An Adversarial Dance: Toward an Understanding of Insiders’ Responses to Organizational Information Security Measures

2023 | Journal of the Association for Information Systems | Citations: 0

Authors: Balozian, Puzant; Burns, A.; Leidner, Dorothy

Abstract: Despite the increased focus on organizational security policies and programs, s ... Expand

Abstract: Despite the increased focus on organizational security policies and programs, some employees continue to engage in maladaptive responses to security measures (i.e., behaviors other than those recommended, intended, or prescribed). To help shed light on insiders' adaptive and maladaptive responses to IS security measures, we conducted a case study of an organization at the forefront of security policy initiatives. Drawing on the beliefs-actions-outcomes (BAO) model to analyze our case data, we uncover a potentially nonvirtuous cycle consisting of security-related beliefs, actions, and outcomes, which we refer to as an "adversarial dance." Explaining our results, we describe a novel belief framework that identifies four security belief profiles and uncovers an underexplored outcome of IS security: insiders' lived security experiences. We find that individuals' unfavorable lived security experiences produce counterproductive security-related beliefs that, in turn, lead to maladaptive behaviors. Maladaptive behaviors create new potential for security risk, leading to increased organizational security measures to counter them. Thus, the adversarial dance continues, as the new security measures have the potential to reinforce counterproductive security-related beliefs about the importance and risk of IS security and lead to new maladaptive behaviors. To help situate our findings within the current security literature, we integrate the results with prior research based on extant theories. While this paper is not the first to suggest that security measures can elicit maladaptive behaviors, the emergent belief framework and expanded BAO model of IS security constitute an important contribution to the behavioral IS security literature.Puzant Balozian is an assistant professor of computer information systems at James Madison University. His research focus is primarily on the impacts of organizational factors on individual user behaviors in the context of information security and privacy and addressing security policy compliance and violation. Collapse

Topics: IT security IT security defense productivity IT security threat anonymity

Methods: case study qualitative interview personal interview theory development survey

Theories: information systems theory neutralization theory behavioral theory

Brick-and-mortar retailer’s competitive strategy with consumer information under showrooming

2023 | Decision Support Systems | Citations: 0

Authors: Hsieh, Chung-Chi; Lathifah, Artya

Abstract: We study a brick-and-mortar (B&M) retailer competing with an online retailer in ... Expand

Abstract: We study a brick-and-mortar (B&M) retailer competing with an online retailer in the same product category under showrooming conditions. Showrooming takes place when consumers visit the B&M retailer to resolve product fit uncertainty first and then buy the best-fit products at the online retailer. In terms of mitigating the showrooming effect, we examine a promotion strategy with which the B&M retailer acquires consumer information from data brokers and makes a promotional offering to a targeted segment of traceable consumers, and investigate how the B&M retailer can benefit from this promotion strategy via a two-stage game-theoretical framework. We show that there is a threshold for the number of traceable consumers above which the promotion strategy begins to benefit the B&M retailer. When in the B&M retailer’s best interest, there exist two equilibria: one in which some traceable consumers showroom and the other in which no traceable consumers showroom. Less showrooming always takes place in the former equilibrium but more showrooming could occur in the latter equilibrium, as compared to the non-promotion strategy. Furthermore, a higher level of product fit uncertainty increases the B&M retailer’s demand and profit while inducing more showrooming in the latter equilibrium. Thus, showrooming driven by product fit uncertainty could leave the B&M retailer better off under the promotion strategy. Collapse

Topics: electronic commerce price discrimination virtual private network price management consumer behavior

Methods: digital trace data survey

Theories: game theory

Defensive Cyber Maneuvers to Disrupt Cyber Attackers

2023 | HICSS | Citations: 0

Authors: Mckneely, Jennifer; Sell, Tara; Straub, Kathleen; Thomas, Daniel

Abstract: erimeter based defenses are limited in deterring and defeating cyberattacks. Mul ... Expand

Abstract: erimeter based defenses are limited in deterring and defeating cyberattacks. Multi-layered approaches are needed to provide robust cybersecurity and defend against Advanced Persistent Threats. Proactive defensive cyber actions can provide positional or temporal advantages over an adversary in the cognitive, technical, and physical domains. These actions comprise cyber maneuvers, which are implemented reconfigurations to a network that aim to make attackers more visible and detectable, impede attacker progress, and reduce attackers’ chances of mission success. Technical actions and response are the primary focus of most current cyber defense frameworks with little attention on adversary behavioral and cognitive effects. We describe the enhanced cyber maneuver framework which addresses cognitive and behavioral responses to cyber effects. We present experimental results that demonstrate the framework and a testing approach to collect supporting findings on the effects of cyber maneuvers. Collapse

Topics: decision making user experience video conference virtual private network

Methods: qualitative interview experiment simulation digital trace data personal interview

Theories: behavioral theory

Bridging Healthcare Barriers with mHealth: A Systematic Review of Tuberculosis Applications and their Limitations

