CT-ISG: Violations in computer and information security

项目摘要提案#0627682“计算机和信息安全中的违规行为“以人为因素工程学科为基础，本研究系统地探讨了导致计算机和信息安全（CIS）违规行为的原因或因素。重点是网络管理员违反CIS的行为。混合方法的研究方法结合了定性（焦点小组）和定量（调查）研究，以了解违反CIS的行为，其后果和导致违规的因素，并制定解决方案，以处理违反CIS的行为。该研究有助于找出改善网络管理员CIS相关行为的解决方案（即减少违规行为的发生或减轻其对CIS漏洞的影响），有助于揭示CIS中涉及的人为因素，特别是网络管理员的错误行为（即违规行为）的作用以及处理这些违规行为的方法。拟议的研究工作利用了网络防御局（CDA）主席Sami Saydjari在计算机和信息安全方面的专业知识。与威斯康星州大学电子商务研究所的合作将加强传播工作，例如为公司组织研讨会，了解CIS中的人为因素，这项研究还将有助于培养工业和系统工程（ISyE）方面的各种本科生和研究生。将组织研究和教学活动之间的几个联系，特别是PI（Carayon）和共同PI（Veeramani）教授的ISyE课程。出版计划有助于向若干社区传播有关这项研究的信息（例如，计算机安全、人为因素工程）。

PROJECT ABSTRACTCT proposal #0627682"Violations in computer and information security"Anchored in the human factors engineering discipline, this research explores systematically the reasons or factors contributing to computer and information security (CIS) violations. The focus is on CIS violations committed by network administrators. A mixed-methods research approach combines qualitative (focus groups) and quantitative (survey) research in order to understand CIS violations, their consequences and the factors contributing to violations, and to develop solutions to deal with CIS violations. This research can help identify solutions for improving CIS-related behaviors of network administrators (i.e. reducing the occurrence of violations or mitigating their impact on CIS vulnerabilities).This research can shed light on the human factors involved in CIS, in particular the role of wrongful behaviors (i.e. violations) of network administrators and methods for dealing with those violations. The proposed research effort takes advantage of the expertise in computer and information security of Sami Saydjari, president of the Cyber Defense Agency (CDA). The collaboration with the University of Wisconsin E-Business Institute will strengthen the dissemination efforts, such as the organization of a workshop for companies to learn about human factors in CIS.This research will also contribute to the training of diverse undergraduate and graduate students in industrial and systems engineering (ISyE). Several links between the research and teaching activities will be organized, in particular with the ISyE courses taught by the PI (Carayon) and the co-PI (Veeramani). The publication plan contributes to the dissemination of information on this research to several communities (e.g., computer security, human factors engineering).