Security Management Practices Research Articles

CyberFusion Protocols: Strategic Integration of Enterprise Risk Management, ISO 27001, and Mobile Forensics for Advanced Digital Security in the Modern Business Ecosystem

This research paper explores the integration of Enterprise Risk Management (ERM), the ISO 27001 standard, and mobile forensics methodologies as a comprehensive framework for enhancing digital security measures within modern business ecosystems. Employing a quantitative research design, this paper utilized a survey methodology, gathering data from 372 professionals across various sectors including risk management, IT/security, and forensic analysis. The analysis was conducted using Partial Least Squares Structural Equation Modeling (PLS-SEM) to test the research hypotheses and assess the impact of the integrated approach on organizational digital security capabilities. The findings reveal a significant positive effect of integrating ERM, ISO 27001, and mobile forensics on an organization’s ability to manage digital risks effectively. Specifically, the integrated approach was found to enhance strategic digital security management, improve the identification, assessment, and mitigation of digital risks, strengthen information security management practices, and elevate the effectiveness and efficiency of digital crime investigation processes. These outcomes underscore the value of a cohesive strategy that leverages the strengths of ERM, ISO 27001, and mobile forensics in addressing the complex and interconnected digital threat landscape. Based on the results, the study recommends adopting a holistic security framework, investing in continuous professional development, leveraging technological advancements for proactive security management, and fostering a culture of security and collaboration. Such measures are crucial for organizations aiming to enhance their resilience against cyber threats and protect their digital assets in the face of sophisticated cyber-attacks. This research contributes to the field of cybersecurity by providing empirical evidence on the benefits of an integrated approach to digital security, offering practical guidelines for organizations seeking to improve their digital security measures, and highlighting the need for continuous adaptation and collaboration in the fight against cyber threats.

Beyond Conventional Threat Defense: Implementing Advanced Threat Modeling Techniques, Risk Modeling Frameworks and Contingency Planning in the Healthcare Sector for Enhanced Data Security

This research study explores the integration of advanced threat and risk modeling with scenario and contingency planning to enhance security and resilience within healthcare organizations. Given the escalating complexity and frequency of cyber threats targeting the healthcare sector, the study assesses the efficacy of a synergistic cybersecurity approach. Utilizing a quantitative research methodology, data were collected through a survey administered to 452 healthcare practitioners, focusing on their perceptions and experiences with cybersecurity threats, risk modeling techniques, and the effectiveness of scenario and contingency planning. The survey incorporated a structured questionnaire utilizing Likert scale closed-ended questions, analyzed using Partial Least Squares Structural Equation Modeling (PLS-SEM) to test the proposed four hypotheses related to the impact of advanced threat and risk modeling and scenario and contingency planning on the cybersecurity posture and operational resilience of healthcare organizations. Results indicated a significant positive relationship between advanced threat modeling and scenario planning with the cybersecurity posture of healthcare organizations, which, in turn, notably enhances organizational resilience. Specifically, the study found that integrating advanced threat and risk modeling with scenario and contingency planning significantly improves the ability of healthcare organizations to identify, assess, and mitigate cyber threats effectively. Furthermore, the findings suggest that such integration contributes to more informed decision-making, improved information security management practices, and more effective and efficient digital crime investigation processes. The research study concludes that a comprehensive approach integrating advanced threat and risk modeling with scenario and contingency planning significantly enhances healthcare organizations' cybersecurity posture and operational resilience. The study recommends adopting an integrated cybersecurity strategy, continuous cybersecurity education for all organizational members,regular cybersecurity assessments, and fostering collaboration for enhanced cybersecurity intelligence.

Cybersecurity threats in the age of IoT: A review of protective measures

The Internet of Things (IoT) heralds a new era of connectivity, transforming the way devices interact and share information. With this transformative potential comes a concomitant rise in cybersecurity threats that pose significant challenges to the integrity of the IoT ecosystem. This paper undertakes a comprehensive examination of cybersecurity threats in the age of IoT, categorizing them into data breaches, malware attacks, physical manipulation, and more. Counteracting these threats necessitates a multifaceted approach encompassing device-level security, network-level measures, and effective management practices. Protective measures discussed include secure boot processes, encryption protocols, and the implementation of intrusion detection systems. However, persistent challenges, such as device diversity and resource constraints, underscore the need for ongoing research and development. Emerging technologies like blockchain, edge computing, and artificial intelligence offer promising avenues to bolster IoT security. In the pursuit of a secure IoT future, this paper emphasizes the critical importance of collaboration and collective efforts. The key findings underscore the centrality of robust security measures in the IoT landscape. The call to action resonates throughout the paper, urging stakeholders to unite in addressing challenges, embracing emerging technologies, and ensuring the responsible growth of IoT. Together, through shared knowledge and collaborative endeavors, we can forge a secure foundation for the continued expansion of IoT technologies

