Results

Found 23 articles

Clear filters

An Examination of Gain- and Loss-Framed Messaging on Smart Home Security Training Programs
PDF
2022 | Information Systems Frontiers | Citations: 0
Authors: Plachkinova, Miloslava; Menard, Philip

Abstract: The Internet of Things (IoT) has gained popularity among home consumers due to i ... Expand

Abstract: The Internet of Things (IoT) has gained popularity among home consumers due to its characteristics related to automation, information gathering, and purported physical security benefits. In an effort to capitalize on an expanding market, IoT developers have rushed products to market without proper due diligence regarding device cybersecurity. By being more focused on the utility and convenience of IoT devices without being concerned about their devices’ inherent security flaws, consumers may be unwittingly putting themselves at risk. Gain- and loss-framed messaging has been an extensively studied form of persuasive communication in other research fields but has not been previously examined in the context of information security research. Using an experimental design, we assess the efficacy of applying gain- and loss-framed principles to a security education training and awareness (SETA) program designed to bolster IoT users’ concerns related to pertinent IoT-based threats and provide information about their corresponding countermeasures. We found that for consumers with low initial IoT security concerns, loss-framed messaging is more effective in increasing security concerns. For consumers with higher initial concerns, messages focusing on desirable outcomes, regardless of an overall gain- or loss-framed message valence, are effective at increasing IoT security concerns. Collapse

Semantic filters: firewall experiment

Topics: mobile system internet of things smart home privacy user training

Methods: experiment multivariate analysis of variance experimental group survey design artifact
Experimental Investigation of Demographic Factors Related to Phishing Susceptibility

2020 | HICSS | Citations: 11
Authors: Li, Wanru; Greitzer, Frank L; Llc, PsyberAnalytix; Lee, James; Yousefi, Bahram; Purl, Justin; Laskey, Kathryn B

Abstract: This paper reports on a simulated phishing experiment targeting 6,938 faculty an ... Expand

Abstract: This paper reports on a simulated phishing experiment targeting 6,938 faculty and staff at George Mason University. The study examined various possible predictors of phishing susceptibility. The focus of the present paper is on demographic factors (including age, gender and position/employment). Since previous studies of age and gender have yielded discrepant results, one purpose of the study was to disambiguate these findings. A second purpose was to compare different types of email phishing exploits. A third objective was to compare the effect of different types of feedback given to those who clicked on one or more of three simulated phishing exploits that were deployed over a three-week period. Our analysis of demographic factors, effects of phishing email content, and effects of repeated exposure to phishing exploits revealed significant age effects, marginally significant gender differences, and significant differences in email type. A multi-level model estimated effects of multiple variables simultaneously. Collapse

Semantic filters: firewall experiment

Topics: electronic mail phishing email phishing service desk system support

Methods: survey experiment chi squared test Bonferroni correction Pearson's chi squared test of independence between categorical variables
Executives' Commitment to Information Security: Interaction between the Preferred Subordinate Influence Approach (PSIA) and Proposal Characteristics
PDF
2020 | ACM SIGMIS Database | Citations: 0
Authors: Menon, Nirup M.; Siponen, Mikko T.

Abstract: Two aspects of decision-making on information security spending, executives' var ... Expand

Abstract: Two aspects of decision-making on information security spending, executives' varying preferences for how proposals should be presented and the framing of the proposals, are developed. The proposed model of executives' commitment to information security is an interaction model (in addition to the cost of a security solution, and the risk and the potential loss of a security threat) consisting of the interaction between an executive's preferred subordinate influence approach (PSIA), rational or inspirational, and the framing, positive or negative, of a security proposal. The interaction of these two constructs affects the executive's commitment to an information security proposal. The model is tested using a scenario-based experiment that elicited responses from business executives across 100+ organizations. Results show that the interaction of the negative framing of a proposal and the inspirational PSIA of an executive affects his or her commitment to information security. Further, negative framing of a proposal and the cost of the security solution interact to decrease the executive's commitment to information security. This study underscores that prescriptions for business executives from normative models in information security spending must be complemented with appropriately framed messages to account for the differences in executives' PSIA (rational and inspirational) and cognitive biases. Collapse

