Information security trust and outcomes : a case study of compliance in a complex system

As recent high-profile data breaches illustrate, an organization that complies with information security control frameworks can also suffer from successful attacks and the subsequent erosion of trust. Information security frameworks used in the federal, payment, and health care industries use a core catalogue of security controls to standardize practices and facilitate assessment. In theory, an organization implementing these standard controls and practices would maintain sufficient security to protect sensitive data. However, these catalogues of controls require resources to implement and change slowly compared to the evolution of technology and threats. Viewed as a static set of rules in a dynamic complex system, the implementation of catalogues of controls may not create predictable outcomes, or act as reliable indicators of the quality of an organization’s security program. I used a case study approach to analyze an organization’s security outcomes during a period when control catalogue implementation transitioned from a best practice to a regulatory mandate I analyzed the organization through the perspective of a complex adaptive system, identifying the complex properties of the organization and its information security team as they endeavored to ensure strict compliance with the control catalogues. I collected data on factors related to the organization’s security outcomes, as well as finances, strategy, and governance. Despite significant changes in IT intensity, strategy, and corporate leadership, the security outcomes faltered and recovered, as emergent processes evolved from the dynamic environment. The compliance results, however, were ambiguous. The formal third-party compliance assessment presented outcomes that overstated the impact of isolated controls from the catalogue, while failing to highlight the broader issues related to organizational risk. This prevented the compliance assessment from representing the true state of security of the organization’s systems. I conclude that the current method of assessing the quality of an organization’s information security program against a control catalogue does not provide sufficient information to establish meaningful trust between organizations. Alternate method that requires a broader perspective of risk may improve the reliability of assessments and provide a more meaningful method to communicate trust.Informatio

An Analysis of Changing Transparency Regarding Cybersecurity in Annual Reports

This paper studies the annual reports of 75 listed firms in the Netherlands in relation to the disclosure of cybersecurity information from a financial law and economics perspective in four consecutive financial years (2018-2021). Also, we study legislative developments (especially in the US) regarding cybersecurity disclosure requirements. Furthermore, we discuss the social and private costs and benefits of cybersecurity transparency. We draft hypotheses regarding the actual disclosure of cybersecurity information and propose a research design of an empirical study covering four financial years. The results of our study show that over time disclosing information regarding cybersecurity increases. However, the information value of the disclosures could improve since companies still disclose mostly technical measures that are hard to compare. In order for these efforts to have a social benefits, harmonization efforts need to be made

AI leadership and the future of corporate governance: Changing demands for board competence

This chapter focuses on the future of one subset of labor - corporate boards. Corporate boards make complex strategic decisions in uncertain environments, such as mergers and acquisitions, new product launches and digital transformation, all of which influence organizations and the nature of labor. However, corporate boards are increasingly struggling due to digitalization, and it is predicted that artificial intelligence (AI), and the “big data” on which AI is based, will become one of the greatest board issues in the next ten years. There is currently limited research on how corporate boards should respond to this challenge. Thus, this chapter presents preliminary results from a research project that includes a systematic literature review and expert interviews, while also touching on how AI could change the future of board work. The findings indicate that boards will need to develop two competence areas to successfully steward firms into an AI-based future: (1) guiding AI operational capability and (2) supervising AI governance capability. The Boards 4 AI Leadership Matrix is presented as a tool to facilitate the development of these competence areas. This chapter concludes that the future boards are unlikely to be replaced by automatization within the foreseeable future although AI is expected to have a fundamental impact on board work

Internet... the final frontier: an ethnographic account: exploring the cultural space of the Net from the inside

The research project The Internet as a space for interaction, which completed its mission in Autumn 1998, studied the constitutive features of network culture and network organisation. Special emphasis was given to the dynamic interplay of technical and social conventions regarding both the Net’s organisation as well as its change. The ethnographic perspective chosen studied the Internet from the inside. Research concentrated upon three fields of study: the hegemonial operating technology of net nodes (UNIX) the network’s basic transmission technology (the Internet Protocol IP) and a popular communication service (Usenet). The project’s final report includes the results of the three branches explored. Drawing upon the development in the three fields it is shown that changes that come about on the Net are neither anarchic nor arbitrary. Instead, the decentrally organised Internet is based upon technically and organisationally distributed forms of coordination within which individual preferences collectively attain the power of developing into definitive standards. --

