Phishing is a social engineering scam that can cause data loss, reputational damages, identity th... more Phishing is a social engineering scam that can cause data loss, reputational damages, identity theft, money loss, and many other damages to people and organisations. Multiple studies showed the effects of human behaviour, such as risk-taking and decision making, on Internet users' security behaviour. Researchers also investigated how email users' behaviour can influence the success of a phishing attempt. Moreover, the number of phishing attempts has been increased rapidly since the beginning of the COVID-19 outbreak. Several studies demonstrated the effects of the COVID-19 pandemic on human behaviour, impacting phishing attempts' success. Organisations can use the results of these studies to find potential high-risk users by measuring the users' behaviour and emotions, which are associated with falling into a phishing scam. In this study, we have developed a solution and guideline using previous studies to identify risky users (i.e., those at risk of clicking on phishing links). The solution will then suggest or assigns proper mitigation actions for those users. The system contains measurement (psychological scales), scoring (machine learning), and mitigation modules that can become more mature and accurate over time. Furthermore, specific situations, such as the pandemic, is also considered in the solution- that is, when a situation like the COVID-19 pandemic happens, the solution will consider the impacted human emotions in finding the high-risk users and might suggest other types of mitigations. We have used regression models for the machine learning module. The proposed solution will help organisations focus more on high-risk users and reduce cyber risks. This solution, however, should be used in combination with technical anti-phishing systems and cybersecurity awareness training campaigns to achieve better results.
Phishing is a process in which attackers send emails to Internet users and try to convince them t... more Phishing is a process in which attackers send emails to Internet users and try to convince them to click on a link to steal their sensitive information or open an attachment to compromise their account, computer, organisation systems, etc. Users' behaviour, such as their risk-taking preference and decision-making style, can influence a phishing attempt's success. However, studies did not profoundly investigate the effects of the behaviours on each step of a phishing process (e.g., opening the email, clicking on the link, and submitting sensitive information on the phishing webpage). This study demonstrated the effects of risk-taking level and decision-making style, gender, age, and education level on the users' respond to each selected step of a phishing attempt. In this real-world study, we measured the behaviours of 135 participants from academia using psychological scales and tests. We then tested their phishability level by sending them simulated phishing emails. The regression analysis results showed that the general risktaking preference and gender of the users could predict their phishability in the second step, i.e., clicking on the phishing link (p<0.05). We could not find any significant relation between their decision-making style and other demographic factors with the users' phishability level in the second step of the phishing. We also could not find any relations between the measured behaviours, age, gender, and education level of the users and their phishability level in the first and second steps (i.e., opening the phishing email and submitting sensitive data to the phishing website). The results of this study can help us develop proper mitigation actions to minimise phishing success in different steps. Organisations can use this approach to identify risky users and focus on decreasing their phishability level, for instance by providing more training to them or changing the behaviour (if possible). The developed model can be used as a comprehensive framework to investigate other behaviours' effects in each step of phishing.
Abstract: COBIT, (Control Objectives for Information and Information related Technologies) as an ... more Abstract: COBIT, (Control Objectives for Information and Information related Technologies) as an IT governance framework is well-known in IS practitioners communities. It would impair the virtues of COBIT to present it only as an IT governance framework. COBIT analyses the complete IS function and offers descriptive and normative support to manage, govern and audit IT in organizations. Although the framework is well accepted in a broad range of IS communities, it is created by practitioners and therefore it holds only a minor amount of theoretical supported claims. Thus critic rises from the academic community. This work contains research focusing on the theoretical fundamentals of the ISACA framework, COBIT 5 released in 2012. We implemented a reverse engineering work and tried to elucidate as much as possible propositions from COBIT 5 as an empiricism. We followed a qualitative research method to develop inductively derived theoretical statements. However our approach differs from...