Semantic filters: firewall experiment

Topics: data security anonymity resource allocation security policy firewall

Methods: experiment survey data transformation factor analysis hierarchical linear modeling
On Robust Estimates of Correlated Risk in Cyber-Insured IT Firms: A First Look at Optimal AI-Based Estimates under “Small” Data
PDF
2019 | ACM Transactions on Management Information Systems | Citations: 0
Authors: Pal, Ranjan; Golubchik, Leana; Psounis, Konstantions; Bandyopadhyay, Tathagata

Abstract: In this article, we comment on the drawbacks of the existing AI-based Bayesian n ... Expand

Abstract: In this article, we comment on the drawbacks of the existing AI-based Bayesian network (BN) cyber-vulnerability analysis (C-VA) model proposed in Mukhopadhyay et al. (2013) to assess cyber-risk in IT firms, where this quantity is usually a joint distribution of multiple risk (random) variables (e.g., quality of antivirus, frequency of monitoring, etc.) coming from heterogeneous distribution families. As a major modeling drawback, Mukhopadhyay et al. (2013) assume that any pair of random variables in the BN are linearly correlated with each other. This simplistic assumption might not always hold true for general IT organizational environments. Thus, the use of the C-VA model in general will result in loose estimates of correlated IT risk and will subsequently affect cyber-insurance companies in framing profitable coverage policies for IT organizations. To this end, we propose methods to (1) find a closed-form expression for the maximal correlation arising between pairs of discrete random variables, whose value finds importance in getting robust estimates of copula-induced computations of organizational cyber-risk, and (2) arrive at a computationally effective mechanism to compute nonlinear correlations among pairs of discrete random variables in the correlation matrix of the CBBN model (Mukhopadhyay et al. 2013). We also prove that an empirical computation of MC using our method converges rapidly, that is, exponentially fast, to the true correlation value in the number of samples. Our proposed method contributes to a tighter estimate of IT cyber-risk under environments of low-risk data availability and will enable insurers to better assess organizational risks and subsequently underwrite profitable cyber-insurance policies. Collapse

Semantic filters: firewall experiment

Topics: computer virus protection security policy firewall IT risk management accounting

Methods: Bayesian network experiment simulation computational algorithm optimization model
See No Evil, Hear No Evil? Dissecting the Impact of Online Hacker Forums
PDF
2019 | Management Information Systems Quarterly | Citations: 26
Authors: Yue, Wei T.; Qiu-Hong Wang; Kai-Lung Hui

Abstract: Online hacker forums offer a prominent avenue for sharing hacking knowledge. Usi ... Expand

Abstract: Online hacker forums offer a prominent avenue for sharing hacking knowledge. Using a field dataset culled from multiple sources, we find that online discussion of distributed denial of service (DDOS) attacks in hackforums.net decreases the number of DDOS-attack victims. A 1% increase in discussion decreases DDOS attacks by 0.032% to 0.122%. This means that two DDOS-attack posts per day could reduce the number of victims by 700 to 2,600 per day. We find that discussion topics with similar keywords can variously increase or decrease DDOS attacks, meaning we cannot ascertain the impact of the discussion just by the post nature. Mentioning botnets, especially new botnets, increases the attacks, but the follow-up discussion decreases the attacks. Our results suggest that online-hacker-forum discussion may exhibit the dual-use characteristic. That is, it can be used for both good and bad purposes. We draw related managerial implications. Collapse

Semantic filters: firewall experiment

Topics: denial of service attack internet technology computer virus Python open source

Methods: term frequency–inverse document frequency latent dirichlet allocation forums posting qualitative content analysis topic model
Decision support for the optimal allocation of security controls
PDF
2018 | Decision Support Systems | Citations: 1
Authors: Zhang, He; Chari, Kaushal; Agrawal, Manish

