Jan Guynes Clark

Why there aren't more information security research studies

Noting a serious lack of empirical research in the area of security risk management (SRM), we proposed a conceptual model based on the study of SRM at the firm level. Although considerable time and effort were expended in attempting to validate the usefulness of the proposed model, we were not successful. We provide here a description of our conceptual model, the methodology designed to test this model, the problems we faced while attempting to test the model, and our suggestions for those who attempt to conduct work in highly sensitive areas.

A hierarchical, objectives-based framework for the digital investigations process

Digital investigations, whether forensic in nature or not, require scientific rigor and are facilitated through the use of standard processes. Such processes can be complex in nature. A more comprehensive, generally accepted digital investigation process framework is therefore sought to enhance scientific rigor and facilitate education, application, and research. Previously proposed frameworks are predominantly single-tier, higher order process models that focus on the abstract, rather than the more concrete principles of the investigation. We contend that these frameworks, although useful in explaining overarching concepts, fail to support the inclusion of additional layers of detail needed by various framework users. We therefore propose a multi-tier, hierarchical framework to guide digital investigations. Our framework includes objectives-based phases and sub-phases that are applicable to various layers of abstraction, and to which additional layers of detail can easily be added as needed. Our framework also includes principles that are applicable in varied ways to all phases. The data analysis function intended to identify and recover digital evidence is used as an example of how the framework might be further populated and used. The framework is then applied using two different case scenarios. At its highest level, the proposed framework provides a simplified view and conceptual understanding of the overall process. At lower levels, the proposed framework provides the granularity needed to achieve practicality and specificity goals set by practitioners and researchers alike.

Dealing with Terabyte Data Sets in Digital Investigations

Investigators and analysts are increasingly experiencing large, even terabyte sized data sets when conducting digital investigations. State-of-the-art digital investigation tools and processes are efficiency constrained from both system and human perspectives, due to their continued reliance on overly simplistic data reduction and mining algorithms. The extension of data mining research to the digital forensic science discipline will have some or all of the following benefits: (i) reduced system and human processing time associated with data analysis; (ii) improved information quality associated with data analysis; and (iii) reduced monetary costs associated with digital investigations. This paper introduces data mining and reviews the limited extant literature pertaining to the application of data mining to digital investigations and forensics. Finally, it provides suggestions for applying data mining research to digital forensics.

Virtual organizational learning in open source software development projects

We studied virtual organizational learning in open source software (OSS) development projects. Specifically, our research focused on learning effects of OSS projects and the factors that affect the learning process. The number and percentage of resolved bugs and bug resolution time of 118 SourceForge.net OSS projects were used to measure the learning effects. Projects were characterized by project type, number and experience of developers, number of bugs, and bug resolution time. Our results provided evidence of virtual organizational learning in OSS development projects and support for several factors as determinants of performance. Team size was a significant predictor, with mid-sized project teams functioning best. Teams of three to seven developers exhibited the highest efficiency over time and teams of eight to 15 produced the lowest mean time for bug resolution. Increasing the percentage of bugs assigned to specific developers or boosting developer participation in other OSS projects also improved performance. Furthermore, project type introduced variability in project team performance.

Identifying Exceptional Application Software Developers: A Comparison of Students and Professionals

Exceptional application software developers are a scarce resource. It is therefore important for employers to identify, retain, and cultivate individuals who exhibit this capacity. This study compared the personality characteristics of exceptional, experienced application software developers with the personality characteristics of junior and senior level IS and CS students (who can be seen as entry-level, or pre-entry level, IT developers). We used the Adjective Checklist to measure personality characteristics for all subjects, then mapped the resultant scales to the Five Factor Model of Personality. The results of this study suggest that exceptional application software developers exhibit significantly higher levels of Extraversion and Conscientiousness. Exceptional students (as determined by GPA), however, were actually found to be introverted. Thus, when GPA is used to pre-screen or filter for entry-level positions, recruiters may actually be excluding some of those candidates who are most likely to become exceptional application software developers. These results have implications for understanding and managing the recruiting of IT personnel and their progression from entry level (novice) to more experienced positions.

