Reinforcing the security of corporate information resources:a critical review of the role of the acceptable use policy

Increasingly users are seen as the weak link in the chain, when it comes to the security of corporate information. Should the users of computer systems act in any inappropriate or insecure manner, then they may put their employers in danger of financial losses, information degradation or litigation, and themselves in danger of dismissal or prosecution. This is a particularly important concern for knowledge-intensive organisations, such as universities, as the effective conduct of their core teaching and research activities is becoming ever more reliant on the availability, integrity and accuracy of computer-based information resources. One increasingly important mechanism for reducing the occurrence of inappropriate behaviours, and in so doing, protecting corporate information, is through the formulation and application of a formal ‘acceptable use policy (AUP). Whilst the AUP has attracted some academic interest, it has tended to be prescriptive and overly focussed on the role of the Internet, and there is relatively little empirical material that explicitly addresses the purpose, positioning or content of real acceptable use policies. The broad aim of the study, reported in this paper, is to fill this gap in the literature by critically examining the structure and composition of a sample of authentic policies – taken from the higher education sector – rather than simply making general prescriptions about what they ought to contain. There are two important conclusions to be drawn from this study: (1) the primary role of the AUP appears to be as a mechanism for dealing with unacceptable behaviour, rather than proactively promoting desirable and effective security behaviours, and (2) the wide variation found in the coverage and positioning of the reviewed policies is unlikely to be fostering a coherent approach to security management, across the higher education sector.

The information security policy unpacked:a critical study of the content of university policies

Ensuring the security of corporate information, that is increasingly stored, processed and disseminated using information and communications technologies [ICTs], has become an extremely complex and challenging activity. This is a particularly important concern for knowledge-intensive organisations, such as universities, as the effective conduct of their core teaching and research activities is becoming ever more reliant on the availability, integrity and accuracy of computer-based information resources. One increasingly important mechanism for reducing the occurrence of security breaches, and in so doing, protecting corporate information, is through the formulation and application of a formal information security policy (InSPy). Whilst a great deal has now been written about the importance and role of the information security policy, and approaches to its formulation and dissemination, there is relatively little empirical material that explicitly addresses the structure or content of security policies. The broad aim of the study, reported in this paper, is to fill this gap in the literature by critically examining the structure and content of authentic information security policies, rather than simply making general prescriptions about what they ought to contain. Having established the structure and key features of the reviewed policies, the paper critically explores the underlying conceptualisation of information security embedded in the policies. There are two important conclusions to be drawn from this study: (1) the wide diversity of disparate policies and standards in use is unlikely to foster a coherent approach to security management; and (2) the range of specific issues explicitly covered in university policies is surprisingly low, and reflects a highly techno-centric view of information security management.

Understanding supply chain disruption risk with the aid of social networks and information flows analysis

Supply Chain Risk Management (SCRM) has become a popular area of research and study in recent years. This can be highlighted by the number of peer reviewed articles that have appeared in academic literature. This coupled with the realisation by companies that SCRM strategies are required to mitigate the risks that they face, makes for challenging research questions in the field of risk management. The challenge that companies face today is not only to identify the types of risks that they face, but also to assess the indicators of risk that face them. This will allow them to mitigate that risk before any disruption to the supply chain occurs. The use of social network theory can aid in the identification of disruption risk. This thesis proposes the combination of social networks, behavioural risk indicators and information management, to uniquely identify disruption risk. The propositions that were developed from the literature review and exploratory case study in the aerospace OEM, in this thesis are:- By improving information flows, through the use of social networks, we can identify supply chain disruption risk. - The management of information to identify supply chain disruption risk can be explored using push and pull concepts. The propositions were further explored through four focus group sessions, two within the OEM and two within an academic setting. The literature review conducted by the researcher did not find any studies that have evaluated supply chain disruption risk management in terms of social network analysis or information management studies. The evaluation of SCRM using these methods is thought to be a unique way of understanding the issues in SCRM that practitioners face today in the aerospace industry.

