2022 ACBSP Conference

Thursday, June 17, 2022 from 8:00-12:00: Preconference refresher of peer review team training. I had not registered and missed some of the preliminary content presented the day before. Was useful for catching up on a few emails as picking up a tidbit or two related to writing high quality Opportunities for Improvement. (OFI’s). Having said that, I was able to serve on an ACBSP Peer Review Team (PRT) and found it to be interesting and a great learning experience. I would highly recommend completing this training in full and volunteering to serve on a PRT.

Thursday, June 17, 2022 from 12:00-1:00: The conference started with a networking lunch. Met Dr. RJ Podeschi (rpodeschi@millikin.edu) of the Tabor School of Business at Millikin. He is the Dean there and knows Jason Sharp.

Thursday, June 17, 2022: 1:00-1:45: Measuring Social Media Marketing’s Impact on HBCU Graduate Programs presented by Dr. Terrell Strayhorn. Great presentation over leveraging social media on a budget to promote graduate programs. I have reached out to him to share his presentation

Tweet

• Examine social media profiles to make sure they reflect what we want about the college
• Use hashtags for internal use and @s to promote/encourage others to share relevant posts (i.e. make it easy on them to be able to share;)
• Posts should include why? What? When? Where? Why? (how?)
• Post early and often. Early refers to posts having plenty of lead time as it sometimes takes times for awareness to build as shares proliferate.
• Acknowledge new followers and likes by responding directly to them. This helps to engage them and gets their contacts/followers to engage.
• To help promote on LinkedIn, their dean created a blog post that they shared on LinkedIn. They found this useful for recruiting.

Thursday, June 17, 2022 from 2:00-2:45: Leadership Development & Networking

hartman-and-fantasia-leadership-development-and-networking-an-interactive-dialogueDownload

Thursday, June 17, 2022 from 3:00-3:45: Engaging Gen Z: Presenter was unable to make it and referred us to their presentation. Posted a video presentation in the app.

sprouse-engaging-gen-zDownload

Thursday, June 17, 2022 from 4:00-5:00: Thought Leader – Developing Resilient and Empathetic Leaders through Higher Education by Dr. Kasthuri Henry, CEO of KasHenry Inc. in Chicago. Empathy is key. Employers are valuing this more than ever. The “other” imperative skill learners need to develop is resiliency. Use Bloom’s taxonomy to to leverage learning. We can not afford to teach undergraduate and graduate students high school levels of cognition. We MUST advance their learning to cognition levels seen in the workplace (i.e. apply, analyze, evaluate, and create). The Resiliency Playbook (speaker’s book) is built around the empathy framework of self-awareness, social awareness, self-management, and relationship management. She shared a story that essentially served as the “five-whys” to get to the root cause. Relate our experiences to learners, facilitate experiential learning. Don’t forget that every student counts. We cannot ask students that one day make a name for themselves if we do not show them we value them when we have them in class.

henry-developing-resilient-and-empathetic-leaders-through-higher-educationDownload

Saturday, June 18, 2022 from 8:30-9:15: How to Scale Experiential Learning in Business Education. Stakeholders are looing at business schools to produce “career-ready” graduates. Only 34% of students feel prepared for the job market. Employers also feel like most students are not career ready. There is a disconnects between what students think they are good at and what businesses think they are good at particularly for leadership, communication, and listening. There is a growing desire by employers to hire those with soft-skills. Traditional internships are great in terms of “experiential learning” but it is difficult to scale due to limited number of interested students, employers, etc. In 2021, 21% reported taking an internship. 25% of students that DO have internship experience, have a less than satisfactory experience with that internship. 67% of students interested in internships cannot participate in one (equity). CapSim and other simulation tools can help expose students to experiential education at scale. CapSim Inbox Platform allows students to be put into various roles within a simulated environment (i.e. finance, marketing, etc.) to measure a variety of soft skills such as communication, leadership, initiative, etc. For example, they may have to respond to an email from their CFO to address a task. The student’s response to that email is evaluated.

• This might be most appropriate for David and Drake
• https://www.capsim.com/inbox-simulations

Saturday, June 18, 2022 from 9:30-11:00: Annual Business & Town Hall Forum. Nothing of significance to report. Basic business of the association including recognition of award recipients, nominations and voting on leadership changes, etc.

Saturday, June 18, 2022 from 11:15-12:00: Improving Student Learning Through Assessment Data Analysis. Shifted to a two-year cycle to ease pressure of constant data collection. They use Excel spreadsheets. Introduced curriculum map (looks almost identical to the ones we do – including courses and objectives and introduced, developed, mastered, assessed). They use a simplified analysis template as a mid-year review to require them (faculty) to review their action plans/implementation throughout the year rather than waiting until the end of the year. They use a variety of data tools including Peregrine Reports, Python, SQL, LaTeX, Power BI, SSRS, and R Studio. They are using Power BI to present the data which helps them to demonstrate that data to faculty where they can filter in various different ways to identify trends/issues. They also use statistical packages to analyze the data. Power BI needs to be a priority as it will let you combine or slice and dice which would be good in terms of measuring/assessing concentrations, different majors, etc. to comply with different requirements from ACBSP and AACSB. They also include faculty type (i.e. adjunct/full-time). We could consider adjunct/full-time as well as SA, PA, etc. We also want to include by department but I think this would be covered by including their major? We need to think about this.

Saturday, June 18, 2022 from 12:00-1:00: Networking Lunch. Sat with Steve Parscale and a few others. Followed up on Rusty’s earlier conversation with him regarding the need to assess concentrations. This is particularly relevant given our recent launch of the MS: Management program that contains multiple concentrations. I believe that a great solution is outlined above and the direction in which we are heading; a zero-credit course to be taken during a student’s final semester. Along with the assessment data collected, it would have to be cross-referenced with each student’s major and if relevant, concentration.

Saturday, June 18, 2022 from 1:00-2:00: Keynote Speaker: New Higher Education Imperative. Stakeholder Capitalism. Stressed the importance of serving the broader definition of stakeholders in a moral and ethical way; addressing diversity, equity, and inclusion issues head on. Demographic shifts mean we have to be more open to change, inclusion, open-mindedness, and better than the past. Globalization is also changing things. Communications is shrinking our globe, making it easier to connect and work globally. This means we have to be more open-minded and able to interact and engage with diverse cultures, languages, etc.

If you do good, people will accuse you of ulterior motives. Do good anyway!

Marc H. Morial

Saturday, June 18, 2022 from 2:00 PM-2:45: Thought Leader Session – Resilience in Higher Education: Fostering a Culture of Transformation. Seemed to provide little value so I left early.

Saturday, June 18, 2022 from 3:15-4:00: Marketing Panel: Leveraging Accreditation to Grow Business Programs in Fluid Times. Over 80% of students starting at a community college do so with the intention of wanting to complete their bachelor’s degree. The first presenter essentially argued the importance of leveraging accreditation to develop articulation agreements, using accounting as an example. The first section of this session was not particularly valuable with the exception of the potential to develop an articulation agreement between us and ACC.

• Promote accreditation at open houses and on admissions website
  • Parents often ask if programs are accredited
  • Use ACBSP standards to discuss the quality of the program
  • Teaching, research, service, class sizes, co-curricular, etc.
• Send accreditation material to high schools
  • Ensure admission staff are well-verses in ACBSP standards
• Promote and increase articulation agreements with 2-year schools and international schools
  • Meet at annual conference
• Encourage faculty to reach out to deans of schools of business when they travel
  • Promote accreditation to non-accredited schools
• Press releases that promote the value of accreditation for increasing the value of the school
  • Focus accreditation
• Use current students as role models
  • Promote honor societies and scholarships
  • Encourage student involvement in accreditation via clubs and regional conference presentations
  • Encourage students to present at regional (ACBSP) conference
• Alumni Outcomes (Meets CHEA Standards)
  • Place alumni outcomes on website (retrievable from LinkedIn) – Use this to build a database of alumni and where they are after graduation
  • Place learning outcomes on website
  • Emphasize Global network of schools and alumni
  • Promote the fact that
• Add accreditation logos to syllabi and email signatures
• Add AACSB/ACBSP logos to table clothes
• Display AACSB/ACBSP logos prominently at Open Houses
• Social Media: Not clear how they will leverage using social but I am thinking with hashtags, including accreditation logos in banner images, Canvas course shells, etc.

marketing-panel-presentation-earnell-seay-1Download

marketing-panel-presentation-reed-peoples-1Download

marketing-panel-presentation-shani-carterDownload

Saturday, June 18, 2022 from 4:15-5:00: Email Marketing: The Hidden Hero of Online Student Recruitment. Email returns a better ROI than social media. It is important to manage email list growth and quality; do not send the same message to all contacts; test delivery; test all links; know your audience.

