Information Security Research Research Articles

Information Security Research in the Information Systems Discipline: A Thematic Review and Future Research Directions

Information security continues to grow in importance in all aspects of society and therefore evolves as a prevalent research area. The information systems (IS) discipline offers a unique perspective to move this stream of literature forward. Using a semiautomated thematic analysis approach based on the topic modeling technique, we review a broad range of information security literature to investigate how we may integrate and advance our understanding of information security. Our analysis reveals four major themes, including information security policy (ISP) compliance, motivations and susceptibility, software security decisions, and firm security strategy. We also identify a theme of security in broader contexts, in which studies consider the societal impacts of information security and online hacker behavior. This review contributes to IS literature by 1) synthesizing the broad range of information security research published in the top journals of the field, moving beyond prior reviews focusing on a narrower scope such as individual ISP compliance; 2) identifying major themes and proposing an overarching research framework encompassing these themes and their interconnections, allowing us to envision future research directions; and 3) enumerating a semiautomated topic modeling approach that other researchers can employ.

Securing tomorrow: a comprehensive survey on the synergy of Artificial Intelligence and information security

AbstractThis survey paper explores the transformative role of Artificial Intelligence (AI) in information security. Traditional methods, especially rule-based approaches, faced significant challenges in protecting sensitive data from ever-changing cyber threats, particularly with the rapid increase in data volume. This study thoroughly evaluates AI’s application in information security, discussing its strengths and weaknesses. It provides a detailed review of AI’s impact on information security, examining various AI algorithms used in this field, such as supervised, unsupervised, and reinforcement learning, and highlighting their respective strengths and limitations. The study identifies key areas for future AI research in information security, focusing on improving algorithms, strengthening information security, addressing ethical issues, and exploring safety and security-related concerns. It emphasizes significant security risks, including vulnerability to adversarial attacks, and aims to enhance the robustness and reliability of AI systems in protecting sensitive information by proposing solutions for potential threats. The findings aim to benefit cybersecurity professionals and researchers by offering insights into the intricate relationship between AI, information security, and emerging technologies.

Expressing opinions about information security in an organization: the spiral of silence theory perspective

Purpose Expressing views on organizational information security (IS) by employees is vital for improving security processes, policies and trainings, while non-communication may conceal the true state of the human factor of IS and lead to security breaches. The purpose of this paper is to introduce the concept of opinion expressing about organizational IS, provide an explanatory model based on the theory of spiral of silence and offer its empirical validation. Design/methodology/approach Data from a web-based survey among the employees of one the universities in the European Union (n = 504) was analyzed with regression analysis to investigate the proposed hypotheses. Findings The study reveals that employees with positive opinions about IS will be more willing to share their opinions with coworkers and management. However, when employees perceive that their pro-IS opinions are not shared by other coworkers, they will remain silent, which increases the risk of problematic opinions spreading throughout the organization. Research limitations/implications The study highlights the need to focus on the communication perspectives of organizational information security, an area often overlooked in the human factor of information security research. Practical implications The results highlight the need to examine the gap between the dominant climate of opinion about IS in the organization and the display of compliant IS behaviors in order to strengthen IS endeavors. Organizations are encouraged to facilitate open dialogue about IS processes, policies and training and implement mechanisms for considering employees’ feedback in order to improve the organization’s IS. Originality/value The study contributes to a growing body of research that moves beyond viewing employees merely as subjects of compliance, recognizing instead their agency in IS issues that can enhance organizational resilience. To the best of the authors’ knowledge, this is the first study to apply the spiral of silence theory in the IS field, thereby helping to overcome the lack of communication science perspectives in organizational IS research.

"No point worrying" – The role of threat devaluation in information security behavior

Extant information security research is characterized by a focus on problem-focused security behaviours, while overlooking the internal, and emotion-focused coping responses that humans exhibit. Threat devaluation, where severity is downplayed, is an established dimension of risk perception, and yet it has not been considered in information security research to date. We address this gap by developing and empirically testing a research model of how threat and coping factors from Protection Motivation Theory influence both problem-focused and emotion-focused coping responses. Data was collected from 518 users and PLS was used to reveal the determinants of, and the relationship between, problem-focused and emotion-focused coping behaviors. The results demonstrate that threat devaluation is a measurable outcome of all threat and coping appraisals considered, providing evidence that multiple coping strategies may be involved in a security threat situation. We also find that many of the well-established determinants of information security behavior, such as self-efficacy, are significantly related to emotion-focused responses. This has implications for researchers and practitioners who seek to create secure environments where users are more likely to enact constructive and problem-focused security behaviors.

