1,523 research outputs found

    New Organizational Challenges in a Digital World: Securing Cloud Computing Usage and Reacting to Asset-Sharing Platform Disruptions

    Get PDF
    Information technology (IT) and IT-enabled business models are transforming the business ecosystem and posing new challenges for existing companies. This two-essay dissertation examines two such challenges: cloud security and the disruption of asset-sharing business models.The first essay examines how an organizations usage of cloud storage affects its likelihood of accidental breaches. The quasi-experiment in the U.S. healthcare sector reveals that organizations with higher levels of digitalization (i.e., Electronic Health Records levels) or those with more IT applications running on their internal data center are less likely to experience accidental breaches after using public cloud storage. We argue that digitalization and operational control over IT applications increase organizations awareness and capabilities of establishing a company-wide security culture, thereby reducing negligence related to physical devices and unintended disclosure after adopting cloud storage. The usage of cloud storage is more likely to cause accidental breaches for organizations contracting to more reputable or domain expert vendors. We explain this result as the consequence of less attention being focused on securing personally accessible data and physical devices given high reliance on reputed and knowledgeable cloud providers. This research is among the first to empirically examine the actual security impacts of organizations cloud storage usage and offers practical insights for cloud security management.The second essay examines how Asset-Sharing Business Model Prevalence (ASBMP) affects the performance implications of industry incumbent firms competitive actions when faced with entrants with asset-sharing business models, like Airbnb. ASBMP represents the amount of third-party products and services that originally were unavailable inside the traditional business model but now are orchestrated by asset-sharing companies in an industry. We use texting mining and econometrics approaches to analyze a longitudinal dataset in the accommodation industry. Our results demonstrate that incumbents competitive action repertoires (i.e., action volume, complexity, and heterogeneity) increase their performance when the ASBMP is high but decrease incumbents performance when the ASBMP is low. Practically, incumbents who are facing greater threat from asset-sharing firms can implement more aggressive competitive action repertoires and strategically focus on new product and M&A strategies. This research contributes to the literature of both competitive dynamics and asset-sharing business models

    Cloud privacy and security issues beyond technology: championing the cause of accountability

    Get PDF
    Cloud computing provides IT service providers increased efficiency of resource utilization while enabling consumers to benefit from innovative advantages like access to up-to-date IT resources and low upfront investment. A significant hindrance to adoption of cloud computing is the lack of trust arising from worries over privacy and security when data resources of cloud service consumers are handled by third parties. A key factor in fostering cloud privacy and security is accountability, which increases trust by obligating an entity to be answerable for its actions. This paper uses a hermeneutic literature review to investigate (i) the prevailing methods and strategies of fostering privacy and security through accountability, (ii) the key actors in championing cloud accountability and (iii) the key barriers to cloud accountability. This literature review provides insight into current practices associated with championing cloud accountability and contributes to cloud service provider awareness of ways to improve cloud computing trustworthiness

    Guidelines for secure cloud-based personal health records

    Get PDF
    Traditionally, health records have been stored in paper folders at the physician’s consulting rooms – or at the patient’s home. Some people stored the health records of their family members, so as to keep a running history of all the medical procedures they went through, and what medications they were given by different physicians at different stages of their lives. Technology has introduced better and safer ways of storing these records, namely, through the use of Personal Health Records (PHRs). With time, different types of PHRs have emerged, i.e. local, remote server-based, and hybrid PHRs. Web-based PHRs fall under the remote server-based PHRs; and recently, a new market in storing PHRs has emerged. Cloud computing has become a trend in storing PHRs in a more accessible and efficient manner. Despite its many benefits, cloud computing has many privacy and security concerns. As a result, the adoption rate of cloud services is not yet very high. A qualitative and exploratory research design approach was followed in this study, in order to reach the objective of proposing guidelines that could assist PHR providers in selecting a secure Cloud Service Provider (CSP) to store their customers’ health data. The research methods that were used include a literature review, systematic literature review, qualitative content analysis, reasoning, argumentation and elite interviews. A systematic literature review and qualitative content analysis were conducted to examine those risks in the cloud environment that could have a negative impact on the secure storing of PHRs. PHRs must satisfy certain dimensions, in order for them to be meaningful for use. While these were highlighted in the research, it also emerged that certain risks affect the PHR dimensions directly, thus threatening the meaningfulness and usability of cloud-based PHRs. The literature review revealed that specific control measures can be adopted to mitigate the identified risks. These control measures form part of the material used in this study to identify the guidelines for secure cloud-based PHRs. The guidelines were formulated through the use of reasoning and argumentation. After the guidelines were formulated, elite interviews were conducted, in order to validate and finalize the main research output: i.e. guidelines. The results of this study may alert PHR providers to the risks that exist in the cloud environment; so that they can make informed decisions when choosing a CSP for storing their customers’ health data