An operational research-based integrated approach for mass evacuation planning of a city

Large-scale disasters are constantly occurring around the world, and in many cases evacuation of regions of city is needed. ‘Operational Research/Management Science’ (OR/MS) has been widely used in emergency planning for over five decades. Warning dissemination, evacuee transportation and shelter management are three ‘Evacuation Support Functions’ (ESF) generic to many hazards. This thesis has adopted a case study approach to illustrate the importance of integrated approach of evacuation planning and particularly the role of OR/MS models. In the warning dissemination phase, uncertainty in the household’s behaviour as ‘warning informants’ has been investigated along with uncertainties in the warning system. An agentbased model (ABM) was developed for ESF-1 with households as agents and ‘warning informants’ behaviour as the agent behaviour. The model was used to study warning dissemination effectiveness under various conditions of the official channel. In the transportation phase, uncertainties in the household’s behaviour such as departure time (a function of ESF-1), means of transport and destination have been. Households could evacuate as pedestrians, using car or evacuation buses. An ABM was developed to study the evacuation performance (measured in evacuation travel time). In this thesis, a holistic approach for planning the public evacuation shelters called ‘Shelter Information Management System’ (SIMS) has been developed. A generic allocation framework of was developed to available shelter capacity to the shelter demand by considering the evacuation travel time. This was formulated using integer programming. In the sheltering phase, the uncertainty in household shelter choices (either nearest/allocated/convenient) has been studied for its impact on allocation policies using sensitivity analyses. Using analyses from the models and detailed examination of household states from ‘warning to safety’, it was found that the three ESFs though sequential in time, however have lot of interdependencies from the perspective of evacuation planning. This thesis has illustrated an OR/MS based integrated approach including and beyond single ESF preparedness. The developed approach will help in understanding the inter-linkages of the three evacuation phases and preparing a multi-agency-based evacuation planning evacuation

The Value of Knowing that You Do Not Know

The value of knowing about data availability and system accessibility is analyzed through theoretical models of Information Economics. When a user places an inquiry for information, it is important for the user to learn whether the system is not accessible or the data is not available, rather than not have any response. In reality, various outcomes can be provided by the system: nothing will be displayed to the user (e.g., a traffic light that does not operate, a browser that keeps browsing, a telephone that does not answer); a random noise will be displayed (e.g., a traffic light that displays random signals, a browser that provides disorderly results, an automatic voice message that does not clarify the situation); a special signal indicating that the system is not operating (e.g., a blinking amber indicating that the traffic light is down, a browser responding that the site is unavailable, a voice message regretting to tell that the service is not available). This article develops a model to assess the value of the information for the user in such situations by employing the information structure model prevailing in Information Economics. Examples related to data accessibility in centralized and in distributed systems are provided for illustration.

Self-monitoring of blood glucose in Black Caribbean and South Asian Canadians with non-insulin treated Type 2 diabetes mellitus:a qualitative study of patients' perspectives

Background: To examine the views and current practice of SMBG among Black Caribbean and South Asian individuals with non-insulin treated Type 2 diabetes mellitus. Methods: Twelve participants completed semi-structured interviews that were guided by the Health Belief Model and analyzed using thematic network analysis. Results: The frequency of monitoring among participants varied from several times a day to once per week. Most participants expressed similar experiences regarding their views and practices of SMBG. Minor differences across gender and culture were observed. All participants understood the benefits, but not all viewed SMBG as beneficial to their personal diabetes management. SMBG can facilitate a better understanding and maintenance of self-care behaviours. However, it can trigger both positive and negative emotional responses, such as a sense of disappointment when high readings are not anticipated, resulting in emotional distress. Health care professionals play a key role in the way SMBG is perceived and used by patients. Conclusion: While the majority of participants value SMBG as a self-management tool, barriers exist that impede its practice, particularly its cost. How individuals cope with these barriers is integral to understanding why some patients adopt SMBG more than others. © 2013 Gucciardi et al.; licensee BioMed Central Ltd.