Understanding employees' responses to information security management practices: a person-environment fit perspective

ABSTRACT This study tests the person–environment fit theory in information security (ISec), which describes situations in which the extent of ISec management is linked to positive or negative employee outcomes. We hypothesise that employees appraise their organisational ISec depending on the mismatch or match perception between their needs and organisational supplies. We define a mismatch as ISec misfit and a match as ISec fit and develop hypotheses framing the relationship between ISec fit (vs. misfit), employees’ emotional reactions (anxiety and attentiveness), and, subsequently, ISec behaviours (ISec in-role, extra-role, and violation behaviours). We conduct quadratic polynomial regressions and apply response surface methodology to test our hypotheses and obtain two findings. First, ISec management are proactively needed by employees instead of prior enforcement perspective. The results show that ISec management practices are appraised negatively when they either exceed or fail to meet employees’ preferences. Second, in expounding on a theoretical construction and empirical test of ISec fit and misfit and their relationships with employee outcomes, we find that attentiveness is greater with ISec fit, whereas anxiety is higher and attentiveness is lesser with ISec misfit. We also find that emotion mediates employees’ ISec behaviours, while only anxiety does not mediate extra-role behaviour.

Perceptions of School Administrators and Students on Security and Safety at Selected Tertiary Institutions in Ghana

The goal of the study is to review the perceptions of school administrators and students on security and safety at selected tertiary institutions in Bono Region, Ghana. The study was conducted at two public tertiary in Ghana's Bono Region. The study used a concurrent mixed-methods approach to collect both quantitative data through Likert scales and qualitative data through open questions within a single questionnaire and some interviews with school administrators. A sample size of seven hundred and fifty-eight (758), including students and administrators was used for this study. The survey revealed that students believe there is good security and safety on the two campuses. Additionally, students say they feel comfortable on campus during the day and night. They also say they feel safe overall. In addition, students do not carry something on them for protection when walking on campus and students are ready to report crime/s against them to the university security. It, however, came out from the study that students avoid certain places on campus because of fear of their security and safety. The study revealed proactive security and safety management practices in the two universities. It came out that the universities provide annual security and safety reports detailing any security and safety-related events with crime prevention details. The study further recommends that University management should prioritize efforts to enhance campus security and safety by employing more strong security personnel and deploying modern security gadgets/items, particularly in locations that students perceive as unsafe.

The Institutionalisation of Information Security Management Practices in selected Organisations in Uganda

The study aimed at examining the extent to which information security management practices were institutionalised in corporate organisations. Evidence shows that failure by organisations to entrench the information security management practices (ISMPs) into organisations’ structures opens the gateway for attacks, threat actors and information breaches to cause harm to information assets with ease. The study explored the phenomenon in its social setting hence the adoption of descriptive research design as the research methodology. The institutional theory was adopted as a new dimension in examining information security management in organisations. This theory suggests that control gears like coercive, normative, mimetic and management commitment could be used to effectively entrench security guidelines in organisations. Methodical scrutiny of the institutionalisation process: development, implementation and maintenance, and evaluation were also carried out. The researcher relied on human experience to make sense of the institutionalised processes. Extant literature was reviewed, and survey questionnaires were developed based on the eleven ISMPs and administered to purposively selected respondents from the two organisations. The eleven ISMPs covered include state of information security policy, asset management, secure information sharing, supply chain security, access management, network security controls, portable and removable media security, remote access security, protective monitoring of information systems, implementation of information security back-ups, and security accreditation by professional bodies. Data analysis was done using SPSS. Findings indicate that organisations have not fully incorporated all the eleven ISMPs covered as best practices and standards. Based on the results from the field, answers to the research questions were partly realised. Recommendations like the implementation of ISMPs to check deficiencies identified, customisation of security guidelines to protect information assets and institutionalisation of security practices at all levels were suggested. Overall, the study was a positive step towards the institutionalisation process of ISMPs in organisations

