References
- Ablon L, Libicki MC and Golay AA (2014) Markets for cybercrime tools and stolen information: Hackers’ Bazaar. RAND Corporation. [WWW document] http://www.rand.org/content/dam/rand/pubs/research_reports/RR600/RR610/RAND_RR610.pdf (accessed 10 October 2016).
- AbrahamSChengalur-SmithIAn overview of social engineering malware: Trends, tactics, and implicationsTechnology in Society201032318319610.1016/j.techsoc.2010.07.001
- AlimSNeaguDRidleyMAxioms for vulnerability measurement of online social network profilesInternational Conference on Information Society (i-Society)2011LondonIEEE241247
- AsiriboOGurlandJCoping with variance heterogeneityCommunications in Statistics-Theory and Methods199019114029404810.1080/03610929008830427
- Ausick P (2016) Data breaches up 15% to date in 2016. [WWW document] http://247wallst.com/technology-3/2016/09/09/data-breaches-up-15-to-date-in-2016/ (accessed 15 September 2016).
- AyyagariRAn exploratory analysis of data breaches from 2005–2011: Trends and insightsJournal of Information Privacy and Security201282335610.1080/15536548.2012.10845654
- AyyagariRTyksJDisaster at a university: A case study in information securityJournal of Information Technology Education2012118596
- BarkerKJD’AmatoJSheridonPCredit card fraud: Awareness and preventionJournal of Financial Crime200815439841010.1108/13590790810907236
- BaskervilleRSpagnolettiPKimJIncident-centered information security: Managing a strategic balance between prevention and responseInformation & Management201451113815110.1016/j.im.2013.11.004
- BealesJHMurisTJChoice or consequences: Protecting privacy in commercial informationThe University of Chicago Law Review2008751109135
- BélangerFCrosslerREPrivacy in the digital age: A review of information privacy research in information systemsMIS Quarterly20113541017104110.2307/41409971
- Ben-ItzhakYOrganised cybercrime and payment cardsCard Technology Today2009212101110.1016/S0965-2590(09)70057-X
- BergGGFreemanMSSchneiderKNAnalyzing the TJ Maxx data security fiasco: lessons for auditorsThe CPA Journal20087883437
- BerryMWBrowneMEmail surveillance using non-negative matrix factorizationComputational & Mathematical Organization Theory200511324926410.1007/s10588-005-5380-5
- BeyeMJeckmansAJErkinZHartelPLagendijkRLTangQAbrahamAPrivacy in online social networksComputational Social Networks2012LondonSpringer87113
- BishopMKleinDVImproving system security via proactive password checkingComputers & Security199514323324910.1016/0167-4048(95)00003-Q
- BlackJDevelopments in data security breach liabilityThe Business Lawyer201369199206
- BlankeSJMcGradyEWhen it comes to securing patient health information from breaches, your best medicine is a dose of prevention: A cybersecurity risk assessment checklistJournal of Healthcare Risk Management2016361142410.1002/jhrm.21230
- BrannMMattsonMToward a typology of confidentiality breaches in health care communication: An ethic of care analysis of provider practices and patient perceptionsHealth Communication200416223125110.1207/S15327027HC1602_6
- BrownMBForsytheABThe ANOVA and multiple comparisons for data with heterogeneous variancesBiometrics197430471972410.2307/2529238
- BrownMBForsytheABRobust tests for the equality of variancesJournal of the American Statistical Association19746934636436710.1080/01621459.1974.10482955
- BurnsAJYoungJARobertsTLCourtneyJFEllisTSExploring the role of contextual integrity in electronic medical record (EMR) system workaround decisions: An information security and privacy perspectiveAIS Transactions on Human-Computer Interaction201573142165
- Cate FH, Abrams ME, Bruening PJ and Swindle O (2009) Dos and don’ts of data breach and information security policy. Articles by Maurer Faculty. [WWW document] http://www.repository.law.indiana.edu/facpub/234 (accessed October 10, 2016).