Prior studies have shown that the behaviours and attitudes of Internet users influence the likeli... more Prior studies have shown that the behaviours and attitudes of Internet users influence the likelihood of being victimised by phishing attacks. Many scammers design a step-by-step approach to phishing in order to gain the potential victim's trust and convince them to take the desired actions. It is important to understand which behaviours and attitudes can influence following the attacker in each step of a phishing scam. This will enable us to identify the root causes of phishing and to develop specific mitigation plans for each step of the phishing process and to increase prevention points. This study investigates to what extent people's risk-taking and decision-making styles influence the likelihood of phishing victimisation in three specific phishing steps. We asked participants to play a risk-taking game and to answer questions related to two psychological scales to measure their behaviours, and then conducted a simulated phishing campaign to assess their phishability throughout the three phishing steps selected. We find that the attitude to risk-taking and gender can predict users' phishability in the different steps selected. There are however other possible direct and indirect behavioural factors that could be investigated in future studies. The results of this study and the model developed can be used to build a comprehensive framework to prevent the success of phishing attempts, starting from their root causes. INDEX TERMS Cyber security, phishing, human behaviour, individual differences, online scams. GEERT POELS is currently a Full Professor of Management Information Systems with the Faculty of Economics and Business Administration, Ghent University, Gent, Belgium, where he teaches intermediate and advanced courses on information systems, IT management, enterprise architecture, and service design. He also teaches with the Master of Enterprise ICT Architecture, IC Institute, Belgium. He supervises Ph.D. research on digital marketplaces, cyber-security, and GDPR. As academic service, he co-developed the COBIT 2019 framework for IT governance. His recent research interests include conceptual modeling (as research method) and enterprise modeling (as research domain) with a focus on business process architecture mapping, ArchiMate, value modeling, and NLP-based automated generation of conceptual models out of user requirements documents. ERIC LAERMANS (Member, IEEE) received the master's degree in engineering physics and the Ph.D. degree in electrical engineering from Ghent University, Belgium, in 1994 and 1999, respectively. He is currently a Professor with the IDLab, Ghent University, Belgium, in collaboration with imec. His research interests include electromagnetic modeling of high-speed interconnection structures (with special attention to via holes) and reverberation chambers to data analysis and machine learning, more specifically, surrogate modeling and experimental design.
The concept of IT Governance is gaining more attention in organizations. The concepts of Governan... more The concept of IT Governance is gaining more attention in organizations. The concepts of Governance, Risk and Compliance (GRC) are derived from the principles of corporate governance and are mainly implemented in large public companies. The purpose of this work is to expand our knowledge and understanding of SMEs and the adoption of GRC. Design/Methodology: In this article we bring a literature overview based on 33 recent invited research papers on GRC, IT and SMEs. The papers will be brought together in a contributed volume that will be published by Springer in 2013. This volume will establish and explore existing and emerging theories on GRC and IT in SMEs, presenting the latest empirical research findings in that area of IT research, and explore new technologies and practices. Findings: It has always been unspecified that GRC is achieved through control of IT, with Control Theory and Agency Theory acting as a foundations for conceptualizing GRC. However caution is needed in applying the mechanisms of GRC in an SME environment. We argue that in an SME environment, other constructs are of more importance in explaining the complex GRC phenomena than the constructs of Agency Theory and Control Theory. Practical Implications: SMEs are of crucial importance to most economies all over the globe. Although there is no single generalized definition for a SME, they are most widely seen as companies with less than 500 (US & Canada) or 250 (Europe and elsewhere) employees. SMEs provide since 2000 everywhere more than 50% of all employment (or 67% of employment outside the financial industry). Originality: There is much debate if the principles of GRC are also applicable in small and medium-sized enterprises (SMEs). This work is based on new empirical material that was never published before. It is brought together and categorized in a volume that uniquely focused on IT and SMEs. Its value is even important for researchers as for IS practitioners.
IFIP Advances in Information and Communication Technology, 2013
In this study we investigate a case of an outsourced information systems (IS) failure (OISF) with... more In this study we investigate a case of an outsourced information systems (IS) failure (OISF) within the collaborative partnership among asymmetric partners. A small and medium-sized enterprise (SME) is dealing with an independent software vendor (ISV) conducting a project of implementing an IS that fails. We used a narrative research methodology for our enquiry. In the construction of our narrative we followed the OISF framework as a theoretical touchstone. As a major conclusion we found that asymmetric collaborations with partners with inadequate managerial and technical IT capabilities are extremely prone to OISF's. We showed that an outcome-based and fixed price contract is not an adequate instrument to conduct such a partnership and to avoid a failure.
