Integration method to protect the privacy and security of information in Process Mining projects: a case study on surgery block

Process Mining is a discipline that recognizes three types of analysis: discovery, monitoring, and process improvement. Organizations are focusing on redesigning and automating their major processes, according to a report published in 2018 [1]. In this way, a challenge n process mining is to show the results of the process analysis in a way that is understandable to non-expert users. Therefore, this research paper introduces a matrix of guidelines to guide process mining specialists/tool developers to improve the results of the analysis in process mining projects. This matrix is composed of 2 study fields that throughout the literature have been merging their virtues. First, process mining under 2 of its 3 types of projects: (1) based on objectives and (2) based on questions. The last type is based on data (exploratory analysis). Second, visualization of data with its techniques to represent data graphically. This research proposes a matrix of guidelines that integrates the discipline of process mining and the set of data visualization techniques based on the purpose of each graph (technique), the question / objective to be achieved and the importance that colors take in the analysis results in the process mining projects.

In line with the growing popularity of process mining, several methodologies have been proposed to guide the conduct of process mining projects. Such methodologies reason that process mining projects start with a concrete question. However, in practice we observe projects with a different starting point, often aimed at exploring the data. Existing methodologies provide limited aid in such situations, and as a result, we wonder: how are questions developed within process mining projects? In this paper, we present the results of an interview study that sheds light on question development in process mining. We provide insights from expert interviewees, resulting in six recommendations that enhance existing methodologies. In doing so, we present concrete examples of how process mining analyses can support question formulation and refinement.KeywordsProcess miningQuestion developmentInterview studyProcess mining methodology

The Quest for Information Privacy in Africa: A Review Essay

The sensitivity of health-care information and its accessibility via the Internet and mobile technology systems is a cause for concern in these modern times. The privacy, integrity and confidentiality of a patient's data are key factors to be considered in the transmission of medical information for use by authorised health-care personnel. Mobile communication has enabled medical consultancy, treatment, drug administration and the provision of laboratory results to take place outside the hospital. With the implementation of electronic patient records and the Internet and Intranets, medical information sharing amongst relevant health-care providers was made possible. But the vital issue in this method of information sharing is security: the patient's privacy, as well as the confidentiality and integrity of the health-care information system, should not be compromised. We examine various ways of ensuring the security and privacy of a patient's electronic medical information in order to ensure the integrity and confidentiality of the information.

Healthcare service delivery, especially in terms of safeguarding personal data, requires ensuring the confidentiality of information. In this regard, establishing cybersecurity systems that ensure information security is highly necessary. The rapid advancement of technologies increases the likelihood of cyberattacks, and particularly, AI-supported threats can cause serious harm in service delivery. In the current era, attacks not only come from humans but also from AI tools, posing threats to information security. Considering that AI technology is expected to further advance in the future, it's evident that this technology could become even more menacing. This is especially pertinent to the healthcare sector. Cyberattacks can lead to breaches in healthcare system data and disrupt service delivery to the extent of paralyzing the healthcare system. Our study, which includes case examples, is a compilation-type research. Within the scope of our research, searches were conducted using the keywords healthcare sector, information security, and cybersecurity on Google Scholar and Web of Science. The most current topic headings intersecting information security with the healthcare sector were examined based on the articles found on the subject. Our study evaluates the following topics in order: information and cyber security concepts, cyber threats and public services, electronic health records and security, major cyber-attacks in the health sector, why healthcare data is attractive for cyberattacks, information security in the artificial intelligence era, and information security policies for Türkiye and other countries in the world. Ransomware holds a significant place among cyberattacks. Therefore, users within the healthcare system are advised to pay particular attention to this issue. Attacks generally occur via email, starting with enticing the user into a cyber-threat through email. Artificial intelligence can also be used to get rid of such spam mails. Hence, it is strongly recommended that users in the healthcare sector undergo training on this matter. These trainings should be conducted regularly and continuously, with the institution's IT center offering an institutional approach in this regard.

RFID in the Information Security and Privacy is hidden in a crisis. RFID Information Security and Privacy Protection using hardware ways to achieve the target is the best way, however, it is subject to the problem of Tag costs and capacity and is currently still unresolved issues. This study focus on the Information Security and Privacy Protection and put forth a EPC specifications to use the model of XOR logic operation with the method of CRC examining the computing, and simulating the shopping mall system which provides a Information Security and Privacy Protection system. We got the data after simulations to show that XOR computing to actual test of 8 bytes, the required time is 17.29 Ticks in average, the spend time is rather short. Follow-up our simulations to the test data of DES encryption methods, an average time of 8,039.41 Ticks is required, the two time required considerable differences. It was informed that this study through practical shows that we could provide a match hardware encryption methods of the specific solutions to achieve their personal privacy protection, confidentiality, confirmed, and the fulfillment of the Information Security and Privacy Protection.

