To Örebro University

Purpose: This paper aims to investigate how congruent keywords are used in information security policies (ISPs) to pinpoint and guide clear actionable advice and suggest a metric for measuring the quality of keyword use in ISPs.

Design/methodology/approach: A qualitative content analysis of 15 ISPs from public agencies in Sweden was conducted with the aid of Orange Data Mining Software. The authors extracted 890 sentences from these ISPs that included one or more of the analyzed keywords. These sentences were analyzed using the new metric - keyword loss of specificity - to assess to what extent the selected keywords were used for pinpointing and guiding actionable advice. Thus, the authors classified the extracted sentences as either actionable advice or other information, depending on the type of information conveyed.

Findings: The results show a significant keyword loss of specificity in relation to pieces of actionable advice in ISPs provided by Swedish public agencies. About two-thirds of the sentences in which the analyzed keywords were used focused on information other than actionable advice. Such dual use of keywords reduces the possibility of pinpointing and communicating clear, actionable advice.

Research limitations/implications: The suggested metric provides a means to assess the quality of how keywords are used in ISPs for different purposes. The results show that more research is needed on how keywords are used in ISPs.

Practical implications: The authors recommended that ISP designers exercise caution when using keywords in ISPs and maintain coherency in their use of keywords. ISP designers can use the suggested metrics to assess the quality of actionable advice in their ISPs.

Originality/value: The keyword loss of specificity metric adds to the few quantitative metrics available to assess ISP quality. To the best of the authors' knowledge, applying this metric is a first attempt to measure the quality of actionable advice in ISPs.

Information security policies (ISPs) are an essential type of formal control that must be designed in a manner that is easily understandable for employees. Prior studies have recommended the inclusion of actionable advice; however, it is unclear how such advice should be worded to minimize the scope for interpretation. Therefore, this study investigates existing ISPs to assess how clear the pieces of actionable advice are and provide suggestions on how actionable advice should be worded in order to be clear. A qualitative content analysis of 15 ISPs from public agencies in Sweden was conducted with the aid of Orange Data Mining Software. First, the findings revealed an unbalance between the ISPs, where one-third of the ISPs provide over 50% of the analyzed actionable advice. Second, around two-thirds offer advice that is ambiguous and does not provide advice that employees can act upon. We, therefore, recommended that ISP designers exercise caution when using words in the ISP and maintain consistency in their word choices throughout.

Purpose: This paper aims to propose a conceptual model of policy components for software that supports modularizing and tailoring of information security policies (ISPs).

Design/methodology/approach: This study used a design science research approach, drawing on design knowledge from the field of situational method engineering. The conceptual model was developed as a unified modeling language class diagram using existing ISPs from public agencies in Sweden.

Findings: This study's demonstration as proof of concept indicates that the conceptual model can be used to create free-standing modules that provide guidance about information security in relation to a specific work task and that these modules can be used across multiple tailored ISPs. Thus, the model can be considered as a step toward developing software to tailor ISPs.

Research limitations/implications: The proposed conceptual model bears several short- and long-term implications for research. In the short term, the model can act as a foundation for developing software to design tailored ISPs. In the long term, having software that enables tailorable ISPs will allow researchers to do new types of studies, such as evaluating the software's effectiveness in the ISP development process.

Practical implications: Practitioners can use the model to develop software that assist information security managers in designing tailored ISPs. Such a tool can offer the opportunity for information security managers to design more purposeful ISPs.

Originality/value: The proposed model offers a detailed and well-elaborated starting point for developing software that supports modularizing and tailoring of ISPs.

When adopting and using a Software Development Method (SDM), it is important to stay true to the philosophy of the method; otherwise, software developers might execute activities that do not lead to the intended outcomes. Currently, no overview of SDM research addresses software developers’ reasoning behind adopting and using SDMs. Accordingly, this paper aims to survey existing SDM research to scrutinize the current knowledge base on software developers’ type of reasoning behind SDM adoption and use. We executed a systematic literature review and analyzed existing research using two steps. First, we classified papers based on what type of reasoning was addressed regarding SDM adoption and use: rational, irrational, and non-rational. Second, we made a thematic synthesis across these three types of reasoning to provide a more detailed characterization of the existing research. We elicited 28 studies addressing software developers’ reasoning and identified five research themes. Building on these themes, we framed four future research directions with four broad research questions, which can be used as a basis for future research.

