Rushed to crack – On the perceived effectiveness of cybersecurity measures for secure behaviour under time pressure

Chowdhury, Noman H.; Adam, Marc T. P.; Teubner, Timm

doi:10.1080/0144929x.2022.2092030

Cited by 3 publications

(6 citation statements)

References 70 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This is also consistent with IT decision making and communication within overall governance responsibilities (Shaikh and Siponen, 2023; Bongiovanni et al , 2022) and decision-making under time pressure and workload requirements (Chen et al , 2022; Gyllensten et al , 2021; Chowdhury et al , 2019; Chowdhury et al , 2022; Giger and Pochwatko, 2008).…”

Section: Theory and Calculationsupporting

confidence: 74%

“…The results presented in this paper will help ERP managers anticipate high-risk enterprise system vulnerabilities and develop actionable plans to manage those vulnerabilities, reducing the concerns of time pressure and workload (Giger and Pochwatko, 2008; Chowdhury et al , 2019; Chowdhury et al , 2022; Bongiovanni et al , 2022).…”

Section: Methodsmentioning

confidence: 99%

“…Much has been written about technical solutions and how to incent end-users to adopt strong security practices (Reuter et al , 2022; Hirschprung et al , 2020), developers and software engineers security practices (Naiakshina, 2019; Ploger et al , 2021), and or external penetration (Lee, 2021; Alzaqebah et al , 2023), but minimally regarding the impact of fatigue in cybersecurity response (Chen et al , 2022). Organizations have devoted their resources to address cybersecurity issues focus on endpoints and networks (Hansen, 2022) are limited to partial solutions (Pharris and Perez-Mira, 2022) or educating the end-user (Chowdhury et al , 2019; Chowdhury et al , 2022), but have overlooked a core component of the organization and its systems, the ERP. The current focus for organizations is to build defenses around the perimeter (Lloyd, 2020; Lee, 2021), not on the inner ERP or its vulnerabilities (Hansen, 2022).…”

Section: Introductionmentioning

confidence: 99%

“…The focus toward end-users and perimeters is not unfounded as research has shown that as end-users encounter cybersecurity issues, they experience high stress under significant time pressure (Chowdhury et al , 2022) with increased awareness of cybersecurity measures reducing the risk to the firm (Chowdhury et al , 2019; Stewart, 2022). The conundrum is that in most organizations, especially those with large, heterogenous enterprise software systems, the effort seems to stop with the end-user and does not extend into the ERP.…”

Section: Introductionmentioning

confidence: 99%

“…The ability of the ERP Manager to sift through large amounts of prior and newly discovered vulnerabilities, evaluate their severity levels, and then prioritize based on enterprise risk is minimal (Johnson et al , 2016). Add this to responding to security threats under intense time pressure and workload (Chowdhury et al , 2019; Chowdhury et al , 2022; Giger and Pochwatko, 2008; Amankwa et al , 2022) creates an untenable approach.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Lost in the middle – a pragmatic approach for ERP managers to prioritize known vulnerabilities by applying classification and regression trees (CART)

Mathieu,

Turovlin

2023

ICS

View full text Add to dashboard Cite

Purpose Cyber risk has significantly increased over the past twenty years. In many organizations, data and operations are managed through a complex technology stack underpinned by an Enterprise Resource Planning (ERP) system such as systemanalyse programmentwicklung (SAP). The ERP environment by itself can be overwhelming for a typical ERP Manager, coupled with increasing cybersecurity issues that arise creating periods of intense time pressure, stress and workload, increasing risk to the organization. This paper aims to identify a pragmatic approach to prioritize vulnerabilities for the ERP Manager. Design/methodology/approach Applying attention-based theory, a pragmatic approach is developed to prioritize an organization’s response to the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) vulnerabilities using a Classification and Regression Tree (CART). Findings The application of classification and regression tree (CART) to the National Institute of Standards and Technology’s National Vulnerability Database identifies prioritization unavailable within the NIST’s categorization. Practical implications The ERP Manager is a role between technology, functionality, centralized control and organization data. Without CART, vulnerabilities are left to a reactive approach, subject to overwhelming situations due to intense time pressure, stress and workload. Originality/value To the best of the authors’ knowledge, this work is original and has not been published elsewhere, nor is it currently under consideration for publication elsewhere. CART has previously not been applied to the prioritizing cybersecurity vulnerabilities.

show abstract