    Moving from a "human-as-problem" to a "human-as-solution" cybersecurity mindset

    Get PDF
    Cybersecurity has gained prominence, with a number of widely publicised security incidents, hacking attacks and data breaches reaching the news over the last few years. The escalation in the numbers of cyber incidents shows no sign of abating, and it seems appropriate to take a look at the way cybersecurity is conceptualised and to consider whether there is a need for a mindset change.To consider this question, we applied a "problematization" approach to assess current conceptualisations of the cybersecurity problem by government, industry and hackers. Our analysis revealed that individual human actors, in a variety of roles, are generally considered to be "a problem". We also discovered that deployed solutions primarily focus on preventing adverse events by building resistance: i.e. implementing new security layers and policies that control humans and constrain their problematic behaviours. In essence, this treats all humans in the system as if they might well be malicious actors, and the solutions are designed to prevent their ill-advised behaviours. Given the continuing incidences of data breaches and successful hacks, it seems wise to rethink the status quo approach, which we refer to as "Cybersecurity, Currently". In particular, we suggest that there is a need to reconsider the core assumptions and characterisations of the well-intentioned human's role in the cybersecurity socio-technical system. Treating everyone as a problem does not seem to work, given the current cyber security landscape.Benefiting from research in other fields, we propose a new mindset i.e. "Cybersecurity, Differently". This approach rests on recognition of the fact that the problem is actually the high complexity, interconnectedness and emergent qualities of socio-technical systems. The "differently" mindset acknowledges the well-intentioned human's ability to be an important contributor to organisational cybersecurity, as well as their potential to be "part of the solution" rather than "the problem". In essence, this new approach initially treats all humans in the system as if they are well-intentioned. The focus is on enhancing factors that contribute to positive outcomes and resilience. We conclude by proposing a set of key principles and, with the help of a prototypical fictional organisation, consider how this mindset could enhance and improve cybersecurity across the socio-technical system

    Security Strategies for Hosting Sensitive Information in the Commercial Cloud

    Get PDF
    IT experts often struggle to find strategies to secure data on the cloud. Although current security standards might provide cloud compliance, they fail to offer guarantees of security assurance. The purpose of this qualitative case study was to explore the strategies used by IT security managers to host sensitive information in the commercial cloud. The study\u27s population consisted of information security managers from a government agency in the eastern region of the United States. The routine active theory, developed by Cohen and Felson, was used as the conceptual framework for the study. The data collection process included IT security manager interviews (n = 7), organizational documents and procedures (n = 14), and direct observation of a training meeting (n = 35). Data collection from organizational data and observational data were summarized. Coding from the interviews and member checking were triangulated with organizational documents and observational data/field notes to produce major and minor themes. Through methodological triangulation, 5 major themes emerged from the data analysis: avoiding social engineering vulnerabilities, avoiding weak encryption, maintaining customer trust, training to create a cloud security culture, and developing sufficient policies. The findings of this study may benefit information security managers by enhancing their information security practices to better protect their organization\u27s information that is stored in the commercial cloud. Improved information security practices may contribute to social change by providing by proving customers a lesser amount of risk of having their identity or data stolen from internal and external thieve

    Secure Data Sharing and Collaboration in the Cloud

    Get PDF
    Cloud technology can be leveraged to enable data-sharing capabilities, which can benefit the user through greater productivity and efficiency. However, the Cloud is susceptible to many privacy and security vulnerabilities, which hinders the progress and widescale adoption of data sharing for the purposes of collaboration. Thus, there is a strong demand for data owners to not only ensure that their data is kept private and secure in the Cloud, but to also have a degree of control over their own data contents once they are shared with data consumers. Specifically, the main issues for data sharing in the Cloud include key management, security attacks, and data-owner access control. In terms of key management, it is vital that data must first be encrypted before storage in the Cloud, to prevent privacy and security breaches. However, the management of encryption keys is a great challenge. The sharing of keys with data consumers has proven to be ineffective, especially when considering data-consumer revocation. Security attacks may also prevent the widescale usage of the Cloud for data-sharing purposes. Common security attacks include insider attacks, collusion attacks, and man-in-the-middle attacks. In terms of access control, authorised data consumers could do anything they wish with an owner's data, including sending it to their peers and colleagues without the data owner's knowledge. Throughout this thesis, we investigate ways in which to address these issues. We first propose a key partitioning technique that aims to address the key management problem. We deploy this technique in a number of scenarios, such as remote healthcare management. We also develop secure data-sharing protocols that aim to mitigate and prevent security attacks on the Cloud. Finally, we focus on giving the data owner greater control, by developing a self-controlled software object called SafeProtect

