Aiding information security decisions with human factors using quantitative and qualitative techniques

Phd ThesisThe Information Security Decision Making Process is comprised of an extremely complex and dynamic set of sub-tasks, sub-goals and inter-disciplinary practices. In order to be effective and appropriate, this process must balance both the requirements of the stakeholder as well as the users within the system. Without careful consideration of users’ behaviours and preferences, interventions are often seen as obstacles towards productivity and subsequently circumvented or simply not adhered to. The approach detailed herein requires an intimate knowledge of both Information Security and Human Behaviour. An effective security policy must adequately protect a given set of assets (human and non-human) or systems as well as preserve maximal productivity. Companies rely on their Intellectual Property Rights which are often stored in a digital format. This presents a plethora of issues regarding security, access management and locality (whether on or off the premises). Furthermore, there is the added complexity of employees and how they operate within this environment (a subset of compliance, competence and policy). With the continued increase in consumerisation, more specifically the rise of Bring Your Own Device, there is a significant threat towards data security that persists outside of the typical working environment. This trend enables employees to access and transfer corporate assets remotely but in doing so creates a conflict over identity, ownership and data management. The governance of these activities creates an extremely complex problem space which requires the need to balance these requirements relying on an accurate assessment of risk, identification of security vulnerabilities and knowledge pertaining to the behaviour of employees. The risks to company assets can be estimated by the analysis of the following issues: • Threats to your assets. These are unwanted events that could cause the deliberate or accidental loss, damage or misuse of the assets. • Vulnerabilities. How susceptible your assets are to attack. • Impact. The magnitude of the potential loss or the seriousness of the event. The ability to quantify and accurately represent these variables is critical in developing, implementing and supporting a successful security policy. The dissertation is structured as follows. Chapter 1 provides an abstract overview of the problem space and highlights our aims, objectives and publications. Chapter 2 details an in-depth literature review of the cross-disciplinary problem space. This involves both the analysis of industry standards, practices and reports as well as a summary of academic literature pertaining to theoretical frameworks and simulations for discussion. Chapter 3 introduces our problem space and documents the rationale for designing our methodology. Each successive chapter (4, 5, & 6) documents a separate investigative strategy for populating specific data sets with respect to the behaviours and practices highlighted from our pilot study and CISO interaction. This provides the rationale behind each approach as well as a documented implementation and evaluation of our experimental design with reference to publications in the field. Chapter 7 documents our modelling strategy and highlights the extensions we propose to the BPMN 2.0 formalism. Chapter 8 concludes our work with reference to our contributions, limitations and the direction of future study

Risk awareness in secondary stroke prevention

Stroke is the single largest cause of disability and second highest cause of death globally. It is estimated that 10 million people a year are affected by stroke in the United Kingdom (UK). Of the 130,000 annual new stroke occurrences in the UK, one third will go on to have a further stroke. Recurrent stroke is more likely to be fatal than first stroke and survivors are more likely to be left with major disability. Many stroke patients do not adhere to secondary prevention strategies due to complex reasons, including lack of appreciation of their high risk of a secondary cardiovascular event. Long-term secondary prevention remains a desired goal in the management of stroke survivors, however, studies have shown that current strategies are not routinely and universally working. Hypothesis: Raising awareness of secondary stroke risk may improve stroke survivor’s adherence to secondary prevention strategies after stroke. Results: A survey of the general public (n=1019) and a population-based study of over 600 stroke survivors found that knowledge about Blood Pressure (BP) and stroke risk factors was poor in high risk populations. Only 55% of stroke survivors were able to cite any well-known vascular risk factors. However, those who were appropriately risk-aware significantly improved their health behaviour post-stroke by consuming less alcohol (P<0.001), less salt (P=0.05) and eating a healthy diet (P=0.02). Further, In a Randomised Controlled Trial setting an intervention to increase risk awareness was successful in increasing awareness (P=0.04) and resulted in a significant increase in knowledge of stroke sub-type (95% CI 0.72-0.677, P<0.001), risk factor control of systolic BP (95% CI 12.1-10.4, P=0.01) and increased the number of healthy lifestyle behaviour changes made at follow-up (P<0.001). Conclusions: Increasing risk awareness is potentially an important mechanism to improve health behaviour following stroke and may improve risk factor control as part of secondary stroke prevention

