Disassociations in Security Policy Lifecycles

Employees’ failure to comply with information systems security policies is a major concern for information technology security managers. In efforts to understand this problem, IS security researchers have traditionally viewed violations of IS security policies through the lens of deterrence theory. In this article, we show that neutralization theory, a theory prominent in Criminology but not yet applied in the context of IS, provides a compelling explanation for IS security policy violations and offers new insight into how employees rationalize this behavior. In doing so, we propose a theoretical model in which the effects of neutralization techniques are tested alongside those of sanctions described by deterrence theory. Our empirical results highlight neutralization as an important factor to take into account with regard to developing and implementing organizational security policies and practices.

Trust represents a fundamental pillar of contemporary security policy, influencing decision-making processes, institutional stability, and the effectiveness of security measures at both national and international levels. This article explores trust as a key precondition for the formulation and implementation of security policy, emphasizing its role in relations between states, within security institutions, and between public authorities and society. The analysis focuses on trust as a multidimensional concept encompassing political legitimacy, transparency, accountability, and the credibility of security actors. Particular attention is paid to the consequences of declining trust, including increased social polarization, weakened resilience of democratic systems, and reduced effectiveness of collective security arrangements. The article argues that building and maintaining trust is not merely a normative objective, but a strategic necessity for ensuring long-term security and stability in an increasingly complex and uncertain security environment.Through comparative analysis of selected European states (Finland, Germany, Czech Republic, Poland, Hungary, France, and Estonia), the paper identifies critical determinants of trust, including transparency, institutional neutrality, crisis communication, and historical path-dependence. The findings demonstrate that trust acts as both an input to and an output of security policy, reinforcing legitimacy through reciprocity between citizens and the state.The article concludes that sustained trust-building must be recognized as a strategic dimension of security governance. Trust-based security strengthens societal resilience, mitigates polarization, and enhances adaptive capacity in hybrid threat environments.

Information security awareness is important among users because it can influence user's behavior towards complying with organization information security policies. Therefore, the current study was conducted to examine information security awareness factors affecting user's compliance behavior towards Health Information System (HIS) security policies based on extended Health Belief Model. The questionnaires were distributed to the respondents at selected public hospitals in Malaysia (N = 454). Statistical results confirm that perceived work experience, perceived severity, perceived benefit, cues to action, self-efficacy and perceived barrier were significant predictors of health information system's security policies compliance behaviour while perceived susceptibility was insignificant. Our findings will prove to be beneficial to fellow researchers and policy makers, especially related to the medical sectors in improving user's behavior toward practicing information security.

Information has become organizations’ most valuable asset, thus being a potential target to threats intending to explore their vulnerabilities and cause considerable damage. Therefore, there is a need to implement policies regarding information systems security (ISS) in an attempt to reduce the chances of fraud or information loss. Thus, it is important to find the critical success factors to the implementation of a security policy as well as to assess the level of importance of each one of them. This paper contributes to the identification of such factors by presenting the results of a survey regarding information systems security policies in small and medium sized enterprises (SME). We discuss the results in the light of a literature framework and identify future works aiming to enhance information security in organizations.

Within the analytic purview of postcolonial feminist theory, this article investigates how women leverage their intelligence-gathering capabilities in Preventing/Countering Violent Extremism (P/CVE) in Nigeria. Although P/CVE is widely perceived as an androcentric project, the threat posed by violent extremism to global peace and security has heightened the clamor for increased involvement of women in the formulation and implementation of peace and security policies in Africa. In 2000, this clamor gained international recognition and support following the adoption of the United Nations Security Council Resolution (UNSCR) 1325 which focuses on Women, Peace and Security (WPS). The resolution acknowledges the disproportionate impact of violent conflict on women and recognizes that women empowerment and gender equality are critical to the attainment of sustainable global peace and security. Notwithstanding, most Euro-American and other global frameworks against women victimization tend to accord the contributions of African women in P/CVE an epiphenomenal consideration. While academic discourses focus more closely on the victim-vanguard narratives of women in relation to terrorism and insurgency, the role of women in intelligence gathering for P/CVE has not received the needed attention in the literature. The universalizing posturing and influence of most global frameworks against women victimization hardly account for the role of African women, with their deep knowledge of their homes, families and communities, as invaluable resource for gathering actionable intelligence crucial for effective P/CVE.

