Journal of Digital Forensics, Security and Law

9-34

Authors: Kenneth J. Knapp, F. Nelson Ford, Thomas E. Marshall, R. Kelly Rainer, Jr.

This study proposes using an established common body of knowledge (CBK) as one means of organizing information security literature. Consistent with calls for more relevant information systems (IS) research, this industry-developed framework can motivate future research towards topics that are important to the security practitioner. In this review, forty-eight articles from ten IS journals from 1995 to 2004 are selected and cross-referenced to the ten domains of the information security CBK. Further, we distinguish articles as empirical research, frameworks, or tutorials. Generally, this study identified a need for additional empirical research in every CBK domain including topics related to legal aspects of information security. Specifically, this study identified a need for additional IS security research relating to applications development, physical security, operations security, and business continuity. The CBK framework is inherently practitioner oriented and using it will promote relevancy by steering IS research towards topics important to practitioners. This is important considering the frequent calls by prominent information systems scholars for more relevant research. Few research frameworks have emerged from the literature that specifically classify the diversity of security threats and range of problems that businesses today face. With the recent surge of interest in security, the need for a comprehensive framework that also promotes relevant research can be of great value.

57-74

Authors: Patricia A.H. Williams

Information governance is becoming an important aspect of organisational accountability. In consideration that information is an integral asset of most organisations, the protection of this asset will increasingly rely on organisational capabilities in security. In the medical arena this information is primarily sensitive patient-based information. Previous research has shown that application of security measures is a low priority for primary care medical practice and that awareness of the risks are seriously underestimated. Consequently, information security governance will be a key issue for medical practice in the future. Information security governance is a relatively new term and there is little existing research into how to meet governance requirements. The limited research that exists describes information security governance frameworks at a strategic level. However, since medical practice is already lagging in the implementation of appropriate security, such definition may not be practical although it is obviously desirable. This paper describes an on-going action research project undertaken in the area of medical information security, and presents a tactical approach model aimed at addressing information security governance and the protection of medical data.

93-96

Authors: Gary Kessler

O'Harrow, R., Jr. (2006). No Place To Hide. New York: Free Press. 352 pages, ISBN: 0-7432-8705-3 (paper), US$26 Reviewed by Gary C. Kessler (gary.kessler@champlain.edu) Personal privacy and the protection of personal identifying information are of concern to all of us. Innumerable articles and conferences address our loss of privacy, either through the sale of consumer databases or our own inattention. Opinions vary from "You have no privacy; get over it" to "This is the end of civil liberties as we know them." We teach people to safely maneuver on the Internet and minimize their exposure to bogus sites set up to steal their identity, warn users about the dangers of phishing and posting personal information on social network sites, use firewalls to protect our databases, and enact laws such as the Health Insurance Portability and Accountability Act (HIPAA) and the Family Educational Rights and Privacy Act (FERPA) to protect information.