COBIT, (Control Objectives for Information and Information related Technologies) as an IT Governa... more COBIT, (Control Objectives for Information and Information related Technologies) as an IT Governance framework is well-known in IS practitioners communities. It would impair the virtues of COBIT to present it only as an IT Governance framework. COBIT analyses the complete IS function and offers descriptive and normative support to manage, govern and audit IT in organizations. Although the framework is well accepted in a broad range of IS communities, it is created by practitioners and therefore it holds only a minor amount of theoretical supported claims. Thus critic rises from the academic community. This work contains research focusing on the theoretical fundamentals of the ISACA framework, COBIT 5 released in 2012. We implemented a reverse engineering work and try to elucidate as much as possible propositions from COBIT 5 as an empiricism. We followed a qualitative research method to develop inductively derived theoretical statements. However our approach differs from the original work on grounded theory by Glaser and Strauss (1967) since we started from a general idea where to begin and we made conceptual descriptions of the empirical statements. So our data was only restructured to reveal theoretical findings. We looked at three candidate theories: 1) Stakeholder Theory (SHT), 2) Principal Agent Theory (PAT), and 3) Technology Acceptance Model (TAM). These three theories are categorized and from each theory, several testable propositions were deduced. We considered the five COBIT 5 principles, five processes (APO13, BAI06, DSS05, MEA03 and EDM03) mainly situated in the area of IS security and four IT-related goals (IT01, IT07, IT10 and IT16). The choice of the processes and IT-related goals are based on an experienced knowledge of COBIT as well of the theories. We constructed a mapping table to find matching patterns. The mapping was done separately by several individuals to increase the internal validity. Our findings indicate that COBIT 5 holds theoretical supported claims. The lower theory types such as PAT and SHT contribute the most. The presence and contribution of a theory is significantly constituted by IT-related goals as compared to the processes. We also make some suggestions for further research. First of all, the work has to be extended to all COBIT 5 processes and IT-related goals. This effort is currently going on. Next we ponder the question what other theories could be considered as candidates for this theoretical reverse engineering labour? During our work we listed already some theories with good potential. Our used pattern matching process can also be refined by bringing in other assessment models. Finally an alternative and more theoretic framework could be designed by using design science research methods and starting with the most relevant IS theories. That could lead to a new IT artefact that eventually could be reconciled with COBIT 5.
Phishing is a social engineering scam that can cause data loss, reputational damages, identity th... more Phishing is a social engineering scam that can cause data loss, reputational damages, identity theft, money loss, and many other damages to people and organisations. Multiple studies showed the effects of human behaviour, such as risk-taking and decision making, on Internet users' security behaviour. Researchers also investigated how email users' behaviour can influence the success of a phishing attempt. Moreover, the number of phishing attempts has been increased rapidly since the beginning of the COVID-19 outbreak. Several studies demonstrated the effects of the COVID-19 pandemic on human behaviour, impacting phishing attempts' success. Organisations can use the results of these studies to find potential high-risk users by measuring the users' behaviour and emotions, which are associated with falling into a phishing scam. In this study, we have developed a solution and guideline using previous studies to identify risky users (i.e., those at risk of clicking on phis...
Enterprise Resource Planning (ERP) implementation is a complex and vibrant process, one that invo... more Enterprise Resource Planning (ERP) implementation is a complex and vibrant process, one that involves a combination of technological and organizational interactions. Often an ERP implementation project is the single largest IT project that an organization has ever launched and requires a mutual fit of system and organization. Also the concept of an ERP implementation supporting business processes across many different departments is not a generic, rigid and uniform concept and depends on variety of factors. As a result, the issues addressing the ERP implementation process have been one of the major concerns in industry. Therefore ERP implementation receives attention from practitioners and scholars and both, business as well as academic literature is abundant and not always very conclusive or coherent. However, research on ERP systems so far has been mainly focused on diffusion, use and impact issues. Less attention has been given to the methods used during the configuration and the...
Wat hebben onze rechtbanken en de Londense ambulancediensten met elkaar gemeen? Juist: beiden heb... more Wat hebben onze rechtbanken en de Londense ambulancediensten met elkaar gemeen? Juist: beiden hebben een IT mislukking achter de rug. De ambulanciers van Londen spannen de kroon met een twintigtal doden op hun naam. De computer verzon ...
... Please use this identifier to cite or link to this item: Record Details. Record ID, 887934. R... more ... Please use this identifier to cite or link to this item: Record Details. Record ID, 887934. Record Type, journalArticle. Author, Jan Devos [802000319126] - Ghent University jgdvos.Devos@UGent. be. Title, Betaalkaartfraude : wat kunnen we eraan doen? Publication Status, published ...
