Root Causes of Healthcare Data Breaches – A Text Analytic Approach

2023 | Americas Conference on Information Systems | Citations: 0

Authors: Chakraborty, Aindrila; White, Garry

Abstract: What might be the root cause of the breaches in healthcare industry? Is it huma ... Expand

Abstract: What might be the root cause of the breaches in healthcare industry? Is it human negligence or technical? If it is human or insider, then what types of insider threats are there? How can these threats be detected? These are the questions this emergent research is going to address. A literature search returned very few empirical research in this area. This research analyzes the textual data as reported by the entities and examines the root causes of the data breaches. Specifically, we found nearly 40% of breaches were due to insiders. We are interested in characteristics of these insider threats since the breaches are based inside the technical perimeter of the hospital. While most research is based on numerical data, this research analyzes the textual data of breach reports. Preliminary results indicate there are different types of insider threats and awareness training has poor effectiveness. Collapse

Topics: insider threat data breach

Risk Factors for Malicious Insider Threats – An Analysis of Attack Scenarios

2023 | Americas Conference on Information Systems | Citations: 0

Authors: Hofmeier, Manfred; Seidenfad, Karl; Rieb, Andreas; Lechner, Ulrike

Abstract: Regarding malicious (intentional) insider threats, the damage potential is part ... Expand

Abstract: Regarding malicious (intentional) insider threats, the damage potential is particularly high. There are many suggestions for prevention and defense, but there is a lack of reliable knowledge about which measures actually are effective in regard to this kind of attacks. Using the serious game "Operation Digital Butterfly", 40 roles and attack scenarios as well as possible countermeasures were collected in 10 game sessions with participants from research institutions, companies and public authorities. These are the starting point for an analysis of effective risk factors at the levels of technology, organization, people and infrastructure, which is presented in this paper. Collapse

Topics: insider threat IT security defense

Methods: qualitative content analysis qualitative coding qualitative interview

Identifying the idiosyncrasies of behavioral information security discourse and proposing future research directions: A Foucauldian perspective

2023 | Journal of Information Technology | Citations: 0

Authors: Liang, Nan (Peter); Hirschheim, Rudy; Luo, Xin (Robert); Hollingsworth, Hayden

Abstract: Information security (InfoSec)–related behaviors have been defined in many diffe ... Expand

Abstract: Information security (InfoSec)–related behaviors have been defined in many different ways in the security literature. Indeed, the coexistence of varying terms describing IS security behaviors could be seen as a conceptual inconsistency. However, we believe that it could also be construed as the sign of a vivid and living field embracing dispersed objects of study without changing the disciplinary discourse itself. To test this belief, we conduct a two-part study. Study 1 analyzes the definitions of InfoSec-related behaviors in the existing security literature. The result of Study 1 uncovers the Foucauldian rules that make possible the discourse on behavioral information security, including the surface of emergence, authorities of delimitation, and the grids of specification. Study 1 also indicates that, although behavioral Information Systems Security (ISS) shares the three rules with other disciplines, it is the only field that studies the relations between them. We therefore propose a disciplinary question that reflects this idiosyncrasy. We then conduct Study 2, using Foucault’s view on preconceptual schemata as a theoretical lens, to identify understudied areas in the ISS literature. We found that the existing literature utilizes two variations of the actor and organization schemata to form or to adapt concepts, and utilize two different approaches to study these two variations, namely, an antecedents approach and a dialectics approach. It is noteworthy that the latter is important but understudied in the literature. We then draw an analogy from moral studies to develop three concepts for future ISS research, namely, Stages of Awareness Development, Security Agency, and Security Disengagement. Collapse

Topics: security policy organizational context decision making IT security bring your own device

Methods: theory development literature sample post-hoc analysis qualitative content analysis structured literature research

Theories: agency theory

Trust and Distrust Network in Group Deception: An Exploratory study

2022 | Americas Conference on Information Systems | Citations: 0

Authors: Ge, Saiying

Abstract: To investigate group deception and demote insider threats, this study leverages ... Expand