Define your audience: know their age, work experience, interests, motivations (i.e. skills, build professional network, etc.), what might stop her I.e. difficulty of graduate school, ROI of degree, etc.); from this, develop key messages that speak to their motivation and addresses their concerns.

Awareness: Gain visibility and create a positive brand image. Keep messages brief and to the point.

Consideration: This is where you provide them with helpful resources, upcoming events, testimonials, offer interaction with staff members, how to finance their education, etc.

Decisions: Overcome final pain points, offer to work with them one-on-one if they require help.

Enrollment: Goal is to complete the applications. Welcome accepted students into the school. Personalize this. Make next steps easy and exciting. We’ve prepared great things for you.

Avoiding SPAM filters: Keep your database list clean. Use opt-in when you can on information request forms. Don’t be afraid of the unsubscribe button (keeps your email list clean: 20-30% annual churn; prevents frustration/badmouthing amongst peers; update preferences; encourages high quality content); Use strong subject lines (he provided a list of do’s and don’ts); Segment email campaigns (i.e. locations, course of interest, lead score, type of request – targeted segmented campaigns are SIGNIFICANTLY more effective);

https://www.mail-tester.com

SPF, DMARC, DKIM methods to verify whitelist scores

Learn how to track clicks from email as well as the web. If we use Qualtrics, it does facilitate this to a degree. Google Analytics provides similar (more detailed) kinds of data. Use templates, segment, automate as much as possible

Sunday, June 19, 2022 from 9:00-9:45: Capstone Courses in the Pandemic: Providing the Best Learning Outcomes. What are our goals? Integration, application (problem identification), and professional readiness. Common approaches include case analyses, simulations, etc. Those three criteria were evaluated by some research she presented and in general, in academic, we get an A, B, and F respectively in these three areas. My last criteria likely would be better given my newly added resume/job search project. Focus on continuing to develop this portion of the class. Lots of reflection exercises (on track there), case analyses (on track there), experiential project (this one I would need to think through more). The goal is to get them into the “consulting” mindset. This might look a lot like the project developed in BCIS 5311 to analyze the information system for an organization. As the capstone, I have to figure out a way to incorporate each area (i.e. networking databases, systems analysis and design, etc.) as part of that project. Consider three projects as I currently do but tweak to more formally align with the three criteria outlined above.

Sunday, June 19, 2022 from 10:00-10:45: Using the Baldridge Framework to Improve Resilience. Baldrige Framework. Creating a culture of Baldrige is key at the most important thing followed but planning strategically and continuity planning. Leading with vision was next. The results of their study indicated that organizations that utilize Baldrige and scored high on it faired better during the pandemic. While I did not find a lot of value in this session, it did serve both as a reminder and motivation for reviewing Baldrige and thinking about how to best incorporate that into what we do as a College. The framework aligns quite nicely with accrediting standards.

Sunday, June 19, 2022 from 11:15-12:00: Standard 3 – Overview of the Requirements for Student and Stakeholder Satisfaction. Parents, alumni, parents, local community (employers), other schools (i.e. transfer institutions), students (current and prospective), faculty/staff all represent stakeholders. We need to collect data from these and others that are somehow involved with our College. One of the keys is to not only collect this data/information but also USE it! See Table 3,1: Student and Stakeholder Groups in the ACBSP Standards. Tools include surveys as well as evaluations. Qualitative/informal ways include advisory boards, dinner/donor with the dean, etc. Great source for “quotes”. Make sure this aligns with the mission. Process is key: Specify the process and follow it. Providing results is also key. Evaluate trends from course evaluations, student measures, alumni surveys, other student/stakeholder measures. We really want a minimum of 3-5 data-points. So, think 3-5 years of data collection. We have several measures; some with a single data point while others of as many as four, I believe. See links below for more thorough examples. So, “use” the information by sharing it with relevant stakeholders.

• ACBSP Self-Study Report 2021
• ACBSP Evidence File
• ACBSP Accredited Programs

NOTE: Due to the need for these feedback loops to be systematic, work with Chris to add these to the calendar to routinize/systematize this process. On a related note, also make sure our AoL reviews are scheduled for the Spring faculty meetings.

Action Items:

• Incorporate AACSB and ACBSP logos to all COB materials (i.e. the Canvas template, website, flyers, guidebooks, etc.).
• Review social media profiles to make sure they clearly and accurately reflect what we want to put out into the world.
• Review AoL outcomes to identify outcomes that align with stakeholder expectations and work to identify objective, validated instruments to assess each outcome. Outcomes might include things like communication, emotional intelligence, ethics, etc.
• Expand internship opportunities and leverage the use of simulations to expand experiential learning at scale.
• Develop Power BI to reflect data for assessment and other feedback tools such as stakeholder satisfaction surveys.
• Share with Drake and David opportunities with CapSim to train with some of the new simulations.

Advertisement

What is a router and what does it do?

In working with students on their logical designs, it has become clear to me that many students get confused about the differences between routers and switches. So, I wanted to take a moment to talk specifically about routers. So, what is a router? Well, a router links together two similar networks in order to direct IP packets from one network to another. When you see IP, you should automatically start thinking about the OSI model and specifically, layer 3 of the OSI model.

Figure 1: The OSI Model
Typically, when students start creating their logical diagram, if they include logical configuration information at all, they always seem to focus on the internal side of this connection; the LAN side. But there is the WAN side of this connection as well. What kind of configuration information is on the WAN side of the connection? It (hopefully) obviously needs an IP address. Just to make this clear, every device connected to the Internet needs a unique IP address in order to be able to communicate with other devices over the Internet. The WAN connection also needs a subnet identified. The subnet is important because it tells the router on the WAN side of the connection which part of the IP address refers to the network and which part refers to the router itself (on the WAN side). The WAN side also needs a default gateway. If the router does not know where to route a particular packet, it needs the default gateway to forward the packet to a higher layer router that may in fact know where that particular packet should be sent. Lastly, the WAN side of the connection needs to know a DNS server so that it can resolve domain names and share that information with clients on the LAN side.

Now, the good news is that while you need to know how to configure these settings, you do not have to come up with the numbering scheme itself. If you have a static connection, this information will be provided to you by your ISP. This is typically the case for business class services in which you need your external address to stay the same so that web server, email servers, and so on can routinely be found in the same place logically. Consumers typically have dynamic addresses and this really makes things easy as the router reaches out to the ISP and obtains this information automatically. The advantage of this is obviously that it reduces your administrative burden.

Figure 2 below shows a router where the WAN port is labeled ‘Line’ and then it also happens to have a four port switch built into the router, with each port labeled 1 through 4. So, the WAN configuration information is associated with the WAN or ‘Line’ side of the router whereas the LAN side of the configuration information is associated with the clients associated with the four ports.

Figure 2: Router
On the internal side of the network, we also have configuration information that is needed. Specifically, we need an IP address and a subnet mask to tell the router which portion of the IP address represents the network and which part represents the router itself. The IP address serves as the default gateway for all the clients on the internal side of the network. Where is the rest of the configuration information internally? It’s not there. When a client on the internal side of the network does not know where the server is that it is trying to communicate with, it sends the packet to its default gateway which is found in its own configuration information. That gateway is the router’s LAN connection. When the router gets that request, if the requested server is not on the LAN side of the connection, it routes the packet to the WAN side of the connection which includes a default gateway so that it knows where to forward the packet.

Figure 3 illustrates a sample logical diagram. In this diagram, for the gateway router, you should see that the WAN connection is dynamically set. Again, this makes it easy on the network administrator. Internally, there is an IP address and a Subnet Mask (SM). There is also an SSID to indicate that this is also a wireless router as well as information indicating that this wireless router is capable as serving as a DHCP server.

Figure 3: Logical Diagram

You may also notice a second, internal router is included in the diagram. This design is segmenting the network at layer 3. I want to draw your attention to the WAN side of the internal router. It includes the IP address and the default gateway. Specifically, I want to draw your attention to the IP address and the fact that it is on the same subnet as the internal side of the gateway router. This is necessary so that the two routers can communicate. Also, note the internal IP address of the internal router. Note that it is on a different subnet. As a result, it can be said that this network is segmented to keep traffic from the business side of the network separate of the traffic on the personal side of the network.

So, that is what a router is and some basic information about the configuration information that goes into a router and whatnot. Commercial routers get much more complicated quickly. But, at the same time, commercial routers are beginning to take on similar dashboards to consumer grade routers making them easier to configure and use. If you have any questions, please leave a comment. Follow me on Twitter @SchuesslerPhD and until next time, happy networking.

Dr. S.

