Information Systems - Theses

Permanent URI for this collection

Search Results

Now showing 1 - 10 of 37
  • Item
    Thumbnail Image
    Strategic information security policy quality assessment : a multiple constituency perspective
    Maynard, Sean Brian. (University of Melbourne, 2010)
    An integral part of any information security management program is the information security policy. The purpose of an information security policy is to define the means by which organisations protect the confidentiality, integrity and availability of information and its supporting infrastructure from a range of security threats. The tenet of this thesis is that the quality of information security policy is inadequately addressed by organisations. Further, although information security policies may undergo multiple revisions as part of a process development lifecycle and, as a result, may generally improve in quality, a more explicit systematic and comprehensive process of quality improvement is required. A key assertion of this research is that a comprehensive assessment of information security policy requires the involvement of the multiple stakeholders in organisations that derive benefit from the directives of the information security policy. Therefore, this dissertation used a multiple-constituency approach to investigate how security policy quality can be addressed in organisations, given the existence of multiple stakeholders. The formal research question under investigation was: How can multiple constituency quality assessment be used to improve strategic information security policy? The primary contribution of this thesis to the Information Systems field of knowledge is the development of a model: the Strategic Information Security Policy Quality Model. This model comprises three components: a comprehensive model of quality components, a model of stakeholder involvement and a model for security policy development. The strategic information security policy quality model gives a holistic perspective to organisations to enable management of the security policy quality assessment process. This research contributes six main contributions as stated below: � This research has demonstrated that a multiple constituency approach is effective for information security policy assessment � This research has developed a set of quality components for information security policy quality assessment � This research has identified that efficiency of the security policy quality assessment process is critical for organisations � This research has formalised security policy quality assessment within policy development � This research has developed a strategic information security policy quality model � This research has identified improvements that can be made to the security policy development lifecycle The outcomes of this research contend that the security policy lifecycle can be improved by: enabling the identification of when different stakeholders should be involved, identifying those quality components that each of the different stakeholders should assess as part of the quality assessment, and showing organisations which quality components to include or to ignore based on their individual circumstances. This leads to a higher quality information security policy, and should impact positively on an organisation�s information security.
  • Item
  • Item
    Thumbnail Image
    Data modeling : description or design?
    Simsion, Graeme C. (University of Melbourne, 2006)
  • Item
    Thumbnail Image
    Data modeling : description or design?
    Simsion, Graeme C. (University of Melbourne, 2006)
  • Item
    Thumbnail Image
    Exploring knowledge leakage risk in knowledge-intensive organisations: behavioural aspects and key controls
    Altukruni, Hibah Ahmed ( 2019)
    Knowledge leakage poses a critical risk to the competitiveness advantages of knowledge-intensive organisations. Although knowledge leakage is a human-centric security issue, little is known in relation to the key factors of individual-level leaking behaviour. Therefore, the aim of this thesis was to explore security practitioners’ perspectives on the key enablers and inhibitors of behavioural knowledge leakage risk in the context of knowledge-intensive organisations. An exploratory, qualitative design was used to carry out the study. Moreover, seven security practitioners working in Australian organisations were recruited to participate in this research. The data were collected using semi-structured questions via two focus group discussions. The discussion sessions lasted between 90 and 120 minutes, including a 10-minute break. The sessions were audio recorded, transcribed, and thematically analysed following Braun and Clarke’s (2006) strategy. Furthermore, two main trends emerged from the analysed data. First, ‘interpersonal enabling factors’ included leaking behaviours and employees’ personality’ traits. Second, contributing ‘organisational practices around knowledge leakage mitigation’ included poor knowledge sensitivity classification systems and poor knowledge security management practices. In conclusion, it is essential that security practitioners address the key identified factors of behavioural leakage risk to mitigate the leaking incidents effectively. Three key security practices that were found to have a superior impact in mitigating leaking enablers included human resource management practices, knowledge security training and awareness practices, and compartmentalisation.
