Information Security Breaches Research Articles

Neural correlates of decision making related to information security: Self-control and moral potency.

Security breaches of digital information represent a significant threat to the wellbeing of individuals, corporations, and governments in the digital era. Roughly 50% of breaches of information security result from the actions of individuals inside organizations (i.e., insider threat), and some evidence indicates that common deterrence programs may not lessen the insiders’ intention to violate information security. This had led researchers to investigate contextual and individual difference variables that influence the intention to violate information security policies. The current research builds upon previous studies and explores the relationship between individual differences in self-control and moral potency and the neural correlates of decision making in the context of information security. The behavioral data revealed that individuals were sensitive to the severity of a violation of information security, and that the measures of self-control and moral potency were reliable indicators of the underlying constructs. The ERP data provided a partial replication of previous research, revealing differences in neural activity for scenarios describing security violations relative to control stimuli over the occipital, medial and lateral frontal, and central regions of the scalp. Brain-behavior analyses showed that higher moral potency was associated with a decrease in neural activity, while higher self-control was associated with an increase in neural activity; and that moral potency and self-control tended to have independent influences on neural recruitment related to considering violations of information security. These findings lead to the suggestion that enhancing moral potency and self-control could represent independent pathways to guarding against insider threat.

Assessing the Current Status of Information Security Policies Among Saccos in Kenya

In 2013, Communication Authority of Kenya (CAK) recorded cyber-attacks amounting to Sh5.4 million loses. In April 2016, Bandari Savings and Credit Cooperative Society lost Sh5 million through fraudulent ATM withdrawals (Nation Newspapers, April 8, 2016). These examples demonstrate weaknesses that may exist from security breaches and incidents caused by people, processes, and technology. Ministry of ICT and CAK are lacking specific Information Security Models tailored towards SACCOS in Kenya. The study therefore sought to assess the current status of information security policies among SACCOS in Kenya. The study adopted descriptive research design. The unit of observation was 135 SACCOS registered with SACCO Societies Regulatory Authority (SASRA) while the unit of analysis was 270 ICT personnel working in the 135 targeted SACCOS. The study targeted the SACCOS heads of IT department. The study used Nassiuma (2000) formula to get a sample of 85 respondents. Purposive sampling was further used in selecting study participants in every SACCOS who were considered to be knowledgeable of the variables under study. The study utilized questionnaire as the survey instrument to collect both quantitative and qualitative data. The study adopted descriptive statistics. Descriptive data was presented by use of frequency tables. The study established that in all the SACCOS studied, information security policy is used. However, there are still challenges on how information security breaches and incidents can be contained based on the results of the study and therefore calls for further research in academic research. The findings of the study indicate that SACCOS were able to validate that the enhanced information security model using an integrated approach worked as planned and reported to auditors, managers and executives that incident response programs are robust and reliable. If security controls didn’t work as planned, they will need to fix them. The actions and resources needed should be included in in the report to executives in the SACCOS sector in Kenya Keywords : SACCOS, Management controls, Information Security Policies, Risk assessment DOI : 10.7176/EJBM/11-27-09 Publication date:September 30th 2019

Insight into hackers’ reaction toward information security breach

This study provides insight into hackers’ reaction toward an information security breach perpetuated either with an ill or good intention. To our knowledge, limited research is available for promoting understanding of whether intent induces different perceived moral affect (i.e., a perpetrator should have feelings of regret, sorrow, guilt, and shame) which explains the effect of perceived intensity of emotional distress on responsibility judgment. Further, research is sparse on enhancing understanding of whether the nature of a perpetrator’s intent affects the moderating role of consideration of the consequences in the relationship between perceived moral affect and responsibility judgment. Increased understanding of the relationships among perceived moral affect, perceived intensity of emotional distress, consideration of the consequences, and responsibility judgment of an information security breach from the hackers’ perspective may shed light on their continued engagement in the act despite society’s disapproval. Analyzes of the responses of 166 hackers recruited at two major hacker conferences reveal that perceived moral affect mediates the effect of perceived intensity of emotional distress on responsibility judgment only in an ill intention breach, and consideration of the consequences strengthens the relationship between perceived moral affect and responsibility judgment only in a good intention breach.

The Impact of Information Security Breach Incidents on CIO Turnover

ABSTRACTWe investigate the relationship between security breaches and chief information officer (CIO) turnover. Because CIOs are directly responsible for IT performance, we argue that their turnover likelihood is higher when they fail to meet IT performance expectations, as reflected by information security breaches. Specifically, we find that breaches caused by system deficiency increase CIO turnover likelihood by 72 percent. However, we find no such association for breaches caused by criminal fraud or human error. We extend our analyses to other executives and document that CEOs are more likely to turn over following breaches caused by both system deficiency and human error, consistent with their broader role within the firm. By contrast, we find no evidence suggesting that CFOs are more likely to turn over following breaches. The findings indicate negative labor market consequences for executives who fail to meet performance expectations within the scope of their duties.

