Computer security incident response teams (CSIRTs) respond to a computer security incident when the need arises. Failure of these teams can have far-reaching effects for the economy and national security. CSIRTs often have to work on an ad hoc basis, in close cooperation with other teams, and in time constrained environments. It could be argued that under these working conditions CSIRTs would be likely to encounter problems. A needs assessment was done to see to which extent this argument holds true. We constructed an incident response needs model to assist in identifying areas that require improvement. We envisioned a model consisting of four assessment categories: Organization, Team, Individual and Instrumental. Central to this is the idea that both problems and needs can have an organizational, team, individual, or technical origin or a combination of these levels. To gather data we conducted a literature review. This resulted in a comprehensive list of challenges and needs that could hinder or improve, respectively, the performance of CSIRTs. Then, semi-structured in depth interviews were held with team coordinators and team members of five public and private sector Dutch CSIRTs to ground these findings in practice and to identify gaps between current and desired incident handling practices. This paper presents the findings of our needs assessment and ends with a discussion of potential solutions to problems with performance in incident response. https://doi.org/10.3389/fpsyg.2017.02179 LinkedIn: https://www.linkedin.com/in/rickvanderkleij1/
MULTIFILE
Cybersecurity is meer dan alleen het nemen van technische maatregelen. En alhoewel gebruikers ten onrechte vaak alleen worden aangemerkt als ‘de zwakke schakel’ binnen die cybersecurity, moet een deel van de maatregelen zich toch echt wel richten op deze groep. Gebruikers gedragen zich immers soms bewust of onbewust onveilig: - ze klikken op hyperlinks als ze dat niet moeten doen; - reageren op een phishingmail; - gebruiken zwakke wachtwoorden; - hergebruiken wachtwoorden; - melden incidenten niet; - geven (te) veel gegevens prijs van zichzelf op social media; - maken niet consequent back-ups van hun data. Sinds jaar en dag lijken organisaties ‘awareness’ te zien als de sleutel om van gebruikers iets minder de zwakke schakel te maken. De gedachte daarachter is kortgezegd dat gebruikers zich ‘beter’ gaan gedragen als we ze voeden met informatie over dreigingen, goed en fout gedrag en het cybersecurity-beleid. Het is inmiddels echter wel duidelijk dat een beleid dat alleen gericht is op ‘awareness’ niet gaatzorgen voor het gewenste effect. Onderzoek toont bijvoorbeeld aan dat anti-phishingcampagnes, waar nepphishingmails worden verstuurd, niet heel lang beklijven. Cybersecuritybedrijven geven dan ook steeds vaker aan dat het niet alleen gaat om het verhogen van kennis en bewustwording, maar ook om andere aspecten die gedrag lijken te beïnvloeden. Recent wetenschappelijk experimenteel onderzoek laat zelfs zien dat het hebben van meer kennis kan leiden tot onveiliger gedrag: gebruikers die (een beetje) meer weten, gedragen zich nog onveiliger. Mogelijk komt dat doordat die groep zichzelf overschat en daardoor ten onrechte grotere risico’s durft te nemen. We moeten dus verder komen dan alleen awareness. Het lab observeert dat er twee grote vraagstukken spelen. 1. Wat moeten we dan verder nog doen? Het is duidelijk dat er geen simpele oplossing is voor het bevorderen van veilig cybergedrag. Toch is het goed om nieuwe oplossingsrichtingen te onderzoeken die richting geven aan het verbeteren van cyberveilig gedrag. 2. Hoe zorgen we ervoor dat organisaties daadwerkelijk verder gaan dan alleen het creëren van meer awareness? Individuele organisaties hebben lang niet altijd de kennis en kunde om dit zelf te doen. Moet de overheid dit stimuleren? Zo ja, hoe dan? Kan het aan de markt zelf (lees: cybersecurity bedrijven) overgelaten worden? Wat kunnen we leren over het stimuleren van effectieve gedragsinterventies binnen andere vakgebieden? https://nl.linkedin.com/in/rutgerleukfeldt
MULTIFILE
Bedrijven bevinden zich tegenwoordig vaak in een keten. Een keten kan worden beschouwd als een verzameling organisaties die een virtueel netwerk delen waar informatie, diensten, goederen of geld doorheen stroomt. Hierbij staan ICT-systemen veelal centraal. Deze afhankelijkheid werkt in de hand dat cyber-gerelateerde risico’s een opmars maken binnen ketens. Niet elke ketenorganisatie beschikt echter over de middelen en kennis om zichzelf te beschermen: om tot sterke ketens te komen is informatiedeling tussen ketenorganisaties over actuele dreigingen en incidenten van belang. Een doel van dit verkennend onderzoek, dat is uitgevoerd in opdracht van het Nationaal Cyber Security Centrum (NCSC), is om inzicht te bieden in de succesfactoren van informatiedeling-initiatieven op het gebied van cyberveiligheid. Met deze kennis kan het NCSC haar accounthouders en adviseurs helpen om de doelgroepen positief te motiveren om actie te nemen ter versterking van ketenweerbaarheid. Tevens wordt met dit onderzoek beoogd om aanknopingspunten voor vervolgonderzoek te identificeren. Het identificeren van succesfactoren vond plaats op basis van een literatuurstudie en gestructureerde interviews met in totaal zes leden uit drie verschillende bestaande informatiedeling-initiatieven rondom cybersecurity: het Managed Service Provider (MSP) Information Sharing and Analysis Centre (ISAC), Energie ISAC en de securitycommissie van de Nederlandse Energie- Data Uitwisseling (NEDU). Alle respondenten zijn informatiebeveiligingsexperts die hun organisatie vertegenwoordigen in de samenwerkingsverbanden. In totaal zijn 20 succesfactoren geïdentificeerd. Deze factoren zijn vervolgens gecategoriseerd tot vier thema’s die bijdragen aan een succesvolle informatiedeling. De thema’s zijn samen te vatten als teamfactoren, individuele factoren, managementfactoren en faciliterende factoren. De vier meest genoemde succesfactoren zijn: ● Expertise: Leden met onderscheidende en gespecialiseerde kennis bevorderen de informatiedeling en zijn ondersteunend aan het individuele leerdoel van de leden. ● Vertrouwen: Vertrouwen is een essentiële voorwaarde voor