Abstract: We present constrained optimization models that could be used in a decision supp ... Expand

Abstract: We present constrained optimization models that could be used in a decision support system for configuring security solutions for an information systems infrastructure. We begin with a deterministic model that uses security breach probabilities as parameters. Since security breach data is not easily available, breach probabilities are often estimated via surveys, which could lead to estimation errors. To develop robust solutions in the presence of estimation errors, we then present a stochastic optimization model that handles uncertainties in breach probability estimations. Our model solutions incorporate quantifiable security risk and business impact as the models are detailed enough to capture various categories of security attacks, and different levels of security protection and loss values for data and applications. We demonstrate the utility of our models by proposing security solutions for a realistic IT infrastructure using breach probability estimates derived from surveys. Collapse

Semantic filters: firewall experiment

Topics: information technology infrastructure IT security threat database system decision support system computer hardware

Methods: survey focus group optimization model stochastic model experiment
Got Phished? Internet Security and Human Vulnerability

2017 | Journal of the Association for Information Systems | Citations: 43
Authors: Goel, Sanjay; Williams, Kevin; Dincelli, Ersin

Abstract: A leading cause of security breaches is a basic human vulnerability: our suscept ... Expand

Abstract: A leading cause of security breaches is a basic human vulnerability: our susceptibility to deception. Hackers exploit this vulnerability by sending phishing emails that induce users to click on malicious links that then download malware or trick the victim into revealing personal confidential information to the hacker. Past research has focused on human susceptibility to generic phishing emails or individually targeted spear-phishing emails. This study addresses how contextualization of phishing emails for targeted groups impacts their susceptibility to phishing. We manipulated the framing and content of email messages and tested the effects on users’ susceptibility to phishing. We constructed phishing emails to elicit either the fear of losing something valuable (e.g., course registrations, tuition assistance) or the anticipation of gaining something desirable (e.g., iPad, gift card, social networks). We designed the emails’ context to manipulate human psychological weaknesses such as greed, social needs, and so on. We sent fictitious (benign) emails to 7,225 undergraduate students and recorded their responses. Results revealed that contextualizing messages to appeal to recipients’ psychological weaknesses increased their susceptibility to phishing. The fear of losing or anticipation of gaining something valuable increased susceptibility to deception and vulnerability to phishing. The results of our study provide important contributions to information security research, including a theoretical framework based on the heuristic-systematic processing model to study the susceptibility of users to deception. We demonstrate through our experiment that several situational factors do, in fact, alter the effectiveness of phishing attempts. Keywords: Phishing, Information Security, Social Engineering, Behavioral Security, Heuristic-Systematic Processing Model, Deception, Cognitive Biases, Vulnerabilities, Security Risk, Threats. Collapse

Semantic filters: firewall experiment

Topics: electronic mail phishing email phishing iPad personality

Methods: survey experiment ANOVA parametric test chi squared test
Towards a Cyber Defense Framework for SCADA Systems Based on Power Consumption Monitoring
PDF
2017 | HICSS | Citations: 0
Authors: Hernández Jiménez, Jarilyn; Chen, Qian; Nichols, Jeffrey; Calhoun, Chelsea; Sykes, Summer

Abstract: Supervisory control and data acquisition (SCADA) systems are industrial automati ... Expand

Abstract: Supervisory control and data acquisition (SCADA) systems are industrial automation systems that remotely monitor and control critical infrastructures. SCADA systems are major targets for espionage and sabotage attackers. Current commercial o↵-the-shelf security solutions are insu cient in protecting SCADA systems against sophisticated cyber-attacks. Furthermore, these breaches are not detected in real-time or fast enough to prevent further damages. To address this challenge we present a feasibility study that proves monitoring power consumption of SCADA devices is an e↵ective approach to detect cyber-attacks. We built a testbed containing a Programmable Logic Controller (PLC) that was instrumented to record its power usage. Three SCADAspeciﬁc cyber-attacks were simulated and we report the power consumption of the PLC under these normal and anomalous scenarios. We show that it is possible to distinguish the PLC power utilization between these scenarios. In route to this result we found and describe vulnerabilities in the DF-1 protocol. Collapse