The Journal of Internet Banking and Commerce, 2009
The vast growth of the payment card industry (PCI) in the last 50 years has placed the industry i... more The vast growth of the payment card industry (PCI) in the last 50 years has placed the industry in the centre of attention, not only because of this growth, but also because of the increase of fraudulent transactions. The conducted research in this domain has produced statistical reports on detection of fraud, and ways of protection. On the other hand, the relevant body of research is quite partial and covers only specific topics. For instance, the provided reports related to losses due to fraudulent usage of cards usually do not present the measures taken to combat fraud nor do they explain the way fraud happens. This can turn out to be confusing and makes one believe that card usage can be more negative than positive. This paper is intended to provide accumulative and organized information of the efforts made to protect businesses from fraud. We try to reveal the effectiveness and efficiency of the current fraud combating techniques and show that organized worldwide efforts are ne...
Cloud computing has become a significant technology trend driven by big players that is transform... more Cloud computing has become a significant technology trend driven by big players that is transforming our current IT industry. Public cloud computing comes with advantages such as cost savings, high availability, and easy scalability. However, Small and Medium-sized Enterprises are driven by different reasons for not outsourcing their IT infrastructure entirely. By combining the benefits of the private and public cloud, hybrid cloud computing allows Small and Mediumsized Enterprises to optimize their infrastructure and run their virtual machines where they will be most effective and efficient. We present in this paper a virtual infrastructure management tool that allows to set-up and manage hybrid clouds efficiently in a user-friendly way. Our tool provides automatic load balancing between the private and public clouds at the virtual machine level, and dynamically upscales onpremise virtual machines to public cloud servers based on cost and performance information.
Electronic Journal of Information Systems Evaluation, 2011
It is well known that Small- and Medium-sized Enterprises (SME) suffer from a lack of IT proficie... more It is well known that Small- and Medium-sized Enterprises (SME) suffer from a lack of IT proficiency and therefore depend heavily on external IT expertise. The acquisition of a strategic IT artefact by an SME is mainly initiated in a market where Independent Software Vendors (ISV) and customers meet. This complex process is dominated by information asymmetry and leads to the ‘lemons’ problem, where low-quality vendors drive out high-quality vendors as predicted by the Lemon Market Theory (LMT). The diversity in quality makes it difficult for prospective buyers to evaluate a product or service with complete certainty and makes the decision to acquire risky. According to LMT, there is incentive for vendors selling poor quality, where quality of services is linked to an entire group rather than to an individual vendor. Although many scholars refer to this phenomenon in their work, empirical evidence is scarce. In this paper, we present the results of an enquiry into the ‘lemon’ problem...
Adjunct Proceedings of the 29th ACM Conference on User Modeling, Adaptation and Personalization
Phishing is a social engineering scam that can cause financial and reputational damage to people ... more Phishing is a social engineering scam that can cause financial and reputational damage to people and organisations. Studies have demonstrated the effects of human behaviour and emotions on people's security behaviour, such as falling into a phishing scam. Moreover, several studies show the effects of the COVID-19 outbreak on human emotions, impacting phishing attempts' success. In this study, we have developed a solution using previous studies' results to identify vulnerable users (i.e., those at risk of clicking on phishing links) in organisations. The solution assigns proper mitigation actions to those high-risk users. The system contains behaviour measurement, risk scoring, and mitigation modules that can mature and develop accuracy over time. Furthermore, situations similar to a pandemic are considered in the solution. The proposed solution will help organisations focus more on protecting high-risk users and reducing successful phishing attacks. This solution should be used in combination with technical anti-phishing and cybersecurity awareness training campaigns to achieve better results.
Phishing is an online scam where criminals trick users with various strategies, with the goal of ... more Phishing is an online scam where criminals trick users with various strategies, with the goal of obtaining sensitive information or compromising accounts, systems, and/or other personal or organisational Information Technology resources. Multiple studies have shown that human factors influence the success of phishing attempts. However, these studies were conducted before the COVID-19 pandemic, which is significant because security reports show that the numbers of phishing attacks have been rapidly increasing since the start of COVID-19. This study investigates the extent to which users' fear, anxiety and stress levels regarding COVID-19, impact falling for common and COVID-19 themed phishing scams during the outbreak period. Prior studies have depicted the effects of human behaviour on phishing attacks before the pandemic, such as risk-taking preferences and users' demographic factors, hence this study also focuses on the effects of those factors on the likelihood of phishing victimisation. More concretely, we present the results of a scenario-based roleplay experiment to study the relationship between fear, anxiety, stress, risk-taking, and demographic factors and the success of phishing attacks during the pandemic. The findings indicate that fear of COVID-19 influences the success of COVID-19 specific themed phishing scams, while anxiety, stress, and risk-taking influences the success of both the COVID-19 themed and common phishing scams. Our findings also suggest that the users' education level impacts common phishing attacks during the pandemic.
