Enter your login details for Computers & Security below. If you do not already have an account you will need to register here.
Check submitted paper
Track accepted paper
Once your article has been accepted you will receive an email from Author Services. This email contains a link to check the status of your article. Track your accepted paper
Most Cited Computers & Security Articles
The most cited articles published since 2011, extracted from Scopus.
Volume 31, Issue 3, May 2012, Pages 357-374
Ali Shiravi | Hadi Shiravi | Mahbod Tavallaee | Ali A. Ghorbani
In network intrusion detection, anomaly-based approaches in particular suffer from accurate evaluation, comparison, and deployment which originates from the scarcity of adequate datasets. Many such datasets are internal and cannot be shared due to privacy issues, others are heavily anonymized and do not reflect current trends, or they lack certain statistical characteristics. These deficiencies are primarily the reasons why a perfect dataset is yet to exist. Thus, researchers must resort to datasets that are often suboptimal. As network behaviors and patterns change and intrusions evolve, it has very much become necessary to move away from static and one-time datasets toward more dynamically generated datasets which not only reflect the traffic compositions and intrusions of that time, but are also modifiable, extensible, and reproducible. In this paper, a systematic approach to generate the required datasets is introduced to address this need. The underlying notion is based on the concept of profiles which contain detailed descriptions of intrusions and abstract distribution models for applications, protocols, or lower level network entities. Real traces are analyzed to create profiles for agents that generate real traffic for HTTP, SMTP, SSH, IMAP, POP3, and FTP. In this regard, a set of guidelines is established to outline valid datasets, which set the basis for generating profiles. These guidelines are vital for the effectiveness of the dataset in terms of realism, evaluation capabilities, total capture, completeness, and malicious activity. The profiles are then employed in an experiment to generate the desirable dataset in a testbed environment. Various multi-stage attacks scenarios were subsequently carried out to supply the anomalous portion of the dataset. The intent for this dataset is to assist various researchers in acquiring datasets of this kind for testing, evaluation, and comparison purposes, through sharing the generated datasets and profiles. © 2011 Elsevier Ltd. All rights reserved.
Volume 32, Issue , April 2013, Pages 90-101
Robert E. Crossler | Allen C. Johnston | Paul Benjamin Lowry | Qing Hu | Merrill Warkentin | Richard Baskerville
Information Security (InfoSec) research is far reaching and includes many approaches to deal with protecting and mitigating threats to the information assets and technical resources available within computer based systems. Although a predominant weakness in properly securing information assets is the individual user within an organization, much of the focus of extant security research is on technical issues. The purpose of this paper is to highlight future directions for Behavioral InfoSec research, which is a newer, growing area of research. The ensuing paper presents information about challenges currently faced and future directions that Behavioral InfoSec researchers should explore. These areas include separating insider deviant behavior from insider misbehavior, approaches to understanding hackers, improving information security compliance, cross-cultural Behavioral InfoSec research, and data collection and measurement issues in Behavioral InfoSec research. © 2012 Elsevier Ltd. All rights reserved.
Volume 30, Issue 8, November 2011, Pages 719-731
Kim Kwang Raymond Choo
Cyber threats are becoming more sophisticated with the blending of once distinct types of attack into more damaging forms. Increased variety and volume of attacks is inevitable given the desire of financially and criminally-motivated actors to obtain personal and confidential information, as highlighted in this paper. We describe how the Routine Activity Theory can be applied to mitigate these risks by reducing the opportunities for cyber crime to occur, making cyber crime more difficult to commit and by increasing the risks of detection and punishment associated with committing cyber crime. Potential research questions are also identified. © 2011 Elsevier Ltd. All rights reserved.
Understanding information systems security policy compliance: An integration of the theory of planned behavior and the protection motivation theory
Volume 31, Issue 1, February 2012, Pages 83-95
This research investigated information systems security policy (ISSP) compliance by drawing upon two relevant theories i.e. the theory of planned behavior (TPB) and the protection motivation theory (PMT). A research model that fused constituents of the aforementioned theories was proposed and validated. Relevant hypotheses were developed to test the research conceptualization. Data analysis was performed using the partial least squares (PLS) technique. Using a survey of 124 business managers and IS professionals, this study showed that factors such as self-efficacy, attitude toward compliance, subjective norms, response efficacy and perceived vulnerability positively influence ISSP behavioral compliance intentions of employees. The data analysis did not support perceived severity and response cost as being predictors of ISSP behavioral compliance intentions. The study's implications for research and practice are discussed. © 2011 Elsevier Ltd. All rights reserved.