An assessment of critical success factors in information security implementation in organizations in Ghana

Purpose This paper aims to identify the critical success factors in improving information security in Ghanaian firms. Design/methodology/approach Through an exploratory study of both public and private Ghanaian organizations. The study relied on a research model based on the technology–organization–environment (TOE) framework and a survey instrument to collect data from 525 employees. The data was analyzed using partial least squares-structural equation modeling (PLS-SEM). Findings The findings confirm the role of the technological, organizational and environmental contexts as significant determinants in the implementation of information security in Ghanaian organizations. Results from PLS-SEM analysis demonstrated a positive correlation between the technology component of information security initiative, organization’s internal efforts toward its acceptance and a successful implementation of information security in Ghanaian firms. Top management support and fund allocation among others will result in positive information security initiatives and positive attitudes toward securing the organization’s information assets. Research limitations/implications The authors discussed the implications of the authors’ findings for research, practice and policy. Social implications The results of this study will be useful for both governmental and non-governmental organizations in terms of best practices for increasing information security. Results from this study will aid organizations in developing countries to better understand their information security needs and identify the necessary procedures to address them. Originality/value This study contributes to filling the knowledge gap in organizational information security research and the TOE framework. Despite the TOE framework being one of the most influential theories in contemporary research of information system domains in an organizational context, there is not enough research linking the domains of information security and the TOE model.

Understanding security behaviour among healthcare professionals by comparing results from technology threat avoidance theory and protection motivation theory

ABSTRACT We investigate security behaviour among healthcare professionals while comparing upon two prevalent theories in information security (IS) research: Protection Motivation Theory (PMT) and Technology Threat Avoidance Theory (TTAT). Although IS research often uses these models, very few studies compare the two models using a diverse sample of 245 healthcare professionals. The data were analysed using partial least squares regression - structural equation modelling (PLS-SEM). Results indicated that both models were similarly robust at predicting security behaviour. Perceived severity and response efficacy positively influenced avoidance motivation (AM) for PMT. All factors of the threat appraisal arm of TTAT and safeguard efficacy played an influencing role on AM in TTAT. Response cost and self-efficacy were not supported in either model, providing us with potentially new insights into this specific population’s security intentions. With the addition of Perceived Threat, TTAT appears to be slightly more robust model with 64% of the variance explained by the given model while PMT explains only 60% of the variance. Given the ever-increasing risk of data breaches in healthcare, practical applications and implications of the study’s findings to health information technology (HIT) policy and infrastructure are also discussed.

Key generation method from fingerprint image based on deep convolutional neural network model

Biometrics effect our live. Security applications employ biometrics. Biometric encryption is growing. Encryption requires biometric key creation. Long, random, and unexpected is the key. Information and communication security research emphasizes long, strong encryption keys. The proposed system uses fingerprint biometrics to generate a long, random biometric encryption key for symmetric encryption. Pre-processing removed noise from donor fingerprint images in the dataset. The program then trains an updateable Tuned VGG-16 convolutional neural network model and tests it on fingerprint images to learn fundamental fingerprint properties. The convolutional neural netwoprk CNN model retains the final weights for the second model to extract encryption key features. Transfer learning built a second convolutional neural network model to retrieve features without relearning. Keeping vector mean for processing. The last step generates an encryption key based on each person's vector of unique biometric features can be used for symmetric encryption algorithms to encrypt personal documents on the personal PC or personal cloud. Our CNN based method uses biometrics to recognize people and create safe and trustworthy encryption keys with over 99% accuracy in testing. Our 98%-accurate deep ANN classifier exceeds the support vector machine and random forest classifiers.

Faulty use of the CIC-IDS 2017 dataset in information security research

Faulty use of the CIC-IDS 2017 dataset in information security research

Information Security Applications in Smart Cities: A Bibliometric Analysis of Emerging Research

This paper aims to analyze the intellectual structure and research fronts in application information security in smart cities to identify research boundaries, trends, and new opportunities in the area. It applies bibliometric analyses to identify the main authors and their influences on information security and the smart city area. Moreover, this analysis focuses on journals indexed in Scopus databases. The results indicate that there is an opportunity for further advances in the adoption of information security policies in government institutions. Moreover, the production indicators presented herein are useful for the planning and implementation of information security policies and the knowledge of the scientific community about smart cities. The bibliometric analysis provides support for the visualization of the leading research technical collaboration networks among authors, co-authors, countries, and research areas. The methodology offers a broader view of the application information security in smart city areas and makes it possible to assist new research that may contribute to further advances. The smart cities topic has been receiving much attention in recent years, but to the best of our knowledge, there is no research on reporting new possibilities for advances. Therefore, this article may contribute to an emerging body of literature that explores the nature of application information security and smart cities research productivity to assist researchers in better understanding the current emerging of the area.

