A situation awareness model for information security risk management

Computers and Security

Volumn 44, Issue , 2014, Pages 1-15

  Webb, Jeb ^a   Ahmad, Atif ^a   Maynard, Sean B ^a   Shanks, Graeme ^a  

^a UNIVERSITY OF MELBOURNE   (Australia)

Author keywords

Evidence based information security; Information security compliance; Information security intelligence; Information security investigation; Information security management; Information security risk management; Situation awareness; Situation awareness theory

Indexed keywords

DECISION MAKING; MOBILE TELECOMMUNICATION SYSTEMS; NATIONAL SECURITY; RISK ASSESSMENT; RISK MANAGEMENT; SECURITY OF DATA;

EVIDENCE-BASED; INFORMATION RESOURCE; INFORMATION SECURITY MANAGEMENTS; INFORMATION SECURITY RISK ASSESSMENT; INFORMATION SECURITY RISK MANAGEMENTS; PROCESS MODELING; SECURITY STRATEGIES; SITUATION AWARENESS;

INFORMATION MANAGEMENT;

EID: 84902248160     PISSN: 01674048     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.cose.2014.04.005     Document Type: Article

References (74)

1. Besma R. Abidi, Nash R. Aragam, Yao Yi, and Mongi A. Abidi Survey and analysis of multimodal sensor planning and integration for wide area surveillance ACM Comput Surv 41 1 2008 1 36
2. Atif Ahmad, Justin Hadgkiss, and A.B. Ruighaver Incident response teams - challenges in supporting the organizational security function Comput Secur 31 2012 643 652
3. AS/NZS ISO/IEC 27005:2011 Information technology - security techniques - information security risk management (ISO/IEC 27005:2011, MOD) 2011
4. R. Baskerville Risk analysis: an interpretive feasibility tool in justifying information systems security Eur J Inf Syst 1 2 1991 121 130
5. Gregory Bedny, and David Meister Theory of activity and situation awareness Int J Cognitive Ergon 3 1 1999 63
6. C. Bolstad Situation awareness: does it change with age? Proceedings of the human factors and ergonomics society 45th annual meeting 2001 Human Factors and Ergonomics Society Santa Monica, CA 272 276
7. Greg Bruno, and Sharon Otterman National intelligence estimates 2008 Council on Foreign Relations website. Available at http://www.cfr.org/iraq/ national-intelligence-estimates/p7758
8. Kathleen Carley Coding choices for textual analysis: a comparison of content analysis and map analysis Sociol Methodol 23 1 1993 75 126
9. C. Chauvin, S. Lardjane, G. Morel, J.P. Clostermann, and B. Langard Human and organizational factors in maritime accidents: analysis of collisions at sea using the HFACS Accid Anal Prev 59 2013 26 37
10. Robert S. Coles, and Rolf Moulton Operationalizing IT risk management Comput Secur 22 6 2003 487 493
11. Carl Colwill Human factors in information security: the insider threat - who can you trust these days? Inf Secur Tech Rep 14 4 2009 186 196
12. Robert F. DeFraites, and William C. Chambers Gaining experience with military medical situational awareness and geographic information systems in a simulated influenza epidemic Mil Med 172 10 2007 1071 1076 (Pubitemid 47584255)
13. T. Dinev, and Q. Hu The centrality of awareness in the formation of user behavioral intention toward protective information technologies J Assoc Inf Syst 8 7 2007 386 408
14. T.E. Dube, R.A. Raines, M.R. Grimaila, K.W. Bauer, and S.K. Rogers Malware target recognition of unknown threats IEEE Syst J 7 3 2013 467 477
15. M.R. Endsley Design and evaluation for situation awareness enhancement Proceedings of the Human Factors Society 32nd annual meeting, 97-101 1988 Human Factors Society Santa Monica, California
16. M.R. Endsley A methodology for the objective measurement of situation awareness Situational awareness in aerospace operations. AGARD-CP-478, 1/1-1/9 1990 NATO-AGARD Neuilly Sur Seine, France
17. M.R. Endsley Toward a theory of situation awareness in dynamic systems Hum Factors 37 1 1995 32 64
18. Mica R. Endsley, D.J. Garland, R.L. Wampler, and Michael D. Matthews Modeling and measuring situation awareness in the infantry operational environment 2000 U.S. Army Research Institute for the Behavioral and Social Sciences Virginia
19. M.R. Endsley, D.J. Garland, R.W.C. Shook, J. Coello, and M. Bandiero Situation awareness problems in general aviation SATech 00-01 2000 SA Technologies, Inc Marietta, GA
20. Mica R. Endsley, and Debra G. Jones Designing for situation awareness: an approach to user-centered design 2011 CRC Press Boca Raton, Florida; London
21. J.A. Espinosa, S.A. Slaughter, R.E. Kraut, and J.D. Herbsleb Team knowledge and coordination in geographically distributed software development J Manag Inf Syst 24 1 2007 135 169
