Foundations and Practice of Security

Digitalisation in healthcare can be a double-edged sword. While it improves the efficiency of healthcare operations through IT infrastructure, its security and privacy concerns can be life-threatening, posing danger to the very lives that healthcare exists to safeguard. Motivated by this, we combined focus-group discussion and observational methods to assess the cyber security situations in two hospitals that have migrated to paperless systems in Ghana. Paperless systems involve the adoption of the Electronic Health Record (EHR) system by hospitals and are usually hosted within healthcare IT infrastructure. This is one of the few studies that has used the ethnographic investigation method to reveal the nature of security and privacy practice in hospitals, with the aim to enhance security practices in health-care. The findings revealed that the participants understood various areas of security practice knowledge; however, this did not translate into their security behaviour, as various security gaps were identified. System misuse and security and privacy violations, characterised by password sharing, authentication sharing, unauthorised access to patient information and physical security issues, were associated with the security practice of the healthcare staff. The causes of these security malpractices were attributed to factors such as peer pressure, bad moral conduct (e.g. personal gain), work factors and security development issues. Based on the assessment, practical implications were suggested to the hospitals. In addition, hospitals that are migrating to paperless systems were advised to establish fundamental security structures, such as security policy establishment and the right security personnel, to averse such security menace.

This article focuses on how small businesses (fewer than 500 employees) are managing information security and the associated risks. Our findings indicate that the businesses interviewed for this study are taking many of the typical steps that are indicative of best security practices. However, there are also several areas of concern that could potentially leave their systems open to threats.

In recent times, the human element plays a major role in the surge of data breaches in healthcare. As a result, we hypothesized that there are gaps between the information security (IS) practices of the healthcare staff and the security policies. We further opined that if there are gaps, the causes could be culminating from poor work factors, personality, psychological, social and cultural perception issues. As a result, a survey was conducted with three departments in a typical hospital to assess a broad range of these factors. From the study results, the healthcare staff' IS knowledge and their self reported IS conscious care behaviour (ISCCB) showed a gap in their security practices. About half of the respondents' responses were in a higher risk region. In exploring for the reasons for these gaps, Workload showed a negative significant correlation (r=-0.346, p-value= 0.05) with information security-conscious care behaviour(ISCCB) risk and perceived barrier risk (r=-.363, pvalue=0.05). But, the hospital information security culture showed negative significant correlation with perceived vulnerability (r=-0.316, pvalue= 0.05), cues to action (r=-0.508,pvalue=0.01), and punishment severity (r=-0.425, pvalue=0.05). Based on the findings of this study, some intrinsic and extrinsic motivational factors can be explored to improve the security perceptions, and security culture of the hospital if causality is established.

The purpose of this panel is to provide a forum to discuss the main IT security issues confronting organizations today. The panelists and attendees will discuss the existing gap between current IT security practices vs. best practices based on survey trends on IT security for the past 5 years, explore popular models used to justify IT security investments, and showcase some of the most popular hacking tools to demonstrate why it is so easy to compromise organizational IT security assets. The panel will conclude by discussing the emerging IT security standards and practices that may help deter, detect, and mitigate the impact of cyber-attacks. As the title suggests, we posit the question: Is Managing IT Security a Mirage?

The integration of generative AI in software organizations presents promising opportunities for automating and enhancing security activities; however, its practical impact on the security practices of software organizations and associated risks remains underexplored. This study investigates how generative AI can enhance software security practices through a multi-case study involving five software organizations. By conducting semi-structured interviews with developers and managers, we identified four security practices where generative AI can support threat assessment, security testing, operational management, and education & guidance. At the same time, we uncover sociotechnical risks that may impede adoption, including concerns about inadequate data management of AI, inaccurate output, and a lack of trust. Guided by the OWASP SAMM framework and rooted in the Gioia methodological approach, our findings are synthesized into a theoretical model of generative AI adoption impacting security practices. This model highlights both the perceived benefits and the risks organizations encounter. Our work provides insights for software organizations looking to adopt generative AI into security-related workflows and contributes a foundational understanding of how such tools are perceived in practice. The paper emphasizes the importance of balancing innovation with caution as software organizations increasingly incorporate generative AI within secure development.

