Understanding and measuring information security culture in developing countries : case of Saudi Arabia

The purpose of the current study was to develop a measurement of information security culture in developing countries such as Saudi Arabia. In order to achieve this goal, the study commenced with a comprehensive review of the literature, the outcome being the development of a conceptual model as a reference base. The literature review revealed a lack of academic and professional research into information security culture in developing countries and more specifically in Saudi Arabia. Given the increasing importance and significant investment developing countries are making in information technology, there is a clear need to investigate information security culture from developing countries perspective such as Saudi Arabia. Furthermore, our analysis indicated a lack of clear conceptualization and distinction between factors that constitute information security culture and factors that influence information security culture. Our research aims to fill this gap by developing and validating a measurement model of information security culture, as well as developing initial understanding of factors that influence security culture. A sequential mixed method consisting of a qualitative phase to explore the conceptualisation of information security culture, and a quantitative phase to validate the model is adopted for this research. In the qualitative phase, eight interviews with information security experts in eight different Saudi organisations were conducted, revealing that security culture can be constituted as reflection of security awareness, security compliance and security ownership. Additionally, the qualitative interviews have revealed that factors that influence security culture are top management involvement, policy enforcement, policy maintenance, training and ethical conduct policies. These factors were confirmed by the literature review as being critical and important for the creation of security culture and formed the basis for our initial information security culture model, which was operationalised and tested in different Saudi Arabian organisations. Using data from two hundred and fifty-four valid responses, we demonstrated the validity and reliability of the information security culture model through Exploratory Factor Analysis (EFA), followed by Confirmatory Factor Analysis (CFA.) In addition, using Structural Equation Modelling (SEM) we were further able to demonstrate the validity of the model in a nomological net, as well as provide some preliminary findings on the factors that influence information security culture. The current study contributes to the existing body of knowledge in two major ways: firstly, it develops an information security culture measurement model; secondly, it presents empirical evidence for the nomological validity for the security culture measurement model and discovery of factors that influence information security culture. The current study also indicates possible future related research needs.

A social matching system : using implicit and explicit information for personalized recommendation in online dating service

Online dating websites enable a specific form of social networking and their efficiency can be increased by supporting proactive recommendations based on participants' preferences with the use of data mining. This research develops two-way recommendation methods for people-to-people recommendation for large online social networks such as online dating networks. This research discovers the characteristics of the online dating networks and utilises these characteristics in developing efficient people-to-people recommendation methods. Methods developed support improved recommendation accuracy, can handle data sparsity that often comes with large data sets and are scalable for handling online networks with a large number of users.

Conference Keynote: Information literacy research and practice: An experiential perspective

In this paper I will explore some experience-based perspectives on information literacy research and practice. The research based understanding of what information literacy looks like to those experiencing it, is very different from the standard interpretations of information literacy as involving largely text based information searching, interpretation, evaluation and use. It also involves particular understandings of the interrelation between information and learning experiences. In following this thread of the history of information literacy I will reflect on aspects of the past, present and future of information literacy research. In each of these areas I explore experiential, especially phenomenographic approaches to information literacy and information literacy education, to reveal the unfolding understanding of people’s experience of information literacy stemming from this orientation. In addressing the past I will look in particular at the contribution of the seven faces of information literacy and some lessons learned from attending to variation in experience. I will explore important directions and insights that this history may help us to retain; including the value of understanding peoples’ information literacy experience. In addressing the present, I will introduce more recent work that adopts the key ideas of informed learning by attending to both information and learning experiences in specific contexts. I will look at some contemporary directions and key issues, including the reinvention of the phenomenographic, or relational approach to information literacy as informed learning or using information to learn. I will also provide some examples of the contribution of experiential approaches to information literacy research and practice. The evolution and development of the phenomenographic approach to information literacy, and the growing attention to a dual focus on information and learning experiences in this approach will be highlighted. Finally, in addressing the future I will return to advocacy, the recognition and pursuit of the transforming and empowering heart of information literacy; and suggest that for information literacy research, including the experiential, a turn towards the emancipatory has much to offer.