- CavusogluHMishraBRaghunathanSThe effect of Internet security breach announcements on market value: Capital market reactions for breached firms and Internet security developersInternational Journal of Electronic Commerce20049170104
- Chaerani W, Clarke N and Bolan C (2011) Information leakage through second hand USB flash drives within the United Kingdom. In Australian Digital Forensics Conference, Perth Western Australia.
- ChaiSBagchi-SenSMorrellCRaoHUpadhyayaSRole of perceived importance of information security: An exploratory study of middle school children’s information security behaviorIssues in Informing Science and Information Technology2006312713510.28945/877
- ChangJLThe dark cloud of convenience: How the HIPAA omnibus rules fail to protect electronic personal health informationLoyola of Los Angeles Entertainment Law Review2013342119154
- CopesHVieraitisLMBounded rationality of identity thieves: Using offender-based research to inform policyCriminology & Public Policy20098223726210.1111/j.1745-9133.2009.00553.x
- CrosslerREJohnstonACLowryPBHuQWarkentinMBaskervilleRFuture directions for behavioral information security researchComputers & Security20133219010110.1016/j.cose.2012.09.010
- CrosslerRELongJHLoraasTMTrinkleBSUnderstanding compliance with bring your own device policies utilizing protection motivation theory: Bridging the intention-behavior gapJournal of Information Systems201428120922610.2308/isys-50704
- CulnanMJCarlinTJOnline privacy practices in higher education: Making the grade?Communications of the ACM200952312613010.1145/1467247.1467277
- D’ArcyJHerathTShossMKUnderstanding employee responses to stressful information security requirements: A coping perspectiveJournal of Management Information Systems201431228531810.2753/MIS0742-1222310210
- DaggettLMFERPA in the twenty-first century: Failure to effectively regulate privacy for all studentsCatholic University Law Review20085859114
- Davis JH (2015) Katherine Archuleta, Director of Personnel Agency, Resigns. The New York Times. [WWW document] http://www.nytimes.com/2015/07/11/us/katherine-archuleta-director-of-office-of-personnel-management-resigns.html?_r=0 (accessed 22 January 2016).
- DeerwesterSDumaisSTFurnasGWLandauerTKHarshmanRIndexing by latent semantic analysisJournal of the American Society for Information Science199041639140710.1002/(SICI)1097-4571(199009)41:6<391::AID-ASI1>3.0.CO;2-9
- DhillonGTorkzadehGValue-focused assessment of information system security in organizationsInformation Systems Journal200616329331410.1111/j.1365-2575.2006.00219.x
- DimkovTPietersWHartelPEffectiveness of physical, social and digital mechanisms against laptop theft in open organizationsGreen Computing and Communications (GreenCom), 2010 IEEE/ACM Int’l Conference on & Int’l Conference on Cyber, Physical and Social Computing (CPSCom)2010HangzhouIEEE727732
- DutchNews (2016) ‘Massive data breach’ at Almelo municipality. [WWW document] http://www.dutchnews.nl/news/archives/2016/09/massive-data-breach-at-almelo-municipaility/ (accessed 15 September 2016).