  • Item
    Thumbnail Image
    Towards a model that explains knowledge sharing behaviour for complex tasks
    Zalk, Marion ( 2018)
    In organisations, knowledge sharing has been studied in many different contexts and settings, as it is an integral part of knowledge creation. This thesis presents and tests a model that explains motivations for knowledge sharing behaviour for complex tasks. The foundation of the research is a number of key organisational and motivational theories including social cognitive theory. Existing research in this area is focussed in 3 domains – the enabling and supportive role of technology; the organisation and its characteristics; and the individual and his/her attitudes and intentions to knowledge sharing. Scant research has considered the task at hand, the task about which individuals perform knowledge sharing and the impact of this task on the individual’s knowledge sharing behaviour. This research is centred on this task, from here on, referred to as ‘the task’ in this thesis. Since the focus of this research is on knowledge sharing behaviour related to complex tasks - it is the characteristic of complexity that forms the basis of the models that are tested in this research. In order to establish the task as the key factor in the performance of knowledge sharing behaviour, the research proposes 3 different models, each with a different variable as the key influencer in the performance of knowledge sharing behaviour. These variables are: i) the task about which knowledge is being shared, ii) the technology used for sharing knowledge, and iii) the actual task of performing knowledge sharing behaviour. These three behavioural models were tested empirically using an experimental research design involving 76 individuals performing a complex task. Data collected through surveys was analysed statistically using analysis of variance and process analysis to assess individual performance associated with knowledge sharing behaviour. Findings confirm that task self-efficacy and knowledge sharing self-efficacy indirectly influence the relationship between task complexity and the quality of knowledge shared. Findings also confirm that commitment to both the task itself and the knowledge sharing, in addition to self-efficacy, indirectly influence the relationship between task complexity and the understandability of knowledge shared. Finally, findings demonstrate that feedback on knowledge shared positively influences the choice of knowledge transfer mechanisms. In addition, qualitative analysis of the codified knowledge and the answers to the open-ended questions validated the study’s findings and provided richer insights into the empirical results. This research contributes to our understanding of the importance of a task and its influence on the quality and understandability of an individual’s knowledge sharing behaviour performance. Furthermore, it contributes to and extends the current literature on complex tasks. Outcomes of this research offer a new perspective on the importance of the role of the task at hand in knowledge sharing. Corresponding to this, there are important implications for the design of supporting technology and potential interventions for human resource management. In addition, this research has important implications for the organisation as it often relies on individual expertise associated with a complex task. This expertise may not be accessible, as it exists in geographically diverse locations. This may impact the execution of the complex task. In order to delve further into the relationship between a complex task and the performance of knowledge sharing behaviour, there is a clear need to consider other characteristics of the task about which knowledge is being shared, as this forms the basis for the individual’s choice of knowledge transfer mechanisms. Future studies should also consider feedback and how to integrate feedback into existing knowledge transfer mechanisms to optimise the sharing of knowledge as this feedback is a tool that can be useful in influencing the preference for knowledge transfer mechanisms.
  • Item
    Thumbnail Image
    Understanding how cloud computing enables business model innovation in start-up companies
    Alrokayan, Mohammed ( 2017)
    Start-up companies contribute significantly to the national economies of many countries but their failure rate is notably high. Successful start-ups typically depend on innovative business models to be competitive and maintain profitability. This thesis explores how the new technologies of cloud computing might enable start-ups to create and maintain competitive advantage. A conceptual framework called Cloud-Enabled Business Model Innovation (CEBMI) is presented that identifies three research questions concerning how cloud computing might enable business model innovation, what form this innovation takes, and how the innovation leads to competitive advantage. These questions were then investigated through three empirical studies involving six case studies with start-ups and two qualitative studies involving interviews with 11 business consultants and three cloud service providers. The detailed findings are presented as a set of key propositions that offer answers to the research questions, and together sketch a view of how CEBMI might enable start-ups to achieve competitive advantage.
  • Item
    Thumbnail Image
    Brokering algorithms for data replication and migration across cloud-based data stores
    Mansouri, Yaser ( 2017)
    Cloud computing provides users with highly reliable, scalable and flexible computing and storage resources in a pay-as-you-go manner. Data storage services are gaining increasing popularity and many organizations are considering moving data out of their in-house data centers to the so-called Cloud Storage Providers (CSPs). However, reliance on a single CSP introduces challenges in terms of service unavailability, vendor lock-in, high network latency to the end users, and a non-affordable monetary cost to application providers. These factors are vital for the data-intensive applications which experience a time-varying workload, and the providers of these applications require to offer users storage services at an affordable monetary cost within the required Quality of Service (QoS). The utilization of multiple CSPs is a promising solution and provides the increment in availability, the enhancement in mobility, the decline in network latency, and the reduction in monetary cost by data dispersion across CSPs offering several storage classes with different prices and performance metrics. The selection of these storage classes is a non-trivial problem. This thesis presents a set of algorithms to address such problem and facilitates application providers with an appropriate selection of storage services so that the data management cost of data-intensive applications is minimized while the specified QoS by users is met. The thesis advances this field by making the following key contributions: (1) Data placement algorithms that select storage services for replication non-stripped and stripped objects respectively, with the given availability to minimize storage cost and with the given budget to maximize availability. (2) A dual cloud-based storage architecture for data placement, which optimizes data management cost (i.e, storage, read, write, and potential migration costs) and considers user-perceived latency for reading and writing data as a monetary cost. (3) The optimal offline algorithm and two online algorithms with provable performance guarantees for data placement, which exploit pricing differences across storage classes owned by different CSPs to optimize data management cost for a given number of replicas of the object while respecting the user-perceived latency. (4) A lightweight object placement algorithm that utilizes Geo-distributed storage classes to optimize data management cost for a number of replicas of the object that is dynamically determined. (5) Design and implementation of a prototype system for empirical studies in latency evaluation in the context of a data placement framework across two cloud providers services (Amazon S3 and Microsoft Azure).