Abstract: To investigate group deception and demote insider threats, this study leverages network analysis to build a ranking of individuals' trustworthiness. Based on a large-scale, international experiment derived from an adversarial group game, we constructed directed unweighted social networks to analyze the dynamic trust and distrust interaction between individuals. By utilizing orally addressed positive and negative opinions, the networks capture the shifting of trustworthiness. As the outcome of collective group intelligence, the results support that node trustworthiness scores indicate actual trustworthiness. We also show that deception outcomes moderate the relationship between deception and node trustworthiness scores. This study contributes to the growing body of computational methods applied to trust in information systems, providing insights into deception and deception detection in small group contexts. Collapse

Topics: social network deception detection insider threat data encryption

Methods: computational algorithm network analysis experiment survey linear regression analysis

Cultivating proactive information security behavior and individual creativity: The role of human relations culture and IT use governance

2022 | Information & Management | Citations: 5

Authors: Lin, Canchu; Wittmer, Jenell L.S.; Luo, Xin (Robert)

Abstract: This study developed the concept of proactive information security behavior and ... Expand

Abstract: This study developed the concept of proactive information security behavior and examined its connections with individual creativity and two organizational context factors: human relations culture (values and beliefs that promote participation and autonomy in decision-making) and IT use governance. Reliability and validity of this construct were tested with survey data. Findings of this study support its positive relationship with individual creativity, human relations culture, and IT use governance, and show partial mediation effects of individual creativity on the relationships between human relations culture and IT use governance, and proactive infor­ mation security behavior. Theoretical and practice implications are discussed. Collapse

Topics: cybersecurity behavior information system use data security information security management organizational context

Methods: survey data transformation literature study exploratory factor analysis Student's t-test

Theories: organizational behavior theory

Volitional Non-Malicious Insider Threats: At The Intersection of COVID-19, WFH and Cloud-Facilitated Shadow-Apps

2021 | Americas Conference on Information Systems | Citations: 0

Authors: Akello, Patricia

Abstract: In 2020, business operations were changed around the world due to disruptions o ... Expand

Abstract: In 2020, business operations were changed around the world due to disruptions of COVID-19, forcing organizations to migrate their workforce to a new Work From Home (nWFH) model quickly, and with limited planning, design or testing. As a result, new data security threats have emerged. This study aims to examine an insider-related threat to organizational data due to a self-support model of computing facilitated and accelerated by the mainstream proliferation of convenient, affordable and easily accessible cloud-based applications. Shadow Information Technology is a "double edged sword"-on the one end it boasts benefits of improved job performance, productivity, and cost savings, while on the other end it poses security threats. Moreover, with COVID-19 and nWFH, risks abound as established formal structures of the traditional workplace which reinforces data security policies and procedures are diminished. This gives employees more leeway to leverage unapproved apps with unvetted risk profiles for workrelated tasks with the risk of introducing vulnerabilities into the work environment. We examine this issue through the lens of Theory of Planned Behavior (TPB) and General Strain Theory (GST), looking at it from the volitional nonmalicious Insider Threat perspective. Study context is nWFH model against the backdrop of COVID-related strains. Expected contribution is in the areas of Insider Threats, Data Security, Shadow IT and Cloud Security. From a theoretical standpoint, the study aims to incorporate GST with the TPB in an attempt to increase its explanatory power while attempting to remedy one of its stated limitations. Collapse

Topics: insider threat cloud computing social norm pandemic organization structure

Methods: structural equation modeling company material survey

Theories: theory of planned behavior general strain theory

Information systems security research agenda: Exploring the gap between research and practice

2021 | Journal of Strategic Information Systems | Citations: 0

Authors: Dhillon, Gurpreet; Smith, Kane; Dissanayaka, Indika

Abstract: This paper undertakes a systematic review of the Information Systems Security li ... Expand

Abstract: This paper undertakes a systematic review of the Information Systems Security literature. The literature review consists of three parts: First, we perform topic modeling of major Information Systems journals to understand the field’s debates. Second, we conduct a Delphi Study composed of the Chief Information Security Officers of major corporations in the US to identify security issues that they view as important. Third, we compare Topic Modeling and the Delphi Study results and discuss key debates, gaps, and contradictions within the academic literature. Further, extant Information Systems Security literature is reviewed to discuss where the academic com­ munity has placed the research emphasis and what is now required in the discipline. Based on our analysis, we propose a future agenda for Information Systems security research. Collapse