AACSB Impact Forum

The College of Business at Tarleton State University is pushing to obtain accreditation from the Association to Advance Collegiate Schools of Business (AACSB), the premier accrediting body for business schools. Before this process began, I knew that AACSB existed. I knew the general idea behind accreditation. But, I can honestly say that I did not know the degree to which they can drive value within a business school by helping to establish and maintain standards by which schools can first be measured and second, continuously improve.

As part of our push for accreditation, this last weekend, I attended one of their “Impact Forums” held at their international headquarters in Tampa Florida. They have identified impact as one of the three pillars of accreditation along with engagement and innovation. But impact is something that can be a little nebulous at times. After all, how do we know that our teaching is having real “impact”? Hence, the reason behind the forum.

So, what is “impact” and how does it apply to the college of business? Well, impact is pretty easy to define: to have a strong effect on something or someone. But, how does that apply to the college of business? Well, we want our teaching, research, and service to have impact. Of course, the assumption is that the impact is positive and hopefully it is.

Traditionally, as faculty, impact has been assessed by counting journal publications in peer reviewed journals and/or publications in high quality journals. Why? Because they are relatively easy to measure. But, we have to realize that impact has many different stakeholders. These might include faculty, staff, administrators, or the academy itself. Other stakeholders might include students, businesses, accrediting organizations, governing bodies, and so on.

So, we need to look at impact from a much broader perspective. Again, as it relates to research, while counting the number of peer reviewed journal publications a researcher had, additional impact information that might prove useful is whether or not other professors are using that work in their classes. Are businesses applying that research to their organization? That is real impact.

But, measuring such impact can prove difficult. Sometimes it takes considerable time for impact to be seen. For example, sometimes research can take more than a year to get published. Beyond that, such research must then be disseminated to various stakeholders for them to begin to be influenced by the results. Ultimately, it may be 2 or 3 years later or more before an impact can be measured. Even then, whether the impact is explicit or implicit can make measuring them difficult at best.

What about other kinds of impact though? Turns out, they are all around us. Some of them are quite easy to measure. We just need to rethink how we look at impact. For example, the number of degrees granted and student placement success (along with research quality and quantity) are the most commonly used impact metrics. These are followed by the number of consulting projects and applied research, rankings, surveys and feedback from key stakeholders, and community engagement and student projects. Finally, we have things like assurance of learning data, alumni engagement, and so on that can serve as representing impact.

So, the scope of impact is much broader than how it might have originally been interpreted. In academia, we impact all three areas: research, teaching, and service. The key is to recognize when we are having an impact and weaving it into a coherent story that helps us to tell our story as an institution.

With such a large potential scope of impact with which to tell our story, how do you know where to start? Start with your mission statement. It tells stakeholders what you value the most. If that is where your value is, that is where the focus of your impact measurements should be. For example, if you are a teaching school and you value innovative teaching, you should probably focus less on measuring and reporting the impact of research. That is not to say that research should be completely ignored. It just should not be “featured”.

So, start with your mission and align appropriate metrics to assess impact. Identify what is impacted, by what, how, what the measures are, and how often they are to be measured. You are painting a road map here so that you can create repeatable results. In the end, this does not have to be a painful process. You do have openly and honestly reflect on your college. But, I think in the long run, it creates an environment for continuous improvement that keeps people engaged and excited about coming to work and doing great things!

Security Theories

Computer Anxiety: “Excessive timidity in using computers, negative comments against computers and information science, attempts to reduce the amount of time spent using computers, and even the avoidance of using computersfrom the place where they are located” (Doronina, 1995).

• Doronina, O. “Fear of Computers: Its Nature, Prevention and Cure,” Russian Social Science Review (36:4) 1995, pp 79-90.

General Deterrence Theory:

• BOSS SR, KIRSCH LJ, ANGERMEIER I, SHINGLER RA and BOSS RW (2009) If Someone Is Watching, I’ll Do What I’m Asked: Mandatoriness, Control, and Information Security. European Journal of Information Systems 18(2), 151–164. 
• STRAUB DW and WELKE RJ (1998) Coping With Systems Risk: Security Planning Models for Management Decision Making. MIS Quarterly 22(4), 441–469.
• D’ARCY J and HOVAV A (2009) Does One Size Fit All? Examining the Differential Effects of IS Security Countermeasures. Journal of Business Ethics 89, 59–71.
• HERATH T and RAO HR (2009) Protection Motivation and Deterrence: A Framework for Security Policy Compliance in Organisations. European Journal of Information Systems 18(2), 106–125. 
• PAHNILA S, SIPONEN M and MAHMOOD A (2007) Employees’ Behavior towards IS Security Policy Compliance. In: 40th Annual Hawaii International Conference on System Sciences. Waikoloa, HI: IEEE Computer Society.
• STRAUB DW (1990) Effective IS Security: An Empirical Study. Information Systems Research 1(3), 255–276. 

Protection Motivation Theory:

• Rogers, R.W. (1975). A protection motivation theory of fear appeals and attitude change. Journal of Psychology, 91, 93-114.
• Rogers, R.W. (1983). Cognitive and physiological processes in fear appeals and attitude change: A revised theory of protection motivation. In J. Cacioppo & R. Petty (Eds.), Social psychophysiology (pp. 153-176). New York: Guilford.
• MADDUX JE and ROGERS RW (1983) Protection Motivation and Self-Efficacy: A Revised Theory of Fear Appeals and Attitude Change. Journal of Experimental Social Psychology 19(5), 469– 479.
• CROSSLER RE (2010) Protection Motivation Theory: Understanding Determinants to Backing Up Personal Data. In: 43rd Hawaii International Conference on System Sciences. pp. 1–10.
• HERATH T and RAO HR (2009) Protection Motivation and Deterrence: A Framework for Security Policy Compliance in Organisations. European Journal of Information Systems 18(2), 106–125.
• JOHNSTON AC and WARKENTIN M (2010) Fear Appeals and Information Security Behaviors: An Empirical Study. MIS Quarterly 34(3), 549–A4.
• PAHNILA S, SIPONEN M and MAHMOOD A (2007) Employees’ Behavior towards IS Security Policy Compliance. In: 40th Annual Hawaii International Conference on System Sciences. Waikoloa, HI: IEEE Computer Society.
• VANCE A, SIPONEN M and PAHNILA S (2012) Motivating IS Security Compliance: Insights from Habit and Protection Motivation Theory. Information & Management 49(3–4), 190–198.
• WOON I, TAN G-W and LOW R (2005) A Protection Motivation Theory Approach to Home Wireless Security. In: Proceedings of the 26th International Conference on Information Systems. pp. 367–380.
• LEE Y and LARSEN KR (2009) Threat or Coping Appraisal: Determinants of SMB Executives’ Decision to Adopt Anti-Malware Software. European Journal of Information Systems 18(2), 177–187. 

Neutralization Theory:

Technology Threat Avoidance Theory (TTAT): Posits that threat avoidance behavior functions as a dynamic positive feedback loop (concept derived from cybernetic theory, and general systems theory) composed of two cognitive processes, threat and coping appraisals, which determine how an individual would cope with IT threats.

• LIANG H and XUE Y (2009) Avoidance of Information Technology Threats: A Theoretical Perspective. MIS Quarterly 33(1), 71–90.
• LIANG H and XUE Y (2010) Understanding Security Behaviors in Personal Computer Usage: A Threat Avoidance Perspective. Journal of the Association for Information Systems 11(7), 394– 413. 

Fear Appeal Theory

• JOHNSTON AC and WARKENTIN M (2010) Fear Appeals and Information Security
• Behaviors: An Empirical Study. MIS Quarterly 34(3), 549–A4.

Technology Anxiety (As a predictor of technology adoption): An individual’s tendency to be uneasy, aprehensive, or fearful about the current or future use of technology ((Parasuraman, et al,m 1990; Allen, 2002).

• Allen, J.W., and Parikh, M.A. “The Impact of Personal Traits on IT Adoption,” Proceedings of the 8th Americas Conference on Information Systems, Dallas, TX, USA, 2002.
• Meuter, M.L., Ostrom, A.L., Bitner, M.J., and Rountree, R. “The Influence of Technology Anxiety on Consumer Use and Experiences with Self-Service Technologies,” Journal of Business Research (56) 2003, pp 899-906.
• Parasuraman, S., and Igbaria, M. “An Examination of Gender Differences in the Determinants of Computer Anxiety and Attitudes Towards Microcomputers Among Managers,” International Journal of Man-Machine Studies (32:3) 1990, pp 327-340.

Research: System Security Effectiveness in Large Versus Small Businesses

Schuessler, J. H., Windsor, J., & Wu, Y. (2014). System Security Effectiveness in Large Versus Small Businesses. Journal Of Information System Security, 10(1), 3.
This publication came from my dissertation. If you are familiar with the research process, dissertations, and whatnot, you know that this is one of your more robust pieces of research. Looking back, I certainly believe this to be true. I was lucky in that I really loved my topic and it kept me engaged throughout the process.