Methodological developments in phenomenography : investing using information to learn in the discipline classroom

This paper discusses methodological developments in phenomenography that make it apropos for the study of teaching and learning to use information in educational environments. Phenomenography is typically used to analyze interview data to determine different ways of experiencing a phenomenon. There is an established tradition of phenomenographic research in the study of information literacy (ex: Bruce, 1997; 2008; Lupton, 2008; Webber, Boon, & Johnston, 2005). Drawing from the large body of evidence complied in two decades of research, phenomenographers developed variation theory, which explains what a learner can feasibly learn from a classroom lesson based on how the phenomenon being studied is presented (Marton, Runesson, & Tsui, 2004). Variation theory’s ability to establish the critical conditions necessary for learning to occur has resulted in the use of phenomenographic methods to study classroom interactions by collecting and analyzing naturalistic data through observation, as well as interviews concerning teachers’ intentions and students’ different experiences of classroom lessons. Describing the methodological developments of phenomenography in relation to understanding the classroom experience, this paper discusses the potential benefits and challenges of utilizing such methods to research the experiences of teaching and learning to use information in discipline-focused classrooms. The application of phenomenographic methodology for this purpose is exemplified with an ongoing study that explores how students learned to use information in an undergraduate language and gender course (Maybee, Bruce, Lupton, & Rebmann, in press). This paper suggests that by providing a nuanced understanding of what is intended for students to learn about using information, and relating that to what transpires in the classroom and how students experience these lessons, phenomenography and variation theory offer a viable framework for further understanding and improving how students are taught, and learn to use information.

Experiencing information across the phenomenon of health information literacy

Interest in the concept of information literacy in different contexts is a topic that has steadily gained increased attention in information literacy discourse and research efforts over recent years. In particular the emergence of the term ‘health information literacy’ attests to this interest and has elevated awareness about the importance and relevance of information literacy in a health context. This paper reports on research that has taken a relational perspective to explore how people experience health information literacy. Initially established by Bruce (1997) the relational perspective draws from an experiential framework that emphasizes the relationship between users and information when learning in different contexts. This approach seeks outcomes that are deeply embedded in users’ informational life worlds and complements experiential phenomenological perspectives that have been used in health research. In keeping with the relational approach this research interprets health information literacy as being the different ways in which people experience using information to learn about health. Using interpretive phenomenography, this research explored variation in the lived experience of how people use information to learn about their health, and variation in what is constituted as information when learning about their health. Participants included 23 males and females aged between 45 and 64 years. All participants were residents from the Greater Brisbane area of Queensland, Australia. The research used semi-structured interviews for data collection. The types of questions posed during interviews included ‘Can you describe a time when you used information to learn about your health?’ and ‘What kinds of information have you used to learn about your health?’. This paper will focus on presenting one element of research findings that concerns the differences in ‘what’ participants experienced as information. Analysis of interview data identified significant variation in the experienced nature of information, specifically the different qualities or elements that comprised the ‘object’ of information, or in other words, what was perceived as ‘informing’. Illustrations of this variation include information experienced as traditional information sources, facts and experiences, something exhibiting particular qualities, physical or psychological changes, other people and role models. These findings provide new insights into what people may experience as information, and build upon existing literature regarding information as a theoretical construct. In addition the potential implications of these findings with respect to the design and delivery of health information literacy education will also be discussed. These research findings contribute to the emergence of information literacy investigations in everyday life and community. Although such settings have long been identified as a significant gap for exploration, research to date in this field has predominantly focused on educational and workplace environments. In this way the knowledge gained from this research has further revealed the contextual nature of information literacy, as well as its complexity as a phenomenon and focus of study.

