Informal learning in security incident response teams

ACIS 2011 Proceedings - 22nd Australasian Conference on Information Systems

Volumn , Issue , 2011, Pages

  Shedden, Piya ^a   Ahmad, Atif ^b   Ruighaver, Anthonie B ^c  

^a Deloitte Touche Tohmatsu   (United States)

^b UNIVERSITY OF MELBOURNE   (Australia)

^c DEAKIN UNIVERSITY   (Australia)

Author keywords

Incident learning; Organisational learning; Security incident response

Indexed keywords

CRITICAL COMPONENT; FOCUS GROUPS; INCIDENT INVESTIGATION; INCIDENT LEARNING; INCIDENT RESPONSE; INFORMAL LEARNING; ORGANISATIONAL LEARNING; ORGANIZATIONAL LEARNING; SECURITY INCIDENT; SECURITY MANAGEMENT;

KNOWLEDGE MANAGEMENT; SECURITY OF DATA;

INFORMATION SYSTEMS;

EID: 84869113234     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (31)

1. Argyris, C. 1976. "Single-Loop and Double-Loop Models in Research on Decision-Making", Administrative Science Quarterly, (21:3), pp.363-375.
2. Argyris, C. and Schon, D. 1978. Organisational Learning. Reading, MA. Adderson-Wesley.
3. Brown, J. S. and P. Duguid 2002. The Social Life of Information. MA. Harvard Business School Press.
4. Davenport, T. H. and L. Prusak 1998. Working knowledge: how organizations manage what they know. Boston, Harvard Business School Press.
5. Dhillon, G. and J. Backhouse 2001. "Current directions in IS security research: towards socio-organizational perspectives. " Information Systems Journal, (11:2), pp. 127-153.
6. Grance, T., Kent, K. and Kim, B. 2004. Computer Security Incident Handling Guide-Recommendations of the National Institute of Standards and Technology. Technology Administration, US Department of Commerce.
7. Farris, G. F. 1979. "The Informal Organization in Strategic Decision-Making. " International Studies of Man and Organization. (9:4), pp.37-62.
8. Fiol, C.M. and Lyles, M.A. 1985. "Organizational Learning", The Academy of Management Review, (10:4), pp.803-813.
9. Hislop, D. 2009. The practice-based perspective on knowledge. Knowledge Management in Organizations. New York, Oxford University Press: 27-40.
10. Huber, G.P. 1991. "Organizational Learning: The Contributing Processes and the Literatures", Organization Science, (2:1), pp.88-115.
11. Jaikumar, V. 2002. "Organizations should build an incident response team", ComputerWorld Canada, (9:16).
12. Kelver, L. 2002. Incident Response in a Global Environment. GSEC Version 1.2b, SANS Reading Room.
13. Kitzinger, J. 1995. "Qualitative research: Introducing focus groups. " British Medical Journal, (311: 7000), pp. 299-302.
14. Levitt, B. and March, J.G. 1988. "Organizational Learning", Annual Review of Sociology, Vol.14, pp.319-340.
15. March, J.G. and Olsen, J.P. 1976. Ambiguity and Choice in Organizations. Universitetsforlaget, Bergen, Norway.
16. Marsick, V. J., and Volpe, M. "The Nature of and Need for Informal Learning. " In V. J. Marsick and M. Volpe (eds.), Informal Learning on the Job, Advances in Developing Human Resources, No. 3. San Francisco: Berrett Koehler, 1999.
17. Marsick, V. J., and Watkins, K. 1990. Informal and Incidental Learning in the Workplace. London and New York: Routledge.
18. Mitropolous, S., Patsos, D. and Douligeris, C. 2006. "On Incident Handling and Response: A state-of-the-art approach", Computers and Security, (25:5), pp.351-370.
19. Muhren, W., van den Eede, G. and van de Walle, B. 2008. "Organizational Learning for the Incident Management Process: Lessons from High Reliability Organizations. " Journal of Information Systems Security, (4:3), pp.3-23.
20. Murray, J. 2007. Analysis of the Incident Handling Six-Step Process. SANS Reading Room.
21. Nonaka, I. 1994. "A dynamic theory of organizational knowledge creation. " Organization Science. (5:1), pp. 14-37.
22. Northcutt, S. 1997. Computer Security Incident Handling, Step-by-Step. The SANS Institute.
23. Novak, C.J. 2007. "Investigative response: After the breach. " Computers and Security, (26:2), pp.183-185.
24. Sasse, M. A. and I. Flechais 2005. Usable Security: Why do we need it? How do we get it?. Security and Usability, O'Reilly Media: 13-30.
25. Scott, W.G. 1961. "Organization theory: an overview and an appraisal. " Journal of the Academy of Management, (4:1), pp2-26.
26. Shrivastava, P. 1983. "A Typology of Organizational Learning Systems", Journal of Management Studies, (20:1), pp.7-28.
27. Simon, H.A. 1991. "Bounded Rationality and Organizational Learning", Organization Science, (2:1), pp.125-134.
28. Siponen, M. T. 2005. "Analysis of modern IS security development approaches: towards the next generation of social and adaptable ISS methods. " Information and Organization, (15:4), pp.339-375.
29. West-Brown, M.J., Stikvoort, D. et al. 2003. Handbook of Computer Security Incident Response Teams (CSIRTs), Second Edition. Pittsburgh, PA, Carnegie-Mellon Software Engineering Institute.
30. Wiik, J., Gonzales, J.J., and Kossakowski, K-P. 2005. "Limits to Effectiveness in Computer Security Incident Response Teams. " in Proceedings of the Twenty-Third International Conference of the System Dynamics Society. The System Dynamics Society, Boston, MA.
31. van Niekerk, J. and von Solms, R. 2004. "Organisational Learning Models for Information Security", in Proceedings of the ISSA 2004 Enabling Tomorrow Conference, 30 June-2 July, Gallagher Estate, Midrand.