Information systems security is a big deal. We all know it. We see stories on TV, read about breaches in the news, and if you are one of the unfortunate ones, you have to deal with consequences of some sort of information systems security compromise. Despite the recognition that security is largely a managerial issue (Hitchings, 1995), managers routinely rank security relatively low compared to other managerial issues (Luftman & Ben-Zvi 2010; Pimchangthong, Plaisent, & Bernard 2003). A lot of this issue is that they simply do not understand the gravity of the situation. Some of it has to do with with a lack of understanding of the issues. This paper seeks to model the threat landscape along with the use of countermeasures and the ultimate effect on information systems security effectiveness. The goal was to develop a model that hopefully is more intuitive for managers that can incorporate the dynamic nature of threats and the use of countermeasures. The result is a unique model that uses cross-sectional data (data gathered at one time) to assess a dynamic relationship that changes over time.

Using Deterrence Theory as its basis (Straub and Welke, 1998), the Security Action Cycle (SAC) which consists of deterrence, detection, prevention, and remedy as dimensions, can be useful for framing the use of countermeasures by organizations. Countermeasures are dynamic in nature in that they constantly change against a changing set of threats face by an organization. Threats are not limited to “hackers” but rather, come in the form of threats from nation states, equipment obsolescence, natural disasters, etc. As the threat landscape changes, so must the use of countermeasures in order to manage risk. The ultimate goal is to insure information system security effectiveness which was conceptualized as the user of SAC efforts to protect hardware, software, data, and services. Lastly, important characteristics such as industry and organizational size were considered, recognizing that these factors might have an impact on the study.

Data was gathered, using an online survey, from AITP  professional members due to the diverse nature of their membership and their participation in prior studies (Nance & Straub 1988; Straub & Nance 1990). Of the 1500 professional members surveyed, 73 responses were gathered. Though low, this is not unusual for security related research. For a great example, see Kotulic and Clark (2004). Using PLS, the results were analyzed. However, to take it to the next level and analyze the circular relationship, where the output results for deterrence, prevention, detection, and remedy became the input the threats construct to close the circle, a personal communication with PLS guru Dr. W. Chin, helped to conclude the analysis. The results can be seen below.

Some of the big take aways were that there is a clear positive relationship between threats and the use of countermeasures. That should not come as a surprise. In fact, it would be surprising if there were not such a relationship. Interestingly, the model did indeed show a relationship between two of the dimensions of the SAC and the threats faced by an organization thus validating the circular relationship between these two constructs. Additionally, three of the four SAC dimensions also showed a positive relationship to the information system security effectiveness construct clearly showing that our use of countermeasures is having the intended protective effects. The study also showed that there is a relationship between industry and the use of preventive measures but also between preventive measures and information systems security effectiveness. Perhaps most interesting of all, the study indicated a negative relationship between organizational size and the use of countermeasures. So, relatively speaking, smaller organizations tend to employ more countermeasures than their larger counterparts. However, when considered with the result of no relationship between organizational size and information systems security effectiveness, a logical conclusion could be that larger organizations do a better job of targeting the use of countermeasures to respond to specific threats whereas small organizations tend to “shotgun” their security measures.

This was a cool study to conduct. I learned a lot and ended up getting two publications out of it. It has helped to form my research stream. I have included the citation at the top of the post. If you are interested in more detail and academic writing does not deter you, please give it a good read and let me know what you think.

Research: “Chunking” Semester Projects

Schuessler, J. H. (2017). “Chunking” Semester Projects: Does it Enhance Student Learning?”. Journal Of Higher Education Theory and Practice, 17(6).

My university is a teaching institution. We value quality teaching and keep students at the center of our focus. You can see it the way we write our learning objectives, the various student programs, and student organizations. While my college us pursuing AACSB accreditation which places more emphasis on research, the university provides for faculty development through our Center for Innovation and Instruction (CII). They put on all kinds of programs, including one geared towards the convergence of conducting research around/involving teaching. Referred to as the Scholarship of Teaching and Learning (SoTL), I think this is a great. I had never done pedagogical/andragogical research before. Sure, I’ve used students as a convenient sample, but the focus of my research has never been on my teaching methods, assignments, etc. Well, thanks to our CII’s efforts, that is no longer true.

I teach a couple of networking classes, undergraduate and graduate. I place a lot of emphasis on the semester project, specifically on some of the different components of network design: logical design, physical design, wireless design, financial analysis, risk assessment, and management design. I traditionally assigned this as a semester project due at the end of the semester. In addition to covering each section in more detail throughout the semester, I also included topic specific discussion boards in which teams of students could share their projects and see the pros and cons of each design with the idea that they could in turn, reflect and improve their own team’s design. As kind of an aside, the projects are all case based so each group was working on the same project. This makes it easier to compare the submissions from each group.

In our graduate version of this class, we actually use some of this data for program assessment purposes. To my disillusionment, I had attempted a variety of things to improve student scores, particularly as it relates to logical and physical designs, but students routinely seem to struggle with not only the diagramming aspects of such design, but also the logical aspects of logical and physical design.

The crux of the issue was that semester project scores were only ‘ok’. Clearly, some students got it. Others clearly were not “getting it”. As part of the SoTL project, I began to think of ways to modify the project such that students could get more substantive feedback earlier in the semester and work on and improve their final project submissions at the end of the semester.

To address these issues, I decided to break the sections up over the course of the semester. Before I get into the details, I make extensive use of Google in my classes. For example, I require students use Google Docs for the papers they submit. In this particular class, since it is a group project, this works particularly well due to the collaborative features of Google Docs. So, for the first submission, I created a discussion board topic in Blackboard, our university’s Learning Management System (LMS). It required each group to create a thread within that discussion board in which they included a read only link to their team’s Google Doc. With each team doing this, and as you recall, they were all working from the same case, each team could see and reflect on the similarities and differences from their peer teams. I should note that within the initial discussion board were details to help students develop a more thorough understanding of the topic (i.e. Logical Diagrams, Physical Diagrams, etc.). Additionally, the rubrics for each discussion board were quite detailed, associating points with very specific items targeted for each particular topic.

The goal was for each group to be able to look at their peer’s work, make suggestions, and perhaps more importantly, incorporate the very best ideas into their own design such that everyone’s project should have improved. They did…sort of.

When comparing the results to those of students during prior semester who were assigned and submitted more traditional, monolithic semester projects, the results were somewhat mixed.

Table 1: Results

Students performed better on the wireless design and the financial analyses, but it was inconclusive regarding their performances in the other areas. Overall, their performance improved if you use the .10 level of statistical significance. Given the low sample size, this may be appropriate. Regardless, I felt as though student learning did improve by chunking the semester project in this way. Positive signs for example included, with the exception of H1, that the mean scores on each section improved in the treatment group. The variance in scores also, for the most part, decreased in the treatment group indicating that there was more consistency in student understanding of the topic in the treatment group. In a post-hoc analysis, I also examined student evaluations in each group to see if there were any differences. The control group were evenly split on the item for agreeing or strongly agreeing on effective instructor feedback and communication. But, the control group overwhelminly strongly agreed that instructor feedback and communication was effective. This pattern held for the remaining factors of the evaluation as well; appropriateness of readings and assignments, technological tools, instructor feedback and communication, course organization, clarity of outcomes and requirements, and content format (Rothman, Romeo, Brennan, and Mitchell, 2011).

In general, chunking semester projects seems to improve student learning. There is a clear relationship between chunking semester projects and improved student evaluations. But, there are clear limitations to this study, perhaps most significantly, the sample size. Additionally, the quasi-experiment utilized different students so as a result, differences could potentially be attributed to differences among the groups themselves rather than the way in which the semester project was implemented. At least as it relates to computer self-efficacy, this does not appear to be an issue in these two groups as there was no statistical difference in scores submitted by each group.

Future research should center around replicating the student with a larger sample. The low sample used in this study could have potentially influenced the statistical results and thus, the interpretation of those results. Other avenues for future research could be directed at student learning as it relates to semester projects and student scores on final exams and overall course grades. Presumably, such holistic measures of student performance provide a more monolithic measure of student learning which could be used to determine the effect of chunked and non-chunked semester projects on such scores.

References

Bodie, G. D., Powers, W. G., & Fitch-Hauser, M. (2006). Chunking, priming and active learning: Toward an innovative and blended approach to teaching communication-related skills. Interactive Learning Environments, 14(2), 119-135. doi:10.1080/10494820600800182

Carstens, D. S., Malone, L. C., & McCauley-Bell, P. (2007). Applying Chunking Theory in Organizational Password Guidelines. Journal Of Information, Information Technology & Organizations, 297-113.

