Reinforcing the security of corporate information resources:a critical review of the role of the acceptable use policy

Increasingly users are seen as the weak link in the chain, when it comes to the security of corporate information. Should the users of computer systems act in any inappropriate or insecure manner, then they may put their employers in danger of financial losses, information degradation or litigation, and themselves in danger of dismissal or prosecution. This is a particularly important concern for knowledge-intensive organisations, such as universities, as the effective conduct of their core teaching and research activities is becoming ever more reliant on the availability, integrity and accuracy of computer-based information resources. One increasingly important mechanism for reducing the occurrence of inappropriate behaviours, and in so doing, protecting corporate information, is through the formulation and application of a formal ‘acceptable use policy (AUP). Whilst the AUP has attracted some academic interest, it has tended to be prescriptive and overly focussed on the role of the Internet, and there is relatively little empirical material that explicitly addresses the purpose, positioning or content of real acceptable use policies. The broad aim of the study, reported in this paper, is to fill this gap in the literature by critically examining the structure and composition of a sample of authentic policies – taken from the higher education sector – rather than simply making general prescriptions about what they ought to contain. There are two important conclusions to be drawn from this study: (1) the primary role of the AUP appears to be as a mechanism for dealing with unacceptable behaviour, rather than proactively promoting desirable and effective security behaviours, and (2) the wide variation found in the coverage and positioning of the reviewed policies is unlikely to be fostering a coherent approach to security management, across the higher education sector.

The information security policy unpacked:a critical study of the content of university policies

Ensuring the security of corporate information, that is increasingly stored, processed and disseminated using information and communications technologies [ICTs], has become an extremely complex and challenging activity. This is a particularly important concern for knowledge-intensive organisations, such as universities, as the effective conduct of their core teaching and research activities is becoming ever more reliant on the availability, integrity and accuracy of computer-based information resources. One increasingly important mechanism for reducing the occurrence of security breaches, and in so doing, protecting corporate information, is through the formulation and application of a formal information security policy (InSPy). Whilst a great deal has now been written about the importance and role of the information security policy, and approaches to its formulation and dissemination, there is relatively little empirical material that explicitly addresses the structure or content of security policies. The broad aim of the study, reported in this paper, is to fill this gap in the literature by critically examining the structure and content of authentic information security policies, rather than simply making general prescriptions about what they ought to contain. Having established the structure and key features of the reviewed policies, the paper critically explores the underlying conceptualisation of information security embedded in the policies. There are two important conclusions to be drawn from this study: (1) the wide diversity of disparate policies and standards in use is unlikely to foster a coherent approach to security management; and (2) the range of specific issues explicitly covered in university policies is surprisingly low, and reflects a highly techno-centric view of information security management.

The post-adoption phase of the broadband in small businesses

In spite of the increasing significance of broadband, many small and medium enterprises (SMEs) are unaware of or unappreciative of its benefits. This is potentially a problem for governments, Internet Service Providers and other supply side institutions. The current study empirically verifies applicability of an extended IS continuance model controlling for organizational variables based on the Technology-Organization-Environment framework to examine factors influencing broadband post-adoption behavior of SMEs in Singapore. Strong support for the model has been manifested by the results, providing insight into influential factors. Results of the study suggest that perceived usefulness is a strong predictor of users’ continuance intention, followed by satisfaction with broadband usage as a significant but weaker predictor. SMEs in a more competitive business environment and whose key executive possesses greater IT knowledge are more likely to use broadband.

Designing a methodology for an office communication and information system:for executives in the Malaysian public sector : the Prime Minister's office

Modern managers are under tremendous pressure in attempting to fulfil a profoundly complex managerial task, that of handling information resources. Information management, an intricate process requiring a high measure of human cognition and discernment, involves matching a manager's lack of information processing capacity against his information needs, with voluminous information at his disposal. The nature of the task will undoubtedly become more complex in the case of a large organisation. Management of large-scale organisations is therefore an exceedingly challenging prospect for any manager to be faced with. A system that supports executive information needs will help reduce managerial and informational mismatches. In the context of the Malaysian public sector, the task of overall management lies with the Prime Minister and the Cabinet. The Prime Minister's Office is presently supporting the Prime Minister's information and managerial needs, although not without various shortcomings. The rigid formalised structure predominant of the Malaysian public sector, so opposed to dynamic treatment of problematic issues as faced by that sector, further escalates the managerial and organisational problem of coping with a state of complexity. The principal features of the research are twofold: the development of a methodology for diagnosing the problem organisation' and the design of an office system. The methodological development is done in the context of the Malaysian public sector, and aims at understanding the complexity of its communication and control situation. The outcome is a viable model of the public sector. `Design', on the other hand, is developing a syntax or language for office systems which provides an alternative to current views on office systems. The design is done with reference to, rather than for, the Prime Minister's Office. The desirable outcome will be an office model called Office Communication and Information System (OCIS).