Conserving a sustainable urban environment through energy security and project management practices

Construction has been highlighted as one sector that could reduce its effect on the environment by implementing more sustainable methodologies. However, there are many different challenges preventing sustainable construction practice, and despite existing research providing advice for carbon emission reduction, these practices are being somewhat neglected. The purpose of this research is to investigate the challenges surrounding sustainable construction practice and the current knowledge on energy security and project management practices that can aid climate change mitigation. The design methodology of this study involves a thorough literature review of existing knowledge on the subject matter followed by primary research. The survey conducted collected quantitative data of 160 valid responses via an online closed ended questionnaire using snowball sampling methods from the construction and engineering professionals working in the UK construction industry. The study found that most participants agree with the encouragement of sustainable construction practices, but are generally unsure about what they can do. Factors such as government involvement and organisation culture have some significance but will rely on further research in order to assess specific influencing variables. The study contributes to existing research on factors surrounding project management and identifies and plethora of areas of improvement, that can be formed into a holistic approach to the current construction industry practice.

Practice of Industrial Internet Security Management in Chemical Enterprises

Practice of Industrial Internet Security Management in Chemical Enterprises

A conceptual framework for assessing information security management practices in selected universities in Uganda

The purpose of this paper is to present a conceptual framework for assessing managerial level information security practices, governance, and activities in selected university institutions in Uganda. Extant literature was drawn from existing information security management practices in different organizations. The proposed conceptual framework consisted of four manageable areas, namely, information security governance practices, information security practices, personnel management practices, and physical security practices. These areas are further subdivided into 25 categories that provide a formal checklist for assessing existing information security management practices in university institutions in Uganda.

Managing organization information security systems, conflicts, and integrity for sustainable Africa transformation

The ubiquitous reliance on technological innovations by enterprise organizations for electronic file-sharing networks across all business transactions has further exposed organization system enterprises to security threats and risks. Globally, a positive relationship exists between employees’ adherence to security policy enforcement, enterprise definitions, and effective management of organization security systems. Security measures required to handle threats to the organizations’ data: confidentiality, integrity, and availability are becoming complex, dynamic, psychological, but largely undeveloped, outdated, and non-sustainable in Africa despite the huge cyber-security innovations. This study highlights the gaps created by poor employees’ adherence to security policies and enforcement in managing organization information security systems, conflicts, and integrity, and strategies to close them. The authors explored a narrative review of prior research that revealed significant information on strategies for managing organization information security systems. Peer-reviewed articles within the last five years were extracted from electronic databases, using relevant search keywords Results show that organizational security issues can be prevented or mitigated through effective adherence to security policies, control over policy enforcement, and enterprise definitions. Findings from this study may extend proper security management practices and prevention strategies for Africa’s transformation.

STUDY OF ORGANIZATIONAL AND INNOVATIVE FUNDAMENTALS ECONOMIC SECURITY OF ENTERPRISES

The article is concerned with studying the theoretical and practical foundations of the organisational and innovative aspect of economic security enterprise, which defines the ways and means of formation, distribution, coordination and control of resources, functions, processes, structures, culture, motivation, communication and other elements of the organisational system of enterprise with a view to ensuring its innovative activity, adaptability, flexibility and openness. The article defines the essence, structure, functions, principles, methods and models of the organisational and innovative aspect of economic security of an enterprise. Particular attention is paid to the role of innovation as an important tool for improving the economic security the enterprise, as well formation of an organisational culture aimed at innovative development. The article contains the results of analysis of current state and trends in the development of the theory and practice of economic security management, as well as examples of application of the proposed methods and tools in practice.

A Hidden Attack Sequences Detection Method Based on Dynamic Reward Deep Deterministic Policy Gradient

