Security Literature Research Articles

An information-theoretic analysis of security behavior intentions amongst United States poll workers.

In light of recent events related to national elections in the United States, safeguarding the security and integrity of forthcoming elections stands as a critical national priority. Elections equipment in the United States constitutes critical national infrastructure, and its operation relies on poll workers, who are trusted insiders. However, those insiders may pose risks if they make mistakes with detrimental consequences or act with malice. This research analyzes a large dataset of 2213 responses obtained from a survey of poll workers and potential poll workers in 13 states. The survey includes the Security Behavior Intentions Scale, which has been previously established and validated in the security literature. We use the responses to assess poll workers' intentions of complying with established security-related practices. We develop a novel model using information theory to examine potential weaknesses in security behaviors and identify poll worker security practices to improve to ensure the integrity of our elections. We also recommend action items and countermeasures for states and localities based upon this empirical analysis.

A method and validation for auditing e-Health applications based on reusable software security requirements specifications

ObjectiveThis article deals with the complex process of obtaining security requirements for e-Health applications. It introduces a tailored audit and validation methodology particularly designed for e-Health applications. Additionally, it presents a comprehensive security catalog derived from primary sources such as law, guides, standards, best practices, and a systematic literature review. This catalog is characterized by its continuous improvement, clarity, completeness, consistency, verifiability, modifiability, and traceability. MethodsThe authors reviewed electronic health security literature and gathered primary sources of law, guides, standards, and best practices. They organized the catalog according to the ISO/IEC/IEEE 29148:2018 standard and proposed a methodology to ensure its reusability. Moreover, the authors proposed SEC-AM as an audit method. The applicability of the catalog was validated through the audit method, which was conducted on a prominent medical application, OpenEMR. ResultsThe proposed method and validation for auditing e-Health Applications through the catalog provided a comprehensive framework for developing or evaluating new applications. Through the audit of OpenEMR, several security vulnerabilities were identified, such as DDOs, XSS, JSONi, and CMDi, resulting in a “Secure” classification of OpenEMR with a compliance rate of 66.97%. ConclusionThe study demonstrates the proposed catalog’s feasibility and effectiveness in enhancing health software security. The authors suggest continuous improvement by incorporating new regulations, knowledge from additional sources, and addressing emerging zero-day vulnerabilities. This approach is crucial for providing practical, safe, and quality medical care amidst increasing cyber threats in the healthcare industry.

Effect of COVID-19 pandemic on household food insecurity: evidence from the United Arab Emirates

PurposeThe objective of this study was to measure the prevalence and severity of food insecurity in the United Arab Emirates (UAE) during May 2021 to June 2022, and to assess the impact of the COVID-19 pandemic on household food insecurity.Design/methodology/approachThis study measured the prevalence of household food insecurity in UAE during May 2021 to June 2022 by employing FAO’s Food Insecurity Experience Scale (FIES). The impact of the COVID-19 pandemic on household food security was evaluated by employing a truncated regression model, using survey data from 504 respondents.FindingsAbout 34% of the households were found to be food secure. About 22% of them experienced moderate or severe food insecurity (i.e. have eaten less than they thought should have) whereas almost none have experienced severe food insecurity during the sample period. The truncated model results show that households’ region of residence, livelihood source, education level, income and number of elderlies have a significant association with the probability of experiencing food insecurity. The pandemic-induced unemployment and disruptions in physical access to food positively associated with the probability of experiencing food insecurity.Social implicationsIt is critical to regularly monitor households’ food security status, and design strategies that explicitly consider the food security status of UAE’s significant expat population; most of whom are migrant manual labourers earning low wages, are less job-secured and have poorer access to health care.Originality/valueAlthough several studies assessed the impact of the pandemic on food security in different countries, there is a lack of studies assessing the impact of the pandemic on food security in the import-dependent Gulf Cooperation Council (GCC) countries, whose food security might be severely impacted due to the COVID-19-induced global food supply chain disruptions. Our application of the truncated regression model also contributes to the food security literature.

The Evolution of Safety and Security Literature in Event Management

The evolution of safety and security literature has been notably accompanied with the rise of modern terrorism, above all after the attacks to World Trade Center in 2001. This was the first bloody incident where four commercial airplanes have been weaponized against the most powerful nation in the planet. Like the recent COVID-19 pandemic, 9/11 has changed not only geopolitics but travel behavior as never before. In this grim context, the present conceptual article focuses and examines the evolution of safety???security literature head by Event Management, as fertile ground in Event Management and Tourism studies, because of terrorism. We identify three academic schools that in different stages make a seminal contribution to the studied field.