The application of monolayer studies in the understanding of liposomal formulations

The study of surfactant monolayers is certainly not a new technique, but the application of monolayer studies to elucidate controlling factors in liposome design remains an underutilised resource. Using a Langmuir-Blodgett trough, pure and mixed lipid monolayers can be investigated, both for their interactions within the monolayer, and for interfacial interactions with drugs in the aqueous sub-phase. Despite these monolayers effectively being only half a bilayer, with a flat rather than curved structure, information from these studies can be effectively translated into liposomal systems. Here we outline the background, general protocols and application of Langmuir studies with a focus on their application in liposomal systems. A range of case studies are discussed which show how the system can be used to support its application in the development of liposome drug delivery. Examples include investigations into the effect of cholesterol within the liposome bilayer, understanding effective lipid packaging within the bilayer to promote water soluble and poorly soluble drug retention, the effect of alkyl chain length on lipid packaging, and drug-monolayer electrostatic interactions that promote bilayer repackaging.

A new dynamic framework for managing ERP development and enterprise strategy

The enterprise management (EM) approach provides a holistic view of organizations and their related information systems. In order to align information technology (IT) innovation with global markets and volatile virtualization, traditional firms are seeking to reconstruct their enterprise structures alongside repositioning strategy and establish new information system (IS) architectures to transform from single autonomous entities into more open enterprises supported by new Enterprise Resource Planning (ERP) systems. This chapter shows how ERP engage-abilities cater to three distinctive EM patterns and resultant strategies. The purpose is to examine the presumptions and importance of combing ERP and inter-firm relations relying on the virtual value chain concept. From a review of the literature on ERP development and enterprise strategy, exploratory inductive research studies in Zoomlion and Lanye have been conducted. In addition, the authors propose a dynamic conceptual framework to demonstrate the adoption and governance of ERP in the three enterprise management forms and points to a new architectural type (ERPIII) for operating in the virtual enterprise paradigm.

A framework for enabling dynamic e-business strategies via new enterprise paradigms and ERP solutions

In the global Internet economy, e-business as a driving force to redefine business models and operational processes is posing new challenges for traditional organizational structures and information system (IS) architectures. These are showing promises of a renewed period of innovative thinking in e-business strategies with new enterprise paradigms and different Enterprise Resource Planning (ERP) systems. In this chapter, the authors consider and investigate how dynamic e-business strategies, as the next evolutionary generation of e-business, can be realized through newly diverse enterprise structures supported by ERP, ERPII and so-called "ERPIII" solutions relying on the virtual value chain concept. Exploratory inductive multi-case studies in manufacturing and printing industries have been conducted. Additionally, it proposes a conceptual framework to discuss the adoption and governance of ERP systems within the context of three enterprise forms for enabling dynamic and collaborative e-business strategies, and particularly demonstrate how an enterprise can dynamically migrate from its current position to the patterns it desires to occupy in the future - a migration that must and will include dynamic e-business as a core competency, but that also relies heavily on ERP-based backbone and other robust technological platform and applications.

A concept-based framework for retrieving evidence to support emergency physician decision making at the point of care

The goal of evidence-based medicine is to uniformly apply evidence gained from scientific research to aspects of clinical practice. In order to achieve this goal, new applications that integrate increasingly disparate health care information resources are required. Access to and provision of evidence must be seamlessly integrated with existing clinical workflow and evidence should be made available where it is most often required - at the point of care. In this paper we address these requirements and outline a concept-based framework that captures the context of a current patient-physician encounter by combining disease and patient-specific information into a logical query mechanism for retrieving relevant evidence from the Cochrane Library. Returned documents are organized by automatically extracting concepts from the evidence-based query to create meaningful clusters of documents which are presented in a manner appropriate for point of care support. The framework is currently being implemented as a prototype software agent that operates within the larger context of a multi-agent application for supporting workflow management of emergency pediatric asthma exacerbations. © 2008 Springer-Verlag Berlin Heidelberg.

