Information & Computer Security最新文献

{"title":"Cybersecurity in modern cars: awareness and readiness of auto workshops","authors":"David Hedberg, Martin Lundgren, Marcus Nohlberg","doi":"10.1108/ics-11-2023-0211","DOIUrl":"https://doi.org/10.1108/ics-11-2023-0211","url":null,"abstract":"\u0000Purpose\u0000This study aims to explore auto mechanics awareness of repairs and maintenance related to the car’s cybersecurity and provide insights into challenges based on current practice.\u0000\u0000\u0000Design/methodology/approach\u0000This study is based on an empirical study consisting of semistructured interviews with representatives from both branded and independent auto workshops. The data was analyzed using thematic analysis. A version of the capability maturity model was introduced to the respondents as a self-evaluation of their cybersecurity awareness.\u0000\u0000\u0000Findings\u0000Cybersecurity was not found to be part of the current auto workshop work culture, and that there is a gap between independent workshops and branded workshops. Specifically, in how they function, approach problems and the tools and support available to them to resolve (particularly regarding previously unknown) issues.\u0000\u0000\u0000Research limitations/implications\u0000Only auto workshop managers in Sweden were interviewed for this study. This role was picked because it is the most likely to have come in contact with cybersecurity-related issues. They may also have discussed the topic with mechanics, manufacturers or other auto workshops – thus providing a broader view of potential issues or challenges.\u0000\u0000\u0000Practical implications\u0000The challenges identified in this study offers actionable advice to car manufacturers, branded workshops and independent workshops. The goal is to further cooperation, improve knowledge sharing and avoid unnecessary safety or security issues.\u0000\u0000\u0000Originality/value\u0000As cars become smarter, they also become potential targets for cyberattacks, which in turn poses potential threats to human safety. However, research on auto workshops, which has previously ensured that cars are road safe, has received little research attention with regards to the role cybersecurity can play in repairs and maintenance. Insights from auto workshops can therefore shed light upon the unique challenges and issues tied to the cybersecurity of cars, and how they are kept up-to-date and road safe in the digital era.\u0000","PeriodicalId":165951,"journal":{"name":"Information & Computer Security","volume":"46 25","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-02-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"139687958","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Getting users to click: a content analysis of phishers’ tactics and techniques in mobile instant messaging phishing","authors":"Rufai Ahmad, S. Terzis, Karen Renaud","doi":"10.1108/ics-11-2023-0206","DOIUrl":"https://doi.org/10.1108/ics-11-2023-0206","url":null,"abstract":"\u0000Purpose\u0000This study aims to investigate how phishers apply persuasion principles and construct deceptive URLs in mobile instant messaging (MIM) phishing.\u0000\u0000\u0000Design/methodology/approach\u0000In total, 67 examples of real-world MIM phishing attacks were collected from various online sources. Each example was coded using established guidelines from the literature to identify the persuasion principles, and the URL construction techniques employed.\u0000\u0000\u0000Findings\u0000The principles of social proof, liking and authority were the most widely used in MIM phishing, followed by scarcity and reciprocity. Most phishing examples use three persuasion principles, often a combination of authority, liking and social proof. In contrast to email phishing but similar to vishing, the social proof principle was the most commonly used in MIM phishing. Phishers implement the social proof principle in different ways, most commonly by claiming that other users have already acted (e.g. crafting messages that indicate the sender has already benefited from the scam). In contrast to email, retail and fintech companies are the most commonly targeted in MIM phishing. Furthermore, phishers created deceptive URLs using multiple URL obfuscation techniques, often using spoofed domains, to make the URL complex by adding random characters and using homoglyphs.\u0000\u0000\u0000Originality/value\u0000The insights from this study provide a theoretical foundation for future research on the psychological aspects of phishing in MIM apps. The study provides recommendations that software developers should consider when developing automated anti-phishing solutions for MIM apps and proposes a set of MIM phishing awareness training tips.\u0000","PeriodicalId":165951,"journal":{"name":"Information & Computer Security","volume":"327 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-01-31","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"140474265","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Exploring the critical success factors of information security management: a mixed-method approach","authors":"Hao Chen, Yuge Hai","doi":"10.1108/ics-03-2023-0034","DOIUrl":"https://doi.org/10.1108/ics-03-2023-0034","url":null,"abstract":"\u0000Purpose\u0000Effective information security management (ISM) contributes to building a healthy organizational digital ecology. However, few studies have built an analysis framework for critical influencing factors to discuss the combined influence mechanism of multiple factors on ISM performance (ISMP). This study aims to explore the critical success factors and understand how these factors contribute to ISMP.\u0000\u0000\u0000Design/methodology/approach\u0000This study used a mixed-method approach to achieve this study’s research goals. In Study 1, the authors conducted a qualitative analysis to take a series of International Organization for Standardization/International Electrotechnical Commission standard documents as the basis to refine the critical factors that may influence organizations’ ISMP. In Study 2, the authors built a research model based on the organizational control perspective and used the survey-based partial least squares-based structural equation modeling (PLS-SEM) approach to understand the relationships between these factors in promoting ISMP. In Study 3, the authors used the fuzzy set qualitative comparative analysis (fsQCA) method to empirically analyze the complex mechanisms of how the combinations of the factors affect ISMP.