Peripheral Extracorporeal Membrane Oygenation Cannula Dressing and Securement Practices Across Australia and New Zealand

The objective of this systematic review was to systematically review papers in the United States that examine current practices in privacy and security when telehealth technologies are used by healthcare providers. A literature search was conducted using the Preferred Reporting Items for Systematic Reviews and Meta-Analyses Protocols (PRISMA-P). PubMed, CINAHL and INSPEC from 2003 – 2016 were searched and returned 25,404 papers (after duplications were removed). Inclusion and exclusion criteria were strictly followed to examine title, abstract, and full text for 21 published papers which reported on privacy and security practices used by healthcare providers using telehealth. Data on confidentiality, integrity, privacy, informed consent, access control, availability, retention, encryption, and authentication were all searched and retrieved from the papers examined. Papers were selected by two independent reviewers, first per inclusion/exclusion criteria and, where there was disagreement, a third reviewer was consulted. The percentage of agreement and Cohen’s kappa was 99.04% and 0.7331 respectively. The papers reviewed ranged from 2004 to 2016 and included several types of telehealth specialties. Sixty-seven percent were policy type studies, and 14 percent were survey/interview studies. There were no randomized controlled trials. Based upon the results, we conclude that it is necessary to have more studies with specific information about the use of privacy and security practices when using telehealth technologies as well as studies that examine patient and provider preferences on how data is kept private and secure during and after telehealth sessions.

What makes safety claims about general purpose AI systems such as large language models trustworthy? We show that rather than the capabilities of security tools such as alignment and red teaming procedures, it is security practices based on these tools that contributed to reconfiguring the image of AI safety and made the claims acceptable. After showing what causes the gap between the capabilities of security tools and the desired safety guarantees, we critically investigate how AI security practices attempt to fill the gap and identify several shortcomings in diversity and participation. We found that these security practices are part of securitization processes aiming to support (commercial) development of general purpose AI systems whose trustworthiness can only be imperfectly tested instead of guaranteed. We conclude by offering several improvements to the current AI security practices.

This article furthers the debate between European Studies and Critical Security Studies by demonstrating how European Union (EU) single market integration functions as a security practice in the area of cybersecurity. It explores how the EU has rendered digitisation as a security concern and cybersecurity emerged as an object of EU governance by developing an analytical approach based on problematisation. Situating the problematisation approach in the genealogical tradition of Foucault, it argues that it provides us with an analytical toolbox enabling inquiry into the conditions that make contemporary security problems possible, powerful and changeable. Tracing EU security problematisations of digitisation over four decades, it shows how the single market has come to function as a security practice and stresses the political implications of it. The final part of the article re‐problematises the findings to afford insights into how they can be rethought at the intersection of European Studies and Critical Security Studies.

This article explores the impact of the Spratly Islands dispute on security relations between China and Southeast Asia after the Cold War. It is argued that the dispute reflects and promotes the emergence of a regional order combining deterrence with consultation and limited co-operation. The balance of power between China, Southeast Asia, and the United States promotes the emergence of a structure of deterrence. Within this structure, the approaches of China and Southeast Asia to diplomacy and international law allow for the development of a regional dialogue and a code of conduct based on consultation and co-operation on non-controversial issues. Consequently, the seeds of an order are emerging in the South China Sea that combines the extremes of deterrence and co-operation. Introduction The Spratly Islands in the South China Sea are located at the intersection of the security spheres of China and Southeast Asia. As such, the dispute between China, Taiwan, Vietnam, the Philippines, Malaysia, and Brunei over this area is not merely a difference of opinion on rights to territory and maritime space. It brings to the fore incompatibilities between the practices China and the countries of Southeast Asia normally employ to ensure peace and stability in their regional environment. The implications of this dispute for the development of mechanisms of deterrence and co-operation between China and the countries of Southeast Asia have tended to be overlooked in the scholarly debate. The Spratly dispute is treated as a peripheral, yet potentially explosive, aspect of Sino--Southeast Asian relations. It is regarded as a product rather than a determinant of their security practices. [1] The Spratlys have been a sore point in the relationship between China and the Southeast Asian claimant states for decades . The dispute oscillates between conflict and co-operation without reaching the stage of crisis or resolution. [2] This protracted stalemate suggests that the dispute is at the fringes of the security agendas of China and Southeast Asia, compared with more pressing security concerns such as the regional financial crisis of the late 1990s and the Taiwan problem. At the same time, the nationalist overtones inherent in the justifications of territorial and maritime claims, coupled with a continuous military build-up in the Spratly area, suggests that the dispute will at some point wreak havoc on peace in the South China Sea. The problem with the dominant approaches to the study of the Spratly dispute is the tendency to overlook the fact that, in the 1990s, it has turned into an arena where the compatibility of the security practices of China and Southeast Asia were tested. During the Cold War, Chinese security policies were directed against the subregional environment of Northeast Asia. By contrast, most of the countries of Southeast Asia formulated their security outlook within the confines of the Association of Southeast Asian Nations (ASEAN). However, the increasing importance of the maritime resources of the South China Sea, and the allowances for extensive maritime zones in international law, have made China and Southeast Asia increasingly important variables in each other's security equations. This article argues that the Spratly dispute has profound implications for regional peace and stability because it promotes the development of a new order in the South China Sea between China and the Southeast Asian states. [3] By bringing representatives of contending security practices together around an issue of conflict, the Spratly dispute has changed the security practices of China and Southeast Asia. The dispute highlights differences in the approach of the two entities to the balance of power, diplomacy, and international law. As the contending parties attempt to find solutions to the problems coming to the fore, the seeds of a new order emerge, representing a compromise between the security practices employed by China and Southeast Asia. …