Semantic filters: firewall experiment

Topics: IT security threat Python malware computer hardware denial of service attack

Methods: experiment machine learning literature study experimental design supervised learning
Combating Phishing Attacks: A Knowledge Management Approach
PDF
2017 | HICSS | Citations: 9
Authors: Jensen, Matthew; Durcikova, Alexandra; Wright, Ryan

Abstract: This paper explores how an organization can utilize its employees to combat phis ... Expand

Abstract: This paper explores how an organization can utilize its employees to combat phishing attacks collectively through coordinating their activities to create a human firewall. We utilize knowledge management research on knowledge sharing to guide the design of an experiment that explores a central reporting and dissemination platform for phishing attacks. The 2x2 experiment tests the effects of public attribution (to the first person reporting a phishing message) and validation (by the security team) of phishing messages on reporting motivation and accuracy. Results demonstrate that knowledge management techniques are transferable to organizational security and that knowledge management can benefit from insights gained from combating phishing. Specifically, we highlight the need to both publicly acknowledge the contribution to a knowledge management system and provide validation of the contribution. As we saw in our experiment, doing only one or the other does not improve outcomes for correct phishing reports (hits). Collapse

Semantic filters: firewall experiment

Topics: phishing web forum knowledge sharing firewall knowledge management

Methods: experiment analysis of covariance survey logistic regression self reported survey
The Use of System in the Loop, Hardware in the Loop, and Co-modeling of Cyber-Physical Systems in Developing and Evaluating Smart Grid Solutions

2017 | HICSS | Citations: 0
Authors: Kezunovic, M; Esmaeilian, A; Manimaran, G; Mehrizi-Sani, A

Abstract: This paper deals with two issues: development of some advanced smart grid applic ... Expand

Abstract: This paper deals with two issues: development of some advanced smart grid applications, and implementation of advanced testbeds to evaluate these applications. In each of the development cases, the role of the testbeds is explained and evaluation results are presented. The applications cover the synchrophasor systems, interfacing of microgrids to the main grid, and cybersecurity solutions. The paper hypothesizes that the use of the advanced testbeds is beneficial for the development process since the solution product-tomarket cycle may be shortened due to early real-life demonstrations. In addition, solution users’ feedback to the testbed demonstration can be incorporated at an early stage when making the changes is not as costly as doing it at more mature development stages. Collapse

Semantic filters: firewall experiment

Topics: computer hardware firewall intrusion detection system cyber-physical system manufacturing information system

Methods: simulation computational algorithm anomaly detection experiment

Page 1 of 3 Next

AIS11

Journals

Conferences

Semantic Filter

Found 23 articles

An Examination of Gain- and Loss-Framed Messaging on Smart Home Security Training Programs

Experimental Investigation of Demographic Factors Related to Phishing Susceptibility

Executives' Commitment to Information Security: Interaction between the Preferred Subordinate Influence Approach (PSIA) and Proposal Characteristics

On Robust Estimates of Correlated Risk in Cyber-Insured IT Firms: A First Look at Optimal AI-Based Estimates under “Small” Data

See No Evil, Hear No Evil? Dissecting the Impact of Online Hacker Forums

Decision support for the optimal allocation of security controls

Got Phished? Internet Security and Human Vulnerability

Towards a Cyber Defense Framework for SCADA Systems Based on Power Consumption Monitoring

Combating Phishing Attacks: A Knowledge Management Approach

The Use of System in the Loop, Hardware in the Loop, and Co-modeling of Cyber-Physical Systems in Developing and Evaluating Smart Grid Solutions