Mobile devices such as smartphones and tablets are widely used for personal and business uses. Compared to personal mobile subscribers, enterprises have more concerns about mobile device security. The challenges an enterprise may face include unlimited access to corporate resources, lack of encryption on corporate data, unwillingness to backup data, etc. Many of these issues have been resolved by auditing and enforcing security policies in enterprise networks. However, it is difficult to audit and enforce security policies on mobile devices. A substantial discrepancy exists between enterprise security policy administration and security policy enforcement. In this paper, we propose a framework, MobileGuardian, for security policy enforcement on mobile devices. Security policy enforcement is further divided into four issues, i.e., sensitive data isolation, security policy formulation, security policy testing, and security policy execution. The proposed framework is secure, flexible, and scalable. It can be adopted on any mobile platforms to implement access control, data confidentiality, security, and integrity.

This chapter provides a critical discussion of the mediatization of policy in general, and of EU foreign and security policy in particular. A common argument in public debate and research is that the media logic is increasingly affecting how policy is formulated. Brommesson and Ekengren are critical of this (as they see it) oversimplified perspective, and they analyse EU foreign and security policy from the opposite point of view in this chapter. Foreign policy is usually described as a conservative policy area, in as much as it is informed by a long-term perspective, and foreign policy is not the subject of public debate to the same extent as other policy areas. Based on this reverse perspective, the authors ask whether policy actors are actually taking advantage of the opportunities provided by mediatization to strengthen long-term policy objectives. The chapter sheds light on the relationship between policy and mediatization through a comparative analysis of two important strategy documents of EU foreign and security policy: the European security strategy of 2003 and the EU global strategy of 2016. The authors discuss the overarching question of whether the formulation of EU foreign and security policy is dominated by media logic, in other words, whether this policy has been mediatized.

Security policies by design in NoSQL document databases

Modern SoC designs incorporate several security policies to protect sensitive assets from unauthorized access. The policies affect multiple design blocks, and may involve subtle interactions between hardware, firmware, and software. This makes it difficult for SoC designers to implement these policies, and system validators to ensure adherence. Associated problems include complexity in upgrading these policies, IP reuse for systems targeted for markets with differing security requirement, and consequent increase in design time and time-to-market. In this paper, we address this important problem by developing a generic, flexible architectural framework for implementing arbitrary security policies in SoC designs. Our architecture has several distinctive features: (1) it relies on a dedicated, centralized, firmware-upgradable plug-and-play IP block that can implement diverse security policies; (2) it interfaces with individual IP blocks through their “security wrapper”, which exploits and extends test/debug wrappers; (3) it implements a security policy as firmware code following existing security policy languages; (4) it can implement any security policy as long as relevant observable and controllable signals from the constituent IPs are accessible through the security wrappers; and (5) it realizes a low-overhead communication link between security wrappers of IP blocks and the centralized, dedicated controller. The approach builds on and extends the recent work on developing a centralized infrastructure IP for SoC security, referred to as IIPS, that interface with IP blocks using their boundary scan based wrappers. While this architecture is generic and independent of security policy types, we provide case studies with several common policies to show the flexibility and extendibility of the architecture. We also evaluate its viability in terms of overhead in area and power.

Despite their importance to the implementation of security and defence policy, less dramatic and more incremental events remain relatively overlooked in the study of security policymaking. Framing these as mid-range instances of security policymaking and applying a norm-dynamics framework, this article addresses that gap. It aims to elucidate how strategic culture, institutionalized norms, and discursive strategies interact to shape this layer of policymaking, drawing on an analysis of the Swedish parliament’s ratification of NATO’s Partnership for Peace programme in 1994 and the Host Nation Support agreement in 2016. The study shows how underlying mechanics in norm dynamics continue to be instrumental for policy transformation in the absence of crisis and war. The findings suggest that institutional inertia rooted in enduring norms acts as a brake on more radical security policy shifts, even when a nation’s security landscape is in flux. The study offers insights relevant for the analysis of the subtler norm dynamics in other parliamentary democracies facing similar mid-range security policy questions. Studying these more modest, incremental forms of policymaking is valuable in a context of shifting power alliances and normative uncertainty in global politics.