Model of Service Quality: Customer Loyalty for Hotels

The authors investigate the relationship between loyalty and perceived service quality of hotel customers and discus managerial implications to develop strategies to enhance loyalty of hotel customers. A survey was conducted among customers in the San Francisco Bay Area. Results indicate that customer loyalty is dependent on perceived service quality which is observed in terms of timelines, facilities, and ambience.

Nursing case management : a new perspective to caring for patients with hip fracture

Nursing Case Management has motivated nurses to examine the effects of care provided to patients, and to devise means of improving this care. The success of this nursing care delivery model is well documented among a variety of acute and chronically ill patients. Utilizing nonparametric ANOVA for comparison of two means, this study investigates the outcome of the implementation of a nursingcase management model on an orthopedic unit of a local hospital. A convenience sample (N=149) of hip-fracture patients for two separate eight months charting periods were used. The first period was pre-case management and the second period was after the implementation of nursing managed care on the unit. Results suggested that nursing case management was effective in reducing the total length of hospital stay and post-operative days significantly.

Proposta de modelo de gestão de riscos para uma IFES visando a realização de auditoria baseada em riscos

Organizations are susceptible to the occurrence of many events that may affect the achievement of their objectives. As a result, Brazilian Public Administration supervisory bodies have required institutions to adopt risk management policies. Given the large number of recommendations issued by Federal Audit Court (TCU) to various Federal Institutions of Higher Education (IFES) in this area, it is proposed a risk management model for Universidade Federal do Rio Grande do Norte (UFRN). This is an applied, exploratory and qualitative study. Regarding to technical procedures, it is characterized as documentary analysis, bibliographical research, case study and action research. The bibliographical research was used to support the elaboration of the Risk Management Guide for Federal Institutions of Higher Education (GERIFES). The documentary analysis, in turn, was used with the aim of knowing the organizational structure and the university´s macroprocesses. The author works in the university internal auditing department and shares the same problem. This characterizes the work as an action research. The case study supported both the elaboration of the guide and the simulation of the specific functionality for the university information system, demonstrated through the User Manual Module "Risk Management" proposed for the Integrated System of Property, Administration and Contracts (SIPAC). This manual has been prepared in order to facilitate the use of this tool if it will be incorporated into the university information system. As research results, a risk management model for UFRN was elaborated and a simulation of an informational tool, which is able to manage risks related to events that may affect the achievement of institutional objectives, was provided to the university administration.

O Programa Nacional Biblioteca da Escola - PNBE: da gestão ao leitor na educação infantil de Natal-RN

This study aims to investigate the process of implementation of Programa Nacional Biblioteca da Escola, PNBE, and the reader's training on Childhood Education level in Natal. The promotion of literary reading is the opportunity of inclusion in a world that is connected to citizenship, to human rights and social justice, because the reading is the way which gives meaning to the life and, therefore, it is a right for everybody. The study is characterized as a qualitative research with evaluative approach. The methodological procedure that constitutes this corpus took place in three stages: the first one was about the analysis of laws and documents of national public policies for the reading promotion; questionnaires were applied by Managing Committee - Natal/RN to CMEIs and the available websites from MEC that provide distribution of the acquis; in the second stage, we adopted the semi-structured interview as a methodological procedure elaborated with open questions that focus on the program management and to the acquis of PNBE; and in the third step we visited the 21 centers of childhood education in Natal for interviewing and to do the exploratory observation in places of reading. The Informant actors in this research are: the advisors of SME - Natal and FNDE, managers and teachers in Municipal Childhood Education Centers who totalize 30 informants. This theoretical and methodological framework follows the studies of Amarilha (1993; 1994; 2002; 2006; 2010; 2012), Bardin (2001), Bogdan; Biklen (1994), Castro (2007; 2008; 2012), Demo (2000; 2006; 2008), Fischer (2006), Moreira; Caleffe (2008), Paiva (2008; 2012), Secchi (2010; 2012), Soares (2003; 2008) and Zilberman (2001; 2003; 2008). The analysis indicates that decentralization strategy which is adopted in public management model will transfer responsibilities and assumption of the PNBE, exempting the actors to planning actions ensuring the efficiency and efficacy implementation on reading policy to national and municipal levels. The qualified acquis that is distributed by MEC reaches every Childhood Education center and does not depend on teacher's desire or it action, only a few of them know about it and they do not have information about the PNBE, neither receive specific training in order to articulate it to the practice of reading with children from Childhood Education. The reading project implemented by private education system in Natal overlaps the PNBE, making it invisible. The reading places that are available for that schooling stage are summarized to the reading corners. In some CMEI, books remain stored in boxes or they are locked in the closet, out of use to the teachers and students. Thus, care for the acquisition, selecting acquis, and a preoccupation to the supply of the reading and books for this education level are lost into volumes of closed boxes, teachers are jettisoned to this process and children do not have any enchantment to the reading or books. In this context, this paper draws attention to how much we should still investigate in order to understanding the perspectives, stresses and challenges from public policies for the reading promotion in our country. We hope that the research will help to improve the management model of the PNBE, ensuring the reading democratization and therefore the reader's training in early Childhood Education.