de bereidheid om samen te werken en informatie te delen. Tijd is hierin een cruciale factor: tijd is nodig voor vertrouwen om te ontstaan. ● Lidmaatschapseisen: Expliciete en impliciete lidmaatschapseisen zorgen voor een selectie op geschikte deelnemers en faciliteren daarmee het onderling vertrouwen. ● Structurele opzet: Een samenwerking dient georganiseerd te zijn volgens een structuur en met een stabiele bezetting van voldoende omvang. Vervolgonderzoek zou zich kunnen richten op het identificeren van strategieën voor het opstarten van samenwerkingsverbanden en het over de tijd behouden van enthousiasme onder de leden in de informatiedeling-initiatieven rondom cybersecurity. Ook onderzoek naar de eigenschappen of kwaliteiten van de voorzitter en hoe deze bijdragen aan het succesvol initiëren en onderhouden van een samenwerkingsverband zijn genoemd. Ook is nog onvoldoende duidelijk hoe gedeelde of juist onderscheidende expertise van de leden bijdraagt aan succes van de informatiedeling-initiatieven. Verder is er behoefte aan kennis over hoe de samenwerking tussen ketenpartners op het gebied van cyberveiligheid buiten bestaande samenwerkingsverbanden is ingericht. Denk hierbij aan een uitbreiding van de huidige studie, maar met een focus op kleinere bedrijven die deel uitmaken van ketens, maar waarbij IT niet de corebusiness is, aangezien die volgens respondenten als risicovol worden gezien voor de keten.
The project aims to improve palliative care in China through the competence development of Chinese teachers, professionals, and students focusing on the horizontal priority of digital transformation.Palliative care (PC) has been recognised as a public health priority, and during recent years, has seen advances in several aspects. However, severe inequities in the access and availability of PC worldwide remain. Annually, approximately 56.8 million people need palliative care, where 25.7% of the care focuses on the last year of person’s life (Connor, 2020).China has set aims for reaching the health care standards of the developed countries by 2030 through the Healthy China Strategy 2030, where one of the improvement areas in health care includes palliative care, thus continuing the previous efforts.The project provides a constructive, holistic, and innovative set of actions aimed at resulting in lasting outcomes and continued development of palliative care education and services. Raising the awareness of all stakeholders on palliative care, including the public, is highly relevant and needed. Evidence based practice guidelines and education are urgently required for both general and specialised palliative care levels, to increase the competencies for health educators, professionals, and students. This is to improve the availability and quality of person-centered palliative care in China. Considering the aging population, increase in various chronic illnesses, the challenging care environment, and the moderate health care resources, competence development and the utilisation of digitalisation in palliative care are paramount in supporting the transition of experts into the palliative care practice environment.General objective of the project is to enhance the competences in palliative care in China through education and training to improve the quality of life for citizens. Project develops the competences of current and future health care professionals in China to transform the palliative care theory and practice to impact the target groups and the society in the long-term. As recognised by the European Association for Palliative Care (EAPC), palliative care competences need to be developed in collaboration. This includes shared willingness to learn from each other to improve the sought outcomes in palliative care (EAPC 2019). Since all individuals have a right to health care, project develops person-centered and culturally sensitive practices taking into consideration ethics and social norms. As concepts around palliative care can focus on physical, psychological, social, or spiritual related illnesses (WHO 2020), project develops innovative pedagogy focusing on evidence-based practice, communication, and competence development utilising digital methods and tools. Concepts of reflection, values and views are in the forefront to improve palliative care for the future. Important aspects in project development include health promotion, digital competences and digital health literacy skills of professionals, patients, and their caregivers. Project objective is tied to the principles of the European Commission’s (EU) Digital Decade that stresses the importance of placing people and their rights in the forefront of the digital transformation, while enhancing solidarity, inclusion, freedom of choice and participation. In addition, concepts of safety, security, empowerment, and the promotion of sustainable actions are valued. (European Commission: Digital targets for 2030).Through the existing collaboration, strategic focus areas of the partners, and the principles of the call, the PalcNet project consortium was formed by the following partners: JAMK University of Applied Sciences (JAMK ), Ramon Llull University (URL), Hanze University of Applied Sciences (HUAS), Beijing Union Medical College Hospital (PUMCH), Guangzhou Health Science College (GHSC), Beihua University (BHU), and Harbin Medical University (HMU). As project develops new knowledge, innovations and practice through capacity building, finalisation of the consortium considered partners development strategy regarding health care, (especially palliative care), ability to create long-term impact, including the focus on enhancing higher education according to the horizontal priority. In addition, partners’ expertise and geographical location was also considered important to facilitate long-term impact of the results.Primary target groups of the project include partner country’s (China) staff members, teachers, researchers, health care professionals and bachelor level students engaging in project implementation. Secondary target groups include those groups who will use the outputs and results and continue in further development in palliative care upon the lifetime of the project.