Cowan, N. (2001). The magical number 4 in short-term memory: a reconsideration of mental storage capacity. The Behavioral And Brain Sciences, 24(1), 87-114.

Eligibility Procedures and Accreditation Standards for Business Accreditation. (2016) (pp. 1-53). Tampa. Retrieved from http://www.aacsb.edu/-/media/aacsb/docs/accreditation/standards/businessstds_2013_update-3oct_final.ashx?la=en

Hambley, A. R. (1994). Electronics: A Top-Down Approach to Computer-Aided Circuitry Design. Prentice Hall PTR.

Kurose, James F., and Keith W. Ross. Computer Networking: A Top-down Approach Featuring the Internet. Harlow: Pearson Education, 2012. Print.

Mathy, F., & Feldman, J. (2012). What’s magic about magic numbers? Chunking and data compression in short-term memory. Cognition, 122(3), 346-362. doi:10.1016/j.cognition.2011.11.003

Miller, G. A. (1956). The magical number seven plus or minus two: some limits on our capacity for processing information. Psychological Review, 63(2), 81-97.

Nelson, T. (2011). Assessing Internal Group Processes in Collaborative Assignments. The English Journal, 100(6), 41-46. Retrieved from http://www.jstor.org/stable/23047879

Rothman, T., Romeo, L., Brennan, M., & Mitchell, D. (2011). Criteria for assessing student satisfaction with online courses. International Journal for e-Learning Security, 1(1-2), 27-32.

Sweller, John. “Cognitive Load Theory, Learning Difficulty, and Instructional Design.” Learning and Instruction 4.4 (1994): 295-312. Print.

Syn, T., & Batra, D. (n.d). Improving Sequence Diagram Modeling Performance: A Technique Based on Chunking, Ordering, and Patterning. Journal Of Database Management, 24(4), 1-25.

Vaughan-Nichols, Steven J. “204.5-Million Lines of Code Equals One Great Linux Distribution.” Computerworld. Computerworld, 22 Oct. 2008. Web. 23 Mar. 2017.
Xu, X., & Padilla, A. M. (2013). Using Meaningful Interpretation and Chunking to Enhance Memory: The Case of Chinese Character Learning. Foreign Language Annals, 46(3), 402-422. doi:10.1111/flan.12039

Research: Data Breach Laws: Do They Work?

Schuessler, J. H., Nagy, D, Fulk, H. K., & Dearing, A. (2017). Data Breach Laws: Do They Work? Journal Of Applied Security Research, 12(3), 84.

I‘ve got a data breach paper coming out in October in the Journal of Applied Security Research that argues for the passage of federal legislation to combat data breaches. I say “combat” but that is really a misnomer. See, “combat” makes it sound like we can take the fight to the bad guys and make them pay for breaking into organizations, stealing personal information, and selling it on the dark web. Unfortunately, it is not that easy. Neither is the passage of federal legislation that governs how those who have been breached should deal with the situation publicly.

Now, I tend to have a rather wide libertarian streak in me. As a result, I do not make light of calling for federal legislation. But, we have to look at the facts. What are the goals behind the creation of data breach legislation in the first place? It is not to stop or otherwise limit the occurrence of data breaches. Nearly every state in the U.S has passed data breach laws. Only Alabama, New Mexico, and South Dakota do not have such laws (National Conference of State Legislatures, nd). So, if such laws were working to reduce breaches, we would not being seeing the seemingly geometric rise in breaches that actually are occurring. In fact, my analysis showed that there were an average of 5.07 data breaches per year in states that would eventually pass data breach legislation and an average of 9.21 breaches per year in those same states after the passage of such legislation.

Table 1. Annual Breaches by Industry.

	2005	2006	2007	2008	2009	2010	2011	2012	2013	2014
Business	25	67	130	237	202	274	177	162	195	258
Educational	75	80	111	131	78	65	57	63	54	57
Government/Military	21	99	110	110	90	104	54	55	60	92
Health/Medical	16	44	63	99	70	165	102	167	271	333
Financial/Credit	20	31	32	79	58	54	31	24	34	43
Total	157	321	446	656	498	662	421	471	614	783

So, no, data breach laws are not designed to reduce the number of data breaches. Rather, data breach laws are designed to facilitate informing consumers that their data has been breached and taking measures to protect their private and financial information as opposed to protecting the information systems that were originally compromised in the first place. Such laws typically include an element that requires notification to the consumer in certain situations such as a breach in which their name and social security number are not encrypted and somehow compromised. When that happens, consumer are notified and can take action to protect themselves such as monitoring the financial transactions, signing up for credit monitoring services, etc. It’s not really about fixing the problem itself but rather, more about applying a band-aid after the fact.

Table 2. Relevant State and Territory Statutes.

State	Citation	State	Citation
Alaska	Alaska Stat. § 45.48.010 et seq.	Nevada	Nev. Rev. Stat. §§ 603A.010 et seq., 242.183
Arizona	Ariz. Rev. Stat. § 44-7501	New Hampshire	N.H. Rev. Stat. §§ 359-C:19, -C:20, -C:21; 189:66
Arkansas	Ark. Code § 4-110-101 et seq.	New Jersey	N.J. Stat. § 56:8-161, -163
California	Cal. Civ. Code §§ 1798.29, 1798.80 et seq.	New York	N.Y. Gen. Bus. Law § 899-aa, N.Y. State Tech. Law 208
Colorado	Colo. Rev. Stat. § 6-1-716	North Carolina	N.C. Gen. Stat §§ 75-61, 75-65
Connecticut	Conn. Gen Stat. § 36a-701b, 2015 S.B. 949, Public Act 15-142	North Dakota	N.D. Cent. Code §§ 51-30-01 et seq., 51-59-34(4)(d)
Delaware	Del. Code tit. 6, § 12B-101 et seq.	Ohio	Ohio Rev. Code §§ 1347.12, 1349.19, 1349.191, 1349.192
Florida	Fla. Stat. §§ 501.171, 282.0041, 282.318(2)(i)	Oklahoma	Okla. Stat. §§ 74-3113.1, 24-161 to -166
Georgia	Ga. Code §§ 10-1-910, -911, -912; § 46-5-214	Oregon	Oregon Rev. Stat. § 646A.600 to .628, 2015 S.B. 601, Chap. 357
Hawaii	Haw. Rev. Stat. § 487N-1 et seq.	Pennsylvania	73 Pa. Stat. § 2301 et seq.
Idaho	Idaho Stat. §§ 28-51-104 to -107	Rhode Island	R.I. Gen. Laws § 11-49.2-1 et seq., 2015 S.B. 134, Public Law 2015-138, 2015 H.B. 5220, Public Law 2015-148
Illinois	815 ILCS §§ 530/1 to 530/25	South Carolina	S.C. Code § 39-1-90, 2013 H.B. 3248
Indiana	Ind. Code §§ 4-1-11 et seq., 24-4.9 et seq.	Tennessee	Tenn. Code § 47-18-2107; § 8-4-119 (2015 S.B. 416, Chap. 42)
Iowa	Iowa Code §§ 715C.1, 715C.2	Texas	Tex. Bus. & Com. Code §§ 521.002, 521.053; Tex. Ed. Code § 37.007(b)(5); Tex. Pen. Code § 33.02
Kansas	Kan. Stat. § 50-7a01 et seq.	Utah	Utah Code §§ 13-44-101 et seq.; § 53A-13-301(6)
Kentucky	KRS § 365.732, KRS §§ 61.931 to 61.934	Vermont	Vt. Stat. tit. 9 § 2430, 2435
Louisiana	La. Rev. Stat. §§ 51:3071 et seq., 40:1300.111 to .116	Virginia	Va. Code § 18.2-186.6, § 32.1-127.1:05, § 22.1-20.2
Maine	Me. Rev. Stat. tit. 10 § 1347 et seq.	Washington	Wash. Rev. Code § 19.255.010, 42.56.590, 2015 H.B. 1078, Chapter 65
Maryland	Md. Code Com. Law §§ 14-3501 et seq., Md. State Govt. Code §§ 10-1301 to -1308	West Virginia	W.V. Code §§ 46A-2A-101 et seq.
Massachusetts	Mass. Gen. Laws § 93H-1 et seq.	Wisconsin	Wis. Stat. § 134.98
Michigan	Mich. Comp. Laws §§ 445.63, 445.72	Wyoming	Wyo. Stat. § 40-12-501 et seq.
Minnesota	Minn. Stat. §§ 325E.61, 325E.64	District of Columbia	D.C. Code § 28- 3851 et seq.
Mississippi	Miss. Code § 75-24-29	Guam	9 GCA § 48-10 et seq.
Missouri	Mo. Rev. Stat. § 407.1500	Puerto Rico	10 Laws of Puerto Rico § 4051 et seq.
Montana	Mont. Code §§ 2-6-1501 to -1503, 30-14-1701 et seq., 33-19-321	Virgin Islands	V.I. Code tit. 14, § 2208
Nebraska	Neb. Rev. Stat. §§ 87-801, -802, -803, -804, -805, -806, -807

“So, if that is the case, why aren’t state laws fine?” Well, I’ll tell you why. They cost us more money. In a paper by Hovav and Gray (2014), they looked at the effect of the TJMaxx breach on various stakeholders. Their identification of stakeholders was pretty exhaustive and even included the intruders themselves. The end result of their analysis was that in the long run, TJX, the parent company, the company was just fine. Initially, stock prices tanked but as damage estimates were revised down, class-action law suits dismissed, and settlement with Visa, their stock value actually increased. Similar results for the Target breach can be found. So, there’s no real market force in the long run that encourages organizations to protect the data of their customers. As long as they can weather the storm, they will come out of the other side, stronger than they were before knowledge of the breach occurred.