22. E. Fioratou, R. Flin, R. Glavin, and R. Patey Beyond monitoring: distributed situation awareness in anaesthesia BJA Br J Anaesth 105 1 2010 83 90
23. Norman Groner, Charles Jennings, and Amy Robinson A negotiated-text method for assessing situation awareness information requirements from emergency responders 2012 IEEE International Multi-Disciplinary Conference on Cognitive Methods in Situation Awareness & Decision Support 2012 259
24. Anna Gryszkiewicz, and Fang Chen Temporal aspects in crisis management and its implications on interface design for situation awareness Cognition, Technol Work 14 2 2012 169 182
25. Shon Harris CISSP all-in-one exam guide 2010 McGraw-Hill New York
26. C. Harvey, N.A. Stanton, C.A. Pickering, M. McDonald, and P. Zheng To twist or poke? A method for identifying usability issues with the rotary controller and touch screen for control of in-vehicle information systems Ergonomics 54 7 2011 609 625
27. D.N. Hogg, B. Torralba, and F.S. Volden A situation awareness methodology for the evaluation of process control systems: studies of feasibility and the implication of use 1993-03-05 OECD Halden Reactor Project Storefjell, Norway
28. G.V. Hulme Getting at risk M.E. Whitman, H.J. Mattord, Management of information security 2004 Thomson Course Technology Boston 307 308
29. ICD 203 Director of national intelligence. Intelligence community directive number 203: analytic standards 2007 Office of the Director of National Intelligence Washington, D.C.
30. ICD 300 Director of national intelligence. Intelligence community directive number 300: management, integration, and oversight of intelligence collection and covert action 2006 Office of the Director of National Intelligence Washington, D.C.
31. ICD 900 Director of national intelligence. Intelligence community directive number 900: mission management 2006 Office of the Director of National Intelligence Washington
32. Loch K. Johnson National security intelligence: secret operations in defense of the democracies Cambridge, UK; Malden, MA 2012
33. JP 2-0 Joint Chiefs of staff. Joint publication 2-0: joint intelligence 2007 Office of the Joint Chiefs of Staff Washington, D.C.
34. Robert V. Katter, Christine A. Montgomery, and John R. Thompson Human processes in intelligence analysis Research Report 1237 1979 US Army Research Institute for the Behavioral and Social Sciences, US Army Intelligence and Security Command
35. S.H. Koch, C. Weir, M. Haar, N. Staggers, J. Agutter, and M. Görges et al. Intensive care unit nurses' information needs and recommendations for integrated displays to improve nurses' situation awareness J Am Med Inf Assoc 19 4 2012 583 590
36. A.G. Kotulic, and J.G. Clark Why there aren't more information security research studies Inf Manag 41 2004 597 607
37. Eileen Kowalski, Cappelli Dawn, and Moore Andrew Insider Threat Study: Illicit Cyber Activity in the Information Technology and Telecommunications Sector. United States Secret Service National Threat Assessment Center and CERT program 2008 Carnegie Mellon University Software Engineering Institute Washington, D.C., Pittsburgh, PA Available at: http://www.secretservice.gov/ ntac/final-it-sector-2008-0109.pdf
38. Mark M. Lowenthal Intelligence: from secrets to policy 2000 CQ Press Washington, D.C
39. Andrea Matwyshyn CSR and the corporate cyborg: ethical corporate information security practices J Bus Ethics 88 2009 579 594
40. J.O. Miller Modeling the US military intelligence process 2004 Department of Operational Sciences, Air Force Institute of Technology Wright Patterson, OH
41. T. Morineau, X. Morandi, N. Le Moellic, S. Diabira, L. Riffaud, and C. Haegelen et al. Decision making during preoperative surgical planning Hum Factors 51 1 2009 67 77
42. A. Naweed, G.R.J. Hockey, and S.D. Clarke Designing simulator tools for rail research: the case study of a train driving microworld Appl Ergon 44 3 2013 445 454
43. W.L. Neuman Social research methods: qualitative and quantitative approaches 2011 Allyn & Bacon Boston, Massachusetts
44. Boon-Yuen Ng, and Atreyi Kankanhalli Information systems for large-scale event management: a case study Pac Asia J Assoc Inf Syst 4 3 2012 1
45. ODNI - Office of the Director of National Intelligence US national intelligence: an overview 2011 Intelligence Consumer's Guide Washington, DC
46. O. Oh, M. Agrawal, and H.R. Rao Information control and terrorism: tracking the Mumbai terrorist attack through twitter Inf Syst Front 13 1 2011 33 43
47. Donn B. Parker Risks of risk-based security Commun ACM 50 3 2007 120 (Pubitemid 46555352)