Pitfalls in Machine Learning for Computer Security

With the growing processing power of computing systems and the increasing availability of massive datasets, machine learning algorithms have led to major breakthroughs in many different areas. This development has influenced computer security, spawning a series of work on learning-based security systems, such as for malware detection, vulnerability discovery, and binary code analysis. Despite great potential, machine learning in security is prone to subtle pitfalls that undermine its performance and render learning-based systems potentially unsuitable for security tasks and practical deployment. In this paper, we look at this problem with critical eyes. First, we identify common pitfalls in the design, implementation, and evaluation of learning-based security systems. We conduct a study of 30 papers from top-tier security conferences within the past 10 years, confirming that these pitfalls are widespread in the current security literature. In an empirical analysis, we further demonstrate how individual pitfalls can lead to unrealistic performance and interpretations, obstructing the understanding of the security problem at hand. As a remedy, we propose actionable recommendations to support researchers in avoiding or mitigating the pitfalls where possible. Furthermore, we identify open problems when applying machine learning in security and provide directions for further research.

Left to Live and Die: Resource Security and the Biopolitics of Land Stockpiling in China

AbstractBeginning in 2007, the Chinese state used liberalising policy and funding to encourage the expansion of large‐scale grain farming. Despite this support, many of the new farms have struggled financially and folded. Drawing on Foucauldian biopolitics and resource security literature, I argue that, with modernised agriculture, the state primarily sought to create not commercial farms, but the redundant farming infrastructure needed to buffer its growing reliance on food imports, abide by global trade regulations, and sustain its urban export manufacturing economy. These balancing efforts harmed commercial farmers: land commodification and policy funding incentivised urban government officials to intervene in rural land‐use planning, but low global market aligned grain prices disincentivised them from considering the place‐particular viability of their plans for producers. This article contributes to critical agrarian change literature by highlighting how modernist states become beholden to rational scientific techniques and sacrifice rural areas for increasingly vulnerable urban areas.

The Impact of Different Basic Trust Types During Critical Situations: The Case of Saudi Arabia and Kuwait

The primary objective of this study is to elucidate the impact of ontological security on states’ foreign policy preferences. The study posits that foreign policy preferences are closely related with their basic trust, a product of the intricate interplay between actor’s agentic capacity and its internal and external environment. This theoretical proposition is subsequently subjected to comparative examination within the contexts of Saudi Arabia and Kuwait. The study contends that despite sharing similar concerns regarding physical and ontological security, these two actors have pursued distinct foreign policy trajectories regarding the Arab uprisings and normalization with Israel that owe to differing types of basic trust. In doing so, the study aims to contribute to the ontological security literature from two perspectives: 1) to refine and elucidate the scope of the basic trust concept by reinterpreting it and highlighting its central role in ontological security analysis, and 2) to contribute to the practical applications of the field by applying the concepts developed in the ontological security literature to case studies of Saudi Arabia and Kuwait.

Information Security Research in the Information Systems Discipline: A Thematic Review and Future Research Directions

Information security continues to grow in importance in all aspects of society and therefore evolves as a prevalent research area. The information systems (IS) discipline offers a unique perspective to move this stream of literature forward. Using a semiautomated thematic analysis approach based on the topic modeling technique, we review a broad range of information security literature to investigate how we may integrate and advance our understanding of information security. Our analysis reveals four major themes, including information security policy (ISP) compliance, motivations and susceptibility, software security decisions, and firm security strategy. We also identify a theme of security in broader contexts, in which studies consider the societal impacts of information security and online hacker behavior. This review contributes to IS literature by 1) synthesizing the broad range of information security research published in the top journals of the field, moving beyond prior reviews focusing on a narrower scope such as individual ISP compliance; 2) identifying major themes and proposing an overarching research framework encompassing these themes and their interconnections, allowing us to envision future research directions; and 3) enumerating a semiautomated topic modeling approach that other researchers can employ.

Factors Influencing Information Security Policy Compliance Behavior in High Education Institutions: Systematic Literature Review

Information security policies and behaviors play a crucial role in organizations, particularly in higher education institutions. These policies outline guidelines and best practices to protect sensitive data, safeguard privacy, and prevent unauthorized access or misuse of information. In higher education institutions, they help secure research findings, intellectual property, and student records. By fostering a culture of security awareness and encouraging responsible behavior, organizations can safeguard their reputation, instill trust, and meet legal and regulatory requirements. This literature review has revealed challenges and highlighted the current trends of information security policy compliance, as well as the theories used for information security compliance from 2013 to 2023. Out of 50 research papers published on the topic of information security policy compliance, three influencing factors were identified through filtration: behavioral intention, awareness and culture, and human with organizational management. The findings show that there is a lack of information security policies in the higher education sector. This review contributes to the information security literature by providing a fully organized systematic review of conducted research in the last decade.