A model for research supervision of international students in engineering and information technology disciplines

A large proportion (over 12 per cent) of international and non-English speaking background (NESB) postgraduate research students enrol in engineering and information technology (IT) programs in Australian universities. They find themselves in an advanced research culture, and are technically and scientifically challenged early in their programs. This is in addition to cultural, social and religious isolation and linguistic barriers they have to contend with. The project team surveyed this cohort at QUT and UWA, on the hypothesis that they face challenges that are more discipline-specific. The results of the survey indicate that existing supervisory frameworks which are limited to linguistic contexts are not fully assisting these students and supervisors to achieve high quality research. The goal of this project is to extend these supervisory frameworks to a holistic model that will address the unique needs and supervisory issues these students face in engineering and IT disciplines. The model will be useable by all other Australian universities.

Ergonomic DHM systems - limitations and trends – a systematic literature review focused on the ‘future of ergonomics’

Digital Human Models (DHM) have been used for over 25 years. They have evolved from simple drawing templates, which are nowadays still used in architecture, to complex and Computer Aided Engineering (CAE) integrated design and analysis tools for various ergonomic tasks. DHM are most frequently used for applications in product design and production planning, with many successful implementations documented. DHM from other domains, as for example computer user interfaces, artificial intelligence, training and education, or the entertainment industry show that there is also an ongoing development towards a comprehensive understanding and holistic modeling of human behavior. While the development of DHM for the game sector has seen significant progress in recent years, advances of DHM in the area of ergonomics have been comparatively modest. As a consequence, we need to question if current DHM systems are fit for the design of future mobile work systems. So far it appears that DHM in Ergonomics are rather limited to some traditional applications. According to Dul et al. (2012), future characteristics of Human Factors and Ergonomics (HFE) can be assigned to six main trends: (1) global change of work systems, (2) cultural diversity, (3) ageing, (4) information and communication technology (ICT), (5) enhanced competiveness and the need for innovation, and; (6) sustainability and corporate social responsibility. Based on a literature review, we systematically investigate the capabilities of current ergonomic DHM systems versus the ‘Future of Ergonomics’ requirements. It is found that DHMs already provide broad functionality in support of trends (1) and (2), and more limited options in regards to trend (3). Today’s DHM provide access to a broad range of national and international databases for correct differentiation and characterization of anthropometry for global populations. Some DHM explicitly address social and cultural modeling of groups of people. In comparison, the trends of growing importance of ICT (4), the need for innovation (5) and sustainability (6) are addressed primarily from a hardware-oriented and engineering perspective and not reflected in DHM. This reflects a persistent separation between hardware design (engineering) and software design (information technology) in the view of DHM – a disconnection which needs to be urgently overcome in the era of software defined user interfaces and mobile devices. The design of a mobile ICT-device is discussed to exemplify the need for a comprehensive future DHM solution. Designing such mobile devices requires an approach that includes organizational aspects as well as technical and cognitive ergonomics. Multiple interrelationships between the different aspects result in a challenging setting for future DHM. In conclusion, the ‘Future of Ergonomics’ pose particular challenges for DHM in regards to the design of mobile work systems, and moreover mobile information access.

Information Literacy Research : The Evolution of the Relational Approach

This chapter introduces the reader to the relational approach to information literacy, its evolution and use in contemporary research and emerging directions. It presents the relational approach, first introduced by Australian information literacy researchers, as an integration of experiential, contextual and transformational perspectives. The chapter opens with a reflection on the wider information literacy domain. It then addresses the development of the approach, its fundamental elements and characteristics, and explores the adoption of the approach in key contexts including education, workplace and community settings. The chapter explores significant studies that have contributed to its evolution and reflects on the impact of the development of the relational framework and related research. The chapter concludes with a focus on directions emerging from the relational understanding ofinformation literacy and potential implications.

Translating vision research into policy and practice to improve the visibility, and hence safety, or road workers at night

The process of translating research into policy and practice is not well understood. This paper uses a case study approach to interpret an example of translation with respect to theoretical approaches identified in the literature. The case study concerns research into “biological motion” or “biomotion”: when lights are placed on the moveable joints of the body and the person moves in a dark setting, there is immediate and accurate recognition of the human form although only the lights can be seen. QUT was successful in gaining Australian Research Council funding with the support of the predecessors of the Queensland Department of Transport and Main Roads (TMR) to research the biomotion effect in road worker clothing using reflective tape rather than lights, and this resulted in the incorporation of biomotion marking into AS/NZS 4602.1 2011. The most promising approach to understanding the success of this translation, SWOV’s “knowledge utilisation approach” provided some insights but was more descriptive than predictive and provided “necessary but not sufficient” conditions for translation. In particular, the supportive efforts of TMR staff engaged in the review and promulgation of national standards were critical in this case. A model of the conclusions is presented. The experiences gained in this case should provide insights into the processes involved in effectively translating research into practice.