Hierarchical attribute-based encryption and scalable user revocation for sharing data in cloud servers
Volume 30, Issue 5, July 2011, Pages 320-331
Guojun Wang | Qin Liu | Jie Wu | Minyi Guo
With rapid development of cloud computing, more and more enterprises will outsource their sensitive data for sharing in a cloud. To keep the shared data confidential against untrusted cloud service providers (CSPs), a natural way is to store only the encrypted data in a cloud. The key problems of this approach include establishing access control for the encrypted data, and revoking the access rights from users when they are no longer authorized to access the encrypted data. This paper aims to solve both problems. First, we propose a hierarchical attribute-based encryption scheme (HABE) by combining a hierarchical identity-based encryption (HIBE) system and a ciphertext-policy attribute-based encryption (CP-ABE) system, so as to provide not only fine-grained access control, but also full delegation and high performance. Then, we propose a scalable revocation scheme by applying proxy re-encryption (PRE) and lazy re-encryption (LRE) to the HABE scheme, so as to efficiently revoke access rights from users. © 2011 Elsevier Ltd. All rights reserved.
Volume 31, Issue 4, June 2012, Pages 418-436
A. Nicholson | S. Webber | S. Dyer | T. Patel | H. Janicke
Supervisory Control and Data Acquisition (SCADA) systems are deployed worldwide in many critical infrastructures ranging from power generation, over public transport to industrial manufacturing systems. Whilst contemporary research has identified the need for protecting SCADA systems, these information are disparate and do not provide a coherent view of the threats and the risks resulting from the tendency to integrate these once isolated systems into corporate networks that are prone to cyber attacks. This paper surveys ongoing research and provides a coherent overview of the threats, risks and mitigation strategies in the area of SCADA security. © 2012 Elsevier Ltd. All rights reserved.
Volume 30, Issues 6-7, September 2011, Pages 353-375
Jonathan J. Davis | Andrew J. Clark
Data preprocessing is widely recognized as an important stage in anomaly detection. This paper reviews the data preprocessing techniques used by anomaly-based network intrusion detection systems (NIDS), concentrating on which aspects of the network traffic are analyzed, and what feature construction and selection methods have been used. Motivation for the paper comes from the large impact data preprocessing has on the accuracy and capability of anomaly-based NIDS. The review finds that many NIDS limit their view of network traffic to the TCP/IP packet headers. Time-based statistics can be derived from these headers to detect network scans, network worm behavior, and denial of service attacks. A number of other NIDS perform deeper inspection of request packets to detect attacks against network services and network applications. More recent approaches analyze full service responses to detect attacks targeting clients. The review covers a wide range of NIDS, highlighting which classes of attack are detectable by each of these approaches. Data preprocessing is found to predominantly rely on expert domain knowledge for identifying the most relevant parts of network traffic and for constructing the initial candidate set of traffic features. On the other hand, automated methods have been widely used for feature extraction to reduce data dimensionality, and feature selection to find the most relevant subset of features from this candidate set. The review shows a trend toward deeper packet inspection to construct more relevant features through targeted content parsing. These context sensitive features are required to detect current attacks. © 2011 Elsevier Ltd. All rights reserved.
Volume 30, Issues 2-3, March 2011, Pages 108-115
Barbara Carminati | Elena Ferrari | Raymond Heatherly | Murat Kantarcioglu | Bhavani Thuraisingham
The existence of online social networks that include person specific information creates interesting opportunities for various applications ranging from marketing to community organization. On the other hand, security and privacy concerns need to be addressed for creating such applications. Improving social network access control systems appears as the first step toward addressing the existing security and privacy concerns related to online social networks. To address some of the current limitations, we have created an experimental social network using synthetic data which we then use to test the efficacy of the semantic reasoning based approaches we have previously suggested. © 2010 Elsevier Ltd. All rights reserved.
Volume 30, Issue 8, November 2011, Pages 625-642
C. Kolias | G. Kambourakis | M. Maragoudakis
Intrusion Detection Systems (IDS) have nowadays become a necessary component of almost every security infrastructure. So far, many different approaches have been followed in order to increase the efficiency of IDS. Swarm Intelligence (SI), a relatively new bio-inspired family of methods, seeks inspiration in the behavior of swarms of insects or other animals. After applied in other fields with success SI started to gather the interest of researchers working in the field of intrusion detection. In this paper we explore the reasons that led to the application of SI in intrusion detection, and present SI methods that have been used for constructing IDS. A major contribution of this work is also a detailed comparison of several SI-based IDS in terms of efficiency. This gives a clear idea of which solution is more appropriate for each particular case. © 2011 Elsevier Ltd. All rights reserved.