HCISPP Study Guide

In cryptography, performing computations on encrypted material without first decrypting it has long been an aspiration. This is exactly what homomorphic encryption (HE) accomplishes. By allowing computation on encrypted data, the associated privacy and security of sensitive information are beyond imagination to date. This chapter delves into the vast and intricate realm of HE, its fundamental theories, and far-reaching implications for machine learning. As a result of the sensitive nature of the data on which machine learning is based, privacy and security issues often arise. In this vein, homomorphic encryption, which allows algorithms to learn from and predict encrypted data, emerges as a possible panacea. The authors thus set out in this chapter to prepare the ground for a deeper understanding of that synergy, showing how it is there but also what lies ahead.

As the era of new-generation big data applications unfolds, the need for secure and adaptive data stream mining has become increasingly paramount. Evolving databases, characterized by ever-changing data streams and dynamic data distributions, present unique challenges and opportunities. This paper addresses the crucial intersection of security and adaptability in the context of data stream mining for new-generation big data. First, we delve into the evolving landscape of big data, where real-time data streams from diverse sources drive decision-making processes. Ensuring the privacy and security of sensitive information within these data streams is a fundamental concern. We explore cryptographic techniques, anonymization methods, and access control mechanisms that safeguard data while allowing for meaningful analysis. We present novel adaptive algorithms and model update strategies that can continuously learn and adjust to changing data distributions. These approaches enable data stream mining to remain effective and accurate over time. This paper offers insights into the fusion of security and adaptability in data stream mining, providing a foundation for the development of robust and privacy-conscious solutions for the evolving landscape of new-generation big data applications.

Aim/Purpose: This paper examines the behavior of financial firm employees with regard to information security procedures instituted within their organization. Furthermore, the effect of information security awareness and its importance within a firm is explored. Background: The study focuses on employees’ attitude toward compliance with information security policies (ISP), combined with various norms and personal abilities. Methodology: A self-reported questionnaire was distributed among 202 employees of a large financial Corporation Contribution: As far as we know, this is the first paper to thoroughly explore employees’ awareness of information system procedures, among financial organizations in Israel, and also the first to develop operative recommendations for these organizations aimed at increasing ISP compliance behavior. The main contribution of this study is that it investigates compliance with information security practices among employees of a defined financial corporation operating under rigid regulatory governance, confidentiality and privacy of data, and stringent requirements for compliance with information security procedures. Findings: Our results indicate that employees’ attitudes, normative beliefs and personal capabilities to comply with firm’s ISP, have positive effects on the firm’s ISP compliance. Also, employees’ general awareness of IS, as well as awareness to ISP within the firm, positively affect employees’ ISP compliance. Recommendations for Practitioners: This study can help information security managers identify the motivating factors for employee behavior to maintain information security procedures, properly channel information security resources, and manage appropriate information security behavior. Recommendation for Researchers: Researchers can see that corporate rewards and sanctions have significant effects on employee security behavior, but other motivational factors also reinforce the ISP’s compliance behavior. Distinguishing between types of corporations and organizations is essential to understanding employee compliance with information security procedures. Impact on Society: This study offers another level of understanding of employee behavior with regard to information security in organizations and comprises a significant contribution to the growing knowledge in this area. The research results form an important basis for IS policymakers, culture designers, managers, and those directly responsible for IS in the organization. Future Research: Future work should sample employees from another type of corporation from other fields and should apply qualitative analysis to explore other aspects of behavioral patterns related to the subject matter.

