{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,1]],"date-time":"2025-10-01T15:31:14Z","timestamp":1759332674030,"version":"3.41.2"},"reference-count":28,"publisher":"Emerald","issue":"2","license":[{"start":{"date-parts":[[2021,3,10]],"date-time":"2021-03-10T00:00:00Z","timestamp":1615334400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.emerald.com\/insight\/site-policies"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["ICS"],"published-print":{"date-parts":[[2021,8,3]]},"abstract":"<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Purpose<\/jats:title>\n<jats:p>In the past, people were usually seen as the weakest link in the IT security chain. However, this view has changed in recent years and people are no longer seen only as a problem, but also as part of the solution. In research, this change is reflected in the fact that people are enabled to report security incidents that they have detected. During this reporting process, however, it is important to ensure that the reports are submitted with the highest possible data quality. This paper aims to provide a process-driven quality improvement approach for human-as-a-security-sensor information.<\/jats:p>\n<\/jats:sec>\n<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Design\/methodology\/approach<\/jats:title>\n<jats:p>This work builds upon existing approaches for structured reporting of security incidents. In the first step, relevant data quality dimensions and influencing factors are defined. Based on this, an approach for quality improvement is proposed. To demonstrate the feasibility of the approach, it is prototypically implemented and evaluated using an exemplary use case.<\/jats:p>\n<\/jats:sec>\n<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Findings<\/jats:title>\n<jats:p>In this paper, a process-driven approach is proposed, which allows improving the data quality by analyzing the similarity of incidents. It is shown that this approach is feasible and leads to better data quality with real-world data.<\/jats:p>\n<\/jats:sec>\n<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Originality\/value<\/jats:title>\n<jats:p>The originality of the approach lies in the fact that data quality is already improved during the reporting of an incident. In addition, approaches from other areas, such as recommender systems, are applied innovatively to the area of the human-as-a-security-sensor.<\/jats:p>\n<\/jats:sec>","DOI":"10.1108\/ics-06-2020-0100","type":"journal-article","created":{"date-parts":[[2021,3,9]],"date-time":"2021-03-09T07:55:36Z","timestamp":1615276536000},"page":"332-349","source":"Crossref","is-referenced-by-count":4,"title":["Improving data quality for human-as-a-security-sensor. A process driven quality improvement approach for user-provided incident information"],"prefix":"10.1108","volume":"29","author":[{"given":"Manfred","family":"Vielberth","sequence":"first","affiliation":[]},{"given":"Ludwig","family":"Englbrecht","sequence":"additional","affiliation":[]},{"given":"G\u00fcnther","family":"Pernul","sequence":"additional","affiliation":[]}],"member":"140","published-online":{"date-parts":[[2021,3,10]]},"reference":[{"issue":"3","key":"key2021080202132160500_ref001","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/1541880.1541883","article-title":"Methodologies for data quality assessment and improvement","volume":"41","year":"2009","journal-title":"ACM Computing Surveys"},{"volume-title":"Data and Information Quality: Dimensions, Principles and Techniques, Data-Centric Systems and Applications","year":"2016","key":"key2021080202132160500_ref002"},{"key":"key2021080202132160500_ref003","first-page":"63","article-title":"A study on advanced persistent threats","volume-title":"IFIP International Conference on Communications and Multimedia Security","year":"2014"},{"issue":"8","key":"key2021080202132160500_ref004","doi-asserted-by":"publisher","first-page":"983","DOI":"10.1016\/j.cose.2012.08.004","article-title":"Power to the people? The evolving recognition of human aspects of security","volume":"31","year":"2012","journal-title":"Computers and Security"},{"issue":"6","key":"key2021080202132160500_ref005","doi-asserted-by":"publisher","first-page":"433","DOI":"10.1007\/s12599-013-0297-x","article-title":"Process-driven data quality management through integration of data quality into existing process models","volume":"5","year":"2013","journal-title":"Business and Information Systems Engineering"},{"key":"key2021080202132160500_ref006","doi-asserted-by":"publisher","first-page":"101","DOI":"10.1016\/j.cose.2018.02.020","article-title":"Detecting semantic social engineering attacks with the weakest link: implementation and empirical evaluation of a human-as-a-security-sensor framework","volume":"76","year":"2018","journal-title":"Computers and Security"},{"key":"key2021080202132160500_ref007","doi-asserted-by":"publisher","first-page":"6910","DOI":"10.1109\/ACCESS.2016.2616285","article-title":"You are probably not the weakest link: towards practical prediction of susceptibility to semantic social engineering attacks","volume":"4","year":"2016","journal-title":"IEEE Access"},{"issue":"1","key":"key2021080202132160500_ref008","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/1515693.1515697","article-title":"A procedure to develop metrics for currency and its application in CRM","volume":"1","year":"2009","journal-title":"Journal of Data and Information Quality"},{"key":"key2021080202132160500_ref009","first-page":"80","article-title":"Analyzing data quality investments in CRM: a model-based approach","volume-title":"Eighth