Volume 34, Issue , May 2013, Pages 47-66
Alexios Mylonas | Anastasia Kastania | Dimitris Gritzalis
Smartphone users increasingly download and install third-party applications from official application repositories. Attackers may use this centralized application delivery architecture as a security and privacy attack vector. This risk increases since application vetting mechanisms are often not in place and the user is delegated to authorize which functionality and protected resources are accessible by third-party applications. In this paper, we mount a survey to explore the security awareness of smartphone users who download applications from official application repositories (e.g. Google Play, Apple's App Store, etc.). The survey findings suggest a security complacency, as the majority of users trust the app repository, security controls are not enabled or not added, and users disregard security during application selection and installation. As a response to this security complacency we built a prediction model to identify users who trust the app repository. The model is assessed, evaluated and proved to be statistically significant and efficient. © 2012 Elsevier Ltd. All rights reserved.
Volume 30, Issue 8, November 2011, Pages 748-769
L. Fuchs | G. Pernul | R. Sandhu
The concept of roles has been prevalent in the area of Information Security for more than 15 years already. It promises simplified and flexible user management, reduced administrative costs, improved security, as well as the integration of employees' business functions into the IT administration. A comprehensive scientific literature collection revealed more than 1300 publications dealing with the application of sociological role theory in the context of Information Security up to now. Although there is an ANSI/NIST standard and an ISO standard proposal, a variety of competing models and interpretations of the role concept have developed. The major contribution of this survey is a categorization of the complete underlying set of publications into different classes. The main part of the work is investigating 32 identified research directions, evaluating their importance and analyzing research tendencies. An electronic bibliography including all surveyed publications together with the classification information is provided additionally. As a final contribution potential future developments in the area of role-research are considered. © 2011 Elsevier Ltd. All rights reserved.
Volume 31, Issue 5, July 2012, Pages 643-652
Atif Ahmad | Justin Hadgkiss | A. B. Ruighaver
Incident response is a critical security function in organisations that aims to manage incidents in a timely and cost-effective manner. This research was motivated by previous case studies that suggested that the practice of incident response frequently did not result in the improvement of strategic security processes such as policy development and risk assessment. An exploratory in-depth case study was performed at a large global financial institution to examine shortcomings in the practice of incident response. The case study revealed the practice of incident response, in accordance with detailed best-practice guidelines, tended to adopt a narrow technical focus aimed at maintaining business continuity whilst neglecting strategic security concerns. The case study also revealed that the (limited) post-incident review process focused on 'high-impact' incidents rather than 'high-learning' (i.e. potentially useful incidents from a learning perspective) incidents and 'near misses'. In response to this case study, we propose a new double-loop model for incident learning to address potential systemic corrective action in such areas as the risk assessment and policy development processes. © 2012 Elsevier Ltd. All rights reserved.
Volume 31, Issue 5, July 2012, Pages 653-672
Sergio Martínez | David Sánchez | Aida Valls
In the context of Statistical Disclosure Control, microaggregation is a privacy-preserving method aimed to mask sensitive microdata prior to publication. It iteratively creates clusters of, at least, k elements, and replaces them by their prototype so that they become k-indistinguishable (anonymous). This data transformation produces a loss of information with regards to the original dataset which affects the utility of masked data, so, the aim of microaggregation algorithms is to find the partition that minimises the information loss while ensuring a certain level of privacy. Most microaggregation methods, such as the MDAV algorithm, which is the focus of this paper, have been designed for numerical data. Extending them to support non-numerical (categorical) attributes is not straightforward because of the limitations on defining appropriate aggregation operators. Concretely, related works focused on the MDAV algorithm propose grouping data into groups with constrained size (or even fixed) and/or incorporate a basic categorical treatment of non-numerical data. This approach affects negatively the utility of the protected dataset because neither the distributional characteristics of data nor their underlying semantics are properly considered. In this paper, we propose a set of modifications to the MDAV algorithm focused on categorical microdata. Our approach has been evaluated and compared with related works when protecting real datasets with textual attribute values. Results show that our method produces masked datasets that better minimises the information loss resulting from the data transformation. © 2012 Elsevier Ltd. All rights reserved.
