Information security management : a case study of an information security culture

This thesis argues that in order to establish a sound information security culture it is necessary to look at organisation's information security systems in a socio- technical context. The motivation for this research stems from the continuing concern of ineffective information security in organisations, leading to potentially significant monetary losses. It is important to address both technical and non- technical aspects when dealing with information security management. Culture has been identified as an underlying determinant of individuals' behaviour and this extends to information security culture, particularly in developing countries. This research investigates information security culture in the Saudi Arabia context. The theoretical foundation for the study is based on organisational and national culture theories. A conceptual framework for this study was constructed based on Peterson and Smith's (1997) model of national culture. This framework guides the study of national, organisational and technological values and their relationships to the development of information security culture. Further, the study seeks to better understand how these values might affect the development and deployment of an organisation's information security culture. Drawing on evidence from three exploratory case studies, an emergent conceptual framework was developed from the traditional human behaviour and the social environment perspectives used in social work, This framework contributes to in- formation security management by identifying behaviours related to four modes of information security practice. These modes provide a sound basis that can be used to evaluate individual organisational members' behaviour and the adequacy of ex- isting security measures. The results confirm the plausibility of the four modes of practice. Furthermore, a final framework was developed by integrating the four modes framework into the research framework. The outcomes of the three case stud- ies demonstrate that some of the national, organisational and technological values have clear impacts on the development and deployment of organisations' informa- tion security culture. This research, by providing an understanding the in uence of national, organi- sational and technological values on individuals' information security behaviour, contributes to building a theory of information security culture development within an organisational context. The research reports on the development of an inte- grated information security culture model that highlights recommendations for developing an information security culture. The research framework, introduced by this research, is put forward as a robust starting point for further related work in this area.

Improving information security management in nonprofit organisations

All organisations, irrespective of size and type, need effective information security management (ISM) practices to protect vital organisational in- formation assets. However, little is known about the information security management practices of nonprofit organisations. Australian nonprofit organisations (NPOs) employed 889,900 people, managed 4.6 million volunteers and contributed $40,959 million to the economy during 2006-2007 (Australian Bureau of Statistics, 2009). This thesis describes the perceptions of information security management in two Australian NPOs and examines the appropriateness of the ISO 27002 information security management standard in an NPO context. The overall approach to the research is interpretive. A collective case study has been performed, consisting of two instrumental case studies with the researcher being embedded within two NPOs for extended periods of time. Data gathering and analysis was informed by grounded theory and action research, and the Technology Acceptance Model was utilised as a lens to explore the findings and provide limited generalisability to other contexts. The major findings include a distinct lack of information security management best practice in both organisations. ISM Governance and risk management was lacking and ISM policy was either outdated or non- existent. While some user focused ISM practices were evident, reference to standards, such as ISO 27002, were absent. The main factor that negatively impacted on ISM practices was the lack of resources available for ISM in the NPOs studied. Two novel aspects of information security dis- covered in this research were the importance of accuracy and consistency of information. The contribution of this research is a preliminary understanding of ISM practices and perceptions in NPOs. Recommendations for a new approach to managing information security management in nonprofit organisations have been proposed.

Five case studies applying soft systems methodology to knowledge management

Construction projects are faced with a challenge that must not be underestimated. These projects are increasingly becoming highly competitive, more complex, and difficult to manage. They become problems that are difficult to solve using traditional approaches. Soft Systems Methodology (SSM) is a systems approach that is used for analysis and problem solving in such complex and messy situations. SSM uses “systems thinking” in a cycle of action research, learning and reflection to help understand the various perceptions that exist in the minds of the different people involved in the situation. This paper examines the benefits of applying SSM to problems of knowledge management in construction project management, especially those situations that are challenging to understand and difficult to act upon. It includes five case studies of its use in dealing with the confusing situations that incorporate human, organizational and technical aspects.

Discourse practice gaps in work life balance : comparative case studies in the Australian construction industry

Perspectives on work-life balance (WLB) reflected in political, media and organisational discourse, would maintain that WLB is on the agenda because of broad social, economic and political factors (Fleetwood 2007). In contrast, critical scholarship which examines work-life balance (WLB) and its associated practices maintains that workplace flexibility is more than a quasi-functionalist response to contemporary problems faced by individuals, families or organisations. For example, the literature identifies where flexible work arrangements have not lived up to expectations of a panacea for work-home conflicts, being characterised as much by employer-driven working conditions that disadvantage workers and constrain balance, as they are by employee friendly practices that enable it (Charlesworth 1997). Further, even where generous organisational work-life balance policies exist, under-utilisation is an issue (Schaefer et al, 2007). Compounding these issues is that many employees perceive their paid work as becoming more intense, pressured and demanding (Townsend et al 2003).