International Conference on Information Quality (ICIQ 2003)","year":"2003"},{"article-title":"Information technology \u2013 security techniques \u2013 information security management systems \u2013 requirements","year":"2013","author":"ISO\/IEC","key":"key2021080202132160500_ref010"},{"key":"key2021080202132160500_ref011","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.SP.800-30r1.","volume-title":"Guide for Conducting Risk Assessments. National Institute of Standards and Technology","author":"Joint Task Force Transformation Initiative","year":"2012"},{"issue":"1","key":"key2021080202132160500_ref012","doi-asserted-by":"publisher","first-page":"14","DOI":"10.1109\/MCC.2015.2","article-title":"Cloud attack and risk assessment taxonomy","volume":"2","year":"2015","journal-title":"IEEE Cloud Computing"},{"key":"key2021080202132160500_ref013","first-page":"2.1","article-title":"How to think about quality","volume-title":"Juran\u2019s Quality Handbook","year":"1999","edition":"5th ed"},{"issue":"1","key":"key2021080202132160500_ref014","doi-asserted-by":"crossref","first-page":"537","DOI":"10.1146\/annurev.psych.50.1.537","article-title":"Survey research","volume":"50","year":"1999","journal-title":"Annual Review of Psychology"},{"issue":"5","key":"key2021080202132160500_ref015","first-page":"44","article-title":"The human element: the weakest link in information security","volume":"204","year":"2007","journal-title":"Journal of Accountancy"},{"key":"key2021080202132160500_ref016","unstructured":"Mello, J.P. (2017), \u201cSecurity awareness training explosion\u201d, available at: https:\/\/cybersecurityventures.com\/security-awareness-training-report\/ (accessed 14 October 2020)."},{"issue":"2","key":"key2021080202132160500_ref017","doi-asserted-by":"crossref","first-page":"66","DOI":"10.1145\/269012.269023","article-title":"Data quality and systems theory","volume":"41","year":"1998","journal-title":"Communications of the ACM"},{"volume-title":"Actionable Information for Security Incident Response","year":"2014","key":"key2021080202132160500_ref018"},{"key":"key2021080202132160500_ref019","doi-asserted-by":"publisher","first-page":"325","DOI":"10.1007\/978-3-540-72079-9.","article-title":"Content-based recommendation systems","volume-title":"The Adaptive Web, Methods and Strategies of Web Personalization, Lecture Notes in Computer Science","year":"2007"},{"key":"key2021080202132160500_ref020","doi-asserted-by":"publisher","first-page":"387","DOI":"10.1109\/SERA.2017.7965756","article-title":"Assessing the cyber-trustworthiness of human-as-a-sensor reports from mobile devices","volume-title":"15th IEEE International Conference on Software Engineering Research, Management and Applications (SERA)","year":"2017"},{"volume-title":"Data Quality for the Information Age","year":"1996","key":"key2021080202132160500_ref021"},{"volume-title":"Managing Quality Dynamics","year":"1991","key":"key2021080202132160500_ref022"},{"issue":"1","key":"key2021080202132160500_ref023","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s42400-019-0040-0","article-title":"Human-as-a-security-sensor for harvesting threat intelligence","volume":"2","year":"2019","journal-title":"Cybersecurity"},{"issue":"11","key":"key2021080202132160500_ref024","doi-asserted-by":"crossref","first-page":"86","DOI":"10.1145\/240455.240479","article-title":"Anchoring data quality dimensions in ontological foundations","volume":"39","year":"1996","journal-title":"Communications of the ACM"},{"issue":"4","key":"key2021080202132160500_ref025","doi-asserted-by":"crossref","first-page":"5","DOI":"10.1080\/07421222.1996.11518099","article-title":"Beyond accuracy: what data quality means to data consumers","volume":"12","year":"1996","journal-title":"Journal of Management Information Systems"},{"volume-title":"Corporate Fraud Handbook: Prevention and Detection","year":"2017","key":"key2021080202132160500_ref026"},{"issue":"4","key":"key2021080202132160500_ref027","doi-asserted-by":"publisher","first-page":"493","DOI":"10.1504\/IJWBC.2011.042993","article-title":"The road from community ideas to organisational innovation: a life cycle survey of idea management systems","volume":"7","year":"2011","journal-title":"International Journal of Web Based Communities"},{"key":"key2021080202132160500_ref028","doi-asserted-by":"publisher","first-page":"169","DOI":"10.1016\/j.ijhcs.2019.05.005","article-title":"Moving from a human-as-problem to a human-as-solution cybersecurity mindset","volume":"131","year":"2019","journal-title":"International Journal of Human-Computer Studies"}],"container-title":["Information &amp; Computer Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.emerald.com\/insight\/content\/doi\/10.1108\/ICS-06-2020-0100\/full\/xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.emerald.com\/insight\/content\/doi\/10.1108\/ICS-06-2020-0100\/full\/html","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,7,25]],"date-time":"2025-07-25T01:22:59Z","timestamp":1753406579000},"score":1,"resource":{"primary":{"URL":"http:\/\/www.emerald.com\/ics\/article\/29\/2\/332-349\/117749"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,3,10]]},"references-count":28,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2021,3,10]]},"published-print":{"date-parts":[[2021,8,3]]}},"alternative-id":["10.1108\/ICS-06-2020-0100"],"URL":"https:\/\/doi.org\/10.1108\/ics-06-2020-0100","relation":{},"ISSN":["2056-4961","2056-4961"],"issn-type":[{"type":"print","value":"2056-4961"},{"type":"print","value":"2056-4961"}],"subject":[],"published":{"date-parts":[[2021,3,10]]}}}