O Programa Nacional Biblioteca da Escola - PNBE: da gestão ao leitor na educação infantil de Natal-RN

This study aims to investigate the process of implementation of Programa Nacional Biblioteca da Escola, PNBE, and the reader's training on Childhood Education level in Natal. The promotion of literary reading is the opportunity of inclusion in a world that is connected to citizenship, to human rights and social justice, because the reading is the way which gives meaning to the life and, therefore, it is a right for everybody. The study is characterized as a qualitative research with evaluative approach. The methodological procedure that constitutes this corpus took place in three stages: the first one was about the analysis of laws and documents of national public policies for the reading promotion; questionnaires were applied by Managing Committee - Natal/RN to CMEIs and the available websites from MEC that provide distribution of the acquis; in the second stage, we adopted the semi-structured interview as a methodological procedure elaborated with open questions that focus on the program management and to the acquis of PNBE; and in the third step we visited the 21 centers of childhood education in Natal for interviewing and to do the exploratory observation in places of reading. The Informant actors in this research are: the advisors of SME - Natal and FNDE, managers and teachers in Municipal Childhood Education Centers who totalize 30 informants. This theoretical and methodological framework follows the studies of Amarilha (1993; 1994; 2002; 2006; 2010; 2012), Bardin (2001), Bogdan; Biklen (1994), Castro (2007; 2008; 2012), Demo (2000; 2006; 2008), Fischer (2006), Moreira; Caleffe (2008), Paiva (2008; 2012), Secchi (2010; 2012), Soares (2003; 2008) and Zilberman (2001; 2003; 2008). The analysis indicates that decentralization strategy which is adopted in public management model will transfer responsibilities and assumption of the PNBE, exempting the actors to planning actions ensuring the efficiency and efficacy implementation on reading policy to national and municipal levels. The qualified acquis that is distributed by MEC reaches every Childhood Education center and does not depend on teacher's desire or it action, only a few of them know about it and they do not have information about the PNBE, neither receive specific training in order to articulate it to the practice of reading with children from Childhood Education. The reading project implemented by private education system in Natal overlaps the PNBE, making it invisible. The reading places that are available for that schooling stage are summarized to the reading corners. In some CMEI, books remain stored in boxes or they are locked in the closet, out of use to the teachers and students. Thus, care for the acquisition, selecting acquis, and a preoccupation to the supply of the reading and books for this education level are lost into volumes of closed boxes, teachers are jettisoned to this process and children do not have any enchantment to the reading or books. In this context, this paper draws attention to how much we should still investigate in order to understanding the perspectives, stresses and challenges from public policies for the reading promotion in our country. We hope that the research will help to improve the management model of the PNBE, ensuring the reading democratization and therefore the reader's training in early Childhood Education.

Reserva extrativista Acaú-Goiana: tragédia comum ou decisão coletiva?