\u0000\u0000\u0000Findings\u0000The following three research findings are obtained. First, based on the text-based qualitative analysis, the authors refined the critical success factors that may increase ISMP, including information security policies (ISP), top management support (TMS), alignment (ALI), information security risk assessment (IRA), information security awareness (ISA) and information security culture (ISC). Second, the PLS-SEM testing results confirmed TMS is the antecedent variable motivating organization’s formation (ISP) and information control (ISC) approaches; these two types of organization control approaches increase IRA, ISA and ALI and then promote ISMP directly and indirectly. Third, the fsQCA testing results found two configurations that can achieve high ISMP and one driving path that leads to non-high ISMP.\u0000\u0000\u0000Originality/value\u0000This study extends knowledge by exploring configuration factors to improve or impede the performances of organizations’ ISM. To the best of the authors’ knowledge, this study is one of the first to explore the use of the fsQCA approach in information security studies, and the results not only revealed causal associations between single factors but also highlighted the critical role of configuration factors in developing organizational ISMP. This study calls attention to information security managers of an organization should highlight the combined effect between the factors and reasonably allocate organizational resources to achieve high ISMP.\u0000","PeriodicalId":165951,"journal":{"name":"Information & Computer Security","volume":"131 44","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-01-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"139604925","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Ethical hardware reverse engineering for securing the digital supply chain in critical infrastructure","authors":"Arne Roar Nygård, S. Katsikas","doi":"10.1108/ics-10-2023-0182","DOIUrl":"https://doi.org/10.1108/ics-10-2023-0182","url":null,"abstract":"\u0000Purpose\u0000This paper aims to discuss the ethical aspects of hardware reverse engineering (HRE) and propose an ethical framework for HRE when used to mitigate cyber risks of the digital supply chain of critical infrastructure operators.\u0000\u0000\u0000Design/methodology/approach\u0000A thorough review and analysis of existing relevant literature was performed to establish the current state of knowledge in the field. Ethical frameworks proposed for other areas/disciplines and identified pertinent ethical principles have been used to inform the proposed framework’s development.\u0000\u0000\u0000Findings\u0000The proposed framework provides actionable guidance to security professionals engaged with such activities to support them in assessing whether an HRE project conforms to ethical principles. Recommendations on action needed to complement the framework are also proposed. According to the proposed framework, reverse engineering is neither unethical nor illegal if performed honourably. Collaboration with vendors and suppliers at an industry-wide level is critical for appropriately endorsing the proposed framework.\u0000\u0000\u0000Originality/value\u0000To the best of the authors’ knowledge, no ethical framework currently guides cybersecurity research, far less of cybersecurity vulnerability research and reverse engineering.\u0000","PeriodicalId":165951,"journal":{"name":"Information & Computer Security","volume":" 10","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-01-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"139621805","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Detecting deception in computer-mediated communication: the role of popularity information across media types","authors":"A. Mirsadikov, Ali Vedadi, Kent Marett","doi":"10.1108/ics-06-2023-0103","DOIUrl":"https://doi.org/10.1108/ics-06-2023-0103","url":null,"abstract":"\u0000Purpose\u0000With the widespread use of online communications, users are extremely vulnerable to a myriad of deception attempts. This study aims to extend the literature on deception in computer-mediated communication by investigating whether the manner in which popularity information (PI) is presented and media richness affects users’ judgments.\u0000\u0000\u0000Design/methodology/approach\u0000This study developed a randomized, within and 2 × 3 between-subject experimental design. This study analyzed the main effects of PI and media richness on the imitation magnitude of veracity judges and the effect of the interaction between PI and media richness on the imitation magnitude of veracity judges.\u0000\u0000\u0000Findings\u0000The manner in which PI is presented to people affects their tendency to imitate others. Media richness also has a main effect; text-only messages resulted in greater imitation magnitude than those viewed in full audiovisual format. The findings showed an interaction effect between PI and media richness.\u0000\u0000\u0000Originality/value\u0000The findings of this study contribute to the information systems literature by introducing the notion of herd behavior to judgments of truthfulness and deception. Also, the medium over which PI was presented significantly impacted the magnitude of imitation tendency: PI delivered through text-only medium led to a greater extent of imitation than when delivered in full audiovisual format. This suggests that media richness alters the degree of imitating others’ decisions such that the leaner the medium, the greater the expected extent of imitation.