Phishing is a social engineering scam that can cause data loss, reputational damages, identity th... more Phishing is a social engineering scam that can cause data loss, reputational damages, identity theft, money loss, and many other damages to people and organisations. Multiple studies showed the effects of human behaviour, such as risk-taking and decision making, on Internet users' security behaviour. Researchers also investigated how email users' behaviour can influence the success of a phishing attempt. Moreover, the number of phishing attempts has been increased rapidly since the beginning of the COVID-19 outbreak. Several studies demonstrated the effects of the COVID-19 pandemic on human behaviour, impacting phishing attempts' success. Organisations can use the results of these studies to find potential high-risk users by measuring the users' behaviour and emotions, which are associated with falling into a phishing scam. In this study, we have developed a solution and guideline using previous studies to identify risky users (i.e., those at risk of clicking on phishing links). The solution will then suggest or assigns proper mitigation actions for those users. The system contains measurement (psychological scales), scoring (machine learning), and mitigation modules that can become more mature and accurate over time. Furthermore, specific situations, such as the pandemic, is also considered in the solution- that is, when a situation like the COVID-19 pandemic happens, the solution will consider the impacted human emotions in finding the high-risk users and might suggest other types of mitigations. We have used regression models for the machine learning module. The proposed solution will help organisations focus more on high-risk users and reduce cyber risks. This solution, however, should be used in combination with technical anti-phishing systems and cybersecurity awareness training campaigns to achieve better results.
Phishing is a process in which attackers send emails to Internet users and try to convince them t... more Phishing is a process in which attackers send emails to Internet users and try to convince them to click on a link to steal their sensitive information or open an attachment to compromise their account, computer, organisation systems, etc. Users' behaviour, such as their risk-taking preference and decision-making style, can influence a phishing attempt's success. However, studies did not profoundly investigate the effects of the behaviours on each step of a phishing process (e.g., opening the email, clicking on the link, and submitting sensitive information on the phishing webpage). This study demonstrated the effects of risk-taking level and decision-making style, gender, age, and education level on the users' respond to each selected step of a phishing attempt. In this real-world study, we measured the behaviours of 135 participants from academia using psychological scales and tests. We then tested their phishability level by sending them simulated phishing emails. The regression analysis results showed that the general risktaking preference and gender of the users could predict their phishability in the second step, i.e., clicking on the phishing link (p<0.05). We could not find any significant relation between their decision-making style and other demographic factors with the users' phishability level in the second step of the phishing. We also could not find any relations between the measured behaviours, age, gender, and education level of the users and their phishability level in the first and second steps (i.e., opening the phishing email and submitting sensitive data to the phishing website). The results of this study can help us develop proper mitigation actions to minimise phishing success in different steps. Organisations can use this approach to identify risky users and focus on decreasing their phishability level, for instance by providing more training to them or changing the behaviour (if possible). The developed model can be used as a comprehensive framework to investigate other behaviours' effects in each step of phishing.
Abstract: COBIT, (Control Objectives for Information and Information related Technologies) as an ... more Abstract: COBIT, (Control Objectives for Information and Information related Technologies) as an IT governance framework is well-known in IS practitioners communities. It would impair the virtues of COBIT to present it only as an IT governance framework. COBIT analyses the complete IS function and offers descriptive and normative support to manage, govern and audit IT in organizations. Although the framework is well accepted in a broad range of IS communities, it is created by practitioners and therefore it holds only a minor amount of theoretical supported claims. Thus critic rises from the academic community. This work contains research focusing on the theoretical fundamentals of the ISACA framework, COBIT 5 released in 2012. We implemented a reverse engineering work and tried to elucidate as much as possible propositions from COBIT 5 as an empiricism. We followed a qualitative research method to develop inductively derived theoretical statements. However our approach differs from...