Modern SoC designs contain a large number of sensitive assets that must be protected from unauthorized access. Authentication mechanisms which control the access to such assets are governed by complex security policies. The security policies affect multiple design blocks and may involve subtle interactions among hardware, firmware, OS kernel, and applications. The implementation of security policies in an SoC design, often referred to as its security architecture, is a subtle composition of coordinating design modules distributed across the different IPs. Toward this direction, this paper gives an overview of SoC security architectures in modern SoC designs and provides a glimpse of their implementation, as well as their design complexities and functional shortcomings. Design of security architectures involves a complex interplay of requirements from functionality, power, security, and validation. We also outline some of the research needs in the area for developing robust, trustworthy SoC designs.

The main objective of this study is to explain managing complexity through the resource-based view as a strategy for the implementation of food security policy. Because the study so far still focused on the form, type, and its dimensions. The study uses a qualitative design and case study strategy to explain the implementation of food security policy. Techniques of data collection used were observation, depth-interviews, and documentation. Based on the matching patterns and time series analysis, managing the complexity of resource sharing in the implementation of food security policy is not effective. This happens because the resources owned by them are not integrated through the governance network. Besides, the governance network organization does not have a clear vision, so they also behave in a changing manner and controlling their resources. This is shown by each government agency controlling the funds for this program and the extension workers do not have the necessary expertise in the food diversification, rice, and animal food programs. Therefore, resource sharing strategies that have value, rareness, imperfect imitability, and organization can achieve successful implementation of this policy.

With the rapid development of the economy, the problem of population aging has become increasingly prominent. To analyse the key factors affecting population aging effectively and predict the development trend of population aging timely are of great significance for formulating relevant policies scientifically and reasonably, which can mitigate the effects of population aging on society. This paper analyses the current situation of population aging in Wuhan of China and discusses the main factors affecting the population aging quantitatively, and then establishes a combination prediction model to forecast the population aging trend. Firstly, considering the attribute values of the primary influence factors are multi-source heterogeneous data (the real numbers, interval numbers and fuzzy linguistic variables coexist), a two-tuple correlation coefficient analysis method is proposed to rank the importance of the influencing factors and to select the main influencing factors. Secondly, a combination prediction model named Multiple Linear Regression Analysis-Autoregressive Integrated Moving Average is established to predict the number and the proportion of aging population in Wuhan. By using the statistical data of Wuhan in the past 20 years, this combination prediction model is used for empirical analysis, and a prediction result of the number and the proportion of aging people in Wuhan in the future is obtained. Based on these quantitative analysis results, we propose some countermeasures and suggestions on how to alleviate the population aging of Wuhan from aspects of economic development, pension security system design and policy formulation, which provide theoretical basis and method reference for relevant population management departments to make scientific decisions.

Despite increasing investment in information security and its strategic role in today’s business success, effective implementation of information security strategies still remains one of the top challenges facing global organizations. This study investigated Information Security Policy compliance of staff members of a municipality in South Africa. Factors such as information security policy, security policy strategic planning, policy implementation and compliance were considered. A questionnaire was distributed to 80 staff members from different sections in this municipality and a response rate of 100% was achieved. The study findings showed that the majority of employees are largely in support of the municipality’s efforts to develop and implement a security policy framework. They also concur that compliance to security policy safeguards and prevents intrusion information, theft and "denial of service". Among other issues, it is recommended that more training and awareness campaigns should be done to all employees in order to improve security of information in this municipality. The study results can be limited by the small number of the population as indicated that the sample was equal to the population (N=n).

Despite acute international tensions, the EU has failed to exert influence, especially in security matters most requiring heroic leadership. The EU has no defence responsibility or capability, and seeks indirect influence through the Common Foreign and Security Policy, the Anglo-French European Security and Defence Policy, and through other policies. The main actors are the Council Secretariat and the Political and Security Committee, but lack of clear institutional lines of authority results in disputes, notably over relations with NATO and policy implementation despite the efforts of the High Representative for foreign policy. Because foreign and security policy are member state responsibilities, the EU is condemned to leaderlessness and concentration on non-military tasks and ambitious schemes are unrealistic. It should reduce institutional overlap to achieve greater coherence in action.