Click to increase image sizeClick to decrease image size Notes 1. "As a result of increasing interconnectivity, information systems and networks are now exposed to a growing number and a wider variety of threats and vulnerabilities. This raises new issues for security." OECD Guidelines for the Security of Information Systems and Networks, July 25, 2002, at p. 7, available at www.oecd.org/dataoecd/16/22/15582260.pdf. 2. Although not the subject of this article, it is important to note that countries are also enacting cybercrime legislation to make clear that certain online activities are illegal and to assist law enforcement in efforts to prosecute cyber criminals. To that end, the Privacy and Computer Crime Committee of the American Bar Association Section of Science & Technology Law has recently undertaken a project to develop a Model Cybercrime Law for the UN International Telecommunication Union's (ITU) Cybersecurity Work Programme to Assist Developing Countries. See also the International Guide to Combating Cybercrime published by this Committee, available at http://www.abanet.org/dch/committee.cfm?com=ST202003. 3. See the Appendix for a compilation of some of the key laws and regulations governing information security. 4. See, e.g., EU Data Protection Directive and HIPAA, cited in the Appendix. 5. See, e.g., E-SIGN, UETA, and UN Convention cited in the Appendix. 6. See, e.g., Kimberly Kiefer and Randy V. Sabett, Openness of Internet Creates Potential for Corporate Information Security Liability, BNA Privacy & Security Law Report, Vol. 1, No. 25 at 788 (June 24, 2002); Alan Charles Raul, Frank R. Volpe, and Gabriel S. Meyer, Liability for Computer Glitches and Online Security Lapses, BNA Electronic Commerce Law Report, Vol. 6, No. 31 at 849 (August 8, 2001); Erin Kenneally, The Byte Stops Here: Duty and Liability for Negligent Internet Security, Computer Security Journal, Vol. XVI, No. 2, 2000. 7. See, e.g., Wolfe v. MBNA America Bank, 485 F.Supp.2d 874, 882 (W.D. Tenn. 2007); Guin v. Brazos Higher Education Service, Civ. No. 05-668, 2006 U.S. Dist. Lexis 4846 (D. Minn. February 7, 2006); and Bell v. Michigan Council, 2005 Mich. App. Lexis 353 (Mich. App. February 15, 2005) (all affirming a negligence cause of action). See also, In Re TJX Companies Retail Security Breach Litigation, 2007 U.S. Dist. Lexis 77236 (D. Mass. October 12, 2007) (rejecting a negligence claim due to the economic loss doctrine, but allowing a negligent misrepresentation claim to proceed). 8. See, e.g., American Express v. Vinhnee, 2005 Bankr. Lexis 2602 (9th Cir. Bk. App. Panel, 2005); Lorraine v. Markel, 2007 U.S. Dist. Lexis 33020 (D. MD. May 4, 2007). 9. Available at www.pcisecuritystandards.org. 10. Available at www.cabforum.org. 11. ISO/IEC 27001, Information Technology—Security Techniques—Information Security Management Systems—Requirements (October 2005) (hereinafter "ISO/IEC 27001"), available for purchase at http://www.standards-online.net/InformationSecurityStandard.htm. 12. Directive 95/46/EC of the European Parliament and of the Council of October 24, 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter "EU Data Protection Directive"). 13. See statutes listed in the Appendix. 14. See statutes listed in the Appendix. 15. Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), 42 U.S.C. 1320d-2 and 1320d-4, (providing that "each person … who maintains or transmits health information shall maintain reasonable and appropriate administrative, technical, and physical safeguards: (A) to ensure the integrity and confidentiality of the information; (B) to protect against any reasonably anticipated: (i) threats or hazards to the security or integrity of the information; and (ii) unauthorized uses or disclosures of the information; and (C) otherwise to ensure compliance with this part by the officers and employees of such person," at 42 U.S.C. 1320d-2(d)(2). 16. Gramm-Leach-Bliley Financial Services Modernization Act ("GLB"), Pub. L. No. 106-102, 113 Stat. 1338 (November 12, 1999), at §§ 501 and 505(b), 15 U.S.C. §§ 6801, 6805, providing that "[E]ach financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers' nonpublic personal information." 17. See, Gramm-Leach-Bliley Act ("GLB"), Public Law 106-102, §§ 501 and 505(b), 15 U.S.C. §§ 6801, 6805, and implementing regulations at 12 C.F.R. Part 30, Appendix B (OCC), 12 C.F.R. Part 208, Appendix D (Federal Reserve System), 12 C.F.R. Part 364, Appendix B (FDIC), 12 C.F.R. Part 568 (Office of Thrift Supervision) and 16 C.F.R. Part 314 (FTC). 18. Final HIPAA Security Regulations, 45 C.F.R. Part 164. 19. There have also been efforts in the United States to pursue comprehensive federal privacy similar to the approach taken by many other countries. See e.g., Microsoft position paper at www.microsoft.com/presspass/download/features/2005/PrivacyLegislationCallWP.doc. Although it remains to be seen whether that approach will ultimately be adopted, it is clear that the combination of U.S. state and federal law has, in effect, imposed a comprehensive obligation of security with respect to all personal information held by all companies. 