2023 | Americas Conference on Information Systems | Citations: 0

Authors: Zajac, Kimsey; Aslan, Aycan; Greve, Maike; Kolbe, Lutz M.; Theron, Grant; Niesler, Thomas; Klopper, Marisa; Cobelens, Frank

Abstract: This event is available at AIS Electronic Library (AISeL): https://aisel.aisnet ... Expand

Abstract: This event is available at AIS Electronic Library (AISeL): https://aisel.aisnet.org/amcis2023/sig_globdev/ sig_globdev/7 AbstractTuberculosis remains one of the most significant burdens for resource-constrained environments with limited healthcare supply, such as the Global South. However, factors such as the adoption of mobile phones create a favorable environment for mobile health technology, yielding a promising avenue for the development of the Global South through digital innovation. Previous studies, however, have not provided a comprehensive assessment of available tuberculosis applications and their features. To bridge this gap, we conducted a systematic review of existing tuberculosis applications to gain a deeper understanding of the current landscape. Our findings indicate that current tuberculosis apps have significant limitations, such as requiring an internet connection or being available in only one language. Our study contributes to extant research by presenting the first systematic analysis of tuberculosis applications and provides practical insights by highlighting areas of improvement that should be addressed in future app development. Collapse

Topics: mobile application mobile application market mobile health digital distribution knowledge sharing

Methods: structured literature research design requirement qualitative content analysis

Responding to Cybersecurity Challenges: Securing Vulnerable U.S. Emergency Alert Systems

2020 | Communications of the Association for Information Systems | Citations: 0

Authors: Green, Andrew W.; Woszczynski, Amy B.; Dodson, Kelly; Easton, Peter

Abstract: Emergency alert systems (EASs) in the United States (US) form part of the nation ... Expand

Abstract: Emergency alert systems (EASs) in the United States (US) form part of the nation’s critical infrastructure. These systems rely on aging platforms and suffer from a fragmented interconnected network of partnerships. Some EASs have an easily identifiable vulnerability: one can access their management website via the Internet. Authorities must secure these systems quickly. Other concerns also exist, such as the lack of policies for reporting vulnerabilities. To begin to assess EASs in the US, we used Shodan to evaluate the availability of these websites in six southeastern states. We found 18 such websites that one could access via the Internet and that required only requiring user credentials to login into. Next, we searched for published policies on reporting vulnerabilities; we found no vulnerability-disclosure policies for any system we identified. To identify, prioritize, and address EAS vulnerabilities, we present a list of technical and management strategies to reduce cybersecurity threats. We recommend integrated policies and procedures at all levels of the public-private-government partnerships and system resilience as lines of defense against cybersecurity threats. By implementing these strategies, EASs in the US will be positioned to update critical infrastructure, notify groups of emergencies, and ensure the distribution of valid and reliable information to atrisk populations. Collapse

Topics: website IT security internet technology data encryption strategic management

Methods: survey

Video Killed the Radio Star? Online Music Videos and Recorded Music Sales

2020 | Information Systems Research | Citations: 12

Authors: Kretschmer, Tobias; Peukert, Christian

Abstract: We study the heterogeneous effects of online video platforms on the sales volume ... Expand

Abstract: We study the heterogeneous effects of online video platforms on the sales volume and sales distribution of recorded music. Identification comes from two natural experiments in Germany. In 2009, virtually all music videos were blocked from YouTube as a result of a legal dispute. In 2013, the dedicated platform Vevo entered the market, making videos of a large number of artists available overnight. Our estimates suggest that restricting (enabling) access to online videos decreases (increases) recorded music sales on average by about 5%–10%. We show that the effect operates independently of the nature of video content, suggesting that user-generated content is as effective as official content. Moreover, we highlight heterogeneity in this effect: online music videos disproportionally benefit sales of new artists and sales of mainstream music. Collapse

Topics: YouTube digital service video streaming service digital platform closed platform

Methods: experiment experimental group natural experiment descriptive statistic longitudinal research

An integrated information system for snowmelt flood early-warning based on internet of things

2015 | Information Systems Frontiers | Citations: 0

Authors: Fang, Shifeng; Xu, Lida; Zhu, Yunqiang; Liu, Yongqiang; Liu, Zhihui; Pei, Huan; Yan, Jianwu; Zhang, Huifang

Abstract: Floods and water resource management are major challenges for human in present a ... Expand

Abstract: Floods and water resource management are major challenges for human in present and the near future, and snowmelt floods which usually break out in arid or semi-arid regions often cause tremendous social and economic losses, and integrated information system (IIS) is valuable to scientific and public decision-making. This paper presents an integrated approach to snowmelt floods early-warning based on geoinformatics (i.e. remote sensing (RS), geographical information systems (GIS) and global positioning systems (GPS)), Internet of Things (IoT) and cloud services. It consists of main components such as infrastructure and devices in IoT, cloud information warehouse, management tools, applications and services, the results from a case study shows that the effectiveness of flood prediction and decision-making can be improved by using the IIS. The prototype system implemented in this paper is valuable to the acquisition, management and sharing of multi-source information in snowmelt flood early-warning even in other tasks of water resource management. The contribution of this work includes developing a prototype IIS for snowmelt flood early-warning in water resource management with the combination of IoT, Geoinformatics and Cloud Service, with the IIS, everyone could be a sensor of IoT and a contributor of the information warehouse, professional users and public are both servers and clients for information management and services. Furthermore, the IIS provides a preliminary framework of e-Science in resources management and environment science. This study highlights the crucial significance of a systematic approach toward IISs for effective resource and environment management. Collapse