Social and Human Capital Contributions of Diverse Board Members

While most firms serve a diverse population, many have no minorities or women serving as Members on their board. Boards are disadvantaged when their composition fails to align with Their employee population or the stakeholder groups they serve; they are neglecting the Contributions of women and minorities as their voices are unheard. The purpose of this multiple Case comparison study builds on current boardroom diversity and board effectiveness research by Exploring how the unique human and social capital contributions of women and minority board Members increase the boards’ capabilities and impact board governance. I qualitatively examined Six boards of varied demographic diversity, systematically analyzing data from multiple sources Including board member interviews, on-site observations of the board meeting interactions, and Archival examination of annual reports to understand performance. The findings revealed the Diverse board members human and social capital coupled with their contribution of learned Strategies and unique interactions resulted in a positive influence on both the board and firm Effectiveness. Based on my findings I developed the Optimal Imperviousness Theory to speak to Strategies that are deployed by women and minority members as coping mechanisms in their Interactions with the dominate culture. Additionally, a Board Competency Matrix was created for Those charged with diversifying boards and a communication process that is captured with the Acronym ‘STUDS’ can be used to guide future research and practice

Internet... the final frontier: an ethnographic account ; exploring the cultural space of the net from the inside

"The research project 'The Internet as a space for interaction', which completed its mission in Autumn 1998, studied the constitutive features of network culture and network organisation. Special emphasis was given to the dynamic interplay of technical and social conventions regarding both the net's organisation as well as its change. The ethnographic perspective chosen studied the Internet from the inside. Research concentrated upon three fields of study: the hegemonial operating technology of net nodes (UNIX) the network’s basic transmission technology (the Internet Protocol IP) and a popular communication service (Usenet). The project's final report includes the results of the three branches explored. Drawing upon the development in the three fields it is shown that changes that come about on the Net are neither anarchic nor arbitrary. Instead, the decentrally organised Internet is based upon technically and organisationally distributed forms of coordination within which individual preferences collectively attain the power of developing into definitive standards." (author's abstract)"Das im Herbst 1998 abgeschlossene Forschungsprojekt 'Interaktionsraum Internet' hat sich mit den konstitutiven Merkmalen der Netzkultur und Netzwerkorganisation beschäftigt. Im Vordergrund des Interesses stand das dynamische Zusammenspiel technischer und gesellschaftlicher Konventionen in der Organisation wie auch im Wandel des Netzes. Die ethnographisch angeleitete Binnenperspektive auf das Internet konzentrierte sich auf drei ausgewählte Bereiche, um Prozesse der Institutionenbildung und die Formen ihrer Transformation zu studieren: die hegemoniale Betriebstechnik der Netzknoten (UNIX), die grundlegende Übertragungstechnik im Netz (das Internet Protokoll IP) und einen populären Kommunikationsdienst (Usenet). Der Schlußbericht des Projekts enthält die Ergebnisse der drei Untersuchungsstränge. Gezeigt wird anhand der Entwicklung in den drei Feldern, daß sich der Wandel des Netzes weder beliebig noch anarchisch vollzieht. Das dezentral organisierte Internet beruht vielmehr auf technisch wie organisatorisch verteilten Formen der Koordination, in denen individuelle Handlungspräferenzen kollektiv definitionsmächtig werden." (Autorenreferat