20. See, e.g., FTC enforcement actions regarding In the Matter of Sunbelt Lending Services, Inc.; In the Matter of Petco Animal Supplies, Inc.; In the Matter of MTS, Inc., d/b/a Tower records/Books/Video; In the matter of Guess?, Inc.; FTC V. Microsoft; and In the Matter of Eli Lilly and Company cited in the Appendix. 21. See, e.g., FTC enforcement actions regarding In the Matter of CardSystems Solutions, Inc.; United States v. ChoicePoint, Inc.; In the Matter of DSW Inc.; and In the Matter of BJ's Wholesale Club, Inc. cited in the Appendix. 22. See list in the Appendix. 23. See, e.g., Guin v. Brazos Higher Education Service, Civ. No. 05-668, 2006 U.S. Dist. Lexis 4846 (D. Minn. February 7, 2006) and Bell v. Michigan Council, 2005 Mich. App. Lexis 353 (Mich. App. February 15, 2005). 24. 205 Mich. App. Lexis 353 at ∗16 (Mich. App. 2005). 25. 2006 U.S. Dist. Lexis 4846 at ∗9 (D. Minn. 2006). 26. Wolfe v. MBNA America Bank, 485 F.Supp.2d 874, 882 (W.D. Tenn. 2007). 27. In Re TJX Companies Retail Security Breach Litigation, 2007 U.S. Dist. Lexis 77236 (D. Mass. October 12, 2007), at pp. 28–29. 28. Ibid. 29. The Homeland Security Act of 2002 defines the term "information system" to mean "any equipment or interconnected system or subsystems of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information, and includes—(A) computers and computer networks; (B) ancillary equipment; (C) software, firmware, and related procedures; (D) services, including support services; and (E) related resources." Homeland Security Act of 2002, Pub. L. 107-296, at Section 1001(b), amending 44 U.S.C. § 3532(b)(4). 30. See, e.g., Australia, Information Privacy Principles under the Privacy Act 1988, Principle No. 4, available at www.privacy.gov.au/publications/ipps.html; AICPA and the Canadian Institute of Chartered Accountants (CICA), Generally Accepted Privacy principles, Principle No. 8, available at http://infotech.aicpa.org/Resources/Privacy/Generally+Accepted+Privacy+Principles; APEC, Privacy principles, Principle No. 7, available at http://austlii.edu.au/∼graham/APEC/APECv10.doc; US-EU Safe Harbor Privacy Principles, available at www.export.gov/safeharbor/SHPRINCIPLESFINAL.htm; Direct Marketing Association, Online Marketing Guidelines, available at www.the-dma.org/guidelines/onlineguidelines.shtml. 31. Directive 95/46/EC of the European Parliament and of the Council of October 24, 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter "EU Data Protection Directive"). 32. EU Data Protection Directive, Preamble at Para. 46. 33. EU Data Protection Directive, Article 17(1). 34. See statutes listed in the Appendix. 35. See statutes listed in the Appendix. 36. See generally, Bruce H. Nearon, Jon Stanley, Steven W. Teppler, and Joseph Burton, Life after Sarbanes-Oxley: The Merger of Information Security and Accountability, Jurimetrics Journal, Vol. 45, 379–412 (2005). 37. American Express v. Vinhnee, 336 B.R. 437; 2005 Bankr. Lexis 2602 (9th Cir. December 16, 2006). 38. Ibid., at p. 444. 39. Ibid., at p. 445. 40. Ibid., at pp. 446–447. 41. Ibid., at p. 449. 42. See, e.g., National Association of Corporate Directors, Information Security Oversight (2007). 43. Sarbanes-Oxley Act, Section 302. 44. See, e.g., GLB Security Regulations (Federal Reserve) 12 C.F.R. 208, Appendix D-2.III(A). 45. HIPAA Security Regulations, 45 C.F.R. Section 164.308(a)(2). 46. See, FTC Decisions and Consent Decrees listed in the Appendix, including Microsoft Consent Decree at II, p. 4; Ziff Davis Assurance of Discontinuance, Para. 27(a), p. 7; Eli Lilly Decision at II.A. 47. FISMA, 44 U.S.C. 3544(a). 48. E. Michael Power and Roland L. Trope, Sailing in Dangerous Waters: A Director's Guide to Data Governanc e , American Bar Association (2005), p. 13; Roland L. Trope, "Directors' Digital Fiduciary Duties," IEEE Security & Privacy, January/February 2005 at p. 78. 49. Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996). 50. Bell v. Michigan Council, 2005 Mich. App. Lexis 353 (Mich. App. February 15, 2005), at pp. 11–13 (noting that harm was foreseeable, but Board took no action). 51. Securing Cyberspace: Business Roundtable's Framework for the Future, Business Roundtable, May 19, 2004 at pp. 1, 2; available at www.businessroundtable.org/pdf//20040518000CyberSecurityPrinciples.pdf. The Business Roundtable is an association of chief executive officers of leading U.S. corporations with a combined workforce of more than 10 million employees in the United States. See www.businessroundtable.org. 52. Information Security Governance: A Call to Action, Corporate Governance Task Force Report, National Cyber Security Partnership, April 2004, pp. 12–13, available at www.cyberpartnership.org/InfoSecGov4_04.pdf. The National Cyber Security Partnership (NCSP) is led by the Business Software Alliance (BSA), the Information Technology Association of America (ITAA), TechNet, and the U.S. Chamber of Commerce in voluntary partnership with academicians, CEOs, federal government agencies, and industry experts. Following the release of the 2003 White House National Strategy to Secure Cyberspace and the National Cyber Security Summit, this public–private partnership was established to develop shared strategies and programs to better secure and enhance America's critical information infrastructure. Further information is available at www.cyberpartnership.org. 53. GLB Security Regulations (OCC), 12 C.F.R. Part 30, Appendix B, Part III.A and Part III.F. 54. See, e.g., Homeland Security Act of 2002 (Federal Information Security Management Act of 2002) 44 U.S.C. Section 3542(b)(1); GLB Security Regulations (OCC), 12 C.F.R. Part 30 Appendix B, Part II.B; HIPAA Security Regulations, 45 C.F.R. Section 164.306(a)(1); Microsoft Consent Decree at II, p. 4. 