Prior studies have shown that the behaviours and attitudes of Internet users influence the likeli... more Prior studies have shown that the behaviours and attitudes of Internet users influence the likelihood of being victimised by phishing attacks. Many scammers design a step-by-step approach to phishing in order to gain the potential victim's trust and convince them to take the desired actions. It is important to understand which behaviours and attitudes can influence following the attacker in each step of a phishing scam. This will enable us to identify the root causes of phishing and to develop specific mitigation plans for each step of the phishing process and to increase prevention points. This study investigates to what extent people's risk-taking and decision-making styles influence the likelihood of phishing victimisation in three specific phishing steps. We asked participants to play a risk-taking game and to answer questions related to two psychological scales to measure their behaviours, and then conducted a simulated phishing campaign to assess their phishability throughout the three phishing steps selected. We find that the attitude to risk-taking and gender can predict users' phishability in the different steps selected. There are however other possible direct and indirect behavioural factors that could be investigated in future studies. The results of this study and the model developed can be used to build a comprehensive framework to prevent the success of phishing attempts, starting from their root causes. INDEX TERMS Cyber security, phishing, human behaviour, individual differences, online scams. GEERT POELS is currently a Full Professor of Management Information Systems with the Faculty of Economics and Business Administration, Ghent University, Gent, Belgium, where he teaches intermediate and advanced courses on information systems, IT management, enterprise architecture, and service design. He also teaches with the Master of Enterprise ICT Architecture, IC Institute, Belgium. He supervises Ph.D. research on digital marketplaces, cyber-security, and GDPR. As academic service, he co-developed the COBIT 2019 framework for IT governance. His recent research interests include conceptual modeling (as research method) and enterprise modeling (as research domain) with a focus on business process architecture mapping, ArchiMate, value modeling, and NLP-based automated generation of conceptual models out of user requirements documents. ERIC LAERMANS (Member, IEEE) received the master's degree in engineering physics and the Ph.D. degree in electrical engineering from Ghent University, Belgium, in 1994 and 1999, respectively. He is currently a Professor with the IDLab, Ghent University, Belgium, in collaboration with imec. His research interests include electromagnetic modeling of high-speed interconnection structures (with special attention to via holes) and reverberation chambers to data analysis and machine learning, more specifically, surrogate modeling and experimental design.
The concept of IT Governance is gaining more attention in organizations. The concepts of Governan... more The concept of IT Governance is gaining more attention in organizations. The concepts of Governance, Risk and Compliance (GRC) are derived from the principles of corporate governance and are mainly implemented in large public companies. The purpose of this work is to expand our knowledge and understanding of SMEs and the adoption of GRC. Design/Methodology: In this article we bring a literature overview based on 33 recent invited research papers on GRC, IT and SMEs. The papers will be brought together in a contributed volume that will be published by Springer in 2013. This volume will establish and explore existing and emerging theories on GRC and IT in SMEs, presenting the latest empirical research findings in that area of IT research, and explore new technologies and practices. Findings: It has always been unspecified that GRC is achieved through control of IT, with Control Theory and Agency Theory acting as a foundations for conceptualizing GRC. However caution is needed in applying the mechanisms of GRC in an SME environment. We argue that in an SME environment, other constructs are of more importance in explaining the complex GRC phenomena than the constructs of Agency Theory and Control Theory. Practical Implications: SMEs are of crucial importance to most economies all over the globe. Although there is no single generalized definition for a SME, they are most widely seen as companies with less than 500 (US & Canada) or 250 (Europe and elsewhere) employees. SMEs provide since 2000 everywhere more than 50% of all employment (or 67% of employment outside the financial industry). Originality: There is much debate if the principles of GRC are also applicable in small and medium-sized enterprises (SMEs). This work is based on new empirical material that was never published before. It is brought together and categorized in a volume that uniquely focused on IT and SMEs. Its value is even important for researchers as for IS practitioners.
IFIP Advances in Information and Communication Technology, 2013
In this study we investigate a case of an outsourced information systems (IS) failure (OISF) with... more In this study we investigate a case of an outsourced information systems (IS) failure (OISF) within the collaborative partnership among asymmetric partners. A small and medium-sized enterprise (SME) is dealing with an independent software vendor (ISV) conducting a project of implementing an IS that fails. We used a narrative research methodology for our enquiry. In the construction of our narrative we followed the OISF framework as a theoretical touchstone. As a major conclusion we found that asymmetric collaborations with partners with inadequate managerial and technical IT capabilities are extremely prone to OISF's. We showed that an outcome-based and fixed price contract is not an adequate instrument to conduct such a partnership and to avoid a failure.