Table 3. Statistical Significance Before and After Enactment of Data Breach Laws.

	Before Law Implemented	After Law Implemented
Average	5.07	9.21
Variance	103.1	93.5
P(T <= t) Two-tail	.041

Now, this is not to say that breaches are “good” for companies. There are real dollar values associated with a data breach. According to the Ponemon Institute (2014), the average cost of a data breach in 2014 was $5.85 million. That’s $201 per record compromised. Those costs are even higher in healthcare. In light my the data from my student in which businesses and health/medical reported more breaches after data breach laws were enacted, that is a deadly combination. But, where do those costs come from? Costs come from the need to hire forensics experts, hotline support, notifications, providing credit monitoring subscriptions, etc.

Table 4. Effect of Data Breach Laws on Industry.

	Before Law Implemented	After Law Implemented	p-value.05
Business	1.21	4.19	.03
Education	1.65	1.51	.72
Government/Military	1.24	1.60	.36
Health/Medical	.66	3.06	.00
Financial/Credit	.61	.82	.57

Table 5. Relationship between annual health care costs nationally and the number of data breaches occurring in the health care industry.

	2005	2006	2007	2008	2009	2010	2011	2012	2013
Total National Health Expenditures (in billions)	2,035	2,167	2,304	2,414	2,506	2,604	2,705	2,817	2,919
Number of Healthcare Data Breaches	16	43	60	97	64	155	76	158	162

So, this brings us back to the issue at hand; what is the goal behind data breach legislation? Let’s refine that question just a bit. What is the goal behind federal data breach legislation? If it is not to curtail the occurrence of data breaches and it is not to encourage organizations to do a better job of protecting their customer’s information, then what is it?

I would argue that it is about streamlining the compliance issue. Part of the reason the cost per record is so high is that organizations that operate across state lines have up to 47 different jurisdictions to potentially comply with (assuming they do business in each state with breach laws on the books). This makes compliance a significant issue. A federal law that establishes a baseline for reporting requirements and defining what constitutes a data breach is needed. It will help to reduce the costs associated with complying with various state’s current laws by allowing organizations to more simply comply with a single federal law.

References

Gross, G. Lawmakers push for federal data breach notification law. PCWorld. 2013. Available at: http://www.pcworld.com/article/2044673/lawmakers-push-for-federal-data-beach-notification-law.html. Accessed March 20, 2017.

Anthony, J. H., Choi, W., & Grabski, S. (2006). Market reaction to e-commerce impairments evidenced by website outages. International Journal of Accounting Information Systems, 7(2), 60-78. doi:10.1016/j.accinf.2005.10.002

Cavusoglu, H., Mishra, B., & Raghunathan, S. (2004). The Effect of Internet Security Breach Announcements on Market Value: Capital Market Reactions for Breached Firms and Internet Security Developers. International Journal of Electronic Commerce, 9(1), 69.

Centers for Medicaid & Medicare Services. (2015) Retrieved 5/27/2015 https://www.cms.gov/Research-Statistics-Data-and-Systems/Statistics-Trends-and-Reports/NationalHealthExpendData/Downloads/Tables.zip

Clarke, R. (1994). Human identification in information systems: Management challenges and public policy issues. Information Technology & People, 7(4), 6-37.

Hardekopf, B. (2014, March 22). This Week In Credit Card News: Data Breaches At Supermarkets, Hospitals And UPS; Fighting Card Theft. Retrieved fromhttp://www.forbes.com/sites/moneybuilder/2014/08/22/this-week-in-credit-card-news-data-breaches-at-supermarkets-hospitals-and-ups-fighting-card-theft/

Hovav, A. P., & Gray, P. (2014). The Ripple Effect of an Information Security Breach Event: A Stakeholder Analysis. Communications of The Association For Information Systems, 34(50), 893-912.

Humer C, Finkle J. Your medical record is worth more to hackers than your credit card. http://wwwreuterscom. 2017. Available at: http://www.reuters.com/article/us-cybersecurity-hospitals-idUSKCN0HJ21I20140924. Accessed March 20, 2017.

Identity Theft Resource Center. Retrieved from http://www.idtheftcenter.org/ITRC-Surveys-Studies/2015databreaches.html

Joerling, J. (2010). Data breach notification laws: an argument for a comprehensive federal law to protect consumer data. Washington University Journal Of Law & Policy, 467.

Millman J. Health care data breaches have hit 30M patients and counting. Washington Post. 2014. Available at: https://www.washingtonpost.com/news/wonk/wp/2014/08/19/health-care-data-breaches-have-hit-30m-patients-and-counting/?utm_term=.c850a7e6b8b1. Accessed March 20, 2017.

National Conference of State Legislatures. Retrieved from http://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx. Accessed March 20, 2017.

Phelps, J., Nowak, G., & Ferrell, E. (2000). Privacy concerns and consumer willingness to provide personal information. Journal of Public Policy & Marketing, 19(1), 27-41.

Ponemon Institute. (2014). 2014 Cost of Data Breach Study: United States

Ring, L. S. (2016, May 31). Is a Federal Data Breach Law in the Cards This Year? Retrieved May 23, 201 Ring, L. S. (2016, May 31). Is a Federal Data Breach Law in the Cards This Year? Retrieved May 23, 2017, from http://www.focusdatasolutions.com/techpol/is-a-federal-data-breach-law-in-the-cards-this-year7, from http://www.focusdatasolutions.com/techpol/is-a-federal-data-breach-law-in-the-cards-this-year

Schuessler, J. H. (2010). General deterrence theory: Assessing information systems security effectiveness in large versus small businesses. Dissertation Abstracts International Section A, 70, 3681.

Schuessler, J. H., Windsor, J., & Wu, Y. (2014). System Security Effectiveness in Large Versus Small Businesses. Journal of Information System Security, 10(1), 3-40.

Sherman, E. (2014, August 28). Why $250M didn’t protect J.P. Morgan from hackers. Retrieved from http://www.cbsnews.com/news/why-250m-didnt-protect-J.P.-morgan-from-hackers/

Shultz, K. S., Hoffman, C. C., & Reiter-Palmon, R. (2005). Using archival data for I-O research: advantages, pitfalls, sources, and examples, The Industrial-Organizational Psychologist, 42(3), 31-37.

Straub, D. W., & Welke, R. J. (1998). Coping With Systems Risk: Security Planning Models for Management Decision Making. MIS Quarterly, 22(4), 441-469.

Thomas, L. (2014). Providing Notice After A Data Breach: 10 Steps To Take. Law360. Retrieved from http://www.law360.com/articles/534816/providing-notice-after-a-data-breach-10-steps-to-take

Review: Tarleton School of Criminology Cybersecurity 2016 Summit

Today, I attended the Tarleton School of Criminology Cybersecurity 2016 Summit held at the George W. Bush Presidential Library. I have to say that it was extremely well done. The various speakers brought forth an upbeat, hopeful message about the future of cybersecurity. With presentations from former military, law enforcement, lawyers, professors, and consultants, it was packed full of useful information.

One of the nice little nuggets I ran across was the concept of the “kill chain” presented by Col Jeff Schilling (ret). Naturally, this came from one of the former military presenters. A quick Google and the meaning behind it was clear and the extension to the field of cybersecurity could be easily extrapolated. Essentially, the kill chain is all the steps necessary to successfully eliminate a target. As it relates to cybersecurity, it would simply be all the steps necessary to compromise a target (read data). Remove any step in the kill chain and the objective of compromise cannot be completed. Now, here’s the kicker. As security professionals, you can attack the kill chain at each and every stage OR you can focus your efforts on a single stage. Basically, this was the argument made today. The point is not to ignore all the other stages. Patching is still important. So it user education. But focus on the data. Focus on the prize.

The thought process behind this is that if we spread our focus on all steps in the kill chain, it divides our focus and we become less effective. As long as we do not lose sight on our most valuable asset, we can focus our efforts where we can be most efficient and effective.

