CT-ISG: Violations in computer and information security

项目摘要建议#0627682“计算机和信息安全中的违规行为”植根于人的因素工程学学科，本研究系统地探讨了导致计算机和信息安全(CIS)违规的原因或因素。重点是网络管理员违反独联体的行为。混合方法研究方法结合了定性(焦点小组)和定量(调查)研究，以了解独联体违规行为、其后果和造成违规行为的因素，并制定解决方案来处理独联体违规行为。本研究有助于找出改善网络管理员CIS相关行为的解决方案(即减少违规行为的发生或减轻其对CIS漏洞的影响)。本研究可以揭示CIS中涉及的人为因素，特别是网络管理员不当行为(即违规行为)的作用和处理这些违规行为的方法。拟议的研究工作利用了网络防御局(CDA)主席萨米·萨伊贾里(Sami Saydjari)在计算机和信息安全方面的专业知识。与威斯康星大学电子商务研究所的合作将加强传播努力，例如为公司组织一个研讨会，以了解企业在企业信息系统中的人为因素。这项研究还将有助于培养不同的工业和系统工程(ISyE)本科生和研究生。将组织研究和教学活动之间的几个联系，特别是由PI(Carayon)和共同PI(Veeramani)教授的ISyE课程。出版计划有助于向几个社区(如计算机安全、人为因素工程学)传播关于这项研究的信息。

PROJECT ABSTRACTCT proposal #0627682"Violations in computer and information security"Anchored in the human factors engineering discipline, this research explores systematically the reasons or factors contributing to computer and information security (CIS) violations. The focus is on CIS violations committed by network administrators. A mixed-methods research approach combines qualitative (focus groups) and quantitative (survey) research in order to understand CIS violations, their consequences and the factors contributing to violations, and to develop solutions to deal with CIS violations. This research can help identify solutions for improving CIS-related behaviors of network administrators (i.e. reducing the occurrence of violations or mitigating their impact on CIS vulnerabilities).This research can shed light on the human factors involved in CIS, in particular the role of wrongful behaviors (i.e. violations) of network administrators and methods for dealing with those violations. The proposed research effort takes advantage of the expertise in computer and information security of Sami Saydjari, president of the Cyber Defense Agency (CDA). The collaboration with the University of Wisconsin E-Business Institute will strengthen the dissemination efforts, such as the organization of a workshop for companies to learn about human factors in CIS.This research will also contribute to the training of diverse undergraduate and graduate students in industrial and systems engineering (ISyE). Several links between the research and teaching activities will be organized, in particular with the ISyE courses taught by the PI (Carayon) and the co-PI (Veeramani). The publication plan contributes to the dissemination of information on this research to several communities (e.g., computer security, human factors engineering).