- ElsonRJLeClercRCustomer information: protecting the organization’s most critical asset from misappropriation and identity theftJournal of Information Privacy and Security20062131510.1080/15536548.2006.10855783
- EngebretsonPPodhradskyACaseyCAn analysis of security vulnerabilities of the Xbox 360 and Xbox Live mobile networkInternational Journal of Mobile Network Design and Innovation20135191610.1504/IJMNDI.2013.057144
- EvangelopoulosNZhangXPrybutokVRLatent semantic analysis: five methodological recommendationsEuropean Journal of Information Systems2012211708610.1057/ejis.2010.61
- FathimaAAhmedBMaking data breach prevention a matter of policy in corporate governanceInternational Journal of Scientific Engineering and Technology20132117
- FaulknerBHacking into data breach notification lawsFlorida Law Review20075910971125
- FrenchAShropshireJHandheld versus Traditional Computer Security Threats and PracticesThe Journal of Internet Electronic Commerce Research2011112153171
- FrenchAMGuoCShimJCurrent status, issues, and future of bring your own device (BYOD)Communications of the Association for Information Systems20143510191197
- FriedmanJHoffmanDVProtecting data on mobile devices: A taxonomy of security threats to mobile computing and review of applicable defensesInformation, Knowledge, Systems Management200871159180
- FurnellSPassword practices on leading websites–revisitedComputer Fraud & Security20141251110.1016/S1361-3723(14)70555-X
- GardnerJAThe ‘states-as-laboratories’ metaphor in state constitutional lawValparaiso University Law Review1996302475491
- Gerard GJ, Hillison W and Pacini C (2005a) Identify theft: an organization’s responsibilities’. [WWW document] http://ruby.fgcu.edu/courses/cpacini/courses/common/idtheftjoffincrim.pdf (accessed September 27).
- GerardGJHillisonWPaciniCIdentity theft: the US legal environment and organisations’ related responsibilitiesJournal of Financial Crime2005121334310.1108/13590790510625043
- GoelSShawkyHAEstimating the market impact of security breach announcements on firm valuesInformation & Management200946740441010.1016/j.im.2009.06.005
- GrayDLadigJThe implementation of EMV chip card technology to improve cyber security accelerates in the US following target corporation’s data breachInternational Journal of Business Administration201562606710.5430/ijba.v6n2p60
- HalamkaJDMandlKDTangPCEarly experiences with personal health recordsJournal of the American Medical Informatics Association20081511710.1197/jamia.M2562
- HansonJBLiability for consumer information security breaches: deconstructing FTC complaints against businesses victimized by consumer information security breachesShidler Journal of Law, Commerce & Technology200841113
- HarrisALLangMYatesDKruckSIncorporating ethics and social responsibility in IS educationJournal of Information Systems Education2011223183
- HarrisonMIKoppelRBar-LevSUnintended consequences of information technologies in health care – an interactive sociotechnical analysisJournal of the American Medical Informatics Association200714554254910.1197/jamia.M2384
- HassanNRLowryPBSeeking middle-range theories in information systems researchInternational Conference on Information Systems (ICIS 2015)2015Fort Worth, TXAIS1318
- HedayatiAAn analysis of identity theft: Motives, related frauds, techniques and preventionJournal of Law and Conflict Resolution201241112
- Heller M (2016) Voter data breach leads to questions of tampering and state security. [WWW document] http://searchsecurity.techtarget.com/news/450303431/Voter-data-breach-leads-to-questions-of-tampering-and-state-security (accessed 15 September 2016).
- HoffmanLJRosenbergTDodgeRRagsdaleDExploring a national cybersecurity exercise for universitiesIEEE Security & Privacy200535273310.1109/MSP.2005.120
- Howard PN and Gulyas O (2014) Data Breaches in Europe: Reported Breaches of Compromised Personal Records in Europe, 2005–2014. [WWW document] https://cmds.ceu.edu/sites/cmcs.ceu.hu/files/attachment/article/663/databreachesineurope_1.pdf (accessed 27 January 2017).
- HuQXuZDinevTLingHDoes deterrence work in reducing information security policy abuse by employees?Communications of the ACM2011546546010.1145/1953122.1953142
- HumphriesSInstitutes of higher education, safety swords, and privacy shields: Reconciling FERPA and the common lawJournal of College and University Law200835145216
- IgureVWilliamsRTaxonomies of attacks and vulnerabilities in computer systemsIEEE Communications Surveys & Tutorials200810161910.1109/COMST.2008.4483667
- ImGPBaskervilleRLA longitudinal study of information system threat categories: The enduring problem of human errorThe DATA BASE for Advances in Information Systems2005364687910.1145/1104004.1104010
- Information Commissioner’s Office (2016) Data security incident trends. [WWW document] https://ico.org.uk/action-weve-taken/data-security-incident-trends/ (accessed 15 September 2016).