It's Not My Fault

This article investigates the transfer of information security breach information between breached firms and their peers. Using a large data set of information security incidents from 2003 to 2013, the results suggest that 1) the effect of information security breach information transfer exists between breached firms and non-breached firms that offer similar products and 2) the effect of information transfer is weaker when the information security breach is due to internal faults or is related to the loss of personally identifiable information. Additional tests demonstrate that the effect of information transfer exhibits consistent patterns across time and with different types of information security breaches. Finally, the effect does not depend on whether the firms are IT intensive. Implications, limitations, and future research are discussed.

Published incidents and their proportions of human error

PurposeThis paper aims to provide an understanding of the proportions of incidents that relate to human error. The information security field experiences a continuous stream of information security incidents and breaches, which are publicised by the media, public bodies and regulators. Despite the need for information security practices being recognised and in existence for some time, the underlying general information security affecting tasks and causes of these incidents and breaches are not consistently understood, particularly with regard to human error.Design/methodology/approachThis paper analyses recent published incidents and breaches to establish the proportions of human error and where possible subsequently uses the HEART (human error assessment and reduction technique) human reliability analysis technique, which is established within the safety field.FindingsThis analysis provides an understanding of the proportions of incidents and breaches that relate to human error, as well as the common types of tasks that result in these incidents and breaches through adoption of methods applied within the safety field.Originality/valueThis research provides original contribution to knowledge through the analysis of recent public sector information security incidents and breaches to understand the proportions that relate to human error.

Deterrence and prevention-based model to mitigate information security insider threats in organisations

Previous studies show that information security breaches and privacy violations are important issues for organisations and people. It is acknowledged that decreasing the risk in this domain requires consideration of the technological aspects of information security alongside human aspects. Employees intentionally or unintentionally account for a significant portion of the threats to information assets in organisations. This research presents a novel conceptual framework to mitigate the risk of insiders using deterrence and prevention approaches. Deterrence factors discourage employees from engaging in information security misbehaviour in organisations, and situational crime prevention factors encourage them to prevent information security misconduct. Our findings show that perceived sanctions certainty and severity significantly influence individuals’ attitudes and deter them from information security misconduct. In addition, the output revealed that increasing the effort, risk and reducing the reward (benefits of crime) influence the employees’ attitudes towards prevent information security misbehaviour. However, removing excuses and reducing provocations do not significantly influence individuals’ attitudes towards prevent information security misconduct. Finally, the output of the data analysis also showed that subjective norms, perceived behavioural control and attitude influence individuals’ intentions, and, ultimately, their behaviour towards avoiding information security misbehaviour.

The Model of Information Security Control in State Information Systems

The control of information protection in state information systems is relevant due to the requirements of the legislation of the Russian Federation, to the value of the information processed in them, to its increasing role in the formation of the modern information society in the Russian Federation, as well as the increasing need for procedures for combining information flows of organizations and enterprises. The article deals with the issues related to the control of information security in state information systems. The analysis of works on this subject reveals a solution to particular problems. Therefore, an integrated formalized approach to solving the problem of protecting information in state information systems, taking into account their specifics, threats and requirements of regulators, is relevant. The information leaks, leakage channels in such systems, as well as threats to information security breaches in state information systems have been analyzed. The most likely threats are cyber-attacks, natural disasters, structural failures and human errors. A formalized model for managing information security in state information systems has been developed, which defines an effective set of protection tools in accordance with the requirements of technical protection measures that can be used to automate the process of monitoring. The formal model aimed at solving the problem of optimizing the used protection mechanisms in relation to the overlapping threats has been proposed. The prospects for the development of this study have been determined.

Real-Time Information Security Incident Management: A Case Study Using the IS-CHEC Technique

Information security recognised the human as the weakest link. Despite numerous international or sector-specific standards and frameworks, the information security community has not yet adopted formal mechanisms to manage human errors that cause information security breaches. Such techniques have been however established within the safety field where human reliability analysis (HRA) techniques are widely applied. In previous work we developed Information Security Core Human Error Causes (IS-CHEC) to fill this gap. This case study presents empirical research that uses IS-CHEC over a 12 month period within two participating public and private sector organisations in order to observe and understand how the implementation of the IS-CHEC information security HRA technique affected the respective organisations. The application of the IS-CHEC technique enabled the proportions of human error related information security incidents to be understood as well as the underlying causes of these incidents. The study captured the details of the incidents in terms of the most common underlying causes, selection of remedial and preventative measures, volumes of reported information security incidents, proportions of human error, common tasks undertaken at the time the incident occurred, as well as the perceptions of key individuals within the participating organisations through semi-structured interviews. The study confirmed in both cases that the vast majority of reported information security incidents relate to human error, and although the volumes of human error related incidents pertaining to both participating organisations fluctuated over the 12 month period, the proportions of human error remained consistently as the majority root cause.