COBIT, (Control Objectives for Information and Information related Technologies) as an IT Governa... more COBIT, (Control Objectives for Information and Information related Technologies) as an IT Governance framework is well-known in IS practitioners communities. It would impair the virtues of COBIT to present it only as an IT Governance framework. COBIT analyses the complete IS function and offers descriptive and normative support to manage, govern and audit IT in organizations. Although the framework is well accepted in a broad range of IS communities, it is created by practitioners and therefore it holds only a minor amount of theoretical supported claims. Thus critic rises from the academic community. This work contains research focusing on the theoretical fundamentals of the ISACA framework, COBIT 5 released in 2012. We implemented a reverse engineering work and try to elucidate as much as possible propositions from COBIT 5 as an empiricism. We followed a qualitative research method to develop inductively derived theoretical statements. However our approach differs from the original work on grounded theory by Glaser and Strauss (1967) since we started from a general idea where to begin and we made conceptual descriptions of the empirical statements. So our data was only restructured to reveal theoretical findings. We looked at three candidate theories: 1) Stakeholder Theory (SHT), 2) Principal Agent Theory (PAT), and 3) Technology Acceptance Model (TAM). These three theories are categorized and from each theory, several testable propositions were deduced. We considered the five COBIT 5 principles, five processes (APO13, BAI06, DSS05, MEA03 and EDM03) mainly situated in the area of IS security and four IT-related goals (IT01, IT07, IT10 and IT16). The choice of the processes and IT-related goals are based on an experienced knowledge of COBIT as well of the theories. We constructed a mapping table to find matching patterns. The mapping was done separately by several individuals to increase the internal validity. Our findings indicate that COBIT 5 holds theoretical supported claims. The lower theory types such as PAT and SHT contribute the most. The presence and contribution of a theory is significantly constituted by IT-related goals as compared to the processes. We also make some suggestions for further research. First of all, the work has to be extended to all COBIT 5 processes and IT-related goals. This effort is currently going on. Next we ponder the question what other theories could be considered as candidates for this theoretical reverse engineering labour? During our work we listed already some theories with good potential. Our used pattern matching process can also be refined by bringing in other assessment models. Finally an alternative and more theoretic framework could be designed by using design science research methods and starting with the most relevant IS theories. That could lead to a new IT artefact that eventually could be reconciled with COBIT 5.
Phishing is a social engineering scam that can cause data loss, reputational damages, identity th... more Phishing is a social engineering scam that can cause data loss, reputational damages, identity theft, money loss, and many other damages to people and organisations. Multiple studies showed the effects of human behaviour, such as risk-taking and decision making, on Internet users' security behaviour. Researchers also investigated how email users' behaviour can influence the success of a phishing attempt. Moreover, the number of phishing attempts has been increased rapidly since the beginning of the COVID-19 outbreak. Several studies demonstrated the effects of the COVID-19 pandemic on human behaviour, impacting phishing attempts' success. Organisations can use the results of these studies to find potential high-risk users by measuring the users' behaviour and emotions, which are associated with falling into a phishing scam. In this study, we have developed a solution and guideline using previous studies to identify risky users (i.e., those at risk of clicking on phis...
Enterprise Resource Planning (ERP) implementation is a complex and vibrant process, one that invo... more Enterprise Resource Planning (ERP) implementation is a complex and vibrant process, one that involves a combination of technological and organizational interactions. Often an ERP implementation project is the single largest IT project that an organization has ever launched and requires a mutual fit of system and organization. Also the concept of an ERP implementation supporting business processes across many different departments is not a generic, rigid and uniform concept and depends on variety of factors. As a result, the issues addressing the ERP implementation process have been one of the major concerns in industry. Therefore ERP implementation receives attention from practitioners and scholars and both, business as well as academic literature is abundant and not always very conclusive or coherent. However, research on ERP systems so far has been mainly focused on diffusion, use and impact issues. Less attention has been given to the methods used during the configuration and the...
Wat hebben onze rechtbanken en de Londense ambulancediensten met elkaar gemeen? Juist: beiden heb... more Wat hebben onze rechtbanken en de Londense ambulancediensten met elkaar gemeen? Juist: beiden hebben een IT mislukking achter de rug. De ambulanciers van Londen spannen de kroon met een twintigtal doden op hun naam. De computer verzon ...
... Please use this identifier to cite or link to this item: Record Details. Record ID, 887934. R... more ... Please use this identifier to cite or link to this item: Record Details. Record ID, 887934. Record Type, journalArticle. Author, Jan Devos [802000319126] - Ghent University jgdvos.Devos@UGent. be. Title, Betaalkaartfraude : wat kunnen we eraan doen? Publication Status, published ...
The Journal of Internet Banking and Commerce, 2009
The vast growth of the payment card industry (PCI) in the last 50 years has placed the industry i... more The vast growth of the payment card industry (PCI) in the last 50 years has placed the industry in the centre of attention, not only because of this growth, but also because of the increase of fraudulent transactions. The conducted research in this domain has produced statistical reports on detection of fraud, and ways of protection. On the other hand, the relevant body of research is quite partial and covers only specific topics. For instance, the provided reports related to losses due to fraudulent usage of cards usually do not present the measures taken to combat fraud nor do they explain the way fraud happens. This can turn out to be confusing and makes one believe that card usage can be more negative than positive. This paper is intended to provide accumulative and organized information of the efforts made to protect businesses from fraud. We try to reveal the effectiveness and efficiency of the current fraud combating techniques and show that organized worldwide efforts are ne...
