practice for more than five decades, beginning with the commercial use of barcodes in the early 1970s. More recently, since about 2003, RFID (Radio Frequency IDentification) use has seen widespread adoption. While these automated identification technologies help improve convenience, effectiveness, and efficiency, associated vulnerabilities need to be carefully considered to weigh their advantages against their disadvantages. By its very nature, automated identification has the potential to expose its subject to privacy and security risks. We consider specific vulnerabilities that are associated with barcode and RFID to identify related attack scenarios and discuss means to address such risks and attacks. Collapse

Topics: radio frequency identification Near Field Communication IT security threat electronic payment data encryption

Security and Privacy Requirements for Cloud Computing in Healthcare: Elicitation and Prioritization from a Patient Perspective

2020 | ACM Transactions on Management Information Systems | Citations: 0

Authors: Ermakova, Tatiana; Fabian, Benjamin; Kornacka, Marta; Thiebes, Scott; Sunyaev, Ali

Abstract: Cloud computing promises essential improvements in healthcare delivery performan ... Expand

Abstract: Cloud computing promises essential improvements in healthcare delivery performance. However, its wide adoption in healthcare is yet to be seen, one main reason being patients’ concerns for security and privacy of their sensitive medical records. These concerns can be addressed through corresponding security and privacy requirements within the system engineering process. Despite a plethora of related research, security and privacy requirements for cloud systems and services have seldomly been investigated methodically so far, whereas their individual priorities to increase the system success probability have been neglected. Against this background, this study applies a systematic requirements engineering process: First, based on a systematic literature review, an extensive initial set of security and privacy requirements is elicited. Second, an online survey based on the best-worst scaling method is designed, conducted, and evaluated to determine priorities of security and privacy requirements. Our results show that confidentiality and integrity of medical data are ranked at the top of the hierarchy of prioritized requirements, followed by control of data use and modification, patients’ anonymity, and patients’ control of access rights. Availability, fine-grained access control, revocation of access rights, flexible access, clinicians’ anonymity, as well as usability, scalability, and efficiency of the system complete the ranking. The level of agreement among patients is rather small, but statistically significant at the 0.01 level. The main contribution of the present research comprises the study method and results highlighting the role of strong security and privacy and excluding any trade-offs with system usability. Enabling a richer understanding of patients’ security and privacy requirements for adopting cloud computing in healthcare, these are of particular importance to researchers and practitioners interested in supporting the process of security and privacy engineering for health-cloud solutions. It further represents a supplement that can support time-intensive negotiation meetings between the requirements engineers and patients. Collapse

Topics: privacy healthcare data cloud computing data security anonymity

Methods: survey literature study experiment structured literature research journal ranking

Theories: construal level theory

Measuring cyber security awareness within groups of medical professionals in Poland

2020 | HICSS | Citations: 0

Authors: Fabisiak, Luiza; Hyla, Tomasz

Abstract: The goal of this study is to measure the cyber security awareness of medical pro ... Expand

Abstract: The goal of this study is to measure the cyber security awareness of medical professionals in Poland, i.e. to verify whether healthcare specialists have knowledge and understanding of basic cyber security threats. This survey was based on the cyber security recommendations from the European Union Agency for Network and Information Security and the U.S. Department of Health and Human Services. The survey consisted of 23 single and multiple-choice questions divided into four parts. The results categorized the respondents and measured the level of cyber security awareness. Among the 620 persons invited to participate in the survey, 300 (48.39%) responded and answered all of the questions. The results show a an unsatisfactory level of knowledge regarding information security in Poland. The main conclusion drawn from the survey is that the quality of cyber security training among medical professionals should be improved and frequency of the trainings should be increased. Collapse

Topics: IT security data security IT security training information system use IT security threat

Methods: survey data transformation factor analysis descriptive statistic Student's t-test

Progressing from the SOC to the EOC

2019 | Americas Conference on Information Systems | Citations: 0

Authors: Pike, Nathan; Pike, Ronald

Abstract: This paper leverages the many advances in information systems security manageme ... Expand

Abstract: This paper leverages the many advances in information systems security management and applies them to broader organizational needs. Specifically, SIEM (Security Incident and Event Management) systems collect log data pertaining to security and uses data science tools ranging from business intelligence, machine learning and artificial intelligence to glean useful insights. The paper explores the potential to apply the data collection and processing capabilities of SIEM platforms to KPIs in the healthcare sector to provide managerial insight into a wide range of organizational processes. Collapse

Topics: IT security physical security information technology infrastructure organizational impact cloud computing

Methods: literature study theory development