Impact of Data Breaches to Organizations and Individuals

Information security breaches pose a growing threat to organizations and individuals, particularly those that are mainly associated with the e-commerce industry. Data security within an organization is important as Information systems are susceptible to cyber-attacks and usage of Information systems is increasing dramatically in every sector whether it is the FMCG sector or education sector. An information security breach can have a major impact on the financial standing of the breached company and its competitors.

Protected Spaces in Smart Cities and the Identification of New Radio Signals in their Environment using a Complex Measurement Method

This research focuses on the creation of a security boundary through the establishment of information security, more specifically by creating an environment that allows for information security for people-to-people communication. The relevance of the research is justified by the vulnerability of infocommunication tools and systems, as well as by the spread of increasingly cheaper information gathering technologies. There was a need to create an environment where personal, communication between man and man could be realized so that its information content remains protected. Analysing the problem, there are a number of security solutions for information-technology devices, but the creation of a near-human analogue environment for information security is a frontier for the subject. In this approach, the direction of the research was determined by the task of developing an environment that excludes the online operation of infocommunication technologies that create an information security gap and how to identify the spatial position of radio-based communication devices in protected spaces that may be a source of information security. In connection with the continuous quality assurance of the protection, it is necessary to identify the radio signals in the environment of the protected room, which - in the majority of cases - is a built environment with buildings. We offer a new conceptual solution. We studied the operation of the information security breaches during the preliminary research phase by designing a protected space and, by virtue of their principal exclusion, we propose a schematic layout of a protected room, excluding many information security issues. The main purpose of the research is to present an environment that can create a safer person-to-person communication and to provide a novel possible conceptual solution for determining the location of the source of a radio signal.

Investigating the impact of publicly announced information security breaches on corporate risk factor disclosure tendencies

Investigating the impact of publicly announced information security breaches on corporate risk factor disclosure tendencies

Forecasting the Impact of Information Security Breaches on Stock Market Returns and VaR Backtest

This paper wants to analyse the cyber-risk impact on economy in particular on the returns of the companies suffering information braches. The problem has become very interesting in recent years in the literature for the large dependence of the business with cyber world. The analysis focuses on event study in which the impact of cyber-attacks on stock prices of selected companies is investigated. Cyber-risk phenomenon is processed considering a portfolio of targeted assets, in order to analyse their correlation. Risk measures, such as VaR, will be evaluated and backtested using different methods to monitor which one is able to better capture this type of riskiness.

Investigating the Determinants of College Students Information Security Behavior Using a Validated Multiple Regression Models

The frequency, intensity and repercussions of information security breaches in higher education has prompted colleges and universities around the world to devote more resources to enhance technical and human controls capabilities. Research has repeatedly found that technical solutions to cybercrime are insufficient in preventing incidents. The present analysis utilizes the Health Belief Model (HBM) to explain users' computer security behavior by replicating an earlier research study. The study, however, applies the HBM model to a new context, higher education, and college students serve as the sample for this research. A validated questionnaire was employed to collect responses from 263 students attending a public state Midwestern university in the United States. Multiple Linear Regression mathematical analysis was conducted on the dataset collected to measure constructs of the information security of college students. Findings of this research suggest that perceived susceptibility, perceived benefits and self-efficacy are good determinants of information security behavior for college students at least on the sample observations. Further, the analysis supported the moderating logic of perceived severity on the effects of susceptibility, benefits, general security orientation, self-efficacy and cues to action. Findings of this research call upon higher education security administrators to enact more effective awareness and training programs based on real-work security incidents simulations and incorporating information security into the general education curricula.

Investigating the Determinants of College Students Information Security Behavior Using a Validated Multiple Regression Models

The frequency, intensity and repercussions of information security breaches in higher education has prompted colleges and universities around the world to devote more resources to enhance technical and human controls capabilities. Research has repeatedly found that technical solutions to cybercrime are insufficient in preventing incidents. The present analysis utilizes the Health Belief Model (HBM) to explain users' computer security behavior by replicating an earlier research study. The study, however, applies the HBM model to a new context, higher education, and college students serve as the sample for this research. A validated questionnaire was employed to collect responses from 263 students attending a public state Midwestern university in the United States. Multiple Linear Regression mathematical analysis was conducted on the dataset collected to measure constructs of the information security of college students. Findings of this research suggest that perceived susceptibility, perceived benefits and self-efficacy are good determinants of information security behavior for college students at least on the sample observations. Further, the analysis supported the moderating logic of perceived severity on the effects of susceptibility, benefits, general security orientation, self-efficacy and cues to action. Findings of this research call upon higher education security administrators to enact more effective awareness and training programs based on real-work security incidents simulations and incorporating information security into the general education curricula.