- Ion I, Sachdeva N, Kumaraguru P and Čapkun S (2011) Home is safer than the cloud!: privacy concerns for consumer cloud storage. Paper presented at the Symposium on Usable Privacy and Security, Pittsburgh, PA, Article No. 13.
- IvesBWalshKRSchneiderHThe domino effect of password reuseCommunications of the ACM2004474757810.1145/975817.975820
- Jaramillo D, Katz N, Bodin B, Tworek W, Smart R and Cook T (2013) Cooperative solutions for bring your own device (BYOD). IBM Journal of Research and Development57(6), 5: 1–5: 11.
- Jayaram N and Morse P (1997) Network security – a taxonomic view. In European Conference on Security and Detection (ECOS), pp 124–127, IET, London.
- Katz E (2015) OPM’s return to paper security clearance processing roils contractors, lawmakers. [WWW document] http://www.govexec.com/oversight/2015/07/opms-return-paper-security-clearance-processing-roils-contractors-lawmakers/117031/?oref=relatedstories (accessed 22 January 2016).
- KemererCFSlaughterSAn empirical approach to studying software evolutionIEEE Transactions on Software Engineering199925449350910.1109/32.799945
- Kim JH (2015) Information theft within different organizational types: a rational choice analysis PhD dissertation, Rutgers, The State University of New Jersey. [WWW document] http://dx.doi.org/doi:10.7282/T3HD7XHF (accessed 27 January 2017).
- KimWJeongO-RKimCSoJThe dark side of the Internet: Attacks, costs and responsesInformation Systems201136367570510.1016/j.is.2010.11.003
- Kish M (2016) One of Portland’s largest financial firms warns of possible data breach. [WWW document] http://www.bizjournals.com/portland/news/2016/09/12/one-of-portlands-largest-financial-firms-warns-of.html (accessed 15 September 2016).
- KoopsB-JLeenesRMeintsMMeulenNJaquet-ChiffelleD-OA typology of identity-related crime: conceptual, technical, and legal issuesInformation, Communication & Society200912112410.1080/13691180802158516
- KotulicAGClarkJGWhy there aren’t more information security research studiesInformation & Management200441559760710.1016/j.im.2003.08.001
- Krutz RL and Vines RD (2010) Cloud Security: A Comprehensive Guide to Secure Cloud Computing. Wiley Publishing.
- KurkovskySSytaEMonitoring of electronic communications at universities: policies and perceptions of privacy44th Hawaii International Conference on System Sciences (HICSS)2011Kauai, HIIEEE110
- LeeASBaskervilleRLGeneralizing generalizability in information systems researchInformation Systems Research200314322124310.1287/isre.14.3.221.16560
- Li X-B and Qin J (2017) Anonymizing and sharing medical text records. Information Systems Research,forthcoming.
- LiginlalDSimIKhansaLHow significant is human error as a cause of privacy breaches? An empirical study and a framework for error managementComputers & Security200928321522810.1016/j.cose.2008.11.003
- LindqvistUJonssonEHow to systematically classify computer security intrusionsThe 1997 IEEE Symposium on Security and Privacy1997Oakland, CAIEEE Computer Society154163
- Markus ML and Saunders C (2007) Editor’s comments: Looking for a few good concepts… and theories… for the information systems field. MIS Quarterly31(1), iii–vi.
- Marotta-WurglerFSelf-Regulation and Competition in Privacy PoliciesThe Journal of Legal Studies201645S2S13S3910.1086/689753
- Mather T, Kumaraswamy S and Latif S (2009) Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance (Theory in Practice). O’Reilly Media, Inc.
- McCallister E, Grance T and Scarfone K (2010) Guide to protecting the confidentiality of personally identifiable information (PII). NIST Special Publication. [WWW document] http://ws680.nist.gov/publication/get_pdf.cfm?pub_id=904990 (accessed 27 January 2017).