A Framework for Synthetic Agetech Attack Data Generation

To address the lack of datasets for agetech, this paper presents an approach for generating synthetic datasets that include traces of benign and attack datasets for agetech. The generated datasets could be used to develop and evaluate intrusion detection systems for smart homes for seniors aging in place. After reviewing several resources, it was established that there are no agetech attack data for sensor readings. Therefore, in this research, several methods for generating attack data were explored using attack data patterns from an existing IoT dataset called TON_IoT weather data. The TON_IoT dataset could be used in different scenarios, but in this study, the focus is to apply it to agetech. The attack patterns were replicated in a normal agetech dataset from a temperature sensor collected from the Information Security and Object Technology (ISOT) research lab. The generated data are different from normal data, as abnormal segments are shown that could be considered as attacks. The generated agetech attack datasets were also trained using machine learning models, and, based on different metrics, achieved good classification performance in predicting whether a sample is benign or malicious.

Television Broadcasting and Information Security: Analyzing Current Challenges and Future Prospects

Television is gradually losing its position, but all predictions about its elimination from the media market in the short term do not come true. This necessitates a new understanding of the contemporary television space in its conceptual and functional dimensions. The purpose of the article is to analyse the information and security challenges in the paradigm of modern television broadcasting. The tasks of the scientific research are focused on the problem of modern positioning of the information culture of television broadcasting: on the one hand, it is a traditional media format that is already clearly established in terms of information security; on the other hand, television is being updated with new formats, which requires appropriate up-to-date mechanisms for responding to new potential threats without a peak cluster. The research methodology is focused on general scientific methods: analysis, modelling, forecasting. The analytical methodological segment provides traditional systemic and comparative characteristics of information security of television broadcasting; innovative methods, such as content analysis and online monitoring, are designed to determine the specifics of television content in the paradigm of modern media culture. The results of the study show that the interpretation of information security in the television segment is ambiguous. It is necessary to formulate a set of guidelines of a practical, applied and theoretical, and mental nature that will regulate information content and prevent threats from television broadcasting. The author proposes the principles of information and communication control that will form a control system in the television cluster but will not turn into censorship: improvement of the fundamental triad of information security (confidentiality, integrity, and availability) and the addition of additional elements - authenticity, reliability, relevance. Prospects for information security research in the television segment are the synergy of human and technological efforts to prevent illegal and harmful activity in the broadcasting process: preventing unauthorised actions, avoiding threatening interpretations, and denying inhumane manifestations. Consequently, television remains an active player in the modern paradigm of the information society, maintaining its status as a relevant broadcaster of content of various kinds. Information security is a set of measures that provide for control over all information and communication media segments, which forms both universal and specific principles of information influence directly on the television format.

Designing an incentive mechanism for information security policy compliance: An experiment

Much information security research focuses on policies firms could adopt to reduce or eliminate employees’ violation behavior. However, current information security policies are based on increasingly outmoded models of compliance behavior. This paper proposes a novel behavioral-based mechanism that offers rewards and punishments to incentivize employees to take the time to protect a company's information assets. This new mechanism is grounded in insights from externality taxes and subsidies, as well as from behavioral economics, that specific incentives operationalized as monetary rewards and punishments effectively improve information security compliance. We also consider the importance of detection in implementing our mechanism. We conduct a set of laboratory experiments to study the impact of the rewards and punishments, as well as the importance of the probability of detection.Our results show clearly that rewards alone or a combination of rewards and punishments are effective in improving information security policy compliance in both high and low-detection environments, but punishments alone are not effective in either of our environments. In addition, a company's information security compensation plan is more likely to be effective in improving compliance if the company can more reliably detect violations. Overall, our study suggests that a compensation structure based on small and predictable financial rewards and punishments is likely more effective than the current punishment-focused approach.

Identifying trends in information security and privacy concern research

Text mining is a research method that can be used to detect research trends and developments in various fields. In this study, an automated textual analysis tool (Voyant Tools) is applied to a vast corpus of academic papers to identify research trends in the fields of information security and privacy concern, focusing on the differences between the first two decades of the twenty-first century. Furthermore, the conceptual proximity between the related terms ‘information security’ and ‘privacy concern’ is investigated by identifying textual trends. We discovered that, while the first decade of information security research was not entirely defined, the second decade focused on privacy-related issues. The focus of privacy concern research was on commerce and marketing in the first decade and on the social dimension in the second decade. This study supports the use of textual analysis of academic literature to identify research trends in various fields, including technological fields.