Volume 30, Issues 6-7, September 2011, Pages 427-445
Romain Giot | Mohamad El-Abed | Baptiste Hemery | Christophe Rosenberger
Among all the existing biometric modalities, authentication systems based on keystroke dynamics present interesting advantages. These solutions are well accepted by users and cheap as no additional sensor is required for authenticating the user before accessing to an application. In the last thirty years, many researchers have proposed, different algorithms aimed at increasing the performance of this approach. Their main drawback lies on the large number of data required for the enrollment step. As a consequence, the verification system is barely usable, because the enrollment is too restrictive. In this work, we propose a new method based on the Support Vector Machine (SVM) learning satisfying industrial conditions (i.e., few samples per user are needed during the enrollment phase to create its template). In this method, users are authenticated through the keystroke dynamics of a shared secret (chosen by the system administrator). We use the GREYC keystroke database that is composed of a large number of users (100) for validation purposes. We compared the proposed method with six methods from the literature (selected based on their ability to work with few enrollment samples). Experimental results show that, even though the computation time to build the template can be longer with our method (54 s against 3 s for most of the others), its performance outperforms the other methods in an industrial context (Equal Error Rate of 15.28% against 16.79% and 17.02% for the two best methods of the state-of-the-art, on our dataset and five samples to create the template, with a better computation time than the second best method). © 2011 Elsevier Ltd. All rights reserved.
Volume 30, Issues 2-3, March 2011, Pages 116-127
Jing Jin | Gail Joon Ahn | Hongxin Hu | Michael J. Covington | Xinwen Zhang
In modern healthcare environments, a fundamental requirement for achieving continuity of care is the seamless access to distributed patient health records in an integrated and unified manner, directly at the point of care. However, Electronic Health Records (EHRs) contain a significant amount of sensitive information, and allowing data to be accessible at many different sources increases concerns related to patient privacy and data theft. Access control solutions must guarantee that only authorized users have access to such critical records for legitimate purposes, and access control policies from distributed EHR sources must be accurately reflected and enforced accordingly in the integrated EHRs. In this paper, we propose a unified access control scheme that supports patient-centric selective sharing of virtual composite EHRs using different levels of granularity, accommodating data aggregation and privacy protection requirements. We also articulate and address issues and mechanisms on policy anomalies that occur in the composition of discrete access control policies from different data sources. © 2010 Elsevier Ltd. All rights reserved.
Volume 30, Issue 4, June 2011, Pages 221-241
Davide Ariu | Roberto Tronci | Giorgio Giacinto
Nowadays the security of Web applications is one of the key topics in Computer Security. Among all the solutions that have been proposed so far, the analysis of the HTTP payload at the byte level has proven to be effective as it does not require the detailed knowledge of the applications running on the Web server. The solutions proposed in the literature actually achieved good results for the detection rate, while there is still room for reducing the false positive rate. To this end, in this paper we propose HMMPayl, an IDS where the payload is represented as a sequence of bytes, and the analysis is performed using Hidden Markov Models (HMM). The algorithm we propose for feature extraction and the joint use of HMM guarantee the same expressive power of n - gram analysis, while allowing to overcome its computational complexity. In addition, we designed HMMPayl following the Multiple Classifiers System paradigm to provide for a better classification accuracy, to increase the difficulty of evading the IDS, and to mitigate the weaknesses due to a non optimal choice of HMM parameters. Experimental results, obtained both on public and private datasets, show that the analysis performed by HMMPayl is particularly effective against the most frequent attacks toward Web applications (such as XSS and SQL-Injection). In particular, for a fixed false positive rate, HMMPayl achieves a higher detection rate respect to previously proposed approaches it has been compared with. © 2011 Elsevier Ltd. All rights reserved.
Volume 30, Issue 5, July 2011, Pages 311-319
Peng Zhang | Jiankun Hu | Cai Li | Mohammed Bennamoun | Vijayakumar Bhagavatula
The core of bio-cryptography lies in the stability of cryptographic keys generated from uncertain biometrics. It is essential to minimize every possible uncertainty during the biometric feature extraction process. In fingerprint feature extraction, it is perceived that pixel-level image rotation transformation is a lossless transformation process. In this paper, an investigation has been conducted on analyzing the underlying mechanisms of fingerprint image rotation processing and potential effect on the major features, mainly minutiae and singular point, of the rotation transformed fingerprint. Qualitative and quantitative analyses have been provided based on intensive experiments. It is observed that the information integrity of the original fingerprint image can be significantly compromised by image rotation transformation process, which can cause noticeable singular point change and produce a non-negligible number of fake minutiae. It is found that the quantization and interpolation process can change the fingerprint features significantly without affecting the visual image. Experiments show that up to 7% bio-cryptographic key bits can be affected due to this rotation transformation. © 2011 Elsevier Ltd. All rights reserved.