We also had presentations from the Secret Service as well as the FBI (no photos or names please).

Our keynote during lunch was Mr. Brian Sartin, Managing Director Verizon RISK Services over Verizon’s 2016 data breach report. No surprises here. Same thing as last year. Threats continue to grow, particularly as they relate to nation state hacking/espionage.

Then we had Candy Heath, AUSA and Lead Cyber Attorney for the United States Northern District of Texas confirm some of the keynote speaker’s findings that the vast majority of those compromised don’t know it. Rather, one a perpetrator’s is taken into custody and their systems are evaluated, numerous targets (sometimes dozens to hundreds) are discovered. This explains the concept of why it takes so long for organizations to discover that a breach has occurred. They are not discovering the breach. Others are…usually about 9 months after the breach originates.

Then a panel discussion over the state of educating security professionals and meeting the needs of employers occurred. The consensus was that we have a lot of work to do. Security professionals are very mobile. They can afford to be. They have highly sought after skills and few competitors. Depending on the presenter, there is a roughly 200,000 person shortage in this country. And, they predicted the problem would get worse. They also recognized the even within the general field of security, that there are specializations and the sometimes, an organization has security specialists, just not the specific ones they need.

Shawn Tuma, another attorney spoke about representing organizations that were the target of cyber attacks and noted the importance of simply have procedures in place and following them. Failure to protect data in and of itself is not the problem. But, failing to take reasonable precautions and not following established procedures opens up an organization to liability.

The second to last speaker was Chuck Easttom, computer scientist and author. He teaches, consults, testifies (prosecution and defense), etc. Bright guy. Would love to take some of his classes. He outlined an incident response template. The big take away from that was about verifying the credentials of the forensic expert. By that, he meant actually verify. Do not just take their word for it. Make sure they do the work and/or that they supervise those who do.

Lastly, Randell Casey, retired from the Army gave a great presentation. The take away there was “where are your electricians?” His point was that at the turn of the century in 1900, electricity was new. The government and large organizations had electricians on staff. When they needed new lines or a problem fixed, they just got their electricians to do it. Today, we simply expect to be about to flip a switch and for everything to work. If we need an electrician, we outsource it. His point was that security is moving in that direction. As things become more virtualized, more cloud based, organizations should shift to what they do best and leave the commoditization of infrastructure and security to professionals. But, he also restated the issue regarding the limited number of professionals on the market. His point here was was as the government continues to develop and employee many of those with these specialties, that as organizations start to wake up and truly understand how wide spread this issue truly is, that the shortage today could grow substantially before market forces can begin to correct the situation.

Now, I do not know if this was a one off event. I hope not. It was extremely well done. All the speakers were top notch from beginning to end. It has me rethinking our CIS programs at Tarleton to see how we might be able to collaborate with the CJ folks in order to generate some synergies. This was exciting, cool stuff.

Media Relations – Tarleton State University:

‘via Blog this’

Review: ISSA 2016 International Conference

As a new ISSA member as of late last year, I attended my first ISSA conference, conveniently located (for me) in Dallas Texas. Being used to academic conferences myself, I was not quite sure what to expect. I knew it was going to be more practitioner based and practitioner based it was…largely from a fairly managerial perspective. So, that was in my favor. So, here’s a recap of the session I attended.

For me, the first day was the weaker of the two days but the first session of the day was the strongest. It was titled “Architecting Your Cyber-security Organization For Big Data, Mobile, Cloud, and Digital Innovation” by Mr. David Foote. He discussed the importance of aligning business and security objectives and that part of making sure that happens is having CISOs report to Boards of Directors rather than to CIOs. He argued that part of what makes managing so difficult is due to churn within the field. This is a result, he argued, of being spread too thin and burnout as experienced cyber-security specialists are constantly having to re-tune because of disruptive technologies such as Cloud, Big Data, IoT, etc.). According to his research, cyber-security jobs require more certifications than other IT jobs and that there are roughly only 1000 top level security experts compared to a need for 10,000 to 30,000. This brought him to the point that we are in deep need of “people architecture”, an alignment of people, programs, practices, and technology. The benefit is an optimization of assets, improved decision making, minimizing unwanted circumstances, etc. Finally, Mr. Foote, discussed the need for consistent job titles and skills across organizations and industries. The lack of such a consistent job definition makes it hard to compare, for exam, a system administrator for one organization to a system administrator for another organization. Mr. Foote did an excellent job presenting and I would highly recommend attending other presentations he puts on.

The second session I attended was not quite as good but I did still come away with some good content. It was titled “Improving Incident Response Plan With Advanced Exercises” by Chris Evans. He stressed the need for “pre-incident” training in order to develop muscle memory. The goal is to stretch beyond just compliance. He described several ways of doing this: workshops, table top exercises, games, simulations, drills, and full scale exercises from least to most complex with the more complex yielding more tangible benefits but require more investment of time, resources, and expertise. The first step is to develop the objectives so that the people that need to participate can be identified. The key take away was that we need to evaluate > test > assess > drill.

The third session on day one was titled “Cyber Law Update”. The presenter struggled on this one. She was neither a technical person nor a manager of technical people. She was, I believe, an insurance person. But, she found herself being corrected several times by the audience. Nevertheless, there was some good content to come out of the presentation. One of the key points was regarding the establishment of FTC authority as it relates to cyber-security breaches. She discussed LabMD who was not liable for the breach but rather, for the failure to take “reasonable” security measures. Another valuable contribution from this presentation was that the inability to show injury is what stops most law suits against companies from being successful. Emotional distress does not count. You must show some sort of physical injury. If you cannot show what or how much you lost, you have no case.

The forth session of the day was titled ” Posture Makes Perfect: Cyber Residual Risk Scoring”. This one was interesting. The presenter was a little unclear in terms of specifics on his scoring model but the general idea was a calculation that gave you a residual which represented risk. He briefly mentioned threat maps and displayed one by Kaspersky and mentioned the Norse Map. I have seen these before but never spent much time looking at them. Having said that, in looking through my notes for this blog post, I Googled them and ran across a site that lists both of these as well as several others. These are pretty slick and can be interesting and compelling when trying to discuss how pervasive security issues are. He also reference the over referenced (his words) Sun Tzu’s quote about know your enemy, know yourself, … While he made the argument through the process he was advocating that you could know your enemy, he started off stating that given the complex threat environment, that you could not know your enemy. This seemed more realistic to me. There are nation states, organized crime, hacktivists, cyber criminals, etc. This make make it seemingly impossible to know your enemy with certainty, at least without a delay to properly investigate. There are just too many possibilities. But, it does suggest that we need to develop methods to more quickly identify these sources so that we can more adequately combat threats. He finished up talking about there being lots of standards and lots of certifications that demonstrate or express proficiency as it relates to assessing, developing, and implementing security in organizations. Despite all of this, breaches continue to occur. Touche!

There was a fifth session for the day but I had to leave. Day two was really pretty solid. All the session were quite good I would say. For my first session on day two, I attended Advances in Security Risk Assessments”. Presented by Mr. Doug Landoll, he started with an Einstein quote: “We cannot solve our problems with the same thinking we used when we created them.” He talked about the threat calculation, which ever one you use, needs some sort of data. You can get that data from many different places. This may be as simply as a survey; “Do you have a firewall in place?” … He stated that CISO’s are in high demand and that if you examine job requirements on job posting sites, the requirements can all be boiled down to “reducing risk.” In order to determine risk, the process for determining a risk score is important. You have to examine controls that are in place. For example, what is the hiring process like? You need to establish physical and logical boundaries to your assessment. You also need to apply a legitimate framework. In his opinion, some “frameworks” are not frameworks but are really just a collection of a few best practices (i.e. SOX, HIPPA, PCI, etc.). Legitimate frameworks include COBIT, NIST, ISO 27001, Cyber-Security Framework, FISMA, etc. With a framework identified, you need to have it mapped (hopefully it is already mapped by a good source) to a standard such as PCI. His point here was that standards and regulations are not frameworks. He then pointed to an article he published on LinkedIn. For assessment, he mentioned RIIOT: review documents, inspect, interview, and observe. Combine multiple approaches. To do good assessment, you need objectivity, expertise, and quality data. Finally, he plugged another person’s book on quantitative assessment (Doug Hubbard). Follow this presenter on LinkedIn.

