Enterprise information security policy assessment : an extended framework for metrics development utilising the goal-question-metric approach

Effective enterprise information security policy management requires review and assessment activities to ensure information security policies are aligned with business goals and objectives. As security policy management involves the elements of policy development process and the security policy as output, the context for security policy assessment requires goal-based metrics for these two elements. However, the current security management assessment methods only provide checklist types of assessment that are predefined by industry best practices and do not allow for developing specific goal-based metrics. Utilizing theories drawn from literature, this paper proposes the Enterprise Information Security Policy Assessment approach that expands on the Goal-Question-Metric (GQM) approach. The proposed assessment approach is then applied in a case scenario example to illustrate a practical application. It is shown that the proposed framework addresses the requirement for developing assessment metrics and allows for the concurrent undertaking of process-based and product-based assessment. Recommendations for further research activities include the conduct of empirical research to validate the propositions and the practical application of the proposed assessment approach in case studies to provide opportunities to introduce further enhancements to the approach.

Minimizing information leakage of tree-based RFID authentication protocols using alternate tree-walking

The privacy of efficient tree-based RFID authentication protocols is heavily dependent on the branching factor on the top layer. Indefinitely increasing the branching factor, however, is not a viable option. This paper proposes the alternate-tree walking scheme as well as two protocols to circumvent this problem. The privacy of the resulting protocols is shown to be comparable to that of linear-time protocols, where there is no leakage of information, whilst reducing the computational load of the database by one-third of what is required of tree-based protocols during authentication. We also identify and address a limitation in quantifying privacy in RFID protocols.

Alcohol and other drugs in construction

Evidence from the infrastructure and building sectors suggests issues of drugs and alcohol and its association with safety risk on construction sites. While most Australian jurisdictions have identified this as a critical safety issue, information is limited regarding the prevalence of alcohol and other drugs in the workplace and there is limited evidential guidance on how to effectively and efficiently address such an issue. A nationally consistent collaborative approach across the construction workforce - involving employers and employees; clients, unions; contractors and sub-contractors is required to engender a cultural change in the construction workforce – in a similar manner to the on-going initiative in securing a cultural change to drink-driving in our society where peer intervention and support is encouraged. A study to address these issues has three key objectives. Firstly, using the standard World Health Organisation Alcohol Use Disorders Identification Test (AUDIT), and a wide ranging set of structured interviews, a national qualitative and quantitative assessment of the use of drugs and alcohol is being undertaken. Secondly, the development of an appropriate industry policy with an adoption of an educative and rehabilitative approach is planned in consultation with employers and employees across the infrastructure and building sectors, with an aim of national adoption. Finally, an industry-specific cultural change management program will be developed through a nationally collaborative approach to reducing the risk of impaired performance on construction sites and increasing workers’ commitment to drugs and alcohol safety. The study outcomes stand to benefit not only occupational health and safety, through a greater understanding of the safety impacts of alcohol and other drugs at work, but also alcohol and drug use as a wider community health issue. This presentation will provide an analysis and discussion of the data collected in objective 1 and how the final results will inform the subsequent phases of the study.

Giving: The next generation – parental effects on donations

This paper provides a summary of what is known from social science research about the effects parents have on the donations of their children. It then goes on to summarize two on-going research projects. The first project provides estimates of the strength of the relationship between the charitable giving of parents and that of their adult children. The second provides estimates of the effect of inheritances on charitable donations. Both projects use data from the Center on Philanthropy Panel Study (COPPS); accordingly, the paper provides an introduction to these data. Finally, the paper draws implications for fundraisers from the two on-going projects, and suggests several other areas in which COPPS can generate knowledge to improve the practice of fundraising.

Using a thimble to drink from a fire hydrant: information anxiety and the third sector

In the last 10 years, the third sector has seen an eruption of texts, websites, discussion forums, conferences, new journals, new research centres and sector-specific degrees. This growing abundance of information allows for hitherto impossible networking, collaboration and general awareness of what is happening in the sector. At the same time, however, like staff in many industries, nonprofit professionals can suffer from an increasingly common 21st century malaise known as ‘information anxiety’. It is worth examining the sector through the lens of Information Studies theory, to question what the information technology needs of nonprofits are and how their information management techniques may differ from those in the public and private sectors. There are implications of this both for those within the industry (in terms of governance, training and public relations) and those external to it (who may form relationships with nonprofits on the basis of access to information).

Information technology and business value in a global economy : do information technology investments pay off in a developing economy?

Understanding the business value of IT has mostly been studied in developed countries, but because most investment in developing countries is derived from external sources, the influence of that investment on business value is likely to be different. We test this notion using a two-layer model. We examine the impact of IT investments on firm processes, and the relationship of these processes to firm performance in a developing country. Our findings suggest that investment in different areas of IT positively relates to improvements in intermediate business processes and these intermediate business processes positively relate to the overall financial performance of firms in a developing country.

Information technology resources,complementaries and capabilities : towards a deeper understanding of leveraging business value from IT

Organisations devote substantial resources to acquire information technology (IT), and explaining the important issue of how IT can affect performance has posed a significant challenge to information system (IS) researchers. Owing to the importance of expanding our understanding on how and where IT and IT-related resources impact organisational performance, this study investigates the differential effects of IT resources and IT-related capabilities, in the presence of platform-related complementarities, on business process performance. We test these relationships empirically via a field survey of 216 firms. The findings suggest that IT resources and IT-related capabilities explain variance in performance. Of interest is the finding that IT resources and IT-related capabilities ability to explain variance in business process is further enhanced by the presence of the platform-related complementarities. Our findings are largely consistent with the resource-based and complementarity arguments of sources of IT-related business value.