AUTOMATED NETWORK SECURITY WITH EXCEPTIONS USING SDN

Campus networks have recently experienced a proliferation of devices ranging from personal use devices (e.g. smartphones, laptops, tablets), to special-purpose network equipment (e.g. firewalls, network address translation boxes, network caches, load balancers, virtual private network servers, and authentication servers), as well as special-purpose systems (badge readers, IP phones, cameras, location trackers, etc.). To establish directives and regulations regarding the ways in which these heterogeneous systems are allowed to interact with each other and the network infrastructure, organizations typically appoint policy writing committees (PWCs) to create acceptable use policy (AUP) documents describing the rules and behavioral guidelines that all campus network interactions must abide by. While users are the audience for AUP documents produced by an organization\u27s PWC, network administrators are the responsible party enforcing the contents of such policies using low-level CLI instructions and configuration files that are typically difficult to understand and are almost impossible to show that they do, in fact, enforce the AUPs. In other words, mapping the contents of imprecise unstructured sentences into technical configurations is a challenging task that relies on the interpretation and expertise of the network operator carrying out the policy enforcement. Moreover, there are multiple places where policy enforcement can take place. For example, policies governing servers (e.g., web, mail, and file servers) are often encoded into the server\u27s configuration files. However, from a security perspective, conflating policy enforcement with server configuration is a dangerous practice because minor server misconfigurations could open up avenues for security exploits. On the other hand, policies that are enforced in the network tend to rarely change over time and are often based on one-size-fits-all policies that can severely limit the fast-paced dynamics of emerging research workflows found in campus networks. This dissertation addresses the above problems by leveraging recent advances in Software-Defined Networking (SDN) to support systems that enable novel in-network approaches developed to support an organization\u27s network security policies. Namely, we introduce PoLanCO, a human-readable yet technically-precise policy language that serves as a middle-ground between the imprecise statements found in AUPs and the technical low-level mechanisms used to implement them. Real-world examples show that PoLanCO is capable of implementing a wide range of policies found in campus networks. In addition, we also present the concept of Network Security Caps, an enforcement layer that separates server/device functionality from policy enforcement. A Network Security Cap intercepts packets coming from, and going to, servers and ensures policy compliance before allowing network devices to process packets using the traditional forwarding mechanisms. Lastly, we propose the on-demand security exceptions model to cope with the dynamics of emerging research workflows that are not suited for a one-size-fits-all security approach. In the proposed model, network users and providers establish trust relationships that can be used to temporarily bypass the policy compliance checks applied to general-purpose traffic -- typically by network appliances that perform Deep Packet Inspection, thereby creating network bottlenecks. We describe the components of a prototype exception system as well as experiments showing that through short-lived exceptions researchers can realize significant improvements for their special-purpose traffic

Computer Science 2019 APR Self-Study & Documents

UNM Computer Science APR self-study report and review team report for Spring 2019, fulfilling requirements of the Higher Learning Commission

BallotShare:an exploration of the design space for digital voting in the workplace

Digital voting is used to support group decision-making in a variety of contexts ranging from politics to mundane everyday collaboration, and the rise in popularity of digital voting has provided an opportunity to re-envision voting as a social tool that better serves democracy. A key design goal for any group decision-making system is the promotion of participation, yet there is little research that explores how the features of digital voting systems themselves can be shaped to configure participation appropriately. In this paper we propose a framework that explores the design space of digital voting from the perspective of participation. We ground our discussion in the design of a social media polling tool called BallotShare; a first instantiation of our proposed framework designed to facilitate the study of decision-making practices in a workplace environment. Across five weeks, participants created and took part in non-standard polls relating to events and other spontaneous group decisions. Following interviews with participants we identified significant drivers and limitations of individual and collective participation in the voting process: social visibility, social inclusion, commitment and delegation, accountability, influence and privacy

Governance of Dual-Use Technologies: Theory and Practice

The term dual-use characterizes technologies that can have both military and civilian applications. What is the state of current efforts to control the spread of these powerful technologies—nuclear, biological, cyber—that can simultaneously advance social and economic well-being and also be harnessed for hostile purposes? What have previous efforts to govern, for example, nuclear and biological weapons taught us about the potential for the control of these dual-use technologies? What are the implications for governance when the range of actors who could cause harm with these technologies include not just national governments but also non-state actors like terrorists? These are some of the questions addressed by Governance of Dual-Use Technologies: Theory and Practice, the new publication released today by the Global Nuclear Future Initiative of the American Academy of Arts and Sciences. The publication's editor is Elisa D. Harris, Senior Research Scholar, Center for International Security Studies, University of Maryland School of Public Affairs. Governance of Dual-Use Technologies examines the similarities and differences between the strategies used for the control of nuclear technologies and those proposed for biotechnology and information technology. The publication makes clear the challenges concomitant with dual-use governance. For example, general agreement exists internationally on the need to restrict access to technologies enabling the development of nuclear weapons. However, no similar consensus exists in the bio and information technology domains. The publication also explores the limitations of military measures like deterrence, defense, and reprisal in preventing globally available biological and information technologies from being misused. Some of the other questions explored by the publication include: What types of governance measures for these dual-use technologies have already been adopted? What objectives have those measures sought to achieve? How have the technical characteristics of the technology affected governance prospects? What have been the primary obstacles to effective governance, and what gaps exist in the current governance regime? Are further governance measures feasible? In addition to a preface from Global Nuclear Future Initiative Co-Director Robert Rosner (University of Chicago) and an introduction and conclusion from Elisa Harris, Governance of Dual-Use Technologiesincludes:On the Regulation of Dual-Use Nuclear Technology by James M. Acton (Carnegie Endowment for International Peace)Dual-Use Threats: The Case of Biotechnology by Elisa D. Harris (University of Maryland)Governance of Information Technology and Cyber Weapons by Herbert Lin (Stanford University