55. See, e.g., 44 USC 3532(b)(1), emphasis added. See also FISMA, 44 U.S.C. Section 3542(b)(1). Most of the foreign privacy laws also focus their security requirements from this perspective. This includes, for example, the EU Privacy Directive, Finland's Privacy Law, Italy's Privacy Law, and the UK Privacy Law. Also in this category is the Canadian Privacy Law. 56. Although they often focus on categories of security measures to address. See, e.g., HIPAA Security Regulations, 45 C.F.R. Part 164. 57. See, e.g., FDA regulations at 21 C.F.R. Part 11 (procedures and controls); SEC regulations at 17 C.F.R. 257.1(e)(3) (procedures); SEC regulations at 17 C.F.R. 240.17a-4 (controls); GLB regulations (FTC) 16 C.F.R. Part 314 (safeguards); Canada, Personal Information Protection and Electronic Documents Act, Schedule I, Section 4.7 (safeguards); EU Data Privacy Directive, Article 17(1) (measures) available at http://europa.eu.int/comm/internal_market/privacy/docs/95-46-ce/dir1995-46_part1_en.pdf. 58. See, e.g., HIPAA 42 U.S.C. 1302d-2, and HIPAA Security regulations, 45 CFR 164.306; COPPA, 15 U.S.C. 6502(b)(1)(D), and COPPA regulations 16 C.F.R. 312.8; IRS Rev. Proc. 97-22, sec. 4.01(2); SEC regulations 17 C.F.R. 257. See also UCC Article 4A, Section 202 ("commercially reasonable" security procedure), and Microsoft Consent Decree. 59. "Appropriate" security required by: HIPAA 42 U.S.C. 1302d-2, and HIPAA Security regulations, 45 CFR 164.306; EU Data Protection Directive, Article 17(1). 60. EU Data Protection Directive, Article 17(1) (emphasis added) 61. See, e.g., Belgium—Belgian Law of 8 December 1992 on Privacy Protection in relation to the Processing of Personal Data, as modified by the law of 11 December 1998 Implementing Directive 95/46/EC, and the law of 26 February 2003, Chapter IV, Article 16(4); Denmark—Act on Processing of Personal Data,; Act No. 429 of 31 May 2000 (unofficial English translation), Title IV, Part 11, Section 41(3); Estonia—Personal Data Protection Act; Passed February12, 2003 (RT1 I 2003, 26, 158), entered into force October 1, 2003, Chapter 3, Sections 19(2); Greece—Law 2472/1997 on the Protection of Individuals with regard to the Processing of Personal Data (as amended by Laws 2819/2000 and 2915/2001); Article 10(3); Ireland—Data Protection (Amendment) Act 2003; Section 2.-(1)(d) and First Schedule Article 7; Lithuania—Law on Legal Protection of Personal Data, January 21, 2003, No. IX-1296, Official translation, with amendments April 13, 2004, Article 24(1); Netherlands—25 892—Rules for the protection of personal data (Personal Data Protection Act) (Unofficial translation); Article 13; Portugal—Act on the Protection of Personal Data (transposing into the Portuguese legal system Directive 95/46/EC of the European Parliament and of the Council of October 24, 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data), Article 14(1); Slovakia—Act No 428 of July 3, 2002 on personal data protection; Section 15(1); Sweden—Personal Data Act (1998:204); issued April 29, 1998, Section 31; and UK—Data Protection Act 1998, Schedule 1, Part I, Seventh Principle. 62. See, e.g., Finland—The Finnish Personal Data Act (523/1999), given on 22.4.1999, Section 32(1); Germany—Federal Data Protection Act as of January 1, 2003, Section 9; Hungary—Act LXIII of 1992 on the Protection of Personal Data and Public Access to Data of Public Interest, Article 10(1); Italy—Personal Data Protection Code, Legislative Decree No. 196 of 30 June 2003, Sections 31 and 33; Spain—Organic Law 15/1999 of December 13 on the Protection of Personal Data, Article 9. 63. 5 USC Sec. 552a. 64. 5 U.S.C. § 552a (d)(10) (emphasis added). 65. 42 U.S.C. 1320d-2(d)(2). 66. See, Gramm-Leach-Bliley Act ("GLB"), Public Law 106-102, §§ 501 and 505(b), 15 U.S.C. §§ 6801, 6805, and implementing regulations at 12 C.F.R. Part 30, Appendix B (OCC), 12 C.F.R. Part 208, Appendix D (Federal Reserve System), 12 C.F.R. Part 364, Appendix B (FDIC), 12 C.F.R. Part 568 (Office of Thrift Supervision) and 16 C.F.R. Part 314 (FTC) (emphasis added). 67. Cal. Civil Code § 1798.81.5(b). 68. See UN Convention at Article 9(3), 9(4), and 9(5). 