IT governance in collaborative organizational structures

Organizations today engage in various forms of alliances to manage their existing business processes or to diversify into new processes to sustain their competitive positions. Many of today’s alliances use the IT resources as their backbone. The results of these alliances are collaborative organizational structures with little or no ownership stakes between the parties. The emergence of Web 2.0 tools is having a profound effect on the nature and form of these alliance structures. These alliances heavily depend on and make radical use of the IT resources in a collaborative environment. This situation requires a deeper understanding of the governance of these IT resources to ensure the sustainability of the collaborative organizational structures. This study reports on the first stage of this initiative. It suggest the types of IT governance structures required for collaborative organizational structures. Semi-structured interviews with senior executives who operate in such alliances reveal that co-created IT governance structures are necessary. Such structures include co-created IT-steering committees, cocreated operational committees, and inter-organizational performance management and communication systems. The findings pave the way for the development of a model for understanding approaches to governing IT and evaluating the effectiveness for such governance mechanisms in today’s IT dependent alliances.

Information technology and business value: how complementary IT usage platform and capable resources explain IT business value variation

Understanding information technology’s (ITs) contribution to business value is an imperative issue, and while we have attempted to untangle the relationship between IT and business value with some success, our knowledge of specific factors leading to ITs contribution to business value still remains limited. In this paper we propose that complementing IT resources, by establishing a sound IT platform with capable organisational resources may aid in ITs ability to contribute to business value. We suggest that performance measurement of this contribution be undertaken at the business process level first, and then mapped through to firm level performance measurement to obtain a better understanding of the path of IT business value contribution.

Towards a Deeper Understanding of Information Technology Governance Effectiveness : A Capabilities-Based Approach

We examine the relationship between the effectiveness of IT steering committee-driven IT governance initiatives and firm’s IT management and IT infrastructure related capabilities. We test these relationships empirically by a field survey of 216 firms. Results of this study suggest that a firms’ effectiveness of IT steering committee-driven IT governance initiatives positively relate to the level of their IT-related capabilities. We also found positive relationships between IT-related capabilities and internal process-level performance, which positively relate to improvement in customer service and firm-level performance. For researchers, we demonstrate that the resourcebased theory provides a more robust explanation of the determinants of firms IT governance initiatives. This would be ideal in evaluating other IT governance initiatives effectiveness in relation to how they contribute to building performance-differentiating IT-related capabilities. For decision makers, we hope our study has reiterated the notion that IT governance is truly a coordinated effort, embracing all levels of human resources.

The Impact of Information Technology Investments on Firm Processes and Performance

This book provides the much needed international dimension on the payoffs of information technology investments. The bulk of the research on the impact of information technology investments has been undertaken in developed economies, mainly the United States. This research provides an alternative dimension - a developing country perspective on how information technology investments impacts organizations. Secondly, there has been much debate and controversy on how we measure information technology investment payoffs. This research uses an innovative two-stage model where it proposes that information technology investments will first impact the process and improvement in the processes will then impact the performance. In doing so, it considers sectors of information technology investment rather than taking it as one. Finally, almost all prior studies in this area have considered only the tangible impact of information technology investments. This research proposes that one can only better understand the benefits by looking at both the tangible and intangible benefits.

Exploring information experience using social media during the 2011 Queensland floods : a pilot study

Social media networks have emerged as a powerful tool in allowing collaboration and sharing of information during times of crisis (Bruns, The Centre for Creative Industries Blog, comment posted on January 19,2011). The 2011 Queensland floods provided a unique opportunity to explore social media use during an emergency. This paper presents the findings of a pilot study that explored the information experiences of people using social media during the flooding of the Brisbane River. Analysis of data from four interviews supported the emergence of four categories of information experience. Examination of the categories revealed variation between the way in which individuals experienced social media and the point of the flooding at which each category of experience occurred. Information regarding individual’s use of social media has the potential to inform the development of social media platforms that can provide relevant and accessible information for the general public in event of a natural disaster.

Building the profession together : towards holistic library and information science education

How can a holistic approach to library and information science education encompassing vocational and university sectors that meets the future information workforce requirements be achieved? This paper will outline a twelve month national project that considered this very question. Funded by the Australian Learning and Teaching Council (ALTC).

Information system experts : definition, identification, and application

Experts’ views and commentary have been highly respected in every discipline. However, unlike traditional disciplines like medicine, mathematics and engineering, Information System (IS) expertise is difficult to define. Despite seeking expert advice and views is common in the areas of IS project management, system implementations and evaluations. This research-in-progress paper attempts to understand the characteristics of IS-expert through a comprehensive literature review of analogous disciplines and then derives a formative research model with three main constructs. A validated construct of expertise of IS will have a wide range of implications for research and practice.

Beyond broadcasting: customer service, community and information experience in the Twittersphere

What opportunities does a channel like Twitter offer to libraries, beyond the realm of marketing? We would like to highlight three roles for Twitter in the academic library environment: Twitter as a service delivery and service recovery channel; Twitter as a community builder; Twitter as a site for information experience.