\u0000","PeriodicalId":165951,"journal":{"name":"Information & Computer Security","volume":"11 19","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-01-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"139437857","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Human factors and cyber-security risks on the railway – the critical role played by signalling operations","authors":"Eylem Thron, Shamal Faily, Huseyin Dogan, Martin Freer","doi":"10.1108/ics-05-2023-0078","DOIUrl":"https://doi.org/10.1108/ics-05-2023-0078","url":null,"abstract":"\u0000Purpose\u0000Railways are a well-known example of complex critical infrastructure, incorporating socio-technical systems with humans such as drivers, signallers, maintainers and passengers at the core. The technological evolution including interconnectedness and new ways of interaction lead to new security and safety risks that can be realised, both in terms of human error, and malicious and non-malicious behaviour. This study aims to identify the human factors (HF) and cyber-security risks relating to the role of signallers on the railways and explores strategies for the improvement of “Digital Resilience” – for the concept of a resilient railway.\u0000\u0000\u0000Design/methodology/approach\u0000Overall, 26 interviews were conducted with 21 participants from industry and academia.\u0000\u0000\u0000Findings\u0000The results showed that due to increased automation, both cyber-related threats and human error can impact signallers’ day-to-day operations – directly or indirectly (e.g. workload and safety-critical communications) – which could disrupt the railway services and potentially lead to safety-related catastrophic consequences. This study identifies cyber-related problems, including external threats; engineers not considering the human element in designs when specifying security controls; lack of security awareness among the rail industry; training gaps; organisational issues; and many unknown “unknowns”.\u0000\u0000\u0000Originality/value\u0000The authors discuss socio-technical principles through a hexagonal socio-technical framework and training needs analysis to mitigate against cyber-security issues and identify the predictive training needs of the signallers. This is supported by a systematic approach which considers both, safety and security factors, rather than waiting to learn from a cyber-attack retrospectively.\u0000","PeriodicalId":165951,"journal":{"name":"Information & Computer Security","volume":"60 26","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-01-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"139390021","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"An exploration of dark and light triad personality traits towards situational crime prevention and compliant information security behaviour","authors":"Keshnee Padayachee","doi":"10.1108/ics-04-2023-0069","DOIUrl":"https://doi.org/10.1108/ics-04-2023-0069","url":null,"abstract":"Purpose This investigation serves a dual purpose: providing preliminary results and serving as a pilot study to confirm the viability of the hypotheses advanced towards a full-scale study. This paper aims to present the preliminary findings of an investigation that explored the constructs of personality traits and situational crime prevention theory (SCPT) as antecedents to social cognitive determinants (attitude, perceived behavioural control and subjective norms using the theory of planned behaviour [TPB] framing) and how these elements subsequently estimate compliant information security behaviour. Moreover, this paper delves into the contrasting influences of light and dark personality traits on insider information security compliance. Design/methodology/approach A cross-sectional survey was conducted to study SCPT measures and the personality factors dyad using a diverse but limited sample (n = 82). Findings There were ten significant direct relationships between SCPT factors and personality traits related to the components of the TPB. Seventeen hypotheses were not supported. However, these findings highlight the complexity of the topic under study. Practical implications Understanding individual differences within the compliance model could be used for custom training protocols, employee selection, assignment and specific types of information security interventions. Originality/value There is a scarcity of studies considering the effects of situational and personality factors, specifically the dark versus light triad of personality traits within the information security domain. Therefore, this preliminary result provides early insight that could guide further studies. This research could have important implications for organisations at risk of insider attacks.","PeriodicalId":165951,"journal":{"name":"Information & Computer Security","volume":"30 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"139129018","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Exploring users’ attitude towards privacy-preserving search engines: a protection motivation theory approach","authors":"A. Skalkos, A. Tsohou, Maria Karyda, S. Kokolakis","doi":"10.1108/ics-08-2022-0142","DOIUrl":"https://doi.org/10.1108/ics-08-2022-0142","url":null,"abstract":"\u0000Purpose\u0000Search engines, the most popular online services, are associated with several concerns. Users are concerned about the unauthorized processing of their personal data, as well as about search engines keeping track of their search preferences. Various search engines have been introduced to address these concerns, claiming that they protect users’ privacy. The authors call these search engines privacy-preserving search engines (PPSEs). This paper aims to investigate the factors that motivate search engine users to use PPSEs.\u0000\u0000\u0000Design/methodology/approach\u0000This study adopted protection motivation theory (PMT) and associated its constructs with subjective norms to build a comprehensive research model. The authors tested the research model using survey data from 830 search engine users worldwide.