69. ISO/IEC 27001, Information Technology—Security Techniques—Information Security Management Systems—Requirements (October 2005). See text at footnotes 157–169, infra. February 1, 12 C.F.R. Part 30, Appendix B (OCC), 12 C.F.R. Part 208, Appendix D (Federal Reserve System), 12 C.F.R. Part 364, Appendix B (FDIC), 12 C.F.R. Part 568 (Office of Thrift May 16 C.F.R. Part 44 U.S.C. Section 45 C.F.R. 164. See of the on by of the Technology and Homeland Security of the Committee on the United States 21, 2007 at p. (noting that FTC under the GLB Act as a for the obligation to maintain reasonable and appropriate available at See also, of the the on Information and the Committee on U.S. House of on April 21, 2004, at p. 5 (noting that is an of reasonable and appropriate measures in of the available at See, e.g., FTC Decisions and Consent Decrees listed in the Appendix. See, e.g., National Association of Insurance for Information Model available at in at See, e.g., Consent Decrees listed in the Appendix. 78. See, e.g., Guin v. Brazos Higher Education Service, Civ. No. 05-668, 2006 U.S. Dist. Lexis 4846 (D. Minn. February 7, 2006) and Bell v. Michigan Council, 2005 Mich. App. 353 (Mich. App. February 15, 2005). Guin v. Brazos Higher Education Service, Civ. No. 05-668, 2006 U.S. Dist. Lexis 4846 (D. Minn. February 7, 2006). Bell v. Michigan Council, 2005 Mich. App. Lexis 353 (Mich. App. February 15, 2005). Committee on available at See, e.g., Italy—Personal Data Protection Code, Legislative Decree No. 196 of 30 June 2003, B, § Act No 428 of July 2002 on personal data § the Appendix, Act, B, Section Act, Section the Appendix, Act, Article Act, Section Act, 16(4); Act, Section 41(3); Act, Section Act, Section 32(1); Act, Section 9; Act, Article 10(3); Act, Article 10(1); Act, Article 24(1); Act, Article 13; Act, Article 14(1); Act, Section 15(1); Act, Article 9; Act, Section 31; UK Act, Schedule 1, Part I, Seventh Act, Article 7. the Appendix, Act, Schedule 2, Section Act, Act, Schedule 1, 4.7 Principle 7, Act, Section Act, Section Act, B, Sections and Act, Sections 17 and the Appendix, Act, Section A Security § Act, Section Decree the Appendix, Decree the Appendix, Act, Section Principle 4; Act, Article Act, Article Act, Sections and Act, Section Act, Section Act, Section Act, B, Sections and Act, Sections 17 and Bruce & Digital Security in a & at p. See, e.g., HIPAA Security Regulations, 45 C.F.R. Section See, e.g., Microsoft Consent Decree at II, p. 4; Ziff Davis Assurance of Discontinuance, Para. p. Eli Lilly Decision at II.B; GLB Security Regulations, 12 C.F.R. Part 30, Appendix B, Part See, e.g., Microsoft Consent Decree at II, p. 4; Eli Lilly Decision at See, e.g., FISMA, 44 U.S.C. Sections and GLB Security Regulations, 12 C.F.R. Part 30, Appendix B, Part See, e.g., In Electronic July 30, Financial Council, 2; available at See, e.g., Microsoft Consent Decree at II, p. 4; GLB Security Regulations (OCC), 12 C.F.R. Part 30 Appendix B, Part Eli Lilly Decision at II.B; HIPAA Security Regulations, 45 C.F.R. Section Information Security Management Act of 2002 44 U.S.C. Section See, e.g., Microsoft Consent Decree at II, p. 4; GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section Information Security Management Act of 2002 44 U.S.C. Section See, e.g., GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part Information Security Management Act of 2002 44 U.S.C. Section See, e.g., Microsoft Consent Decree at II, p. 4; GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part See, e.g., GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section See, e.g., HIPAA Security Regulations, 45 C.F.R. Section See, e.g., United States v. Cir. See, e.g., Inc. v. also v. or of to with and of See, e.g., HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part and Part FISMA, 44 U.S.C. Sections and Microsoft Consent Decree at II, p. 4; Ziff Davis Assurance of HIPAA Security Regulations, 45 CFR Section and and on HIPAA Security of & Section of Science & Technology Law, No. April 2003, at p. 2, available at See, e.g., HIPAA regulations 45 C.F.R. Sections and GLB Regulations, 12 C.F.R. 208, Appendix and 12 C.F.R. Part 30, Appendix B, Part Microsoft Consent at p. 4. HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Sections and GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section and Ziff Davis Assurance of Discontinuance, Para. 25, p. 6. HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part Ziff Davis Assurance of Discontinuance, Para. p. 5 and Para. 25, p. 6. HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part Ziff Davis Assurance of Discontinuance, Para. 25, p. 6. GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part Ziff Davis Assurance of Discontinuance, Para. 25, p. HIPAA Security Regulations, 45 C.F.R. Sections and Ziff Davis Assurance of Discontinuance, Para. 25, p. 6. Ziff Davis Assurance of Discontinuance, Para. 25, p. 6. HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section Ziff Davis Assurance of Discontinuance, and 26, pp. HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part See, e.g., FISMA, 44 U.S.C. Section HIPAA Security Regulations, 45 C.F.R. Section Ziff Davis Assurance of Discontinuance, Para. p. 5. Ziff Davis Assurance of Discontinuance, Para. p. 