Volume 30, Issue 1, January 2011, Pages 63-80
Christos Xenakis | Christoforos Panos | Ioannis Stavrakakis
Mobile Ad Hoc Networks (MANETs) are susceptible to a variety of attacks that threaten their operation and the provided services. Intrusion Detection Systems (IDSs) may act as defensive mechanisms, since they monitor network activities in order to detect malicious actions performed by intruders, and then initiate the appropriate countermeasures. IDS for MANETs have attracted much attention recently and thus, there are many publications that propose new IDS solutions or improvements to the existing. This paper evaluates and compares the most prominent IDS architectures for MANETs. IDS architectures are defined as the operational structures of IDSs. For each IDS, the architecture and the related functionality are briefly presented and analyzed focusing on both the operational strengths and weaknesses. Moreover, methods/techniques that have been proposed to improve the performance and the provided security services of those are evaluated and their shortcomings or weaknesses are presented. A comparison of the studied IDS architectures is carried out using a set of critical evaluation metrics, which derive from: (i) the deployment, architectural, and operational characteristics of MANETs; (ii) the special requirements of intrusion detection in MANETs; and (iii) the carried analysis that reveals the most important strengths and weaknesses of the existing IDS architectures. The evaluation metrics of IDSs are divided into two groups: the first one is related to performance and the second to security. Finally, based on the carried evaluation and comparison a set of design features and principles are presented, which have to be addressed and satisfied in future research of designing and implementing IDSs for MANETs. © 2010 Elsevier Ltd. All rights reserved.
Volume 31, Issue 4, June 2012, Pages 597-611
Shari Lawrence Pfleeger | Deanna D. Caputo
Most efforts to improve cyber security focus primarily on incorporating new technological approaches in products and processes. However, a key element of improvement involves acknowledging the importance of human behavior when designing, building and using cyber security technology. In this survey paper, we describe why incorporating an understanding of human behavior into cyber security products and processes can lead to more effective technology. We present two examples: the first demonstrates how leveraging behavioral science leads to clear improvements, and the other illustrates how behavioral science offers the potential for significant increases in the effectiveness of cyber security. Based on feedback collected from practitioners in preliminary interviews, we narrow our focus to two important behavioral aspects: cognitive load and bias. Next, we identify proven and potential behavioral science findings that have cyber security relevance, not only related to cognitive load and bias but also to heuristics and behavioral science models. We conclude by suggesting several next steps for incorporating behavioral science findings in our technological design, development and use. © 2012 Elsevier Ltd. All rights reserved.
Volume 31, Issue 8, November 2012, Pages 956-966
Cristina Alcaraz | Javier Lopez | Rodrigo Roman | Hsiao Hwa Chen
Key management in wireless sensor networks (WSN) is an active research topic. Due to the fact that a large number of key management schemes (KMS) have been proposed in the literature, it is not easy for a sensor network designer to know exactly which KMS best fits in a particular WSN application. In this article, we offer a comprehensive review on how the application requirements and the properties of various key management schemes influence each other. Based on this review, we show that the KMS plays a critical role in determining the security performance of a WSN network with given application requirements. We also develop a method that allows the network designers to select the most suitable KMS for a specific WSN network setting. In addition, the article also addresses the issues on the current state-of-the-art research on the KMS for homogeneous (i.e. non-hierarchical) networks to provide solutions for establishing link-layer keys in various WSN applications and scenarios. © 2012 Elsevier Ltd. All rights reserved.
Volume 32, Issue , April 2013, Pages 158-169
Shuzhen Wang | Zonghua Zhang | Youki Kadobayashi
The increasing complexity of today's computer systems, together with the rapid emergence of novel vulnerabilities, make security hardening a formidable challenge for security administrators. Although a large variety of tools and techniques are available for vulnerability analysis, the majority work at system or network level without explicit association with human and organizational factors. This article presents a middleware approach to bridge the gap between system-level vulnerabilities and organization-level security metrics, ultimately contributing to cost-benefit security hardening. In particular, our approach systematically integrates attack graph, a commonly used effective approach to representing and analyzing network vulnerabilities, and Hidden Markov Model (HMM) together, for exploring the probabilistic relation between system observations and states. More specifically, we modify and apply dependency attack graph to represent network assets and vulnerabilities (observations), which are then fed to HMM for estimating attack states, whereas their transitions are driven by a set of predefined cost factors associated with potential attacks and countermeasures. A heuristic searching algorithm is employed to automatically infer the optimal security hardening through cost-benefit analysis. We use a synthetic network scenario to illustrate our approach and evaluate its performance through a set of simulations. © 2012 Elsevier Ltd. All rights reserved.