  • Item
    Thumbnail Image
    Player negotiated digital multiplayer game experiences
    Harrop, Mitchell Owen ; HARROP, MITCHELL ( 2016)
    This thesis covers the negotiation of rules and experiences by players of digital multiplayer games. An examination of existing literature found that overall contemporary games studies can be seen to suffer from an over-emphasis on what mentalities and motivations players bring to games, rather than how they negotiate and change their experiences during play and over longer periods of time. To address these gaps, data was gathered in three qualitative studies that utilised interviews, observations, game paratexts and the researcher’s own experiences. Using a constructivist grounded theory approach (Charmaz, 2006), Fine’s (1983) version of Goffman’s (1974) frame analysis was used to gain insight into the gathered data. The first of the three studies was exploratory, examining the case of Defence of the Ancients (DotA). DotA was a game modification that went through many versions and was selected for its known complexities in how players framed their playing experiences and utilised different social rules for play. The second study concerned the negotiation of loot distribution (in-game items) in the massively multiplayer online role-playing game World of Warcraft (WoW). The final study focused primarily on fabrications such as pranks and farcical behaviours. Such activities were important to how players framed their changing gameplay across a multitude of games. As a core contribution, Fine’s version of frame analysis was used to explore how individuals fleetingly frame their game playing in a multitude of ways such as serious competitions, casual events, pranks and learning experiences. The nature of game technology was influential in this process and players often appealed to the form of the technology in their negotiations, even searching for a voice of an “absent designer” (Lantz-Andersson & Linderoth, 2011) as a rationale for their actions. Furthermore, such oscillating frames could operate under a pretence awareness context (Glaser & Strauss, 1964), not only between individuals, but also between different enacted selves. For example, an experienced player teaching a new player game mechanics and acting under the pretence they had not seen the location of their pupil’s avatar, thus effectively balancing their social and ludic roles of teacher and competitor respectively.
  • Item
    Thumbnail Image
    Towards intelligence-driven information security risk management: an intelligent information security method
    WEBB, JEB ( 2015)
    Information security risk management (ISRM) methods aim to protect organizational information infrastructure from a range of security threats using efficient and cost‐effective means. A review of the literature identified three common practical deficiencies that can undermine ISRM: (1) Information security risk identification is commonly perfunctory; (2) Information security risks are commonly estimated with little reference to the organization’s actual situation; and (3) Information security risk assessment is commonly performed on an intermittent, non‐historical basis. These deficiencies indicate that despite implementing “best practices,” organizations are likely to have inadequate situation awareness (SA) regarding their information security risk environments. SA is achieved by a decision‐maker in progressive stages. First, one perceives relevant elements of a situation. Once these situational elements are perceived, their intrinsic and contextual meanings can be comprehended in light of established knowledge. Optimal SA is achieved when the decision-maker knows and understands enough about relevant situational elements to project the future of the situation and its implications for operational goals and objectives. Supporting SA is a matter of supporting a decision‐maker’s ability to perceive, comprehend, and project. In ISRM, the general situations of interest are organizational information security risk environments. To answer the research question, “How can situation awareness be increased in information security risk management?” this thesis offers a design science artifact that supports perception, comprehension, and projection by means of a distributed intelligence collection and analysis effort. This artifact—the Intelligent Information Security Method—is the output of an in‐depth case study of the US Intelligence Community’s enterprise management structure, which was performed using publicly available, open source documents. The intelligence cycle, as executed by the US Intelligence Community, was modeled using Endsley’s SA theory and comparisons were then drawn between the US model and organizations to develop a risk management system for organizations. The Intelligent Information Security Method has two major dimensions. The primary (theoretical) dimension of the method is a high level process that explains how organizational SA can be achieved in general terms. The secondary (practical) dimension of the Method concerns the practical details—or “inner workings”—of this process, which are presented as a comprehensive information security risk management system design. This thesis makes a significant contribution to information security management theory by explaining management in the cognitive terms of SA, and then describing how an organizational intelligence production effort can be used to support managerial SA. The thesis makes a significant contribution to information security management practice by specifying a management system design that organizations can use to actually achieve this theoretical objective. The Intelligent Information Security Method can be used to improve the quality of ISRM in the implementing organization while simultaneously supporting the management and optimization of the organization’s business processes.