- McCallum A, Nigam K and Ungar LH (2000) Efficient clustering of high-dimensional data sets with application to reference matching. In The Sixth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp 169–178, ACM.
- McKelveyBOrganizational systematics: Taxonomic lessons from biologyManagement Science197824131428144010.1287/mnsc.24.13.1428
- McKelvey B (1982) Organizational Systematics: Taxonomy, Evolution, Classification. University of California Press, Los Angeles, California.
- MenschSWilkieLInformation security activities of college students: An exploratory studyAcademy of Information and Management Sciences Journal201114291116
- MesoPDingYXuSApplying protection motivation theory to information security training for college studentsJournal of Information Privacy and Security201391476710.1080/15536548.2013.10845672
- Ni LoideainNThe end of safe harbor: Implications for EU digital privacy and data protection lawJournal of Internet Law2016198714
- NicholsonJLO’RearsonMEData protection basics: A primer for college and university counselJournal of College and University Law200936101
- NissenbaumHPrivacy in Context: Technology, Policy, and the Integrity of Social Life2009Stanford, CaliforniaStanford University Press
- ParksRXuHChuC-HLowryPBExamining the intended and unintended consequences of organisational privacy safeguardsEuropean Journal of Information Systems2016261376510.1057/s41303-016-0001-6
- PavlouPAState of the information privacy literature: where are we now and where should we go?MIS Quarterly201135497798810.2307/41409969
- Pearson S (2009) Taking account of privacy when designing cloud computing services. Paper presented at the ICSE Workshop on Software Engineering Challenges of Cloud Computing, Vancouver, Canada, 44–52.
- PembleMDon’t panic: Taxonomy for identity theftComputer Fraud & Security2008200877910.1016/S1361-3723(08)70111-8
- PerettiKKData breaches: what the underground world of carding revealsSanta Clara Computer and High Technology Journal200825375413
- PhamDVSyedAHalgamugeMNUniversal serial bus based software attacks and protection solutionsDigital Investigation20117317218410.1016/j.diin.2011.02.001
- PicansoKEProtecting information security under a uniform data breach notification lawFordham Law Review200675355
- PinsonCNew legal frontier: Mass information loss and security breachSMU Science and Technology Law Review20071127
- Podhradsky A, Dovidio R, Engebretson P and Casey C (2013) Xbox 360 hoaxes, social engineering, and gamertag exploits. In 46th Hawaii International Conference on System Sciences (HICSS), pp 3239–3250, IEEE, Wailea, HI.
- PorterMFAn algorithm for suffix strippingProgram: Electronic Library and Information Systems198014313013710.1108/eb046814
- PoseyCRobertsTLLowryPBBennettRJCourtneyJFInsiders’ protection of organizational information assets: development of a systematics-based taxonomy and theory of diversity for protection-motivated behaviorsMIS Quarterly20133741189121010.25300/MISQ/2013/37.4.09
- RajaUTretterMJClassification of software patches: a text mining approachJournal of Software Maintenance and Evolution: Research and Practice2011232698710.1002/smr.468
- RanchalRBhargavaBOthmaneLBLilienLKimAKangMet alProtection of identity information in cloud computing without trusted third party2010New Delhi, IndiaPaper presented at the IEEE Symposium on Reliable Distributed Systems368372
- Roosta T, Shieh S and Sastry S (2006) Taxonomy of security attacks in sensor networks and countermeasures. In The First IEEE International Conference on System Integration and Reliability Improvements, IEEE, Hanoi, Vietnam.
- Sansurooah K and Szewczyk P (2012) A study of remnant data found on USB storage devices offered for sale on the Australian second hand market in 2011. In 10th Australian Information Security Management Conference, Perth, Australia.