Does CIO risk appetite matter? Evidence from information security breach incidents

After a series of recent high-profile information security breach incidents, practitioners have engaged in heated debates about the role of the chief information officer (CIO), particularly his/her role in information security risk management. However, little is known in the academic literature about how a CIO's appetite for risk affects the effectiveness of information security management. We address this gap by examining how a CIO's risk appetite is associated with information security breach incidents. We show that the level of CIO risk aversion is negatively associated with the likelihood of breach incidents. Furthermore, we find that this association is stronger if the company's chief executive officer (CEO) is also risk averse. In additional analyses, we show that the relationship between CIO risk aversion and breach incidents varies depending on breach type and the strategic position of the company and is moderated by the CIO's power.

Information security breaches and IT security investments: Impacts on competitors

In current business climate, a firm’s information systems security is no longer independent from the industry’s broader security environment. A question arises, then, whether stock market values reflect the interdependence of security breaches and investments. In this paper, we used the event study methodology to investigate how a firm’s security breaches and IT security investments influence its competitors. We collected and reviewed 118 information security breaches and 98 IT security investment announcements from 2010 to 2017. We found substantial evidence supporting our hypothesis that information security breaches do, indeed, have a competition effect: when one firm is breached, its competitors have opportunities to absorb market power. For the IT security investment announcements, however, we observed the positive externalities, or contagion effect, in play: market investors feel that the security investments made by one firm increase the security level of the entire network, and hence, competitors also get benefits. Additionally, we found that the competition effect was higher when the breaches occurred after the preceding security investments than when there were no preceding investments before the breaches.

The impact of audit firms’ characteristics on audit fees following information security breaches

Given the importance of auditors’ assessing business risks and evaluating internal controls, we investigate whether an audit firm’s industry expertise, tenure, and size can help its auditors better understand external and internal threats faced by the client with less effort. Using reported information security breach incidents from 2004 to 2013, we find that, consistent with prior studies, audit fees are higher after the occurrence of an information security breach. However, such an association is negatively moderated when the audit firm has industry-specific expertise, longer experience with the client, and is one of the Big 4 firms. Our results suggest that because of their better knowledge about a specific industry, increased familiarity with the client’s operations, and more resources to understand a client’s vulnerabilities and/or information security policies and procedures, these auditors are more capable of assessing the potentially changing information security risks implied by the occurrence of information security breach incidents. Our results are robust to a variety of sensitivity checks.

An Efficient Golden Ratio Method for Secure Cryptographic Applications

With the increase in the use of electronic transactions in everyday life, secure communications and data storage to withstand any kind of attack is warranted. The golden ratio, being the most irrational among irrational numbers, can be used in elliptic curve cryptosystems, power analysis security, and other applications. However, in such applications, cryptographic operations should take place very quickly before the keys are extracted or decoded by the attackers. This paper proposes an efficient method of golden ratio computation in cryptography to resist information security breaches. We compare our new golden ratio method with the well-known Fibonacci sequence method. The experimental results show that our proposed method is more efficient than the Fibonacci sequence method. Our golden ratio method with infinite precision provides reliable counter measure strategy to address the escalating security attacks.

HEART-IS: A novel technique for evaluating human error-related information security incidents

Organisations continue to suffer information security incidents and breaches as a result of human error even though humans are recognised as the weakest link with regard to information security. Despite this level of understanding organisations continue to focus their attention on technical security controls rather than the human factor and have not incorporated methods such as Human Reliability Analysis (HRA) which are used within high reliability sectors such as rail, aviation and energy. The objectives of our research are to define a human error related information security incident and create the novel HEART of Information Security (HEART-IS) technique which is an adaptation of the Human Error Assessment and Reduction Technique (HEART). We conducted a case study within a private sector organisation using HEART-IS to establish if HRA is applicable to information security. The novel HEART-IS technique comprises of a mapping component and an analysis component. In the case study, we applied HEART-IS to map HEART Error Producing Conditions (EPC) to twelve months of reported information security incidents and analysed the volumes of human error and underlying causes. We found that HEART-IS is applicable to the information security field with some minor amendments to the terminology. The mapping of information security incident causes to the HEART Error Producing Conditions (EPC) was successful but the in-built HEART human error probability calculations did not match the actual volumes of reported human error related incidents.