Search

Purpose: The purpose of this paper is to propose a theory of information security intelligence and examine the effects of managers' information security intelligence (MISI) on employees' procedural countermeasure awareness and information security policy (ISP) compliance intention. Design/methodology/approach: A survey approach and structural equation modeling is utilized. Partial least squares (WarpPLS 6.0) and nonlinear algorithm are employed to analyze and examine the hypotheses. In total, 324 employees from companies in South Korea participated in the survey, which was conducted by a professional survey service company. Findings: MISI positively affects employees' awareness of information security procedural countermeasures; information security knowledge and problem-solving skills have positive effects on procedural countermeasures awareness; MISI increases employees' compliance intention through procedural countermeasure awareness; and information security procedural countermeasures positively affect employees' ISP compliance intention. Research limitations/implications: This study proposes a theory of information security intelligence and examines its impacts on employees' compliance intentions. The study highlights the mediating role of information security procedural countermeasures between information security intelligence and employees' compliance intentions. Practical implications: Managers should improve and explicitly demonstrate information security knowledge and problem-solving skills to increase employees' ISP compliance intention. To protect the organization's intellectual capital, managers should champion the development and promotion of PCM, rather than leave these functions to the information security group. Originality/value: This is the first empirical study to propose and validate MISI. [ABSTRACT FROM AUTHOR]

• Identifying benchmarking peer for establishing an information security policy. • Feature engineering based on Vague Soft Set. • Improvements of Gaussian process classification by integrating Vague Soft Set. • Combined use of Gaussian process and Vague Soft Set performs best among classifiers. Benchmarking methodology provides organizations with appropriate information security policy. However, selecting an appropriate organization as a benchmarking peer can be a challenge due to firms' heterogeneous implementation and usage of information systems. Our goal is to develop and propose methods to appropriately identify a benchmarking peer organization by incorporating machine learning methods and mathematics set theory. We incorporate vague soft set, entropy, dynamic time warping, and Gaussian process. We use log data from information security management systems in multiple companies to validate our methods. Our experimental results indicate that the combined use of Gaussian process, vague soft set, and dynamic time warping can be more effective in identifying an appropriate benchmarking peer than conventional machine learning methods. [ABSTRACT FROM AUTHOR]

This study analyzes the determinants of information security that influence the adoption of Web-based integrated information systems (IIS) by government agencies in Peru. The study introduces Web-based information systems designed to formulate strategic plans for the Peruvian government. A theoretical model is proposed to test the impact of organizational factors such as deterrent efforts, severity efforts, and preventive efforts and individual factors such as perceived information security threats and security awareness on intentions to use Web-based IIS. The empirical results indicate that deterrent efforts and deterrent severity have no significant influence on use intentions of IIS, whereas preventive efforts play an important role in such intentions. Information security awareness and perceived information security threats as individual factors have a significant effect on intentions to use the system. This suggests that organizations should implement preventive efforts by introducing various information security solutions, and improve information security awareness while reducing perceived information security threats. [ABSTRACT FROM PUBLISHER]

Early studies of electronic journals (e-journals) viewed the web as a technological discontinuity that would deem traditional academic publishing null This article uses the industry life cycle framework as a lens to examine the formation of academic e-journals. The article proposes five factors affecting the academic publishing dominant design selection process, and examines these factors against six longitudinal case studies. The study concludes that from technical/functional, economic and market perspectives, e-journals are superior to paper journals (p journals) However academic social norms and the managerial processes needed to establish and maintain e-journals are more influential on their formation than the capabilities provided by the new technology. In addition, the long-term sustainability and survivability of e-journals depend on the administrative and managerial processes established by its management team. This study demonstrates that although the web enables a large number of new entrants and a variety of business and technical models, e-journals are a competency-enhancing innovation that relies on the existing expertise of professional publishers and the journal's ability to support the social and cultural needs of academia. [ABSTRACT FROM AUTHOR]

As organizational reliance on technology increases, cybersecurity attacks become more attractive to attackers and increasingly devastating to organizations. Due to lacking knowledge and skills, humans are often considered the most susceptible threat vector for cyber attacks. Previous studies in information systems (IS) literature have confirmed awareness techniques to be the first step in increasing employee cybersecurity-related knowledge, promoting securityconscious decision-making, and the prevention of naive IS security behaviors. While training initiatives exist within many organizations, there appears to be a limited number of empirical research studies that focus on what security education, training, and awareness (SETA) programs should encompass. This includes topics to be covered, the most valuable method for delivery, and to what degree these factors play a part in the IS security practice of employees. The aim of this study was to use subject-matter experts (SMEs) to validate: 1) the key topics needed for two SETA program types (typical & socio-technical), 2) the measurement criteria for employees' cybersecurity countermeasures awareness (CCA), 3) weights for the three CCA categories (awareness of policy, SETA, & monitoring) in the overall CCA measure, and 4) two SETA programs content with integrated vignette-based assessments for CCA. A Delphi methodology was utilized to gather feedback from 21 SMEs regarding cybersecurity topics for organizational SETA programs, validation of SETA training content, and to develop a vignettebased measure of CCA. Results show that awareness of the organizational cybersecurity policy was the most important category for the overall CCA measure with 41%, followed by awareness of SETA program content, with 34%, while awareness of monitoring was 25%. The paper concludes with discussions and future research agenda. [ABSTRACT FROM AUTHOR]