Exploring openEHR-based clinical guidelines in acute stroke care and research

Largely speaking, health information systems today are not able to exchange data between each other and understand the data’s meaning automatically by means of their information technology components. This lack of ‘interoperability’ also leads to patients experiencing an undesired discontinuity in their care. This thesis is a part of a health informatics field which tackles interoperability barriers by offering standardised information models for electronic health records. More specifically, this work explores possibilities of combining standardised information models offered by the openEHR interoperability approach with knowledge from evidence-based clinical practice guidelines. The applied methodology includes openEHR archetypes, the openEHR reference information model, standard medical terminologies such as SNOMED CT, the international stroke treatment registry SITS, a newly developed model for representing guideline knowledge (the ‘Care Entry-Network Model’), and rules authored in the Guideline Definition Language, a formalism recently endorsed by openEHR as a part of its specifications. The study design used is based on evaluating the work done by means of retrospectively checking the compliance of completed patient cases with guidelines from the domain of acute stroke management in Europe, both experimentally and using thousands of real patient cases from SITS. Our overall findings are that i) the Care Entry-Network Model facilitates an intermediate step between narrative guideline text and computer-interpretable guidelines to be deployed in openEHR systems, ii) the Guideline Definition Language is practicable for creating and automatically running openEHR-based computer-interpretable guidelines, where we also provide detailed accounts of our employed GDL technologies, and iii) the Guideline Definition Language combined with real patient data from patient data registries can generate new clinical knowledge, which in our case has benefited stroke carers and researchers working with acute stroke thrombolysis. In conclusion, using our methodology, health care stakeholders would get evidence-based knowledge components in their electronic health records based on shareable, well maintainable information and knowledge models in the form of archetypes and GDL rules respectively. However, our approach still needs to be tested at the point of clinical decision making and compared to other approaches for providing exchangeable computer-interpretable guidelines

Evidence for the outcomes and impact of clinical pharmacy: context of UK hospital pharmacy practice

Objectives: The role of clinical pharmacists in hospitals has evolved and continues to expand. In the UK, outside of a few national policy drivers, there are no agreed priorities, measures or defined outcomes for hospital clinical pharmacy (CP). This paper aims to (1) highlight the need to identify and prioritise specific CP roles, responsibilities and practices that will bring the greatest benefit to patients and health systems and (2) describe systematic weaknesses in current research methodologies for evaluating CP services and propose a different approach. Method: Published reviews of CP services are discussed using the Economic, Clinical and Humanistic Outcomes framework. Recurring themes regarding study methodologies, measurements and outcomes are used to highlight current weaknesses in studies evaluating CP. Results: Published studies aiming to demonstrate the economic, clinical or humanistic outcomes of CP often suffer from poor research design and inconsistencies in interventions, measurements and outcomes. This has caused difficulties in drawing meaningful conclusions regarding CP’s definitive contribution to patient outcomes. Conclusion: There is a need for more research work in National Health Service (NHS) hospitals, employing a different paradigm to address some of the weaknesses of existing research on CP practice. We propose a mixed-methods approach, including qualitative research designs, and with emphasis on cost-consequence analyses for economic evaluations. This approach will provide more meaningful data to inform policy and demonstrate the contribution of hospital CP activities to patient care and the NHS