7. HIPAA Security Regulations, 45 C.F.R. Section Microsoft Consent Decree at II, p. 4. FISMA, 44 U.S.C. Section Eli Lilly Decision at GLB Security Regulations, 12 C.F.R. Part 30, Appendix B, Part Ziff Davis Assurance of Discontinuance, Para. and p. 7; Eli Lilly Decision at HIPAA Security Regulations, 45 C.F.R. Section Microsoft Consent Decree at II, p. 4; Ziff Davis Assurance of Discontinuance, Para. and p. 7; Eli Lilly Decision at GLB Security Regulations, 12 C.F.R. Part 30, Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section and GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section Microsoft Consent Decree at II, p. 4; Eli Lilly Decision at Microsoft Consent Decree at p. 5. Ziff Davis Assurance of Discontinuance, Para. p. 7. See, e.g., of the of the of National on 21, at See, e.g., GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part See, e.g., GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section and GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part Wolfe v. MBNA America Bank, 485 F.Supp.2d 874, 882 (W.D. Tenn. 2007). See Bell v. Michigan Council, 2005 Mich. App. Lexis 353 (Mich. App. February 15, 2005). See Guin v. Brazos Higher Education Service, Civ. No. 05-668, 2006 U.S. Dist. Lexis 4846 at (D. Minn. February 7, 2006) that a was the to and a of a was not a of a of reasonable The Financial is a of U.S. federal agencies, that the Board of of the Reserve Insurance the National the of the of the and the of Thrift on on in an Internet 8, 2006 at p. available at on on in an Internet 8, 2006 at p. available at Guide for the Guidelines Information Security December available at Information Security July available at See National Institute of and Management Guide for Information Technology No. available at ISO/IEC 27001, Information Technology—Security Techniques—Information Security Management Systems—Requirements (October 2005) (hereinafter "ISO/IEC ISO/IEC § for is the and of International and is of a of the of with and a in that the The American National Institute the United States. See, The also in and in related to including The of make its with the United States. See ISO/IEC 27001, § (emphasis added). ISO/IEC 27001, § ISO/IEC 27001, § ISO/IEC 27001, § 164. ISO/IEC 27001, § ISO/IEC 27001, §§ and 6. ISO/IEC 27001, §§ and 8. ISO/IEC 27001, §§ ISO/IEC that with an International not in from legal p. 1. EU Data Protection Directive, Article 8. Article Data Protection on the processing of personal data to health in health February 15, at pp. available at (emphasis in See list of state laws in Report, Security and Laws of 15, 2005 at Appendix available at Code, § Rev. Stat. Available at www.pcisecuritystandards.org. See list in the Appendix. See, e.g., 16 CFR Section Health Insurance Portability and Accountability Act Security Regulations, 45 C.F.R. § HIPAA security regulations to in the Act Security Regulations, 12 C.F.R. Part 30 Appendix B, Part security regulations to information in the financial Homeland Security Act of 2002 § 1001(b), amending 44 U.S.C. § and § amending 44 U.S.C. § information and information systems from unauthorized and regulations, 21 C.F.R. Part 11. See, e.g., Cal. Civil Code § 1798.81.5(b). See April 2, the Matter of of the Act of of Information and Information Services, No. No. April 2, at available at (hereinafter Wolfe v. MBNA America Bank, 485 F.Supp.2d 874, 882 (W.D. Tenn. 2007). in an Internet 12, 2005 available at This was by an on on in an Internet 8, available at of No. 25, The is an See, e.g., HIPAA Security Regulations, 45 C.F.R. § at p. 6. Ibid., at p. 3. Ibid. v. National 2007 U.S. App. Lexis 2007), at p. 13. See, e.g., on of Security Breach Personal of Privacy of April 2006 (hereinafter at pp. at note , at p. a of such in the United States and a of the number of individuals Privacy at IRS Rev. Proc. § See list of statutes in the Appendix. on for Access to Information and Part of A to Appendix, at 12 C.F.R. Part 30 (OCC), 12 C.F.R. Part (Federal Reserve System), 12 C.F.R. Part (FDIC), and 12 C.F.R. Part 568 (Office of Thrift 29, Vol. No. 29, at p. (hereinafter the maintains personal information that the not in the laws the to the or of the information, than the individuals of any of the security of the See, e.g., Code § Rev. Stat. § Code, § Stat. § Code § 2007 The also any combination of of information that to or the such as and or and See, e.g., Breach to the of & Financial Services, December 15 USC Section This that with the of at 15 USC Section and are of in this and are of in this See, and of a Duty to Information Security Computer & L. See and to Law the Protection of Personal BNA Privacy & Security Law Report, 19, p. May See at on the of the Framework for Electronic and Services, with focus on the 26, available at Science and Technology Committee, House of Internet of July 24, at Para. of the Privacy of Canada, for in to Privacy available at See Privacy Breach of the Privacy available at Privacy available at See, of the Privacy to the Law of February at available at Available at Available at to information to state