Attacker identification from network traffic is a common practice of cyberspace security management. However, network administrators cannot cover all security equipment due to the cyberspace management cost constraints, giving attackers the chance to escape from the surveillance of network security administrators by legitimate actions and to perform the attack in both physical domain and digital domain. Therefore, we proposed a hidden attack sequence detection method based on reinforcement learning to deal with the challenge through modeling the network administrators as an intelligent agent that learns their action policy from the interaction with the cyberspace environment. Following Deep Deterministic Policy Gradient (DDPG), the intelligent agent can not only discover the hidden attackers hiding in the legitimate action sequences but also reduce the cyberspace management cost. Furthermore, a dynamic reward DDPG method was proposed to improve defense performance, which set dynamic reward depending on the hidden attack sequences steps and agent’s check steps, compared to the fixed reward in common methods. Meanwhile, the method was verified in a simulated experimental cyberspace environment. Finally, the experimental results demonstrate that there are hidden attack sequences in cyberspace, and the proposed method can discover the hidden attack sequences. The dynamic reward DDPG shows superior performance in detecting hidden attackers, with a detection rate of 97.46%, which can improve the ability to discover hidden attackers and reduce the 6% cyberspace management cost compared to DDPG.

Editorial

Welcome to the ninth issue of the Journal of Construction Business and Management. Globally, poor project performance has become an area of concern to researchers, construction practitioners and policymakers. The lack of understanding of the factors causing poor project performance is responsible for developing appropriate management strategies to address the problem. Achieving the successful completion of construction projects remain a pressing goal. Several approaches have emerged proposed to construct quicker, greener, sustainable, affordable buildings and infrastructure with better quality and low environmental impact. However, the problem of poor project performance persists. 
 This journal edition presents scholarly discussions on theoretical and empirical challenges confronting practitioners and enterprises in the construction industry. The intention is to understand the practice and theoretical lens used in its explanation or interpretation. This journal edition covers the following subjects: quality management practices, environmental waste management practices, unethical practices, positive organisational behaviour, occupational eustress, theft and vandalism. The issue contains five articles written by twelve scholars based in Malawi, Nigeria, South Africa and the United Kingdom.
 The first article by Odiba, Demain and Ruikar (2021) develops a contextual model for improving the culture of quality that can facilitate effective quality management practices in construction organisations. The designed model is a quality system that construction organisations can use in identifying some typical barriers hindering effective Quality Management System (QMS) implementation; assisting in the development of cultural values that can drive effective QMS implementation; undertaking effective QMS practices as they relate to construction and recognising the potential results and longer-term benefits obtainable from implementing effective QMS. The second article by Oladiran, Bayewun and Aderogba (2021) investigates the environmental waste management practices (EWMPs) of contractors on construction sites. Construction wastes pose challenges to contractors and clients on construction projects globally, with significant consequences on the environment. Contractors were aware of material storage strategies, ordering the exact amount of materials and checking deliveries properly. Based on these findings, the study recommends that construction firms, governments, and institutions involved in regulating the sector should sponsor the training of professionals on the various EWMPs towards improving their awareness.
 The causes of quackery in quantity surveying practice are examined in the paper by Dada and Bamigboye (2021). The article highlights that the reasons for quackery in quantity surveying practice are multidimensional and can be narrowed down to unethical practices, client engagement, job security, regulatory and issues related to corruption. The fourth paper by Ogwueleka and Ikediashi (2021) assesses the effects of positive organisational behaviour (POB) constructs on eustress amongst construction employees based on the rationale that organisational behaviour has been characterised by negativity than positively. The study focuses on identifying the areas that can propel positive mental health among construction employees to improve their performances and increase work productivity. Five constructs of POB models and five parameters of eustress that have a significant influence on eustress were identified and outlined in the paper.
 The phenomenon of theft and vandalism on construction job sites in Sub-Saharan Africa has not been fully explored to guarantee the implementation of evidence-based security management practices to minimise losses and improve projects' profitability margins. The fifth paper by Simukonda and Kamwela (2021) investigated the management of theft and vandalism by large contractors to identify implementation issues that need improvement. The study found that the key security management practices used on construction sites include inventorying construction materials, tools and equipment, termination of employment for offenders, and reporting theft and vandalism to enforcement agencies.
 I thank all authors who submitted papers for consideration. I also value the contributions and unrelenting efforts of the JCBM editorial board members and panel of reviewers in ensuring that manuscripts are of high quality and keeping the journal on the path to attaining the expected standard and quality. Finally, these articles should help inspire new ethical, waste and security management practices. As ever, if there is something you would like to share with us, compliments, criticisms, feedback and suggestions on how to improve the quality of the journal, don't hesitate to get in touch.
 Abimbola Windapo PhD
 Editor-in-chief

The Management of Theft and Vandalism on Construction Jobsites in the Southern Region of Malawi