Topics: internet of things mobile system geographic information system cloud computing global navigation satellite system

Methods: design artifact case study simulation longitudinal research time series analysis

Knowledge Sharing Initiatives in a Chinese Professional Services Firm

2010 | Americas Conference on Information Systems | Citations: 0

Authors: Davison, Robert M

Abstract: Knowledge management has received increasing attention from both academics and p ... Expand

Abstract: Knowledge management has received increasing attention from both academics and practitioners in the past few years. However, much of what we know is limited to larger organisations in developed economies. In this study, we describe and analyse the impact of an knowledge sharing project in a medium sized Chinese professional services firm. Employing Canonical Action Research, we describe how we diagnosed the organisational situation, planned theory-driven changes, implemented a new knowledge sharing platform and then evaluated the outcomes of the implementation. Key findings relate to the importance of guanxi (relationships) between employees and the role of instant messaging technology. The theoretical and practical implications of these findings for knowledge management in the Chinese context are discussed. Recommendations for future research and additional technology applications are identified. Collapse

Topics: knowledge sharing sharing platform knowledge management Google+ social media

Methods: action research mixed method literature sample

Theories: transactive memory theory

A Transaction Cost Perspective of the "Software as a Service" Business Model

2009 | Journal of Management Information Systems | Citations: 0

Authors: Susarla, Anjana; Barua, Anitesh; Whinston, Andrew B.

Abstract: Application service providers (ASP), which host and maintain information technol ... Expand

Abstract: Application service providers (ASP), which host and maintain information technology (IT) applications across the Internet, offer an alternative to traditional models of IT service for user firms. We build on prior literature in transaction cost economics (TCE) to argue that the contract design should address ex post transaction costs that result due to contractual incompleteness and opportunism. We argue that contract design is multidimensional, and that it is necessary to design governance structures that can protect user firms from shirking and monitoring costs, as well as provide for efficient adaptation when requirements are incompletely specified at the start of the initiative. Our empirical analysis suggests that factors such as uncertainty in specifying service requirements, interdependence between the ASP application and IT systems in the client organization, and the need for specific investments favor time and materials contracts, whereas fixed prices are desirable when strong incentives are needed for cost reduction. We also find that contracts that are aligned with transaction attributes in a transaction cost-economizing manner are significantly less likely to experience budget overruns and realize better ex post performance than those that are not. These results hold normative implications for both user and provider firms to assess the performance implications of choosing contracts in line with prescriptions of TCE. Collapse

Topics: outsourcing business model internet technology usability personalization

Methods: survey data transformation confirmatory factor analysis survey design qualitative interview

Theories: transaction cost economics theory of bounded rationality

End-to-end privacy control in service outsourcing of human intensive processes: A multi-layered Web service integration approach

2007 | Information Systems Frontiers | Citations: 0

Authors: Hung, Patrick C. K.; Chiu, Dickson K. W.; Fung, W. W.; Cheung, William K.; Wong, Raymond; Choi, Samuel P. M.; Kafeza, Eleanna; Kwok, James; Pun, Joshua C. C.; Cheng, Vivying S. Y.

Abstract: With the recent adoption of service outsourcing, there have been increasing gene ... Expand

Abstract: With the recent adoption of service outsourcing, there have been increasing general demands and concerns for privacy control, in addition to basic requirement of integration. The traditional practice of a bulk transmission of the customers’ information to an external service provider is no longer adequate, especially in the finance and healthcare sectors. From our consultancy experience, application-to-application privacy protection technologies at the middleware layer alone are also inadequate to solve this problem, particularly when human service providers are heavily involved in the outsourced process. Therefore, we propose a layered architecture and a development methodology for enforcing end-to-end privacy control policies of enterprises over the export of personal information. We illustrate how Web services, augmented with updated privacy facilities such as Service Level Agreement (SLA), Platform for Privacy Preferences Project (P3P), and the P3P Preference Exchange Language (APPEL), can provide a suitable interoperation platform for service outsourcing. We further develop a conceptual model and an interaction protocol to send only the required part of a customer’s record at a time. We illustrate our approach for end-to-end privacy control in service outsourcing with a tele-marketing case study and show how the software of the outsourced call center can be integrated effectively with the Web services of a bank to protect privacy. Collapse

Topics: privacy web service outsourcing marketing management knowledge representation

Methods: case study ontological modelling conceptual modelling literature study