Mnemonic Encounters: The Construction and Persistence of International “History Wars” and the Case of Japan–South Korea Relations

Abstract Why does contentious history play such an outsized role in some international relationships? Why do these “history wars” endure, overriding incentives to reconcile? Despite their demonstrable importance, history wars have generally been neglected by conventional conflict and security literature; and, while scholarship concerning the international politics of memory has expanded significantly, overarching frameworks addressing these questions remain underdeveloped. In this article, drawing on theories of memory politics, relational identity and ontological security, I analyze history wars as mnemonic encounters: sites at which national identities are constructed in relation to one another through remembering and forgetting shared history. Within such encounters, history wars may arise and persist where each side's mnemonic practices involve conflicting, negative representations of the other, and such representations constitute an important element of their national identities. This occurs because the rearticulation of conflictual representations constitutes both a means by which the national community is reproduced and a defense mechanism against the ontological threat posed by the other side's counter-constructions. Illustrating this framework, I explicate the construction and persistence of Japan and South Korea's “history problem,” drawing on extensive fieldwork and a discourse analysis of over one thousand original-language texts from both countries across politics, media and culture.

Volatile threshold switching devices for hardware security primitives: Exploiting intrinsic variability as an entropy source

In the age of the Internet of Things, the proliferation of edge devices has resulted in a significant increase in personal information that is susceptible to theft and counterfeiting at various stages of data communication. As a result, substantial attention has been focused on hardware (HW) security elements, such as the true random number generator and physical unclonable function. With the recent surge in research and development of emerging memristors, which exploit the inherent variability of these devices, there has been a notable increase in studies on HW security. Particularly, volatile threshold switch (TS) devices, which exhibit insulator/metal characteristics below/above a certain threshold voltage, show great promise as security devices due to their lower power consumption and higher cycling endurance compared to nonvolatile memory devices. Despite the promising attributes and increasing demand for TS devices for HW security, there remains a lack of a comprehensive overview covering various TS devices and their potential contributions to HW privacy. To address this gap, this review provides an encompassing analysis of different types of TS devices and their performance in HW security literature, providing insight into current limitations and the future prospects of HW security primitives based on TS devices.

Fostering security-related citizenship through the employee-supervisor relationship: An examination of supervisor security embodiment

Organizational information security performance is increasingly dependent on employees’ security-related citizenship behaviors that stretch beyond the scope of formal organizational prescription and control. Unfortunately, cultivating enactment of these valued behaviors has proven challenging for many companies. The literature has recognized workplace relationships as important determinants of behavioral security outcomes and extra-role security behaviors (ERBs) in particular. Taken further, an employee's relationship with the immediate supervisor is recognized as one of the most influential relational factors shaping a variety of workplace behaviors, including those related to security. Consistent with these notions, scholars have called for making the employee-supervisor relationship a more central component of behavioral security research and practice. Currently however, beyond recognition of this relationship's importance, the knowledge base is unclear about how it shapes ERB enactment. Because employees view supervisors as both organizational agents and as individuals in their own rights, this relationship has the potential to drive productive or counterproductive security behaviors, depending on how aligned the supervisor's security values are with those of the organization. Yet, the security literature has given surprisingly little consideration to the notion that employees can differ in the extent to which they perceive supervisors as embodying organizational information security values. Responding to this gap, the current study examines how employee-supervisor relations and perceived security-related value alignment between supervisors and the broader organization shape employees’ commitment to organizational information security and ultimately, ERB enactment. Grounded in the social identity theory of leadership (SITL), a research model is developed that positions high-quality employee-supervisor exchange as a direct antecedent of affective commitment to organizational information security, which then serves as a central intrinsic motivational mechanism driving ERB enactment. Further, rooted in SITL's principles on leader prototypicality and supervisor organizational embodiment, employee-perceived value alignment between the immediate supervisor and the organization as a whole—referred to here as supervisor security embodiment (SSE)—is introduced as a critical boundary condition influencing the extent to which employee-supervisor relations drive commitment. Results from model testing empirically demonstrate the value of SSE in explicating how this important relationship shapes workplace ERB enactment, through its influence on affective commitment to organizational information security performance.