Post-retrieval search hit clustering to improve information retrieval effectiveness: Two digital forensics case studies

This research extends text mining and information retrieval research to the digital forensic text string search process. Specifically, we used a self-organizing neural network (a Kohonen Self-Organizing Map) to conceptually cluster search hits retrieved during a real-world digital forensic investigation. We measured information retrieval effectiveness (e.g., precision, recall, and overhead) of the new approach and compared them against the current approach. The empirical results indicate that the clustering process significantly reduces information retrieval overhead of the digital forensic text string search process, which is currently a very burdensome endeavor.

Using Stakeholder Analysis to Identify Users in Healthcare Information Systems Research: Who is the Real User?

Applying IS research to the healthcare context is an important endeavor. However, IS researchers must be cautious about identifying individual roles, the context of the setting, and postulating generalizability. Much of IS theory is rooted in organizations, their business processes, and stakeholders. It is not a simple matter to generalize healthcare IS research, assuming that it is equivalent to organizational IS research. Hospitals, emergency rooms, and laboratories are different from the “business environment†, and “healthcare sers†vary considerably in their roles. Therefore, IS researchers need to understand the healthcare setting before they can appropriately apply IS theory. Obviously, if we are studying the wrong person, or group of people, we cannot expect to get relevant results. In order to alleviate confusion regarding “who is the user?†in healthcare IS research, we provide examples of healthcare scenarios, perform simplified stakeholder analysis for each scenario, and identify the stakeholders.

Revisiting the Impact of Information Technology Investments on Productivity: An Empirical Investigation Using Multivariate Adaptive Regression Splines MARS

This article revisits the relationship between IT and productivity, and investigates the impact on information technology IT investments. Using the MARS techniques, we show that although IT Stock is the greatest predictor variable for productivity Ko, M.; Clark, J.G.; Ko, D.Value Added, it is only significant as an interaction variable, combined with Non-IT Capital, Non-IT Labor, Industry, or Size.

Finite mixture partial least squares for segmentation and behavioral characterization of auction bidders

The purpose of this study is to demonstrate how to empirically segment, without a priori knowledge, online auction bidders using experimental data and finite mixture models. The proposed method utilizes a finite mixture partial least squares (FIMIX-PLS) approach to examine bidder behaviors and personality characteristics, evaluate bidder differences, and then segment the bidders. The empirical experiment is conducted for two different auction mechanisms - English and Vickrey. Results from both auction mechanisms indicate that FIMIX-PLS is capable of profiling and segmenting the bidders based on their individual characteristics. The post hoc analysis confirms the segmentation scheme and the capability of FIMIX-PLS in segmenting bidders into statistically identifiable homogeneous groups without a priori information of group characteristics. Such advantage is practical for online businesses dealing with increasing amount of data about their customers on a real time basis.

Dynamics of Affect and Cognition in Simulated Agents: Bridging the Gap between Experimental and Simulation Research

The purpose of this article is to propose a simulation framework combining Soft-System Methodology, System Dynamics, and the Cognitive Affective Personality System model, to facilitate the design and development of agents (e.g., agent based models, software agents) with interacting affective and cognitive units. A review of the literature supports the building of a third-order positive causal-loop model between the constructs Affectivity, Self-Efficacy, and Perceived Task Complexity. The model is evaluated to exemplify the use of this framework to study affective states in simulated agents. The behavior of the model is consistent with previous research, corroborating its utility as a tool for endowing complex agents in simulations with mechanisms of human affectivity, and as a computational artifact to develop affective computing systems. The framework, incorporating soft-constructs into simulation models and supporting the study of their process-based (dynamic) interactions, serves to bridge the gap between experimental and simulation research. The limitations of the approach and directions for future research are also discussed. Dynamics of Affect and Cognition in Simulated Agents: Bridging the Gap between Experimental and Simulation Research