Guideline-recommended care processes in acute stroke

Introduction: Although clinical guidelines recommend various care processes to improve outcomes of patients with stroke, evidence to support many of them, such as the management of post-stroke infections and the monitoring of abnormal physiological variables, are scarce. While for those care processes with more evidence, very few studies have quantified their variations across regions and what factors influence their implementation in clinical practice. This thesis aims to determine the utilisation of guideline-recommended care processes for patients with acute stroke, and explore various strategies that may improve their implementation. Methods: I conducted secondary analyses of a large clinical trial to explore the associations of care processes and clinical outcomes, using data of 11,093 patients with acute stroke from nine countries. These care processes included dysphagia screening, indwelling urinary catheterisation (IUC), and early detection of low blood pressure (BP) and oxygen saturation (SaO2) levels. To explore variations in the utilisation of care processes, I compared the evidence-based recommendations for stroke unit care across Australia/UK, China, India/Sri Lanka and South America. I also conducted a process evaluation of a ‘quality improvement’ intervention within an ongoing trial involving the management of patients with acute intracerebral haemorrhage in China, to explore what factors could improve the implementation of systems to improve the quality of care. Results: Patients who failed a dysphagia screen, had an IUC, had SBP <120mmHg or SaO2 <93% during the acute phase (up to 7 days after stroke onset) had increased odds of poor outcome. The utilisation of care processes varied across regions, with lower probabilities of reperfusion therapy and allied health care in low- and middle-income countries (LMICs) than high-income countries. Constant training with the clinicians, case reviews, optimisation of workflow within available resources, and having a dedicated team, may facilitate the implementation of evidence-based care. Conclusions: The utilisations of guideline-recommended care processes are associated with patient outcomes and vary across regions. Timely assessment and appropriate management should be provided to those with dysphagia, IUC, low BP, and low SaO2 levels, in an effort to improve their recovery after stroke. Future studies are needed to confirm the causality of these associations and to examine opportunities to promote the delivery of evidence-based stroke care, especially in LMICs

Conducting randomised controlled trials in an acute stroke unit

PhD ThesisStroke is a major cause of death and disability in the UK. Few treatments exist and those that do, such as thrombolysis (‘clot-busting’ treatment) must be given urgently and are not risk-free. Large scale randomised controlled trials are crucial for the development of safe, effective, acute interventions, but progress has been limited, ostensibly due to ethical and regulatory difficulties. Theoretical work in this area has focussed primarily upon the requirement for prospective informed consent, but has also considered potential conflicts of interests inherent in the dual role of clinicianresearchers, and the notion that research and clinical practice are, can be, and should be conducted separately. Empirical evidence on this topic is lacking. By providing such evidence, this study examines claims made in the literature regarding the difficulties encountered or perceived in conducting emergency research. It also explores whether, how, and to what effect, the distinction between research and clinical activity advocated in the bioethical literature is maintained. Methods Ethnographic methods were employed, including participant observation, semistructured interviews, and audio-recording of research consent interactions in an acute stroke unit. Data were analysed drawing upon constant comparative and framework methods. Results and conclusion Whilst providing empirical evidence supporting some of the theoretical and conceptual literature, the data also furnish a detailed account of pragmatic issues encountered and managed daily by healthcare professionals in the acute stroke environment. Whilst attempts were made at the study site to separate, at least in part, clinical and research activity, it was observed that absolute separation of clinical activities is neither attainable, sustainable, nor desirable. Placement of research nurses within the clinical environment may promote transparency and greater understanding of their role, whilst simultaneously demystifying research concepts. Ultimately this may promote closer working relationships, contributing to enhanced recruitment, retention and management of research participants.personal Researcher Development Award, from the Department of Health National Coordinating Centre for Research Capacity Development (since superseded by the National Institute for Health Research

Added value of acute multimodal CT-based imaging (MCTI) : a comprehensive analysis

Introduction: MCTI is used to assess acute ischemic stroke (AIS) patients.We postulated that use of MCTI improves patient outcome regardingindependence and mortality.Methods: From the ASTRAL registry, all patients with an AIS and a non-contrast-CT (NCCT), angio-CT (CTA) or perfusion-CT (CTP) within24 h from onset were included. Demographic, clinical, biological, radio-logical, and follow-up caracteristics were collected. Significant predictorsof MCTI use were fitted in a multivariate analysis. Patients undergoingCTA or CTA&amp;CTP were compared with NCCT patients with regards tofavourable outcome (mRS ≤ 2) at 3 months, 12 months mortality, strokemechanism, short-term renal function, use of ancillary diagnostic tests,duration of hospitalization and 12 months stroke recurrence