Validating the IS-Impact model : two exploratory case studies in China and Malaysia

For over a decade, IT expenditure in China and Malaysia has shown a significant increase, as organisations in these countries are increasingly dependent on information systems (IS) for achieving strategic advantages and business benefits. However, there have been numerous reports of dissatisfaction with IS, and in some cases the effectiveness of the information systems have yet to be reviewed. Two exploratory case studies reported in this paper are the first phase of an overall research in validating the IS-Impact model introduced by Gable, Sedera and Chan in two countries: China and Malaysia. This validation research aims to produce a standard measuring model across different contexts. The purpose of this paper is to present preliminary findings from two exploratory case studies, attempt to test the feasibility of the research design and to investigate applicability of the IS-Impact model in Chinese and Malaysian organisations. Twenty-nine respondents from a Chinese private company and seventeen respondents from a state government in Malaysia were involved in these studies. Findings indicated that most of existing IS-Impact measures are applicable in the study contexts, however, there are some new measures informed by the respondents. Feedback from the case studies also suggested necessary modifications to the Mandarin instrument.

National guidelines for digital modelling : case studies

These National Guidelines and Case Studies for Digital Modelling are the outcomes from one of a number of Building Information Modelling (BIM)-related projects undertaken by the CRC for Construction Innovation. Since the CRC opened its doors in 2001, the industry has seen a rapid increase in interest in BIM, and widening adoption. These guidelines and case studies are thus very timely, as the industry moves to model-based working and starts to share models in a new context called integrated practice. Governments, both federal and state, and in New Zealand are starting to outline the role they might take, so that in contrast to the adoption of 2D CAD in the early 90s, we ensure that a national, industry-wide benefit results from this new paradigm of working. Section 1 of the guidelines give us an overview of BIM: how it affects our current mode of working, what we need to do to move to fully collaborative model-based facility development. The role of open standards such as IFC is described as a mechanism to support new processes, and make the extensive design and construction information available to asset operators and managers. Digital collaboration modes, types of models, levels of detail, object properties and model management complete this section. It will be relevant for owners, managers and project leaders as well as direct users of BIM. Section 2 provides recommendations and guides for key areas of model creation and development, and the move to simulation and performance measurement. These are the more practical parts of the guidelines developed for design professionals, BIM managers, technical staff and ‘in the field’ workers. The guidelines are supported by six case studies including a summary of lessons learnt about implementing BIM in Australian building projects. A key aspect of these publications is the identification of a number of important industry actions: the need for BIMcompatible product information and a national context for classifying product data; the need for an industry agreement and setting process-for-process definition; and finally, the need to ensure a national standard for sharing data between all of the participants in the facility-development process.

Communication and control : case studies in Australian telecommuting

This paper discusses the results of in-depth semi-structured interviews with 39 telecommuters from 12 Australian organisations. The paper serves two broad aims: firstly, it identifies current trends in telecommuting and offers a perspective on Australian developments. Secondly, it provides a focus on significant communication aspects of the Australian telecommuting experience. Findings are that the majority of interviewees reported overall satisfaction with telecommuting as an important contributor to their improved work and lifestyle outcomes. Overall, telecommuters appear to cope with communication aspects of their work environments. They also were not overreliant on advanced communications media when telecommuting. Difficulties as reported by telecommuter interviewees included: perceived discomfort over lack of management support for their telecommuting; reduced levels of interpersonal communication suggesting the likely need to adopt a ‘media mix’ approach to servicing their communication needs; problems of information access; and telecommuters’ reported levels of difficulty with their uses of some computer and communication technologies. Problems relating to telecommuters’ perceived professional and social isolation, were also identified. Finally, the paper underscores where organisational communication theorists and practitioners need to more energetically embrace the concepts of virtual work and telecommuting

Factors that influence Information Systems decisions and outcomes: A summary of key themes from four case studies" (2006). ACIS 2006 Proceedings. Paper 43.

This paper reports a summary of key findings from an examination of Information Systems decision making in four organisations. The study focused on what factors influenced decision makers during the critical preimplementation phase of Information Systems projects when systems were evaluated, selected and acquired. Using data gathered from interviews and organisational documentation, a critical hermeneutic analysis was performed in order to build an understanding of how informational and contextual influences acted on decision makers. Eight broad themes of factors were identified as having influence on decision makers and outcomes.

