Decision-makers regularly need to make trade-offs between benefits in the present and the future. Smaller immediate rewards are often preferred over larger delayed rewards. The concept of delay discounting describes how rewards further in the future lose their value in comparison to immediate or more proximal rewards. Empirical evidence shows that people discount future rewards using a hyperbolic function, which gives rise to preference reversals as the delay between a decision and receipt of the reward increases. People show great differences in terms of their tendency to discount future benefits. The extent of discounting is characterized by each individuals’ discounting factor k. This study investigates the extent to which the discounting factor k can be inferred from publicly observable pieces of information (i.e. ownership of items, habits) linked to individuals. Data was collected from 331 respondents in an online questionnaire. The analyses show that 37% of the variance can be (More)

Healthcare professionals are often the weakest link in the security chain, which is contributing to data breaches in the healthcare sector. A number of reasons account for this. Technological countermeasures for cyber defenses have been heightened and the adversaries tend to exploit easy entry points. Besides, healthcare staffs are usually occupied by their core duty of healthcare provison with little experience in information security.With a Design Science Approach (DSA), observational measures for effective profiling of healthcare staffs were developed. Regulations and security standards such as the Code of Conduct, General Data Protection Regulation (GDPR) of European Union (EU), ISO 7799, and other Norwegian Acts and regulations for personal data protection, were reviewed for the observational measures. A comprehensive Healthcare Security Practice Analysis, Modeling and Incentivization (HSPAMI) framework was proposed for analyzing healthcare staffs' security practices in a comprehensive way.

The healthcare sector is characterized with variant situations and services such as emergency services, collaborations in patient care and patient referrals. These activities require erratic accesses and electronic exchange of personal health information (PHI) between health professionals and healthcare organizations. Also, healthcare information is deemed to be among the most confidential of all types of personal data. Analyzing and modeling the security threats emanating from healthcare staffs' security practices therefore need an efficient approach. There is a need for tailored measures to be adopted in assessing healthcare personnel security practices in relation to Confidentiality, Integrity and Availability (CIA) threats. Standards and technical security implementations, required by regulatory bodies, have resulted in tracking healthcare staffs' security practices in various data sources which can be explored for security countermeasures. A literature survey was adopted to obtain the most appropriate observational measures that can be used to empirically study healthcare staffs' security practice analysis, modeling and incentivization (HSPAMI). The survey was conducted in journal and conference articles, healthcare security breaches reports and AI tools for detecting anomalous healthcare staff security practices. The survey results did not find a comprehensive and tailed observational measures suitable for the HSPAMI project. A comprehensive and tailored observational measures were therefore developed from healthcare standards, legal, regulatory aspects, and the code of conduct. Observational measures relating to healthcare security practices such as self-authorization, inter-organizational accesses to PHI and ICT readiness were found to be unique and have not been factored in existing observational measures for efficient profiling of healthcare staffs.

Prediction Markets are the markets designed and operated to mine and aggregate the information scattered among the traders. Recently, some researchers have started exploring the application of prediction markets in the information security domain. The information security prediction market will facilitate trading of contracts to hedge the financial impact of the risks associated with the underlying information security events, such as discovery of a vulnerability in a piece of software. However, prediction markets differ in their objectives and requirements, and therefore information security prediction markets need to be carefully engineered to meet the specific requirements. The contribution of this paper is the identification of a set of design requirements for an information security prediction market, and associated performance criteria. We present five categories of design requirements: Contracts, Trading Process, Participants and Incentives, Clearing House, and Market Management for the information security prediction market. Furthermore, we present six performance measures: Information Elicitation, Transparency, Efficiency, Transaction Cost, Liquidity, and Manipulation Resistance for the performance assessment of information security prediction market.

Abstract—Information Security Standards such as NIST SP 800-39 and ISO/IEC 27005:2011 are turning their scope towards business process security. And rightly so, as introducing an infor-mation security control into a business-processing environment is likely to affect business process flow, while redesigning a business process will most certainly have security implications. Hence, in this paper, we investigate the similarities and differences between Business Process Management (BPM) and Information Security Management (ISM), and explore the obstacles and opportunities for integrating the two concepts. We compare three levels of abstraction common for both approaches; top-level implementa-tion strategies, organizational risk views & associated tasks, and domains. With some minor differences, the comparisons shows that there is a strong similarity in the implementation strategies, organizational views and tasks of both methods. The domain comparison shows that ISM maps to the BPM domains; however, some of the BPM domains have only limited support in ISM.

Purpose The purpose of this paper is to present a new method for ranking authentication products. Using this method, issues such as technical performance, application/system‐specific requirements, cost and usability are addressed. The method simplifies and makes the selection process more transparent by identifying issues that are important when selecting products. Design/methodology/approach The paper used quantitative cost and performance analysis. Findings The method can be widely applied, allowing the comparison and ranking of an extensive variety of authentication products (passwords, biometrics, tokens). The method can be used for both product selection and the process of product development as supported by the case studies. Originality/value This is a work that demonstrates how to compare authentication methods from different categories. A novel ranking method has been developed which allows the comparison of different authentication products in a defined usage scenario.