Background levels of urban land contamination

The research work reported in this thesis is concerned with the development and application of an urban scale sampling methodology for measuring and assessing background levels of heavy metal soil contamination in large and varied urban areas. The policy context of the work is broadly the environmental health problems posed by contaminated land and their implications for urban development planning. Within this wider policy context, the emphasis in the research has been placed on issues, related to the determination and application of 'guidelines' for assessing the significance of contaminated land for environmental planning. In concentrating on background levels of land contamination, the research responds to the need for additional techniques which address both the problems of measuring soil contamination at the urban scale and which are also capable of providing detailed information for use in the assessment of contaminated sites. Therefore, a key component of the work has been the development of a land-use based sampling framework for generating spatially comprehensive data on heavy metals in soil. The utility of the information output of the sampling method is demonstrated in two alternative ways. Firstly, it has been used to map the existing pattern of typical levels of heavy metals in urban soils. Secondly, it can be used to generate both generalised data in the form of 'reference levels' from which the overall significance of .background contamination may be assessed and detailed data, termed 'normal limit levels' for use in the assessment of site specific investigation data. The fieldwork was conducted in the West Midlands Metropolitan County and surface soil has been sampled and analysed for a measure of plant-available' and 'total' lead cadmium, copper and zinc. The research contrasts with much of the previous work on contaminated land which has generally concentrated on either the detailed investigation of individual sites suspected of being contaminated or the appraisal of land contamination resulting from specific point sources.

Purchasing green transport and logistics services:implications from the environmental sustainability attitude of 3PLs

Environmental sustainability is an area of increasing importance for third party logistics (3PL) companies. As the design and implementation of services requires interaction between buyer and 3PL, the 3PLs are in a critical position to support the efforts towards greening operations of different supply chain participants. However the literature in this field reflects a gap between the perspectives of buyers and 3PLs. This chapter attempts to fill this void through an explorative case study analysis on the environmental attitude of 3PLs in order to derive implications for buyers’ behavior. The results indicate that the buyer’s role is critical in different ways in the development of green initiatives among 3PLs. An increased orientation towards longer-term contracts and joint development would likely enhance the level of green initiatives. Indirectly, the buyer has the opportunity to influence its 3PLs through interaction with employees on different levels in the company, including top management.

An investigation into the adoption and implementation of electronic commerce in Saudi Arabian small and medium enterprises

Saudi Arabian Small and Medium Enterprises (SMEs) will face fierce competition from new entrants to local markets as a result of their accession to the Word Trade Organisation (WTO), and electronic commerce (e-commerce) technologies can reinforce SME's competitive edge. This study investigates the state of e-commerce adoption and analyses the factors that determine the extent to which SMEs in Saudi Arabia are inclined towards deploying e-commerce technologies. This could assist future firms in designing effective implementation projects. Seven SMEs' e-commerce adoption levels are studied as a case. The Technology-Organization-Environment (TOE) framework was used as the major source of inspiration in our analysis of e-commerce adoption amongst Saudi SMEs. In addition to advancing research on e-commerce in Saudi Arabia, this chapter also highlights several directions for future inquiry and implications for managers and policymakers.

The use of ERS-1 crossovers and TOPEX/Poseidon repeat pass data for global sea surface variability studies

In previous sea-surface variability studies, researchers have failed to utilise the full ERS-1 mission due to the varying orbital characteristics in each mission phase, and most have simply ignored the Ice and Geodetic phases. This project aims to introduce a technique which will allow the straightforward use of all orbital phases, regardless of orbit type. This technique is based upon single satellite crossovers. Unfortunately the ERS-1 orbital height is still poorly resolved (due to higher air drag and stronger gravitational effects) when compared with that of TOPEX/Poseidon (T/P), so to make best use of the ERS-1 crossover data corrections to the ERS-1 orbital heights are calculated by fitting a cubic-spline to dual-crossover residuals with T/P. This correction is validated by comparison of dual satellite crossovers with tide gauge data. The crossover processing technique is validated by comparing the extracted sea-surface variability information with that from T/P repeat pass data. The two data sets are then combined into a single consistent data set for analysis of sea-surface variability patterns. These patterns are simplified by the use of an empirical orthogonal function decomposition which breaks the signals into spatial modes which are then discussed separately. Further studies carried out on these data include an analysis of the characteristics of the annual signal, discussion of evidence for Rossby wave propagation on a global basis, and finally analysis of the evidence for global mean sea level rise.