Managing Work, Hedonism and 'the Borderline' Between the Legal and Illegal Markets: Two Case Studies of Recreational Heavy Drug Users

In the context of cultural and/or differential ‘normalisation’ of certain forms of drug use, this article describes two case-studies of heavy recreational drug users. The daily lives of these users blur the line between the legal and the illegal; their drug trading is generally as a consumer and ‘friend of a friend’ small dealer in the low-level market. In the first case, problems with management of employment, time and financial budgeting are described; in the second case, such management is accomplished. Discussion refers to: differences between the two in relation to resources and vulnerability to risks, and to leisure/pleasure cultures of hedonism. The research agenda should pay more attention to users who seek to maintain a legitimate lifestyle but who develop problems managing work and their drug-related leisure. Understanding the consumer demand and dealing activity of such users is important in trying to develop a fuller understanding of drug markets.

Social media and its impact on crisis communication: Case studies of Twitter use in emergency management in Australia and New Zealand

There is a growing awareness worldwide of the significance of social media to communication in times of both natural and human-created disasters and crises. While the media have long been used as a means of broadcasting messages to communities in times of crisis – bushfires, floods, earthquakes etc. – the significance of social media in enabling many-to-many communication through ubiquitous networked computing and mobile media devices is becoming increasingly important in the fields of disaster and emergency management. This paper undertakes an analysis of the uses made of social media during two recent natural disasters: the January 2011 floods in Brisbane and South-East Queensland in Australia, and the February 2011 earthquake in Christchurch, New Zealand. It is part of a wider project being undertaken by a research team based at the Queensland University of Technology in Brisbane, Australia, that is working with the Queensland Department of Community Safety (DCS) and the EIDOS Institute, and funded by the Australian Research Council (ARC) through its Linkages program. The project combines large-scale, quantitative social media tracking and analysis techniques with qualitative cultural analysis of communication efforts by citizens and officials, to enable both emergency management authorities and news media organisations to develop, implement, and evaluate new social media strategies for emergency communication.

Evolving a synergistic approach to road safety : an appraisal of the project management, stakeholder engagement and change facilitation (PSC) approach by means of two case studies

Existing research and best practice were utilized to develop the Project Management, Stakeholder Engagement and Change Facilitation (PSC) approach to road safety infrastructure projects. Two case studies involving Queensland Transport and Main Roads demonstrated that use of the PSC has potential to create synergies for projects undertaken by multi-disciplinary road safety groups, and to complement Safe System projects and philosophy. The case studies were the North West Road Safety Alliance project, and the implementation of Road Safety Audit policy, and utilised a mix of qualitative and quantitative methods including interviews and surveys.

Learnings, case studies and guidelines for establishing shared and collaborative service delivery in the non-government sector: Evaluation of the Multi-Tenant Service Centre (MTSC) Pilots Project

This report presents learnings, case studies, guidelines and resources for non-government organisations that are planning to implement shared or collaborative arrangements with other agencies. It summarises results from an evaluation of the implementation phase of the Multi-Tenant Service Centre (MTSC) Pilots Project, which was completed in June 2008. This evaluation shows that developing and implementing shared and collaborative arrangements is a complex process that presents many risks, challenges and barriers to success, but can have many potential benefits for non government organisations. As this report makes clear, there is no ‘one size fits all’ approach to this process. The MTSC Pilots Project was conducted by the Department of Communities (DoC), Queensland Government, as part of its Strengthening Non-Government Organisations strategy. The objective of the MTSC Pilots initiative was to co-locate separate service providers in an appropriately located centre, operating with effective and transparent management, which enabled service providers to improve client services. Three MTSC consortiums in Mackay, Caboolture and Toowoomba were selected as the pilots over a four year period from 2006 – 2010.

Exploring the usefulness of structural-functional approaches to systematically assess the functionality of governance arrangements for natural resource management planning in two Australian case studies

This research developed and applied an evaluative framework to analyse multiple scales of decision-making for environmental management planning. It is the first exploration of the sociological theory of structural-functionalism and its usefulness to support evidence based decision-making in a planning context. The framework was applied to analyse decision-making in Queensland's Cape York Peninsula and Wet Tropics regions.

Teaching about deliberative politics: Case studies of classroom–community learning projects in four nations

Theories of deliberative politics position grass-roots community members as more than spectators of politics, and instead recognize their capacity for political engagement by discussing and evaluating options in order to make decisions about issues affecting community life. The processes and products of journalism can assist deliberative politics by providing community members with information resources that are vital for understanding the root causes of problems, weighing up competing claims, forming networks around shared concerns, reaching decisions and undertaking action. This article presents the findings of case studies of four community–classroom projects--one each from Australia, New Zealand, the United States and South Africa--that develop the capacity of journalism students to be effective contributors to deliberative politics. The research points to the importance of learning activities that prepare students to work in diverse communities, map significant community places and structures, identify leaders and stakeholders, engage in respectful dialogue about problems and perspectives, and appreciate community frames and values.