\u0000\u0000\u0000Findings\u0000The results confirm the interpretive power of PMT in privacy-related decision-making and show that users are more inclined to take protective measures when they consider that data abuse is a more severe risk and that they are more vulnerable to data abuse. Furthermore, the results highlight the importance of subjective norms in predicting and determining PPSE use. Because subjective norms refer to perceived social influences from important others to engage or refrain from protective behavior, the authors reveal that the recommendation from people that users consider important motivates them to take protective measures and use PPSE.\u0000\u0000\u0000Research limitations/implications\u0000Despite its interesting results, this research also has some limitations. First, because the survey was conducted online, the study environment was less controlled. Participants may have been disrupted or affected, for example, by the presence of others or background noise during the session. Second, some of the survey items could possibly be misinterpreted by the respondents in the study questionnaire, as they did not have access to clarifications that a researcher could possibly provide. Third, another limitation refers to the use of the Amazon Turk tool. According Paolacci and Chandler (2014) in comparison to the US population, the MTurk workers are more educated, younger and less religiously and politically diverse. Fourth, another limitation of this study could be that Actual Use of PPSE is self-reported by the participants. This could cause bias because it is argued that internet users’ statements may be in contrast with their actions in real life or in an experimental scenario (Berendt et al., 2005, Jensen et al., 2005); Moreover, some limitations of this study emerge from the use of PMT as the background theory of the study. PMT identifies the main factors that affect protection motivation, but other environmental and cognitive factors can also have a significant role in determining the way an individual’s attitude is formed. As Rogers (1975) argued, PMT as proposed does not attempt to specify all of the possible factors in a fear appeal that may affect persuasion, but ra","PeriodicalId":165951,"journal":{"name":"Information & Computer Security","volume":"3 s4","pages":""},"PeriodicalIF":0.0,"publicationDate":"2023-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"138621365","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Do you want a secure e-wallet? Understanding the role of risk and security in e-wallet continuance intention","authors":"WeiLee Lim, Uma Thevi Munikrishnan, Choi-Meng Leong, L. Hiew, Mei-Wei Leong, Liu Yang","doi":"10.1108/ics-05-2023-0085","DOIUrl":"https://doi.org/10.1108/ics-05-2023-0085","url":null,"abstract":"Purpose This study aims to explore e-wallet continuance intention in Malaysia using perceived usefulness (PU), perceived ease of use (PEU), perceived risk (PR) and perceived security (PS). Additional emphasis is placed on the degree of necessity of risk and security conditions driving the continuance intention to use e-wallets. Design/methodology/approach This quantitative study used a sample of 281 respondents. Partial least-squares structural equation modelling (PLS-SEM) was used to test the associations, while necessary condition analysis (NCA) was performed to uncover the factors’ necessity level. Findings PU is the primary facilitator for the continuance intention of e-wallet usage, followed by PS, PR and PEU. However, none were necessary for usage. E-wallet providers must emphasise enhancing PU, prioritise data security and improve the PEU to foster sustained e-wallet usage, while prudent risk management is a nice-to-have. Practical implications To maintain the survival of e-wallets, service providers must focus on prioritising PEU, PU and PS for positive user experiences, including contentment, utility, convenience, comfort and safety. Compliance with user authorisation, real-time transaction monitoring and comprehensive security protocols is a must for security concerns. Originality/value This study represents the limited empirical research focusing on risk and security in the continuance intention of e-wallet usage. Furthermore, an NCA was performed to determine the essential circumstances of risk and security for the continuance intention of e-wallets.","PeriodicalId":165951,"journal":{"name":"Information & Computer Security","volume":"14 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2023-11-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"139230593","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"European Artificial Intelligence Act: an AI security approach","authors":"Konstantinos Kalodanis, Panagiotis Rizomiliotis, D. Anagnostopoulos","doi":"10.1108/ics-10-2022-0165","DOIUrl":"https://doi.org/10.1108/ics-10-2022-0165","url":null,"abstract":"Purpose The purpose of this paper is to highlight the key technical challenges that derive from the recently proposed European Artificial Intelligence Act and specifically, to investigate the applicability of the requirements that the AI Act mandates to high-risk AI systems from the perspective of AI security. Design/methodology/approach This paper presents the main points of the proposed AI Act, with emphasis on the compliance requirements of high-risk systems. It matches known AI security threats with the relevant technical requirements, it demonstrates the impact that these security threats can have to the AI Act technical requirements and evaluates the applicability of these requirements based on the effectiveness of the existing security protection measures. Finally, the paper highlights the necessity for an integrated framework for AI system evaluation. Findings The findings of the EU AI Act technical assessment highlight the gap between the proposed requirements and the available AI security countermeasures as well as the necessity for an AI security evaluation framework. Originality/value AI Act, high-risk AI systems, security threats, security countermeasures.","PeriodicalId":165951,"journal":{"name":"Information & Computer Security","volume":"290 7","pages":""},"PeriodicalIF":0.0,"publicationDate":"2023-11-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"139246034","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}