River basin surveillance using remotely sensed data: a water resources information management system

This thesis describes the development of an operational river basin water resources information management system. The river or drainage basin is the fundamental unit of the system; in both the modelling and prediction of hydrological processes, and in the monitoring of the effect of catchment management policies. A primary concern of the study is the collection of sufficient and sufficiently accurate information to model hydrological processes. Remote sensing, in combination with conventional point source measurement, can be a valuable source of information, but is often overlooked by hydrologists, due to the cost of acquisition and processing. This thesis describes a number of cost effective methods of acquiring remotely sensed imagery, from airborne video survey to real time ingestion of meteorological satellite data. Inexpensive micro-computer systems and peripherals are used throughout to process and manipulate the data. Spatial information systems provide a means of integrating these data with topographic and thematic cartographic data, and historical records. For the system to have any real potential the data must be stored in a readily accessible format and be easily manipulated within the database. The design of efficient man-machine interfaces and the use of software enginering methodologies are therefore included in this thesis as a major part of the design of the system. The use of low cost technologies, from micro-computers to video cameras, enables the introduction of water resources information management systems into developing countries where the potential benefits are greatest.

An exploration of female leadership language:case studies of senior women in Bahrain

This is a multiple case study of the leadership language of three senior women working in a large corporation in Bahrain. The study’s main aim is to explore the linguistic practices the women leaders use with their colleagues and subordinates in corporate meetings. Adopting a Foucauldian (1972) notion of ‘discourses’ as social practices and a view of gender as socially constructed and discursively performed (Butler 1990), this research aims to unveil the competing discourses which may shape the leadership language of senior women in their communities of practice. The research is situated within the broader field of Sociolinguistics and the specific field of Language and Gender. To address the research aim, a case study approach incorporating multiple methods of qualitative data collection (observation, interviews, and shadowing) was utilised to gather information about the three women leaders and produce a rich description of their use of language in and out of meeting contexts. For analysis, principles of Qualitative Data Analysis (QDA) were used to organise and sort the large amount of data. Also, Feminist Post- Structuralist Discourse Analysis (FPDA) was adopted to produce a multi-faceted analysis of the subjects, their language leadership, power relations, and competing discourses in the context. It was found that the three senior women enact leadership differently making variable use of a repertoire of conventionally masculine and feminine linguistic practices. However, they all appear to have limited language resources and even more limiting subject positions; and they all have to exercise considerable linguistic expertise to police and modify their language in order to avoid the ‘double bind’. Yet, the extent of this limitation and constraints depends on the community of practice with its prevailing discourses, which appear to have their roots in Islamic and cultural practices as well as some Western influences acquired throughout the company’s history. It is concluded that it may be particularly challenging for Middle Eastern women to achieve any degree of equality with men in the workplace because discourses of Gender difference lie at the core of Islamic teaching and ideology.

The use of ICT by logistics service providers and implications for training needs:a cross-country perspective

Changes in the international economic scenario in recent years have made it necessary for both industrial and service firms to reformulate their strategies, with a strong focus on the resources required for successful implementation. In this scenario, information and communication technologies (ICT) has a potentially vital role to play both as a key resource for re-engineering business processes within a framework of direct connection between suppliers and customers, and as a source of cost optimisation. There have also been innovations in the logistics and freight transport industry in relation to ICT diffusion. The implementation of such systems by third party logistics providers (3PL) allows the real-time exchange of information between supply chain partners, thereby improving planning capability and customer service. Unlike other industries, the logistics and freight transport industry is lagging somewhat behind other sectors in ICT diffusion. This situation is to be attributed to a series of both industry-specific and other factors, such as: (a) traditional resistance to change on the part of transport and logistics service providers; (b) the small size of firms that places considerable constraints upon investment in ICT; (c) the relative shortage of user-friendly applications; (d) the diffusion of internal standards on the part of the main providers in the industry whose aim is to protect company information, preventing its dissemination among customers and suppliers; (e) the insufficient degree of professional skills for using such technologies on the part of staff in such firms. The latter point is of critical importance insofar as the adoption of ICT is making it increasingly necessary both to develop new technical skills to use different hardware and new software tools, and to be able to plan processes of communication so as to allow the optimal use of ICT. The aim of this paper is to assess the impact of ICT on transport and logistics industry and to highlight how the use of such new technologies is affecting providers' training needs. The first part will provide a conceptual framework of the impact of ICT on the transport and logistics industry. In the second part the state of ICT dissemination in the Italian and Irish third party logistics industry will be outlined. In the third part, the impact of ICT on the training needs of transport and logistics service providers - based on case studies in both countries - are discussed. The implications of the foregoing for the development of appropriate training policies are considered. For the covering abstract see ITRD E126595.