Fast changing technologies and increased sophistication in cyberattacks have heightened the information security and privacy risks for all contemporary organizations. Research shows that security breaches are mainly internal and caused by ignorant and disgruntled employees. As human resource manages employees from recruitment to separation and handles most sensitive personal data of employees in the organization, it plays a critical role in protecting information security and privacy. This chapter provides an overview of the basics of information security and privacy concepts and frameworks. It highlights the major roles human resource functionaries can play in designing, applying, and monitoring appropriate controls throughout the employment cycle, that is, before, during, and after employment to protect information security and privacy.

Knowledge flows permit to analyze the type and sources of knowledge, and the way in which knowledge flows or is managed within an organization. This paper presents how a knowledge flow approach implemented in a process mining project, which analyzes process instances, supports the categorization of the different types and assets of knowledge stored in the repositories of software development organizations. In addition, it provides information for the roles involved in improvement cycles to make strategic decisions based on the types of mining (process discovery, conformance checking and process improvement). We present the implementation of the intervention methodology for the identification of processes, flows and types of knowledge with the objective of strengthening and validating the compliance of software processes. These results were validated with an experience report on the analysis of knowledge flows in a Mexican software development company implementing a Process Mining project.

This research aims to provide an overview of the current conditions related to the readiness (completeness and maturity) of information security and ensure information security is in accordance with applicable standards and can find out what should be improved in information security from various fields that will be made reports to agency leaders.Evaluation of Information Security using the Information Security Index (KAMI) 4.2 with criteria in SNI ISO / IEC 27001: 2013 in six areas namely governance, risk management, framework, asset management, technology and information security, and supplements.The evaluation results of the Sleman Regency Communication and Information Technology Office received a Good status with a final score of 622 and a maturity level of IV.The final results of the evaluation explain that the Sleman Regency Communication and Information Technology Office has a "Managed and Measurable" status and can already carry out Information Security Index (KAMI) certification, especially ISO / IEC 27001: 2013 certification.All aspects have a high score, only a few aspects that only need a little improvement, namely in the Governance Area and the Supplementary Area by using the completeness of the ISO / IEC 27001: 2013 and ISO / IEC 27002: 2013 standards in practice.This research focuses on evaluating the readiness (Completeness and Maturity) of information security by implementing the KAMI index version 4.2, but implemented in different case studies and providing recommendations for improvement based on the ISO / IEC 27001: 2013 information security policy standard and the ISO / IEC 27002 information security practice standard.

Cloud computing and other cloud-based computing platforms (e.g., fog computing and edge computing) are recent and popular computing approaches. Due to the nature, architecture and infrastructure of cloud-based computing, it is important to acknowledge the importance of cloud data security, privacy and compliance in an organizational context. This chapter presents a discussion of the key factors an organization is required to address in order to develop a cybersecurity strategy aligned with its organizational and business goals. The specific architectural contexts of cloud computing and cloud-based computing are considered from an information security and privacy point of view. The discussion in this chapter explores the key organizational, human and technological factors associated with data and information security, privacy and compliance, from the perspective of an organization that is adopting cloud-based computing.