The second presentation on day two was titled “Culture Changes, Communicating Cyber Risk in Business Terms.” One of the panelists stated that technology was similar to dog years, referring to the speed of change. The concept of nation states launching cyber attacks is recent. attack surfaces have mushroomed. It was also pointed out that the boundary of the enterprise is becoming harder to define as we rely more and BYOD devices, cloud services, etc. When asked about some of the recent drivers of culture change, the data breach at the Office of Personnel Management was brought up as was the Mirai DDoS attack and Dewall. The interesting thing about this last one was they were held responsible, not for a data breach, but rather for claiming through advertising that their systems were more secure than they actually were. Another example of driving a culture of change was ransom-ware and the interaction between victims and hackers. The panel concluded by discussing some of the existing standards (NIST, ISO 27005, etc.) and the focus on IT security risk and that we need to refocus on enterprise risk instead. I read into this an alignment of security and business objectives.

The third session I attended for the day was titled “Stepwise Security – A Planned Path to Reducing Risk” by Wade Tongen. He described the “de-perimeterization” of organizations and how that makes securing them difficult. Per the 2016 Verizon Data Breach Report, 63% of breaches occur as a result of weak, default, or stolen passwords. He mentioned the need for identity assurance because users have multiple identities (i.e. personal, professional, privileged, non-privileged). There is a need for consolidated identities. Fragmented identities result in sticky notes, use of same password for multiple systems, spreadsheets, etc. Use multifactor authentication EVERYWHERE. Organizations need role based provisioning so that applications, services, licenses etc. are all associated with a role so that when that role changes, access changes accordingly. Finally, the speed with which we can identify perpetrators, maximizes the chance of being able to do something about it. He used a convenience store robbery as an example. If it is robbed and you can give the police and accurate description quickly, they are more likely to be able to do something about it than if you can’t provide them with evidence (such as video surveillance) for several days.

The final session I attended on day 2 was over Mr. Robot and whether or not it was an accurate depiction of a hacker’s perspective. A panel session, the consensus was that it was. I left this session as I did not really see much value in the discussion. Overall, it was a good experience. It was new to me. As I mentioned, I am used to academic conferences. But, this was a nice conference to attend; one that I can do some further research about some of these concepts and take bake and use in my classes.

#BCIS5304 #BCIS3347 #ISSEConf

Review: 2016 Social Media Conference

I attended the 2016 Social Media Conference yet again this year. I think it was the best one I have attended, with each session giving me little tidbits of information about how to better manage and utilize my use of social media as a professional and in my classes. This is not to say that the conference can’t be improved. I would like to see stronger session on leveraging some of the analytics available in some of the platforms as well as to see a track dedicated to academic research revolving around social media. But, from top to bottom, this year’s conference was the best I have attended.

For my first session, I attended a session on “In Introduction to Social Network Analysis” bu Vivian Ta (@VivianTa22). A doctoral student from UTA, she presented last year and was back again. She described social network analysis as mapping and measuring the flow of information. It enables you to identify connectors, influencers, bridges, and isolates. The methodology allows you to track the spread of disease, sexual relationships, collaborators, business, law enforcement, etc. The value of social network analysis is that it allows you to identify data and patterns of information flow. There are two types of social network analyses: egocentric and socio-centric. Egocentric revolves around a single person to demonstrate economic success, depression, etc. Socio-centric social network analysis focuses on large groups to describe groups of people to give insight into concentration of power, spread of disease, group dynamics, etc. There are three types of measures used to analyze social network relationships (referred to as centrality measures): degrees, betweenness, and closeness. Degrees refers to the number of relationship connections each node has. Betweenness refers to nodes that link together multiple groups. They represent single points of failure and can be important linkages in terms of allowing information to travel between groups. Lastly, closeness refers to how quickly information can travel between nodes. As for actually gathering the data, you can utilize direct measures such as surveys but this can be time consuming and difficult. Indirect measures can come from organizations, citation analyses, co-authors, memberships in organizations etc. This is a cheaper approach but does not indicate how nodes are truly related to one another. Still another approach is to use data scraping, web harvesting, or data extraction techniques to pull data directly from user’s social media accounts. For example, you can harvest likes, follows, friends, reply to’s, retweets, comments, tags, etc. See OutWit Hub for an example of a data scraper. As for analyzing the data retrieved, there are several FREE platforms: NodeXL, Pajek, UCInet, NetDraw, Mag. e, Guess, R Packages for SNA, and Gephi. You can examine the frequency of interactions, types of interactions or flows, as well as the similarity of characteristics (status, location, educations, beliefs, etc.). This was a nice presentation that gave me a research idea so in my mind, it was excellent.

The second session I attended was titled “How to Use Social Media in Higher Education to Tell Your Program’s Story” by Dr. Becker and Dr. Putman. The started off by citing Hoover, 2015 who found that interacting with current students and staff through social media is more effective that interacting with them face to face. They stressed the need to align social media efforts with strategic goals and that you need a dedicated social media person to handle efforts 10-15 hours per week. They used a work-study position for this which is funded mostly through the federal government, thus reducing the funding requirement on the part of the department. Start by developing strategies and goals and develop a consistent message across platforms. It would not be wise to have a very conservative message shared through one outlet and then a very wild approach on another. Develop a hashtag for your department. They noted that it is challenging to consistently post, create messages with audience appeal, and dedicate time of an employee. You should post photos with your messages as it leads to significantly more likes, comments, and click throughs. Short posts and pose a question also tend to be more effective. Finally, the best times of the day to post are around 9:00 AM and 4:45 PM so, 1-2 times per day. This was a good presentation, which gave me some good ideas for managing our own department’s use of social media.

The third session was titled “Twitter for Educators – Network, Learn, Grow” by Yvonne Mulhern. She started off with an interesting quote from someone I did not catch: “Twitter makes me like people I’ve never met. Facebook makes me hate people I know.” She talked about using Twitter for professional development, self-promotion, and the use of Twitter Lists. Follow people you admire, leaders in your field, etc for professional development. Tweet publications, research ideas, etc. Finally, follow other’s Twitter Lists which enables you to more efficiently follow leaders in your field. Follow HigherEdJobs or Chronicles Jobs. The idea is to develop your own personal learning network (PLN). There are also several tools that enable you to streamline your use of Twitter: Twistori.com, TweetReports.com and do not forget to look at Twitter analytics.

The fourth session was presented by Dr. Goen and Dr. Stafford and was titled “Remaining Legal and Combating Trolls on Periscope, Facebook Live, and Meerkat”. They limited the discussion of Meerkat given their recent demise. They first defined a troll as an individual that visits a page to post insulting, off-topic comments to provoke some sort of emotional response. In general, they identified two different types of trolls: spammer trolls and disruptive trolls. Spammer trolls are all about them, selling their stuff, etc. Disruptive trolls spew insults, often sexual, violent posts, etc. Regardless of the type of troll, there are ways to combat trolls. On Periscope, you can set a post to follow only which means only those who follow you may post a comment. All others can only watch. You can also block users on a live broadcast. This does not remove a negative comment but it does prevent them from making additional ones. Finally, you can set a broadcast to private which only enables those following you to make comments. There are similar tools on Facebook (FB). On FB, yo ucan report/block a person from your page. The report aspect provides FB with information about your objection and allows you to continue to view the other’s account. If you simply block a user, you do not have to report anything but by doing so, you can no longer see the other’s account. You can also adjust your general privacy settings to limit what others can see. Alternatively, you can customize each post to limit its exposure. Finally, you should only accept friend requests from people you know.

The final session was over YouTube by Dr. Mitzi Lewis. Titled “How to Make the Most of Your YouTube Channel”, Dr. Lewis boiled it down to three essential areas: Brand Your Channel, Be Found, and Keep ’em Watching. For Branding Your Channel, know your mission and post videos that are directly relevant to it. If you need to deviate, consider adding another channel. Make sure your banner, name, and icon are consistent in terms of terms, colors, style, etc. You are trying to give off a consistent image. Have a good, relevant channel trailer that is, ideally, 30-60 seconds. Finally, include channel sections to groups similar/related videos. For Be Found, make sure your thumbnails are images that are relevant to the video content. She gave the example of Jimmy Kimmel videos in which then thumbnail is usually an image of the guest being interviewed. Make sure the titles use words that people will search for. Put the meat of your descriptions early in the narrative, so they can be seen without hitting “more.” If you want to identify good key words to include, google.com/trends/explore can be helpful. Finally, keep tags short and meaningful. Finally, for the Keep ’em Watching group, Dr. Lewis suggested maximizing watching time by hooking them first and then let them watch. So, given them a tease, intro, and then discuss your topic. It is extremely important to hook them early. If you use playlists to organize related videos, limit the number of videos in the playlist to the teens or so. Use a watermark which will exist on all of your videos. Finally, regularly upload videos so subsribers have something to visit. For other helpful tips and tricks, she recommended creatoracademy.youtube.com.

This year’s conference was better than years past. Again, I would like to see an academic research track included as well as some strong sessions on analytics. But, this is a nice little conference that is applicable to this in higher education, primary and secondary school, as well as businesses and other organizations. So, plan on attending next year!