Cloud computing has become a significant technology trend driven by big players that is transform... more Cloud computing has become a significant technology trend driven by big players that is transforming our current IT industry. Public cloud computing comes with advantages such as cost savings, high availability, and easy scalability. However, Small and Medium-sized Enterprises are driven by different reasons for not outsourcing their IT infrastructure entirely. By combining the benefits of the private and public cloud, hybrid cloud computing allows Small and Mediumsized Enterprises to optimize their infrastructure and run their virtual machines where they will be most effective and efficient. We present in this paper a virtual infrastructure management tool that allows to set-up and manage hybrid clouds efficiently in a user-friendly way. Our tool provides automatic load balancing between the private and public clouds at the virtual machine level, and dynamically upscales onpremise virtual machines to public cloud servers based on cost and performance information.
Electronic Journal of Information Systems Evaluation, 2011
It is well known that Small- and Medium-sized Enterprises (SME) suffer from a lack of IT proficie... more It is well known that Small- and Medium-sized Enterprises (SME) suffer from a lack of IT proficiency and therefore depend heavily on external IT expertise. The acquisition of a strategic IT artefact by an SME is mainly initiated in a market where Independent Software Vendors (ISV) and customers meet. This complex process is dominated by information asymmetry and leads to the ‘lemons’ problem, where low-quality vendors drive out high-quality vendors as predicted by the Lemon Market Theory (LMT). The diversity in quality makes it difficult for prospective buyers to evaluate a product or service with complete certainty and makes the decision to acquire risky. According to LMT, there is incentive for vendors selling poor quality, where quality of services is linked to an entire group rather than to an individual vendor. Although many scholars refer to this phenomenon in their work, empirical evidence is scarce. In this paper, we present the results of an enquiry into the ‘lemon’ problem...
Adjunct Proceedings of the 29th ACM Conference on User Modeling, Adaptation and Personalization
Phishing is a social engineering scam that can cause financial and reputational damage to people ... more Phishing is a social engineering scam that can cause financial and reputational damage to people and organisations. Studies have demonstrated the effects of human behaviour and emotions on people's security behaviour, such as falling into a phishing scam. Moreover, several studies show the effects of the COVID-19 outbreak on human emotions, impacting phishing attempts' success. In this study, we have developed a solution using previous studies' results to identify vulnerable users (i.e., those at risk of clicking on phishing links) in organisations. The solution assigns proper mitigation actions to those high-risk users. The system contains behaviour measurement, risk scoring, and mitigation modules that can mature and develop accuracy over time. Furthermore, situations similar to a pandemic are considered in the solution. The proposed solution will help organisations focus more on protecting high-risk users and reducing successful phishing attacks. This solution should be used in combination with technical anti-phishing and cybersecurity awareness training campaigns to achieve better results.
Phishing is an online scam where criminals trick users with various strategies, with the goal of ... more Phishing is an online scam where criminals trick users with various strategies, with the goal of obtaining sensitive information or compromising accounts, systems, and/or other personal or organisational Information Technology resources. Multiple studies have shown that human factors influence the success of phishing attempts. However, these studies were conducted before the COVID-19 pandemic, which is significant because security reports show that the numbers of phishing attacks have been rapidly increasing since the start of COVID-19. This study investigates the extent to which users' fear, anxiety and stress levels regarding COVID-19, impact falling for common and COVID-19 themed phishing scams during the outbreak period. Prior studies have depicted the effects of human behaviour on phishing attacks before the pandemic, such as risk-taking preferences and users' demographic factors, hence this study also focuses on the effects of those factors on the likelihood of phishing victimisation. More concretely, we present the results of a scenario-based roleplay experiment to study the relationship between fear, anxiety, stress, risk-taking, and demographic factors and the success of phishing attacks during the pandemic. The findings indicate that fear of COVID-19 influences the success of COVID-19 specific themed phishing scams, while anxiety, stress, and risk-taking influences the success of both the COVID-19 themed and common phishing scams. Our findings also suggest that the users' education level impacts common phishing attacks during the pandemic.
Uploads
Papers by Jan Devos