Suchergebnisse

PurposeThis paper presents a qualitative study of penetration testing, the practice of attacking information systems to find security vulnerabilities and fixing them. The purpose of this paper is to understand whether and to what extent penetration testing can reveal various socio-organisational factors of information security in organisations. In doing so, the paper innovates theory by using Routine Activity Theory together with phenomenology of information systems concepts.Design/methodology/approachThe articulation of Routine Activity Theory and phenomenology emerged inductively from the data analysis. The data consists of 24 qualitative interviews conducted with penetration testers, analysed with thematic analysis.FindingsThe starting assumption is that penetration testers are akin to offenders in a crime situation, dealing with targets and the absence of capable guardians. A key finding is that penetration testers described their targets as an installed base, highlighting how vulnerabilities, which make a target suitable, often emerge from properties of the existing built digital environments. This includes systems that are forgotten or lack ongoing maintenance. Moreover, penetration testers highlighted that although the testing is often predicated on planned methodologies, often they resort to serendipitous practices such as improvisation.Originality/valueThis paper contributes to theory, showing how Routine Activity Theory and phenomenological concepts can work together in the study of socio-organisational factors of information security. This contribution stems from considering that much research on information security focuses on the internal actions of organisations. The study of penetration testing as a proxy of real attacks allows novel insights into socio-organisational factors of information security in organisations.

AbstractThe extant literature has demonstrated that there is a need for more empirical research on the subject of policing cybercrime. This article makes a contribution and offers a qualitative exploration of the problem of policing cybercrime from an international perspective. It structures the analysis around three main challenges: the knowledge, forensic, and legal challenges. A literature review supports the evidence that these issues are core challenges when policing cybercrime. Through 13 semi-structured interviews with cybercrime specialists from 8 countries, these three challenges are further investigated. A thematic analysis of the interviews, whilst confirming some of the previous literature findings, also outlines novel findings. Interview analysis shows that in some areas little recent progress has been made, in particular the recording of cybercrime. However, in other areas new creative solutions have been implemented, including filling the policing skills gap with civilian specialists. The article concludes by offering recommendations for addressing some of the challenges for policing cybercrime.