In this paper, we provide some insights towards understanding the uniqueness of gait (ankle motion) by relating the discriminativeness of gait to the shoe type, direction of the motion and gait cycle. For analysis, we use gait samples of the people when all of them walk with the same specific types of footwear, thus eliminating the randomness (noise) introduced by the shoe variability. We collect gait using an accelerometer sensor, which is attached to the ankle of the person. The accelerometer records ankle motion in three directions: up-down, forward-backward and sideway. The verification method is based on detecting and averaging gait cycles in acceleration signal. Our gait data set consists of 480 samples from 30 persons. Each person walked with the 4 different types of footwear. Our analysis reveal that heavy footwear reduces the discrimination and the sideway motion of the foot has the most discriminating power compared to the up-down or forward-backward directions of the motion. Furthermore, various gait cycle parts contribute differently to the recognition performance. In addition, our analysis confirm that recognition performance can significantly decrease when the test and template samples are obtained using different shoe types. The recognition performance in terms of EER was in the range of 5%-18.3% mainly depending on the shoe type and the direction of motion.

Research in biometric gait recognition has increased. Earlier gait recognition works reported promising results, usually with a small sample size. Recent studies with a larger sample size confirm gait potential as a biometric from which individuals can be identified. Despite much research being carried out in gait recognition, the topic of vulnerability of gait to attacks has not received enough attention. In this paper, an analysis of minimal-effort impersonation attack and the closest person attack on gait biometrics are presented. Unlike most previous gait recognition approaches, where gait is captured using a (video) camera from a distance, in our approach, gait is collected by an accelerometer sensor attached to the hip of subjects. Hip acceleration in three orthogonal directions (up-down, forward-backward, and sideways) is utilized for recognition. We have collected 760 gait sequences from 100 subjects. The experiments consisted of two parts. In the first part, subjects walked in their normal walking style, and using the averaged cycle method, an EER of about 13% was obtained. In the second part, subjects were trying to walk as someone else. Analysis based on FAR errors indicates that a minimal-effort impersonation attack on gait biometric does not necessarily improve the chances of an impostor being accepted. However, attackers with knowledge of their closest person in the database can be a serious threat to the authentication system.

This paper presents a classification of attacks by malicious software. Unlike previous schemes, it focuses on application software instead of operating systems. We classify attacks pertaining to input, processing, and output of an application. Our scheme can be used to adapt testing strategies and is intended as a step towards developing a security metric for assessing robustness of programs.

A Location Based Service (LBS) is a service where knowledge of the location of an object or individual is used to personalise the service. Typical examples include the E911 emergency location service in the US and 'Where is the nearest xx' type of services. However, since these services often may be implemented in a way that exposes sensitive personal information, there are several privacy issues to consider. A key question is: "Who should have access to what location information under which circumstances?It is our view that individuals should be equipped with tools to become in the position to formulate their own personal location privacy policies, subject to applicable rules and regulations.This paper identifies concepts that may be useful when formulating such policies. The key concept is that of an observation of a located object. An observation typically includes the location, the identity of the object, the time the observation was made and the speed of the object. The idea is that the individual should be able to adjust the accuracy at which these observations are released depending on parameters such as the intended use and the identity of the recipient.We provide fragments of a language for formulating personal location privacy policies and give some small examples illustrating the kind of policies that we have in mind.

In protocols for the distribution of symmetric keys, a principal will usually either take on the role as a session key provider or as a session key user. A principal taking on the role as session key user may also act as the master or the slave. Methods for the analysis of cryptographic protocols that fail to properly handle multiple roles are demonstrated to yield undependable results. A protocol, KP, similar to the Needham and Schroeder symmetric key distribution protocol (1978) is presented. An example is provided to show how a multirole flaw in KP can be utilized by an adversary to obtain a session key. Using a method due to M. Burrows et al. (1989) and P. Bieber (1990) it is shown that KP seems to be suitable for secure key distribution. The approach due to P. Bieber is then modified to facilitate the detection of the class of multirole flaws.>

The BAN approach to analysis of cryptographic protocols (M. Burrows et al., 1988) transforms a correctness requirement into a proof obligation of a formal belief logic. It is shown that the BAN protocol annotation rules make flaws due solely to protocol step permutation undetectable by the BAN logic. This is illustrated by a short example. In the style of BAN logic, the author defines the concept of a terminating idealized protocol. BAN logic has been used to prove the correctness of an insecure protocol (D. Nessett, 1990). The author shows that this protocol belongs to the class of nonterminating protocols.>