Recent reports indicate that over 85% of data breaches are still caused by a human element, of which healthcare is one of the organizations that cyber criminals target. As healthcare IT infrastructure is characterized by a human element, this study comprehensively examined the effect of psycho-socio-cultural and work factors on security behavior in a typical hospital. A quantitative approach was adopted where we collected responses from 212 healthcare staff through an online questionnaire survey. A broad range of constructs was selected from psychological, social, cultural perception, and work factors based on earlier review work. These were related with some security practices to assess the information security (IS) knowledge, attitude and behavior gaps among healthcare staff in a comprehensive way. The study revealed that work emergency (WE) has a positive correlation with IS conscious care behavior (ISCCB) risk. Conscientiousness also had a positive correlation with ISCCB risk, but agreeableness was negatively correlated with information security knowledge (ISK) risk and information security attitude (ISA) risk. Based on these findings, intrinsic and extrinsic motivation methods combined with cutting-edge technologies can be explored to discourage IS risks behaviors while enhancing conscious care security practice.

Not everyone is aware of the risks of cyber attacks on the internet once data travels through physical connections. In academic institutions, sometimes students take for granted the risks involved in accessing the internet. They may be excited and enjoy using the social media, communicate through email, and download or upload files without being aware of the cyber security risks these actions may entail. There are a lot of risk possibilities that may occur and are unknown to the students. This paper evaluates the internet security awareness and practices of students enrolled at Bulacan State University Sarmiento Campus during the 1st semester of AY 2017-2018. A total of 289 students from different departments were requested to answer the survey using Google Forms. The survey suggests that most students are still unaware of the vulnerabilities and risks that come with accessing the internet. Students are not fully aware of the existence of security threats and how to identify them, and they are, therefore, unable to execute appropriate defense mechanisms to defeat threats. The researchers, then recommend that internet security practices be integrated in the technology courses which form part of their program curriculum.

Small to medium-sized enterprises (SMEs) in North America do not always adequately address security. Based on responses from 232 SME owners and managers, the authors found that the adoption of security recommendations made by experts appear to be significantly influenced by the decisions of other local SMEs. A hot-spot analysis of information security practices suggested that local trends lead to prioritizing certain security practices and not adopting others. Follow-up interviews with business owners and Chamber of Commerce directors provided insights on how security hotspots developed or not. The study identified both hot spot and cold spot communities, and sought to assess how local business networking conduits like chambers of commerce help promote best security practices

The article describes how CCTV has evolved in Denmark from 1954, where it is first mentioned in a specialist journal, to 1982, where legislation is passed that regulates how CCTV can be used and by whom. The article identifies four technological frames in which CCTV is placed in the period. Three of these are ‘use-directed’ as they point to various ways of using CCTV and identify certain advantages and obstacles for this use. These three frames are ‘CCTV in industries’, ‘CCTV in traffic’, and ‘CCTV in security practices’. The fourth technological frame is critical towards using CCTV; it fears that the relationship between citizens and state is hampered and that the privacy of citizens is at risk. This technological frame is labeled ‘CCTV as a democratic threat’. The article shows how there have been various controversies between the different interpretations of CCTV. Thus, CCTV in Denmark has not evolved through linear and uncontested progression; in fact, CCTV has been at the centre of several controversies in which surveillance practices have been negotiated and regulated.

The first essay focuses on technology firms in the sharing economy and attempts to enrich our understanding of actions organizations take to gain legitimacy in this specific context. I draw upon literature in institutional theory that explains legitimacy and legitimation. News stories about one sharing economy organization’s actions are used to construct a typology of legitimation strategies from the ground up. The literature review and bringing together of theoretical legitimation strategies in itself can potentially help future research on legitimation. The operationalization of these strategies in practice in the sharing economy context contributes to literature in information systems. The second essay focuses on legitimacy repair following a data breach. Legitimacy issues arise when audiences probe an organization’s behavior during crisis events. A data breach is one such crisis event. A data breach might lead to unauthorized access of private individual data that might be put to illicit use, increasing the potential for harm. Since internal security practices are a mystery to external stakeholders, the firm is subjected to scrutiny, raising questions about its security practices. Given the negative repercussions that a firm might face, I examine whether subsequent positive actions can serve to mitigate them. Using data from a well-known repository of data breaches and news of firm actions following a breach, I find that positive sentiment about security practices in news media helps to lower market repercussions.