Plaintext awareness in identity-based key encapsulation

The notion of plaintext awareness ( PA ) has many applications in public key cryptography: it offers unique, stand-alone security guarantees for public key encryption schemes, has been used as a sufficient condition for proving indistinguishability against adaptive chosen-ciphertext attacks ( IND-CCA ), and can be used to construct privacy-preserving protocols such as deniable authentication. Unlike many other security notions, plaintext awareness is very fragile when it comes to differences between the random oracle and standard models; for example, many implications involving PA in the random oracle model are not valid in the standard model and vice versa. Similarly, strategies for proving PA of schemes in one model cannot be adapted to the other model. Existing research addresses PA in detail only in the public key setting. This paper gives the first formal exploration of plaintext awareness in the identity-based setting and, as initial work, proceeds in the random oracle model. The focus is laid mainly on identity-based key encapsulation mechanisms (IB-KEMs), for which the paper presents the first definitions of plaintext awareness, highlights the role of PA in proof strategies of IND-CCA security, and explores relationships between PA and other security properties. On the practical side, our work offers the first, highly efficient, general approach for building IB-KEMs that are simultaneously plaintext-aware and IND-CCA -secure. Our construction is inspired by the Fujisaki-Okamoto (FO) transform, but demands weaker and more natural properties of its building blocks. This result comes from a new look at the notion of γ -uniformity that was inherent in the original FO transform. We show that for IB-KEMs (and PK-KEMs), this assumption can be replaced with a weaker computational notion, which is in fact implied by one-wayness. Finally, we give the first concrete IB-KEM scheme that is PA and IND-CCA -secure by applying our construction to a popular IB-KEM and optimizing it for better performance.

Improving usefulness of eHealth systems through Information Accountability

With the implementation of the Personally Controlled eHealth Records system (PCEHR) in Australia, shared Electronic Health Records (EHR) are now a reality. However, the characteristic implicit in the PCEHR that puts the consumer (i.e. patient) in control of managing his or her health information within the PCEHR prevents healthcare professionals (HCPs) from utilising it as a one-stop-shop for information at point of care decision making as they cannot trust that a complete record of the consumer's health history is available to them through it. As a result, whilst reaching a major milestone in Australia's eHealth journey, the PCEHR does not reap the full benefits that such a shared EHR system can offer.

Informed for health : exploring variation in ways of experiencing health information literacy

This research was a qualitative study that explored the experience of health information literacy. It used a research approach that emphasised identifying and describing variation in experience to investigate people's experience of using information to learn about health, and what they experienced as information for learning about health. The study's findings identified seven categories that represented qualitatively different ways in which people experienced health information literacy, and provide new knowledge about people's engagement with health information for learning in everyday life. The study contributes to consumer health information research and is significant to the disciplines of health and information science.

Clinical skin examination outcomes after a video-based behavioral intervention analysis from a randomized clinical trial