Fostering information security compliance as organizational citizenship behavior

Information security is heightened when employees develop a strong sense of information stewardship for information assets, a form of organizational citizenship behavior, suggesting that compliance should be perceived as a symbiotic relationship between organizations and employees. We conducted a field study by collecting multi-source, match-paired survey data from 487 employees paired with their supervisor's ratings. Results showed that affective commitment, job satisfaction, perceived organizational support, and social influence were positively related to compliance behavior. This research contributes to the information security literature by showing that employees with strong organizational bond are more likely to exhibit higher levels of security policy compliance.

A comprehensive survey of digital twins: Applications, technologies and security challenges

Alongside advancements in Artificial Intelligence (AI), significant progress has been made in big data processing, edge/cloud computing, and ubiquitous computing in the past two decades. These advancements catalyzed the development and adoption of Digital Twins (DT) across various domains, serving as virtual replicas of Physical Objects (POs). DTs provide advanced visualization and simulation capabilities, enabling effective estimation, optimization, and forecasting of PO's behaviors. However, the widespread adoption of DTs has introduced various security threats, vulnerabilities, and attacks. Despite ongoing research in DT applications and security, there is a lack of systematic review of the DT security literature across domains and architectural layers. This study fills this gap by systematically reviewing DT research, focusing on three interrelated aspects: DT applications, architectural layers, and security. We explore DT's architectural layers, functional requirements, application, and creation software to identify potential threats, attacks, and vulnerabilities specific to DT layers and application domains. We then systematize our findings under a unified security framework and pinpoint countermeasures against identified security challenges. Furthermore, our study explores DT's role in mitigating existing cyber threats, and we conclude our work by identifying open challenges and potential research directions.

Machine Learning (In) Security: A Stream of Problems

Machine Learning (ML) has been widely applied to cybersecurity and is considered state-of-the-art for solving many of the open issues in that field. However, it is very difficult to evaluate how good the produced solutions are, since the challenges faced in security may not appear in other areas. One of these challenges is the concept drift, which increases the existing arms race between attackers and defenders: malicious actors can always create novel threats to overcome the defense solutions, which may not consider them in some approaches. Due to this, it is essential to know how to properly build and evaluate an ML-based security solution. In this article, we identify, detail, and discuss the main challenges in the correct application of ML techniques to cybersecurity data. We evaluate how concept drift, evolution, delayed labels, and adversarial ML impact the existing solutions. Moreover, we address how issues related to data collection affect the quality of the results presented in the security literature, showing that new strategies are needed to improve current solutions. Finally, we present how existing solutions may fail under certain circumstances and propose mitigations to them, presenting a novel checklist to help the development of future ML solutions for cybersecurity.

Credibility in Crises: How Patrons Reassure Their Allies

Abstracts How do citizens of US allies assess different reassurance strategies? This article investigates the effects of US reassurance policies on public opinion in allied states. We design and conduct a survey experiment in five Central–Eastern European states—Estonia, Latvia, Lithuania, Poland, and Romania—in March 2022. Set against the backdrop of Russia’s invasion of Ukraine, this experiment asked respondents to evaluate four types of reassurance strategies, each a critical tool in US crisis response policy: military deployments, diplomatic summitry, economic sanctions, and public reaffirmations of security guarantees. The international security literature typically values capabilities for their deterrence and reassurance benefits, while largely dismissing public reaffirmations as “cheap talk” and economic sanctions as being ineffective. Yet we find preferences for the use of economic sanctions and public statements as reassurance strategies during crises, in part because these approaches help states manage escalation risks.

A Psychoanalytic Approach to Turkish Foreign Policy: Crisis, Disorder, and Disorientation

ABSTRACT What explains Turkey’s current foreign policy disorientation, causing the country to swing from one position to another in a relatively short period of time? We argue that rational arguments do not provide comprehensive explanations of the fluctuations in Turkish foreign policy. By utilising a psychoanalytic approach, this study argues that the relentless radical developments that unfolded at home and abroad in the past decade paralysed the Turkish leadership, disrupting their sense of order in international politics while detaching them from important geopolitical realities. Under this neurotic condition, Turkey’s leadership has engaged in a constant seek for recognition as a key regional player irrespective of how controversial these efforts may be. In making sense of this case, this study builds on the ontological security literature in International Relations and contributes to the existing debates on foreign policy crises by integrating a Lacanian notion of jouissance to the ontological security framework. It shows that the jouissance approach offers a productive lens which captures how an ontologically insecure state like Turkey follows disorderly conducts in international politics and gains satisfaction from it as a way to reassure its ruptured sense of actorness at times of multiple crises.