In recent years we have observed, in Brazil, the expansion of democratic spaces, providing the use of participatory management strategies in common-pool areas. However, the existence of a co-management model does not guarantee its practice, neither that it will prevent the depletion of common features characterizing the tragedy proposed by Hardin. In this work we analysed the management of Acaú-Goiana RESEX which is located in the cities of Acaú (PB) and Goiana (PE), eight years after its legal creation. We evaluated how much the users of RESEX possess information (even if non formalized) regarding the common use of area and whether they exhibit collectivist values. We used as an interpretative tool the facilitators principles of common resource management (PGRC) identified by Elinor Ostrom and the questionnaire of human values proposed by Schwartz. The human values questionnaire was applied to 240 individuals, half beneficiary and the other half non-beneficiary, only the beneficiaries were submitted to the questionnaire of PGRC. Interviews were conducted in the period of May to September 2014. We tested three hypotheses: 1) The degree of dependence from RESEX resources will play an important role on indirect knowledge of the PGRC; 2) the inclusion of individuals in a communal area (RESEX) increases collectivists values; 3) higher collectivist value rates increases knowledge of PGRC. To this end, we defined levels of socio-economic dependence of RESEX resources, knowledge of PGRC and individual values. GLM statistic analysis of mean comparison and correlation were employed. Our results showed that the knowledge on six of the seven items analyzed in the basic principles (PGRC) is still low. The extended land area and the high number of users may be exerting a detrimental effect on the development of a co-management. Contrary to expected, it was not the dependency who influenced knowledge on the PGRC, but the time spent in contact with the RESEX. This indicates that direct contact with the environment, not the dependence of it, that raises awareness about PGRC. According to our hypothesis, individuals with collectivist values showed greater knowledge of PGRC and reduced hours of work within the RESEX, indicating a greater tendency of individuals refrain their use of the common resource. Individualistic values correlated with less knowledge of a PGRC. Among the beneficiaries, individuals with higher individualistic values had higher monthly income, while among non-beneficiaries there was no such correlation, demonstrating the economic advantages of individualism (free-riding) in situations of non-private use of resources. Our data emphasize the importance of guiding the main actors in the development of a co-participatory management in the direction of the basic principles, and to develop collectivist values among users of a common good can raise awareness of these principles.

A value-oriented model for managing service supply chains

Service supply chain (SSC) has attracted more and more attention from academia and industry. Although there exists extensive product-based supply chain management models and methods, they are not applicable to the SSC as the differences between service and product. Besides, the existing supply chain management models and methods possess some common deficiencies. Because of the above reasons, this paper develops a novel value-oriented model for the management of SSC using the modeling methods of E3-value and Use Case Maps (UCMs). This model can not only resolve the problems of applicability and effectiveness of the existing supply chain management models and methods, but also answer the questions of ‘why the management model is this?’ and ‘how to quantify the potential profitability of the supply chains?’. Meanwhile, the service business processes of SSC system can be established using its logic procedure. In addition, the model can also determine the value and benefits distribution of the entire service value chain and optimize the operations management performance of the service supply.

Sales resource management training:a guide to developing effective salespeople

This paper adopts a sales resource management (SRM) framework to provide guidance on how to develop effective salespeople via sales training. SRM can be used to identify the individual training needs based on the individual-based modelling data. The individual-based modelling data can also be used to evaluate the outcome of sales training. This paper also gives some suggestions on the forms of sales training which are most likely to develop effective salespeople. © 2010 IEEE.

Auditoría integrada de Información + Conocimiento: aplicación en un caso de estudio

Se presentan los resultados de la aplicación de una metodología integradora de auditoría de información y conocimiento, llevada a cabo en un Centro de Investigación del Ministerio de Ciencia, Tecnología y Medio Ambiente de la provincia de Holguín, Cuba, conformada por siete etapas con un enfoque híbrido dirigida a revisar la estrategia y la política de gestión de información y conocimiento, identificar e inventariar y mapear los recursos de I+C y sus flujos, y valorar los procesos asociados a su gestión. La alta dirección de este centro, sus especialistas e investigadores manifestaron la efectividad de la metodología aplicada cuyos resultados propiciaron reajustar la proyección estratégica en relación con la gestión de la I+C, rediseñar los flujos informativos de los procesos claves, disponer de un directorio de sus expertos por áreas y planificar el futuro aprendizaje y desarrollo profesional.