Importance Older men are at risk of dying of melanoma. Objective To assess attendance at and clinical outcomes of clinical skin examinations (CSEs) in older men exposed to a video-based behavioral intervention. Design, Setting, and Participants This was a behavioral randomized clinical trial of a video-based intervention in men aged at least 50 years. Between June 1 and August 31, 2008, men were recruited, completed baseline telephone interviews, and were than randomized to receive either a video-based intervention (n = 469) or brochures only (n = 461; overall response rate, 37.1%) and were again interviewed 7 months later (n = 870; 93.5% retention). Interventions Video on skin self-examination and skin awareness and written informational materials. The control group received written materials only. Main Outcomes and Measures Participants who reported a CSE were asked for the type of CSE (skin spot, partial body, or whole body), who initiated it, whether the physician noted any suspicious lesions, and, if so, how lesions were managed. Physicians completed a case report form that included the type of CSE, who initiated it, the number of suspicious lesions detected, how lesions were managed (excision, nonsurgical treatment, monitoring, or referral), and pathology reports after lesion excision or biopsy. Results Overall, 540 of 870 men (62.1%) self-reported a CSE since receiving intervention materials, and 321 of 540 (59.4%) consented for their physician to provide medical information (received for 266 of 321 [82.9%]). Attendance of any CSE was similar between groups (intervention group, 246 of 436 [56.4%]; control group, 229 of 434 [52.8%]), but men in the intervention group were more likely to self-report a whole-body CSE (154 of 436 [35.3%] vs 118 of 434 [27.2%] for control group; P = .01). Two melanomas, 29 squamous cell carcinomas, and 38 basal cell carcinomas were diagnosed, with a higher proportion of malignant lesions in the intervention group (60.0% vs 40.0% for controls; P = .03). Baseline attitudes, behaviors, and skin cancer history were associated with higher odds of CSE and skin cancer diagnosis. Conclusions and Relevance A video-based intervention may increase whole-body CSE and skin cancer diagnosis in older men. Trial Registration: anzctr.org.au Identifier: ACTRN12608000384358

Intra-organizational information asymmetry in offshore ISD outsourcing

Purpose - Contemporary offshore Information System Development (ISD) outsourcing is becoming even more complex. Outsourcing partner has begun ‘re-outsourcing’ components of their projects to other outsourcing companies to minimize cost and gain efficiencies. This paper aims to explore intra-organizational Information Asymmetry of re-outsourced offshore ISD outsourcing projects. Design/methodology/approach - An online survey was conducted to get an overall view of Information Asymmetry between Principal and Agents (as per the Agency theory). Findings - Statistical analysis showed that there are significant differences between the Principal and Agent on clarity of requirements, common domain knowledge and communication effectiveness constructs, implying an unbalanced relationship between the parties. Moreover, our results showed that these three are significant measurement constructs of Information Asymmetry. Research limitations/implications - In our study we have only considered three main factors as common domain knowledge, clarity of requirements and communication effectiveness as three measurement constructs of Information Asymmetry. Therefore, researches are encouraged to test the proposed constructs further to increase its precision. Practical implications - Our analysis indicates significant differences in all three measurement constructs, implying the difficulties to ensure that the Agent is performing according to the requirements of the Principal. Using the Agency theory as theoretical view, this study sheds light on the best contract governing methods which minimize Information Asymmetry between the multiple partners within ISD outsourcing organizations. Originality/value - Currently, to the best of our knowledge, no study has undertaken research on Intra-organizational Information Asymmetry in re-outsourced offshore ISD outsourcing projects.

Transparency tools in gene patenting for informing policy and practice

In the recent decision Association for Molecular Pathology v. Myriad Genetics1, the US Supreme Court held that naturally occurring sequences from human genomic DNA are not patentable subject matter. Only certain complementary DNAs (cDNA), modified sequences and methods to use sequences are potentially patentable. It is likely that this distinction will hold for all DNA sequences, whether animal, plant or microbial2. However, it is not clear whether this means that other naturally occurring informational molecules, such as polypeptides (proteins) or polysaccharides, will also be excluded from patents. The decision underscores a pressing need for precise analysis of patents that disclose and reference genetic sequences, especially in the claims. Similarly, data sets, standards compliance and analytical tools must be improved—in particular, data sets and analytical tools must be made openly accessible—in order to provide a basis for effective decision making and policy setting to support biological innovation. Here, we present a web-based platform that allows such data aggregation, analysis and visualization in an open, shareable facility. To demonstrate the potential for the extension of this platform to global patent jurisdictions, we discuss the results of a global survey of patent offices that shows that much progress is still needed in making these data freely available for aggregation in the first place.