The phenomenon of theft and vandalism on construction job sites in Sub-Saharan Africa (SSA) has not been fully explored to guarantee the implementation of evidence-based security management practices (SMPs) to minimise losses and improve projects' profitability margins. This study investigated the management of theft and vandalism by large contractors in the Southern Region of Malawi to identify implementation issues that need improvement. A quantitative approach using an empirical survey-based questionnaire was adopted. 44 SMPs identified from the literature review were tested by data collected from a sample survey of 40 large contractors in the Southern Region of Malawi. The descriptive statistical method of mean score ranking was used to analyse the data through IBM Statistical Package of Social Sciences (SPSS) version 20.0. Among the five-point Likert scale agreement measurements used, 11 SMPs were found to be "always used", 12 SMPs "often used", 15 SMPs "sometimes used", and six SMPs "rarely used". Overall, the top three highly ranked SMPs (in descending order) were inventorying construction materials, tools and equipment, termination of employment for offenders, and reporting theft and vandalism to enforcement agencies. Contrariwise, the use of closed-circuit television (CCTV), alarm systems and access control systems (ACS) was the least ranked SMPs. The contractors’ management improvements for theft and vandalism would need to focus on implementing proactive anti-theft and anti-vandalism SMPs whose choice should be informed by comprehensive Jobsite security risk assessment. Dissemination of the results may help contractors understand their security management strategies and implement practical solutions for curbing theft and vandalism on job sites to minimise its endemic effect on contractors’ financial performance. Keywords: Theft and Vandalism; Security management practices; Likert scale; Malawi.

Cybersecurity and the new firm: surviving online threats

PurposeNascent firms and startups are often subject to challenges that their more mature counterparts can avoid. While cybersecurity is an issue that all firms contend with, it is especially challenging for new entrepreneurial ventures who lack the resources and capabilities of established firms. The purpose of this paper is to seek to delve deeper into the cybersecurity and risk management needs of small firms and startups.Design/methodology/approachExtant literature and available tools are explored to develop a usable framework applicable to small firms and new entrepreneurial ventures.FindingsThe liabilities of newness and smallness make entrepreneurial ventures a unique context in which to study the significance of cybersecurity and data privacy risk management. The authors offer an overview of issues and potential solutions relevant to entrepreneurial ventures.Research limitations/implicationsWhile offering practical insights, the work is a theoretical framework. The framework will enable researchers to develop more nuanced theory when it comes to cybersecurity and data privacy risk management.Practical implicationsThe framework illustrates four distinct contexts for cybersecurity and risk management when it comes to the needs of small firms and startups. Adoption levels are explained, and small business operators and entrepreneurs can thus use the framework to determine the most appropriate approach for their enterprise.Originality/valueThe authors develop a framework illustrating adoption of different security and risk management practices by entrepreneurial ventures based on their specific needs and context. The authors thus offer practical solutions for startups and nascent firms regarding cybersecurity and privacy management.

Information security management frameworks and strategies in higher education institutions: a systematic review

Effective information security management (ISM) practices to protect the information assets of organizations from security intrusions and attacks is imperative. In that sense, a systematic literature review of academic articles focused on ISM in higher education institutions (HEIs) is conducted. For this purpose, an empirical study was performed. Studies carried out from 2012 onward reporting results from HEIs data that perform the ISM through various means, such as a set of framework functions, implementation phases, infrastructure services, and securities to their assets, have been explored. The articles found were then analyzed following a methodological procedure consisting of a systematic mapping study with their research questions, inclusion and exclusion criteria, selection of digital libraries, and analysis of the respective search strings. A set of competencies, resources, directives, and strategies that contribute to designing and to developing an ISM framework (ISMF) for HEIs is identified based on standards such as ISO 27000, COBIT, ITIL, NIST, and EDUCAUSE. This study introduces a strategic reference that guides HEIs on the development of an ISMF and provides recommendations that should be considered for its implementation in an era of ever-evolving security threats.