Misinterpretations and faulty use of Software Development Method (SDM) practices and principles are identified pitfalls in Software Development (SD). Previous research indicates cases with method adoption and use failures; one reason could be the SDM Cargo Cult (CC) behavior, where SD organizations claim to be agile but not doing agile. Previous research has suggested the SDM CC framework as an analytical tool. The aim of this paper is to refine the SDM CC framework and empirically test this version of the framework. We use data from an ethnographical study on three SD teams’ Daily Scrum Meetings (DSM). The empirical material was collected through observations, interviews, and the organization’s business documents. We uncovered twelve CC situations in the SD teams’ use of the DSM practice, structured into seven categories of SDM deviations: bringing irrelevant information, canceling meetings, disturbing the team, receiving unclear information, bringing new requirements, problemsolving, and task distribution.

In today's complex environments, safeguarding organizations’ information assets is difficult and requires more than solely technical skills. In order to meet the need for future information security specialists, in 2018 the Informatics department at Örebro University launched an International Master’s Program in Information Security Management. The program content was developed in collaboration with industry and governmental partners. One of the challenges with this co-design effort was to elicit the requirements of the courses in the program from a diverse set of actors. Also, an educational program has a finite number of teaching hours, which means that a limited number of requirements, or topics on information security, can be covered. Consequently, there was a need to prioritize between the elicited requirements and make the partners prioritize. To both these ends, we employed the Delphi method. In this chapter, we give an account of the process of eliciting and prioritizing course requirements using an adapted Delphi method. The adopted process included three iterations, for which workshops and surveys were used to collect the necessary data. The implementation has been far from instrumental, and in this chapter we discuss the details related to design choices made and the rationale behind these choices.

Public organisations are starting to show an interest in automated decision-making (ADM). So far, existing research focuses on the governmental perspective on this phenomenon. Less attention is paid to citizens' views on ADM. The aim of this study is to provide empirical insights into citizen awareness of and beliefs about ADM in public-sector services. To this end, we participated in an annual national survey in Sweden carried out by the SOM Institute at Gothenburg University concluding that a minority of the citizens know about the use of ADM in public-sector services. Furthermore, when computers instead of civil servants make decisions in the public-sector, citizens expect decisions by computers to become less legally secure but more impartial. They also expect ADM to take personal circumstances into account to a lesser degree and become less transparent. Finally, we found that citizens with that awareness expect decisions by computers to become more reliable and impartial. Based on our empirical findings in relation to previous research, we suggest four hypotheses on citizen's awareness and beliefs about public-sector ADM.

When end users have to prioritize between different rationalities in organisations there is a risk of non-compliance with information security policies. Thus, in order for information security managers to align information security with the organisations’ core work practices, they need to understand the competing rationalities. The Value-based compliance (VBC) analysis method has been suggested to this end, however it has proven to be complex and time-consuming. Computerized software may aid this type of analysis and make it more efficient and executable. The purpose of this paper is to elicit a set of requirements for computerized software that support analysis of competing rationalities in relation to end users’ compliance and non-compliance with information security policies. We employed a design science research approach, drawing on design knowledge on VBC and elicited 17 user stories. These requirements can direct future research efforts to develop computerized software in this area.

Today, many business processes are propelled by critical information that needs safeguarding. Procedures on how to achieve this end are found in information security policies (ISPs) that are rarely tailored to different target groups in organizations. The purpose of this paper is therefore to propose a conceptual model of policy components for software that supports modularizing and tailoring of ISPs. We employed design science research to this end. The conceptual model was developed as a Unified Modeling Language class diagram using existing ISPs from public agencies in Sweden. The conceptual model can act as a foundation for developing software to tailor ISPs.

Given that there are an increasing number of information security breaches, organizations are being driven to adopt best practice for coping with attacks. Information security standards are designed to embody best practice and the legitimacy of these standards is a core issue for standardizing organizations. This study uncovers how structures at play in de jure standard development affect the input and throughput legitimacy of standards. We participated as members responsible for standards on information security and our analysis revealed two structures: consensus and warfare. A major implication of the combination of these structures is that legitimacy claims based on appeals to best practice are futile because it is difficult to know which the best practice is.