    Pseudonymization and its Application to Cloud-based eHealth Systems

    Get PDF
    Responding to the security and privacy issues of information systems, we propose a novel pseudonym solution. This pseudonym solution has provable security to protect the identities of users by employing user-generated pseudonyms. It also provides an encryption scheme to protect the security of the users’ data stored in the public network. Moreover, the pseudonym solution also provides the authentication of pseudonyms without disclosing the users’ identity information. Thus the dependences on powerful trusted third parties and on the trustworthiness of system administrators may be appreciably alleviated. Electronic healthcare systems (eHealth systems), as one kind of everyday information system, with the ability to store and share patients’ health data efficiently, have to manage in-formation of an extremely personal nature. As a consequence of known cases of abuse and attacks, the security of the health data and the privacy of patients are a great concern for many people and thus becoming obstacles to the acceptance and spread of eHealth systems. In this thesis, we survey current eHealth systems in both research and practice, analyzing potential threats to the security and privacy. Cloud-based eHealth systems, in particular, enable applications with many new features in data storing and sharing. We analyze the new issues on security and privacy when cloud technology is introduced into eHealth systems. We demonstrate that our proposed pseudonym solution can be successfully applied to cloud-based eHealth systems. Firstly, we utilize the pseudonym scheme and encryption scheme for storing and retrieving the electronic health records (EHR) in the cloud. The identities of patients and the confidentiality of EHR contents are provably guaranteed by advanced cryptographic algorithms. Secondly, we utilize the pseudonym solution to protect the privacy of patients from the health insurance companies. Only necessary information about patients is disclosed to the health insurance companies, without interrupting the cur-rent normal business processes of health insurance. At last, based on the pseudonym solution, we propose a new procedure for the secondary use of the health data. The new procedure protects the privacy of patients properly and enables patients’ full control and clear consent over their health data to be secondarily used. A prototypical application of a cloud-based eHealth system implementing our proposed solution is presented in order to exhibit the practicability of the solution and to provide intuitive experiences. Some performance estimations of the proposed solution based on the implementation are also provided.Um gewisse Sicherheits- und Datenschutzdefizite heutiger Informationssysteme zu beheben, stellen wir eine neuartige Pseudonymisierungslösung vor, die benutzergenerierte Pseudonyme verwendet und die Identitäten der Pseudonyminhaber nachweisbar wirksam schützt. Sie beinhaltet neben der Pseudonymisierung auch ein Verschlüsselungsverfahren für den Schutz der Vertraulichkeit der Benutzerdaten, wenn diese öffentlich gespeichert werden. Weiterhin bietet sie ein Verfahren zur Authentisierung von Pseudonymen, das ohne die Offenbarung von Benutzeridentitäten auskommt. Dadurch können Abhängigkeiten von vertrauenswürdigen dritten Stellen (trusted third parties) oder von vertrauenswürdigen Systemadministratoren deutlich verringert werden. Elektronische Gesundheitssysteme (eHealth-Systeme) sind darauf ausgelegt, Patientendaten effizient zu speichern und bereitzustellen. Solche Daten haben ein extrem hohes Schutzbedürfnis, und bekannte Fälle von Angriffen auf die Vertraulichkeit der Daten durch Privilegienmissbrauch und externe Attacken haben dazu geführt, dass die Sorge um den Schutz von Gesundheitsdaten und Patientenidentitäten zu einem großen Hindernis für die Verbreitung und Akzeptanz von eHealth-Systemen geworden ist. In dieser Dissertation betrachten wir gegenwärtige eHealth-Systeme in Forschung und Praxis hinsichtlich möglicher Bedrohungen für Sicherheit und Vertraulichkeit der gespeicherten Daten. Besondere Beachtung finden cloudbasierte eHealth-Systeme, die Anwendungen mit neuartigen Konzepten zur Datenspeicherung und -bereitstellung ermöglichen. Wir analysieren Sicherheits- und Vertraulichkeitsproblematiken, die sich beim Einsatz von Cloud-Technologie in eHealth-Systemen ergeben. Wir zeigen, dass unsere Pseudonymisierungslösung erfolgreich auf cloudbasierte eHealth-Systeme angewendet werden kann. Dabei werden zunächst das Pseudonymisierungs- und das Verschlüsselungsverfahren bei der Speicherung und beim Abruf von elektronischen Gesundheitsdatensätzen (electronic health records, EHR) in der Cloud eingesetzt. Die Vertraulichkeit von Patientenidentitäten und EHR-Inhalten werden dabei durch den Einsatz moderner kryptografischer Algorithmen nachweisbar garantiert. Weiterhin setzen wir die Pseudonymisierungslösung zum Schutz der Privatsphäre der Patienten gegenüber Krankenversicherungsunternehmen ein. Letzteren werden lediglich genau diejenigen Patienteninformationen offenbart, die für den störungsfreien Ablauf ihrer Geschäftsprozesse nötig sind. Schließen schlagen wir eine neuartige Vorgehensweise für die Zweitverwertung der im eHealth-System gespeicherten Daten vor, die die Pseudonymisierungslösung verwendet. Diese Vorgehensweise bietet den Patienten angemessenen Schutz für ihre Privatsphäre und volle Kontrolle darüber, welche Daten für eine Zweitverwertung (z.B. für Forschungszwecke) freigegeben werden. Es wird ein prototypisches, cloudbasiertes eHealth-System vorgestellt, das die Pseudonymisierungslösung implementiert, um deren Praktikabilität zu demonstrieren und intuitive Erfahrungen zu vermitteln. Weiterhin werden, basierend auf der Implementierung, einige Abschätzungen der Performanz der Pseudonymisierungslösung angegeben
    • …
    corecore