Understanding Human Aspects for an Effective Information Security Management Implementation

In today's world, information security is a trending as well as a crucial topic for both individuals and organisations. Cyber attacks cause financial loss for businesses with data breaches and production loss. Data breaches can result in loss of reputation, reduced customer loyalty, and fines. Also due to cyber attacks, business continuity is affected so that organisations cannot provide continuous production. Therefore, organisations should reduce cyber risks by managing their information security. For this purpose, they may use ISO/IEC 27001 information security management standard. ISO/IEC 27001:2013 includes 114 controls that are in both technical and organisational level. However, in the practice of security management, individuals' information security behaviour could be underestimated. Herein, technology alone cannot guarantee the safety of information assets in organisations, thereby a range of human aspects should be taken into consideration. In this study, the importance of security behaviour with respect to ISO/IEC 27001 information security management implementation is presented. The present study extensively analyses the data collected from a survey of 630 people. The results of reliability measures and confirmatory factor analysis support the scale of the study.

The impact of information security management practices on organisational agility

PurposeThis study aims to determine the extent to which information security management (ISM) practices impact the organisational agility by examining the relationship between both concepts.Design/methodology/approachA quantitative method research design has been used in this study. This study was conducted throughout Malaysia with a total of 250 valid questionnaires obtained from managers and executives from the Multimedia Super Corridor (MSC)-status companies. Structural equation modelling (SEM) using partial least square was used to analyse the data and to test all nine hypotheses developed in this study.FindingsFindings from this study indicate that operational agility (OA) is significantly related to ISM practices in MSC-status companies. The validation of the structural model of nine hypotheses developed for this study has demonstrated satisfactory results, exhibited six significant direct relationships and three insignificant relationships.Research limitations/implicationsThis study has addressed the needs for a comprehensive, coherent and empirically tested ISM practices and organisational agility framework. The current theoretical framework used in this study emphasised on the ISM–organisational agility dimensions that are predominantly important to ascertain high level of ISM practices and perceived agility level among the information technology (IT) business companies in Malaysia. With the application of SEM for powerful analysis, the empirical-based framework established in this study was validated by the empirical findings, thus contributing significantly to the field of information security (InfoSec).Originality/valueThis study has filled the research gap between different constructs of ISM practices and OA. The model put forth in this study contributes in several ways to the InfoSec research community. The recognition of InfoSec practices that could facilitate organisational agility in the IT industry in Malaysia is vital and contributes to more value creation for the organisations.

‘Who Can Sing the Song of MSF?’

This article explores the everyday practice of security management and negotiations for access conducted by Médecins Sans Frontières (MSF) in North Kivu, in the Democratic Republic of the Congo (DRC). Based on ethnographic fieldwork, interviews and archival exploration, it examines the experience of MSF Congolese employees, who navigate a complex politics of humanitarian fixing and brokerage. Their role in MSF is simultaneously defined and circumscribed by their political and social situation. MSF’s security management relies on local staff’s interpersonal networks and on their ability to interpret and translate. However, local staff find themselves at risk, or perceived as a ‘risk’: exposed to external pressures and acts of violence, while possibilities for promotion are limited precisely because of their embeddedness. They face a tension between being politically and socially embedded and needing to perform MSF’s principles in practice. As such, they embody the contradictions of MSF’s approach in North Kivu: a simultaneous need for operational ‘proximity’, as well as performative distance from everyday conflict processes.

A Longitudinal Study on Web-Sites Password Management (in)Security: Evidence and Remedies

Single-factor password-based authentication is generally the norm to access on-line Web-sites. While single-factor authentication is well known to be a weak form of authentication, a further concern arises when considering the possibility for an attacker to recover the user passwords by leveraging the loopholes in the password recovery mechanisms. Indeed, the adoption by a Web-site of a poor password management system makes useless even the most robust password chosen by the registered users. In this paper, building on the results of our previous work, we study the possible attacks to on-line password recovery systems analyzing the mechanisms implemented by some of the most popular Web-sites. In detail, we provide several contributions: (i) we revise and detail the attacker model; (ii) we provide an updated analysis with respect to a preliminary study we carried out in December 2017; (iii) we perform a brand new analysis of the current top 200 Alexa's Web-sites of five major EU countries; and, (iv) we propose Maildust, a working open-source module that could be adopted by any Web-site to provide registered users with a password recovery mechanism to prevent mail service provider-level attacks. Overall, it is striking to notice how the analyzed Web-sites have made little (if any) effort to become compliant with the GDPR regulation, showing that the objective to have basic user protection mechanisms in place-despite the fines threatened by the GDPR-is still far, mainly because of sub-standard security management practices. Finally, it is worth noting that while this study has been focused on EU registered Web-sites, the proposed solution has, instead, general applicability.