Security Responses in Software Development

The pressure on software developers to produce secure software has never been greater. But what does security look like in environments that do not produce security-critical software? In answer to this question, this multi-sited ethnographic study characterizes security episodes and identifies five typical behaviors in software development. Using theory drawn from information security and motivation research in software engineering, this article characterizes key ways in which individual developers form security responses to meet the demands of particular circumstances, providing a framework managers and teams can use to recognize, understand, and alter security activity in their environments.

Multiple-Layer Image Encryption Utilizing Fractional-Order Chen Hyperchaotic Map and Cryptographically Secure PRNGs

Image encryption is increasingly becoming an important area of research in information security and network communications as digital images are widely used in various applications and are vulnerable to various types of attacks. In this research work, a color image cryptosystem that is based on multiple layers is proposed. For every layer, an encryption key and an S-box are generated and utilized. These are based on a four-dimensional (4D) dynamical Chen system of a fractional-order, the Mersenne Twister, OpenSLL, Rule 30 Cellular Automata and Intel’s MKL. The sequential application of Shannon’s ideas of diffusion and confusion three times guarantees a total distortion of any input plain image, thereby, resulting in a totally encrypted one. Apart from the excellent and comparable performance to other state-of-the-art algorithms, showcasing resistance to visual, statistical, entropy, differential, known plaintext and brute-force attacks, the proposed image cryptosystem provides an exceptionally superior performance in two aspects: a vast key space of 21658 and an average encryption rate of 3.34 Mbps. Furthermore, the proposed image cryptosystem is shown to successfully pass all the tests of the NIST SP 800 suite.

Methodological foundations of information security research

The lack of an established approach to methodological research in information security determines the further development of scientific knowledge and changes in paradigms and becomes especially relevant considering the aggression of the Russian Federation and the need to strengthen the information security of Ukraine. The purpose of this study was to identify the principles of information security research methodology. To fulfil this purpose, general philosophical methods of investigating legal phenomena were applied, namely the analysis of corresponding legislation and theoretical solutions. This paper, considering the latest theory of state and law and information law of Ukraine, considering the current legislation and regulatory requirements of the European Union, outlined abstract and logical aspects of the methodological foundations of information security research in the context of digital transformation and Russian information expansion. It was noted that addressing the topic of interdisciplinary research is closely related to a fundamentally new historical situation, which reveals the construction of information relations of a new type between social groups, covering philosophy, political science, sociology, economics, and law. This study considered the activity-based, system-structural, system-functional, informational, integration, predictive, methodological, and paradigmatic scientific approaches to the study of legal phenomena. It was indicated that information security is of particular importance for the design of innovative social systems in the context of digital transformation, which requires further scientific research on the methodology of scientific intelligence in information security. The study was aimed at improving the research methods of information security and protection of individuals, society, and the state from destructive informational influence covered by the object of information security.

NT-GNN: Network Traffic Graph for 5G Mobile IoT Android Malware Detection

IoT Android application is the most common implementation system in the mobile ecosystem. As assaults have increased over time, malware attacks will likely happen on 5G mobile IoT Android applications. The huge threat posed by malware to communication systems security has made it one of the main focuses of information security research. Therefore, this paper proposes a new graph neural network model based on a network traffic graph for Android malware detection (NT-GNN). While some current malware detection systems use network traffic data for detection, they ignore the complex structural relationships of network traffic, focusing exclusively on network traffic between pairs of endpoints. Additionally, our suggested network traffic graph neural network model (NT-GNN) considers the graph node and edge aspects, capturing the connection between various traffic flows and individual traffic attributes. We first extract the network traffic graph and then detect it using a novel graph neural network architecture. Finally, we experimented with the proposed NT-GNN model on the well-known Android malware CICAndMal2017 and AAGM datasets and achieved 97% accuracy. The results reflect the sophisticated nature of our methodology. Furthermore, we want to provide a new method for malicious code detection.

The effects of knowledge mechanisms on employees' information security threat construal

AbstractOrganisations implement a variety of knowledge mechanisms such as information security education, training and awareness (SETA) programs and information security policies, to influence employees' secure behaviour. Despite increased efforts to provide information systems (IS) security knowledge to employees, data breaches and other security incidents resulting from insider behaviour continue. Recent IS security research, primarily grounded on assumptions of employees' rational assessment of numerous factors, has yielded inconsistent results. Challenging this paradigm, we model secure behaviour on security knowledge mechanisms, which focuses on the multidimensional nature of security knowledge breadth, depth and finesse to represent the full array of managerial levers. We further draw on construal level theory to conceptualise users' perceptual judgements of security messages. Two studies support our model, with the second building on the first. Study 1, an experiment with 312 participants, focused on validating the treatments. Study 2, a survey with 219 participants, validated the entire model. Results showed that our model has significantly more explanatory and predictive power than the orthodox paradigm. Our results have practical implications for optimising the organisation of knowledge mechanisms by emphasising the personal relevance of threats and defining the factors that lead to secure behaviour. We also contribute to the discourse on information security research and provide a template for integrating theories, thus opening new avenues for future research.