Topics: IT security IT security threat systems design information security policy compliance malware

Methods: delphi study literature study topic model computational algorithm machine learning

Theories: socio technical theory

An Analysis of Complexity of Insider Attacks to Databases

2021 | ACM Transactions on Management Information Systems | Citations: 0

Authors: Kul, Gökhan; Upadhyaya, Shambhu; Hughes, Andrew

Abstract: Insider attacks are one of the most dangerous threats to an organization. Unfort ... Expand

Abstract: Insider attacks are one of the most dangerous threats to an organization. Unfortunately, they are very difficult to foresee, detect, and defend against due to the trust and responsibilities placed on the employees. In this article, we first define the notion of user intent and construct a model for a common scenario that poses a very high risk for sensitive data stored in the organization’s database. We show that the complexity of identifying pseudo-intents of a user in this scenario is coNP-Complete, and launching a harvester insider attack within the boundaries of the defined threat model takes linear time while a targeted threat model is an NP-Complete problem. We also discuss the general defense mechanisms against the modeled threats and show that countering the harvester insider attack takes quadratic time while countering the targeted insider attack can take linear to quadratic time, depending on the strategy chosen. We analyze the adversarial behavior and show that launching an attack with minimum risk is also an NP-Complete problem. Finally, we perform timing experiments with the defense mechanisms on SQL query workloads collected from a national bank to test the feasibility of using these systems in real time. Collapse

Topics: database system structured query language insider threat IT security defense random-access memory

Methods: cluster analysis experiment computational algorithm digital trace data k-means clustering

Understanding Information Security Policy Violation from a Situational Action Perspective

2021 | Journal of the Association for Information Systems | Citations: 10

Authors: Li, Han; Luo, Xin; Chen, Yan

Abstract: Insiders' negligence or abuse is regarded as a leading cause of information sec ... Expand

Abstract: Insiders' negligence or abuse is regarded as a leading cause of information security breaches in organizations. As most of the extant studies have largely examined insider threats at a high level of abstraction, the role of situational moral reasoning for information security policy (ISP) violations in specific situations has received little attention. To advance this line of research, this paper opens up a potentially fruitful path for IS researchers by applying situational action theory (SAT) to contextually examine why employees violate ISPs in particular situations. We consider the violations of password security policy, internet use policy, and confidential data security policy, and examine specific violation intents ranging from altruistic to malicious. The results support most of the assertions derived from SAT. We found situational moral beliefs to be the predominant driver for ISP violations across three situations in an organizational setting. However, the moderation effect of moral beliefs was only significant in situations involving sharing passwords and selling confidential data. Sanction certainty and sanction severity were also found to have different effects across situations. We conclude by presenting implications for IS security practitioners and suggestions for future research. Collapse

Topics: password information system use IT security data security security policy

Methods: partial least squares regression structural equation modeling survey nonparametric test literature study

Theories: action theory

Demystifying analytical information processing capability: The case of cybersecurity incident response

2021 | Decision Support Systems | Citations: 7

Authors: Naseer, Humza; Maynard, Sean B.; Desouza, Kevin C.

Abstract: Little is known about how organizations leverage business analytics (BA) to deve ... Expand

Abstract: Little is known about how organizations leverage business analytics (BA) to develop, process, and exploit analytical information in cybersecurity incident response (CSIR). Drawing on information processing theory (IPT), we conducted a field study using a multiple case study design to answer the following research question: How do organizations exploit analytical information in the process of cybersecurity incident response by using business analytics? We developed a theoretical framework that explains how organizations respond to the dy­ namic cyber threat environment by exploiting analytical information processing capability in the CSIR process. This, in turn, leads to positive outcomes in enterprise security performance, delivering both strategic and financial benefits. Our findings contribute to the BA and cybersecurity literature by providing useful insights into BA applications and the facilitation of analytics-driven decision making in CSIR. Further, they contribute to IPT by providing new insights about analytical information needs, mechanisms to seek analytical information, and analytical information use in the process of CSIR. Collapse

Topics: IT security IT security threat analytical information system decision making malware

Methods: case study qualitative interview theory development multiple case study anomaly detection

Theories: information processing theory