- SenRBorleSEstimating the contextual risk of data breach: An empirical approachJournal of Management Information Systems201532231434110.1080/07421222.2015.1063315
- ShafferGGlobalization and social protection: the impact of EU and international rules in the ratcheting up of US data privacy standardsYale Journal of International Law2000251188
- SidorovaAEvangelopoulosNValacichJSRamakrishnanTUncovering the intellectual core of the information systems disciplineMIS Quarterly200832346748210.2307/25148852
- SmithHJDinevTXuHInformation Privacy Research: An Interdisciplinary ReviewMIS Quarterly2011354989101510.2307/41409970
- SteinbrookRPersonally controlled online health data-the next big thing in medical care?New England Journal of Medicine2008358161653165610.1056/NEJMp0801736
- TangPCAshJSBatesDWOverhageJMSandsDZPersonal health records: definitions, benefits, and strategies for overcoming barriers to adoptionJournal of the American Medical Informatics Association200613212112610.1197/jamia.M2025
- TiptonSChoiYThe rise in payment system breaches: the TargetCaseInternational Journal of Computer and Information Technology20143510601064
- TracolXEU–U.S. Privacy Shield: The saga continuesComputer Law & Security Review201632577577710.1016/j.clsr.2016.07.013
- TrautmanLJAltenbaumer-PriceKThe board’s responsibility for information technology governanceThe John Marshall Journal of Information Technology & Privacy Law201028313341
- TremblayMCBerndtDJLutherSLFoulisPRFrenchDDIdentifying fall-related injuries: Text mining the electronic medical recordInformation Technology and Management200910425326510.1007/s10799-009-0061-6
- TuttleHImplications of the Ashley Madison hackRisk Management201562889
- UpendarJRaoEGAn overview of plastic card frauds and solutions for avoiding fraudster transactionsInternational Journal of Research in Engineering and Technology20132821522210.15623/ijret.2013.0208036
- WijkERHolmesTRGone in a flash: A misplaced USB drive prompts internal auditing to rethink its coverage of security risksInternal Auditor20076437577
- VenterHEloffJHA taxonomy for information security technologiesComputers & Security200322429930710.1016/S0167-4048(03)00406-1
- Verizon (2015. Last updated). 2015 Data Breach Investigations Report. [WWW document] http://www.verizonenterprise.com/resources/reports/rp_data-breach-investigation-report_2015_en_xg.pdf (accessed 27 January 2017).
- Verma S and Singh A (2012) Data theft prevention & endpoint protection from unauthorized USB devices – Implementation. In International Conference on Advanced Computing (ICoAC), pp 1–4, IEEE, Chennai, India.
- WallJDLowryPBBarlowJBOrganizational violations of externally governed privacy and security rules: Explaining and predicting selective violations under conditions of strain and excessJournal of the Association for Information Systems20151713976
- WangTKannanKNUlmerJRThe association between the disclosure and the realization of information security risk factorsInformation Systems Research201324220121810.1287/isre.1120.0437
- Wang Y and Nepali RK (2015) Privacy threat modeling framework for online social networks. In International Conference on Collaboration Technologies and Systems, pp 358–363, IEEE, Atlanta, Georgia.
- WarkentinMWillisonRBehavioral and policy issues in information systems security: the insider threatEuropean Journal of Information Systems200918210110510.1057/ejis.2009.12
- WelchBOn the comparison of several mean values: an alternative approachBiometrika1951383/433033610.2307/2332579
- Willison R and Warkentin M (2010) The expanded security action cycle: a temporal analysis ‘Left of Bang’. In The Dewald Roode Workshop on Information Systems Security Research, IFIP WG8.
- WillisonRWarkentinMBeyond deterrence: An expanded view of employee computer abuseMIS Quarterly201337112010.25300/MISQ/2013/37.1.01
- XuWGrantGNguyenHDaiXSecurity breach: The case of TJX Companies, IncCommunications of the Association for Information Systems20082331575590
- YoungEEducational privacy in the online classroom: FERPA, MOOCs, and the big data conundrumHarvard Journal of Law & Technology201528549593
- ZviranMHagaWJPassword security: an empirical studyJournal of Management Information Systems199915416118510.1080/07421222.1999.11518226