She’s worth IT: challenges for female CIOs in ensuring IT security compliance

PurposeIT security compliance is critical to the organization’s success, and such compliance depends largely on IT leadership. Considering the prevalence of unconscious gender biases and stereotyping at the workplace and growing female leadership in IT, the authors examine how the internalization of stereotype beliefs, in the form of the employee’s gender, impacts the relationships between leadership characteristics and IT security compliance intentions.Design/methodology/approachA controlled experiment using eight different vignettes manipulating Chief Information Officer (CIO) gender (male/female), Information Technology (IT) expertise (low/high) and leadership style (transactional/transformational) was designed in Qualtrics. Data were gathered from MTurk workers from all over the US.FindingsThe findings suggest that both CIOs' and employees' gender play an important role in how IT leadership characteristics – perceived expertise and leadership style – influence the employees' intentions and reactance to comply with CIO security recommendations.Research limitations/implicationsThis study's findings enrich the security literature by examining the role of leadership styles on reactance and compliance intentions. They also provide important theoretical implications based on gender stereotype theory alone: First, the glass ceiling effects can be witnessed in how men and women employees demonstrate prejudice against women CIO leaders through their reliance on perceived quadratic CIO IT expertise in forming compliance intentions. Secondly, this study's findings related to gender role internalization show men and women have a prejudice against gender-incongruent roles wherein women employees are least resistive to transactional male CIOs, and men employees are less inclined to comply with transactional female CIOs confirm the findings related to gender internationalization from Hentschel et al. (2019).Practical implicationsThis study highlights the significance of organizations and individuals actively promoting gender equality and fostering environments that recognize women's achievements. It also underscores the importance of educating men and women about the societal implications of stereotyping gender roles that go beyond the organizational setting. This research demonstrates that a continued effort is required to eradicate biases stemming from gender stereotypes and foster social inclusion. Such efforts can positively influence how upcoming IT leaders and employees internalize gender-related factors when shaping their identities.Social implicationsThis study shows that more work needs to be done to eliminate gender stereotype biases and promote social inclusion to positively impact how future IT leaders and employees shape their identities through internalization.Originality/valueThis study redefines the concept of “sticky floors” to explain how subordinates can hinder and undermine female leaders, thereby contributing to the glass ceiling effect. In addition, the study elucidates how gender roles shape employees' responses to different leadership styles through gender stereotyping and internalization.

Interdependent security games in the Stackelberg style: how first-mover advantage impacts free riding and security (under-)investment

Abstract Network games are commonly used to capture the strategic interactions among interconnected agents in simultaneous moves. The agents’ actions in a Nash equilibrium must take into account the mutual dependencies connecting them, which is typically obtained by solving a set of fixed point equations. Stackelberg games, on the other hand, model the sequential moves between agents that are categorized as leaders and followers. The corresponding solution concept, the subgame perfect equilibrium, is typically obtained using backward induction. Both game forms enjoy very wide use in the (cyber)security literature, the network game often as a template to study security investment and externality—also referred to as the interdependent security games—and the Stackelberg game as a formalism to model a variety of attacker–defender scenarios. In this study, we examine a model that combines both types of strategic reasoning: the interdependency as well as sequential moves. Specifically, we consider a scenario with a network of interconnected first movers (firms or defenders, whose security efforts and practices collectively determine the security posture of the eco-system) and one or more second movers, the attacker(s), who determine how much effort to exert on attacking the many potential targets. This gives rise to an equilibrium concept that embodies both types of equilibria mentioned above. We will examine how its existence and uniqueness conditions differ from that for a standard network game. Of particular interest are comparisons between the two game forms in terms of effort exerted by the defender(s) and the attacker(s), respectively, and the free-riding behavior among the defenders.

An Investigation of the Factors That Influence Information Security Culture in Government Organizations in Bhutan

ABSTRACT Organizations make large investments to secure data and networks, but information security breaches as a result of insiders continue to rise. One possible contributor to this is poor information security culture. This study investigated the key factors that contribute to effective information security culture in government organizations in Bhutan and how information security culture influences employee security behavior. A research model was developed for the study based on an analysis of the information security literature. Data was collected using an online survey of 181 government employees. Senior management support, information security policy, training and awareness campaigns, interpersonal trust, and job- versus employee-oriented organizational culture were all found to influence information security culture, and information security culture contributed to information security behavior. The study extends understanding of the roles of trust and different dimensions of organizational culture in improving information security culture and behavior. The findings should help government policy makers and information security practitioners when developing information security strategies and programs.