Volume 37, Issue , April 2013, Pages 215-227
Saman Zonouz | Amir Houmansadra | Robin Berthiera | Nikita Borisova | William Sanders
As smartphones are becoming more complex and powerful to provide better functionalities, concerns are increasing regarding security threats against their users. Since smart-phones use a software architecture similar to PCs, they are vulnerable to the same classes of security risks. Unfortunately, smartphones are constrained by their limited resources that prevent the integration of advanced security monitoring solutions that work with traditional PCs. We propose Secloud, a cloud-based security solution for smartphone devices. Secloud emulates a registered smartphone device inside a designated cloud and keeps it synchronized by continuously passing the device inputs and network connections to the cloud. This allows Secloud to perform a resource-intensive security analysis on the emulated replica that would otherwise be infeasible to run on the device itself. We demonstrate the practical feasibility of Secloud through a prototype for Android devices and illustrate its resource effectiveness by comparing it with on-device solutions. © 2013 Elsevier Ltd. All rights reserved.
Volume 39, Issue PARTA, June 2013, Pages 2-16
David Zhao | Issa Traore | Bassam Sayed | Wei Lu | Sherif Saad | Ali Ghorbani | Dan Garant
Botnets represent one of the most serious cybersecurity threats faced by organizations today. Botnets have been used as the main vector in carrying many cyber crimes reported in the recent news. While a significant amount of research has been accomplished on botnet analysis and detection, several challenges remain unaddressed, such as the ability to design detectors which can cope with new forms of botnets. In this paper, we propose a new approach to detect botnet activity based on traffic behavior analysis by classifying network traffic behavior using machine learning. Traffic behavior analysis methods do not depend on the packets payload, which means that they can work with encrypted network communication protocols. Network traffic information can usually be easily retrieved from various network devices without affecting significantly network performance or service availability. We study the feasibility of detecting botnet activity without having seen a complete network flow by classifying behavior based on time intervals. Using existing datasets, we show experimentally that it is possible to identify the presence of existing and unknown botnets activity with high accuracy even with very small time windows. © 2013 Elsevier Ltd. All rights reserved.
Volume 31, Issue 2, March 2012, Pages 221-232
Hyeun Suk Rhee | Young U. Ryu | Cheong Tag Kim
Information security is a critical issue that many firms face these days. While increasing incidents of information security breaches have generated extensive publicity, previous studies repeatedly expose low levels of managerial awareness and commitment, a key obstacle to achieving a good information security posture. The main motivation of our study emanates from this phenomenon that the increased vulnerability to information security breaches is coupled with the low level of managerial awareness and commitment regarding information security threats. We report this dissonance by addressing a cognitive bias called optimistic bias. Using a survey, we study if MIS executives are subject to such a bias in their vulnerability perceptions of information security. We find that they demonstrate optimistic bias in risk perception on information security domain. The extent of this optimistic bias is greater with a distant comparison target with fewer information sharing activities. This optimistic bias is also found to be related to perception of controllability with information security threats. In order to overcome the effects of optimistic bias, firms need more security awareness training and systematic treatments of security threats instead of relying on ad hoc approach to security measure implementation. © 2011 Elsevier Ltd. All rights reserved.
Understanding the mindset of the abusive insider: An examination of insiders' causal reasoning following internal security changes
Volume 30, Issues 6-7, September 2011, Pages 486-497
Clay Posey | Rebecca J. Bennett | Tom L. Roberts
Employees can have a profound, detrimental influence on information security that costs organizations billions of U.S. dollars annually. As a result, organizations implement stringent security controls, which can inadvertently foster the behaviors that they are designed to deter. This research attempts to understand this phenomenon of increased internal computer abuses by applying causal reasoning theory to explain employees' causal-search process following the implementation of information security measures. Our findings show how interpersonal and environmental factors influence insiders' beliefs that the organization trusts them (i.e., attributed trust) and how low attributed trust perceptions drive computer abuse incidents subsequent to security changes. We also highlight the need for both managers and security researchers to assess the frequency with which employees encounter information security changes within dynamic, organizational environments. © 2011 Elsevier Ltd. All rights reserved.