48. P.R. Pennathur, D.P. Cao, A.M. Bisantz, L. Lin, R.J. Fairbanks, and R.L. Wears et al. Emergency department patient-tracking system evaluation Int J Industrial Ergon 41 4 2011 360 369
49. Costin Raiu Cyber-threat evolution: the past year Comput Fraud Secur 3 2012 5 8
50. J. Rees, and J. Allen The state of risk assessment practices in information security: an exploratory investigation J Organ Comput Electron Commer 18 4 2008 255 277
51. J. Reid, R. Hull, B. Clayton, G. Porter, and P. Stenton Priming, sense-making and help: analysis of player behaviour in an immersive theatrical experience Pervasive Mob Comput 6 5 2010 499 511
52. J.M. Riley, D.B. Kaber, and J.V. Draper Situation awareness and attention allocation measures for quantifying telepresence experiences in teleoperation Hum Factors Ergon Manuf Serv Industries 14 1 2004 51 67
53. J. Rogstadius, M. Vukovic, C.A. Teixeira, V. Kostakos, E. Karapanos, and J.A. Laredo CrisisTracker: crowdsourced social media curation for disaster awareness IBM J Res Dev 57 5 2013
54. R. Rousseau, S. Tremblay, and R. Breton Defining and modeling situation awareness: a critical review S. Tremblay, S. Banbury, A cognitive approach to situation awareness: theory and application 2004 Ashgate Publishing Company Burlington 3 21
55. J. Sauer, D.G. Wastell, G.R.J. Hockey, C.M. Crawshaw, M. Ishak, and J.C. Downing Effects of display design on performance in a simulated ship navigation environment Ergonomics 45 5 2002 329 347 (Pubitemid 34618532)
56. Ron Schmittling Performing a security risk assessment ISACA J 1 2010 1 7
57. Thomas Schnell, Yongjin Kwon, Sohel Merchant, and Timothy Etherington Improved Flight technical performance in flight decks equipped with synthetic vision information system displays Int J Aviat Psychol 14 1 2004 79 102 (Pubitemid 38203197)
58. Annette Senior, and Richard Copley Deploying a new system for recording and managing information during an emergency to aid decision making J Bus Continuity Emerg Plan 2 3 2008 267 280
59. R.S. Shaw, C.C. Chen, A.L. Harris, and H.J. Huang The impact of information richness on information security awareness training effectiveness Comput Educ 52 2009 92 100
60. Piya Shedden, A.B. Ruighaver, and Atif Ahmad Risk management standards - the perception of ease of use J Inf Syst Secur 6 3 2010 23 41
61. Piya Shedden, Rens Scheepers, Wally Smith, and Atif Ahmad Incorporating a knowledge perspective into security risk assessments VINE J Inf Knowl Manag Syst 41 2 2011 152
62. I. Sim, D. Liginlal, and L. Khansa Information privacy situation awareness: construct and validation J Comput Inf Syst 53 1 2012 57 64
63. M. Siponen Information security standards focus on the existence of process, not its content Commun ACM 49 8 2006 97 100 (Pubitemid 44232133)
64. K. Smith, and P.A. Hancock Situation awareness is adaptive, externally directed consciousness Hum Factors 37 1 1995 137 148
65. Diane H. Sonnenwald, Kelly L. Maglaughlin, and Mary C. Whitton Designing to support situation awareness across distances: an example from a scientific collaboratory Inf Process Manag 40 6 2004 989 1011
66. Geordie Stewart, and David Lacey Death by a thousand facts: criticising the technocratic approach to information security awareness Inf Manag Comput Secur 20 1 2012 29
67. Gregory F. Treverton, Seth G. Jones, Steven Boraz, and Philip Lipscy Toward a theory of intelligence RAND National Security Research Division workshop report (Conference Proceedings) 2006
68. Gregory F. Treverton, and C. Bryan Gabbard Assessing the tradecraft of intelligence analysis RAND National Security Research Division technical report 2008
69. USG - US Government A tradecraft primer: structured analytic techniques for improving intelligence analysis 2009 US Central Intelligence Agency, Center for the Study of Intelligence Washington, D.C.
70. Daniil M. Utin, Mikhail A. Utin, and Jane Utin General misconceptions about information security lead to an insecure world Inf Secur J A Glob Perspect 17 4 2008 164 169
71. Kristan J. Wheaton Evaluating intelligence: answering questions asked and not Int J Intell Count Intell 22 4 2009 614 631
72. Michael E. Whitman, and Herbert J. Mattord Management of information security 2004 Thomson Course Technology Boston, Mass.
73. R.K. Yin Case study research: design and methods 2009 SAGE Thousand Oaks, California
74. Lili Yang, Su Guofeng, and Yuan Hongyong Design principles of integrated information platform for emergency responses: the case of 2008 Beijing Olympic Games Information Syst Res 23 3 2012 761 786