Factors Influencing User’s Intention to Adopt AI-Based Cybersecurity Systems in the UAE

Aim/Purpose: The UAE and other Middle Eastern countries suffer from various cybersecurity vulnerabilities that are widespread and go undetected. Still, many UAE government organizations rely on human-centric approaches to combat the growing cybersecurity threats. These approaches are ineffective due to the rapid increase in the amount of data in cyberspace, hence necessitating the employment of intelligent technologies such as AI cybersecurity systems. In this regard, this study investigates factors influencing users’ intention to adopt AI-based cybersecurity systems in the UAE. Background: Even though UAE is ranked among the top countries in embracing emerging technologies such as digital identity, robotic process automation (RPA), intelligent automation, and blockchain technologies, among others, it has experienced sluggish adoption of AI cybersecurity systems. This selectiveness in adopting technology begs the question of what factors could make the UAE embrace or accept new technologies, including AI-based cybersecurity systems. One of the probable reasons for the slow adoption and use of AI in cybersecurity systems in UAE organizations is the employee’s perception and attitudes towards such intelligent technologies. Methodology: The study utilized a quantitative approach whereby web-based questionnaires were used to collect data from 370 participants working in UAE government organizations considering or intending to adopt AI-based cybersecurity systems. The data was analyzed using the PLS-SEM approach. Contribution: The study is based on the Protection Motivation Theory (PMT) framework, widely used in information security research. However, it extends this model by including two more variables, job insecurity and resistance to change, to enhance its predictive/exploratory power. Thus, this research improves PMT and contributes to the body of knowledge on technology acceptance, especially in intelligent cybersecurity technology. Findings: This paper’s findings provide the basis from which further studies can be conducted while at the same time offering critical insights into the measures that can boost the acceptability and use of cybersecurity systems in the UAE. All the hypotheses were accepted. The relationship between the six constructs (perceived vulnerability (PV), perceived severity (PS), perceived response efficacy (PRE), perceived self-efficacy (PSE), job insecurity (JI), and resistance to change (RC)) and the intention to adopt AI cybersecurity systems in the UAE was found to be statistically significant. This paper’s findings provide the basis from which further studies can be conducted while at the same time offering critical insights into the measures that can boost the acceptability and use of cybersecurity systems in the UAE. Recommendations for Practitioners: All practitioners must be able to take steps and strategies that focus on factors that have a significant impact on increasing usage intentions. PSE and PRE were found to be positively related to the intention to adopt AI-based cybersecurity systems, suggesting the need for practitioners to focus on them. The government can enact legislation that emphasizes the simplicity and awareness of the benefits of cybersecurity systems in organizations. Recommendation for Researchers: Further research is needed to include other variables such as facilitating conditions, AI knowledge, social influence, and effort efficacy as well as other frameworks such as UTAUT, to better explain individuals’ behavioral intentions to use cybersecurity systems in the UAE. Impact on Society: This study can help all stakeholders understand what factors can increase users’ interest in investing in the applications that are embedded with security. As a result, they have an impact on economic recovery following the COVID-19 pandemic. Future Research: Future research is expected to investigate additional factors that can influence individuals’ behavioral intention to use cybersecurity systems such as facilitating conditions, AI knowledge, social influence, effort efficacy, as well other variables from UTAUT. International research across nations is also required to build a larger sample size to examine the behavior of users.

Teorije in modeli v vedenjskih informacijskovarnostnih raziskavah

Behavioral information security is concerned with explaining the role of users in the information security system, drawing on various psychological, organizational, and criminological theories to explain and predict user behavior. Despite numerous systematic literature reviews on the field of information security, there is no comprehensive systematic review of the theories used in behavioral information security research. The purpose of this paper is to investigate which theories are most widely used in research, in which subject areas they are most used, which factors are most frequently included in research according to each set of theories, and which are most frequently statistically significant. Accordingly, we made two studies involving a systematic review of the literature over the past ten years. The findings suggest that the most used theories include the protection motivation theory and the theory of planned behavior. In these two theories, self-efficacy and perceived usefulness of the technology are factors, which are most often statistically significant in predicting self-protective behavior.