Opportunities for computer abuse: Considering systems risk from the offender's perspective

Robert Andrew Willison, James Backhouse

    Research output: Working paperResearch

    Abstract

    Systems risk refers to the likelihood that an IS is inadequately guarded against certain types of damage or loss. While risks are posed by acts of God, hackers and viruses, consideration should also be given to the `insider' threat of dishonest employees, intent on undertaking some form of computer abuse. Against this backdrop, a number of researchers have addressed the extent to which security managers are cognizant of the very nature of systems risk. In particular, they note how security practitioners' knowledge of local threats, which form part of such risk, is often fragmented. This contributes to situations where risk reducing efforts are often less than effective. Security efforts are further complicated given that the task of managing systems risk requires input from a number of departments including, for example, HR, compliance, IS/IT and physical security. In a bid to complement existing research, but also offer a fresh perspective, this paper addresses systems risk from the offender's perspective. If systems risk entails the likelihood that an IS is inadequately protected, this text considers those conditions, within the organisational context, which offer a criminal opportunity for the offender. To achieve this goal a model known as the `Crime Specific Opportunity Structure' is advanced. Focussing on the opportunities for computer abuse, the model addresses the nature of such opportunities with regards to the organisational context and the threats posed by rogue employees. Drawing on a number of criminological theories, it is believed the model may help inform managers about local threats and, by so doing, enhance safeguard implementation.
    Original languageEnglish
    Place of PublicationKøbenhavn
    Number of pages45
    Publication statusPublished - 2005

    Cite this

    Willison, Robert Andrew ; Backhouse, James. / Opportunities for computer abuse : Considering systems risk from the offender's perspective. København, 2005.
    @techreport{b56934f08eb411dba124000ea68e967b,
    title = "Opportunities for computer abuse: Considering systems risk from the offender's perspective",
    abstract = "Systems risk refers to the likelihood that an IS is inadequately guarded against certain types of damage or loss. While risks are posed by acts of God, hackers and viruses, consideration should also be given to the `insider' threat of dishonest employees, intent on undertaking some form of computer abuse. Against this backdrop, a number of researchers have addressed the extent to which security managers are cognizant of the very nature of systems risk. In particular, they note how security practitioners' knowledge of local threats, which form part of such risk, is often fragmented. This contributes to situations where risk reducing efforts are often less than effective. Security efforts are further complicated given that the task of managing systems risk requires input from a number of departments including, for example, HR, compliance, IS/IT and physical security. In a bid to complement existing research, but also offer a fresh perspective, this paper addresses systems risk from the offender's perspective. If systems risk entails the likelihood that an IS is inadequately protected, this text considers those conditions, within the organisational context, which offer a criminal opportunity for the offender. To achieve this goal a model known as the `Crime Specific Opportunity Structure' is advanced. Focussing on the opportunities for computer abuse, the model addresses the nature of such opportunities with regards to the organisational context and the threats posed by rogue employees. Drawing on a number of criminological theories, it is believed the model may help inform managers about local threats and, by so doing, enhance safeguard implementation.",
    keywords = "Edb-sikkerhed, Edb-kriminalitet, Virksomhedens sikkerhed, Medarbejderkriminalitet, Crime Specific Opportunity Structure",
    author = "Willison, {Robert Andrew} and James Backhouse",
    year = "2005",
    language = "English",
    type = "WorkingPaper",

    }

    Opportunities for computer abuse : Considering systems risk from the offender's perspective. / Willison, Robert Andrew; Backhouse, James.

    København, 2005.

    Research output: Working paperResearch

    TY - UNPB

    T1 - Opportunities for computer abuse

    T2 - Considering systems risk from the offender's perspective

    AU - Willison, Robert Andrew

    AU - Backhouse, James

    PY - 2005

    Y1 - 2005

    N2 - Systems risk refers to the likelihood that an IS is inadequately guarded against certain types of damage or loss. While risks are posed by acts of God, hackers and viruses, consideration should also be given to the `insider' threat of dishonest employees, intent on undertaking some form of computer abuse. Against this backdrop, a number of researchers have addressed the extent to which security managers are cognizant of the very nature of systems risk. In particular, they note how security practitioners' knowledge of local threats, which form part of such risk, is often fragmented. This contributes to situations where risk reducing efforts are often less than effective. Security efforts are further complicated given that the task of managing systems risk requires input from a number of departments including, for example, HR, compliance, IS/IT and physical security. In a bid to complement existing research, but also offer a fresh perspective, this paper addresses systems risk from the offender's perspective. If systems risk entails the likelihood that an IS is inadequately protected, this text considers those conditions, within the organisational context, which offer a criminal opportunity for the offender. To achieve this goal a model known as the `Crime Specific Opportunity Structure' is advanced. Focussing on the opportunities for computer abuse, the model addresses the nature of such opportunities with regards to the organisational context and the threats posed by rogue employees. Drawing on a number of criminological theories, it is believed the model may help inform managers about local threats and, by so doing, enhance safeguard implementation.

    AB - Systems risk refers to the likelihood that an IS is inadequately guarded against certain types of damage or loss. While risks are posed by acts of God, hackers and viruses, consideration should also be given to the `insider' threat of dishonest employees, intent on undertaking some form of computer abuse. Against this backdrop, a number of researchers have addressed the extent to which security managers are cognizant of the very nature of systems risk. In particular, they note how security practitioners' knowledge of local threats, which form part of such risk, is often fragmented. This contributes to situations where risk reducing efforts are often less than effective. Security efforts are further complicated given that the task of managing systems risk requires input from a number of departments including, for example, HR, compliance, IS/IT and physical security. In a bid to complement existing research, but also offer a fresh perspective, this paper addresses systems risk from the offender's perspective. If systems risk entails the likelihood that an IS is inadequately protected, this text considers those conditions, within the organisational context, which offer a criminal opportunity for the offender. To achieve this goal a model known as the `Crime Specific Opportunity Structure' is advanced. Focussing on the opportunities for computer abuse, the model addresses the nature of such opportunities with regards to the organisational context and the threats posed by rogue employees. Drawing on a number of criminological theories, it is believed the model may help inform managers about local threats and, by so doing, enhance safeguard implementation.

    KW - Edb-sikkerhed

    KW - Edb-kriminalitet

    KW - Virksomhedens sikkerhed

    KW - Medarbejderkriminalitet

    KW - Crime Specific Opportunity Structure

    M3 - Working paper

    BT - Opportunities for computer abuse

    CY - København

    ER -