In our increasingly global society, organizations face many opportunities in innovation, improved productivity and easy access to talent. At the same time, one of the greatest challenges, businesses experience nowadays, is the importance of social and/or human capital for their effectiveness and success (Backhaus and Tikoo, 2004; Mosley, 2007; Theurer et al., 2018; Tumasjan et al., 2020). High-quality employees are crucial to the competitive strength of an organization in the global economy, as these employees have a major influence on organizational reputation (Dowling at al., 2012). An important question is how, under these global circumstances, organizations and companies in the Netherlands can best be stimulated to attract and preserve social capital.Several studies have suggested the scarcity of talent and the crucial importance of gaining competitive advantage with recruitment communication to find the fit between personal and fundamental organizational characteristics and values for employees (Cable and Edwards, 2004; Bhatnagar and Srivastava, 2008; ManPower Group, 2014; European Communication Monitor (ECM), 2018). In order to become an employer of choice, organizations have to not only stand out from the crowd during the recruitment process but work on developing loyalty and a culture of trust in their relationship with employees (ECM, 2018). Employer Branding focuses on the process of promoting an organization, as the “employer of choice” to a desired target group, which an organization aims to attract and retain. This process encompasses building an identifiable and unique employer identity or, more specifically, “the promotion of a unique and attractive image” as an employer (Backhaus 2004, p. 117; Backhaus and Tikoo 2004, p. 502).One of the biggest challenges in the North of the Netherlands at the moment is the urgent need for qualified labor in the IT, energy and healthcare sectors and the excess supply of international graduates who are able to find a job in the North of the Netherlands (AWVN, 2019). Talent development, as part of the regional labor market and education policy, has been an important part of government programs and strategies in the region (VNO-NCW Noord, 2018). For instance, North Netherlands Alliance (SNN) signed a Northern Innovation Agenda for the 2014-2020 period. SNN encourages, facilitates and connects ambitions focused on the development of the Northern Netherlands. Also, the Social Economic council North Netherlands issued an advice on the labour market in the North Netherlands (SER Noord Nederland, 2017). Knowledge institutions also contribute through employability programs. Another example is the Regional Talent Agreement (Talent Akkoord) framework issued by the Groningen educational institutions, employers and employees’ organizations and regional authorities in which they jointly commit to recruiting, training, retaining and developing talent for the Northern labor market. Most of the hires with a maximum of five year of experience at companies are represented by millennials. To learn what values make an attractive brand for employees in the of the North of the Netherlands, we conducted a first study. When ranking the most important values of corporate culture which matter to young employees, they mention creative freedom, purposeful work, flexibility, work-life balance as well as personal development. Whereas attractive workplace and job security do not matter to such a degree. A positive work environment and a good relationship with colleagues are valued highly (Hein, 2019).To date, as far as we know, no other employer branding studies have been carried out for the North of the Netherlands. Further insight is needed into the role of employer branding as a powerful tool to retain talent in Northern industry in particular.The goal of this study is to provide a detailed analysis of the regional industry in the Northern Netherlands and contribute to: 1) the scientific body of knowledge about whether and how employer branding can strengthen the attractiveness of a regional industry in the labor market; 2) the application of this knowledge and insights by companies and governments in local policy development in the North of the Netherlands.
On a societal scale, the ‘problem with work’ is that everyone is exhausted, job security has been replaced by ‘flex work’ and much important work had been invisibilised. While billions of people are displaced and illegalized from work, others have physical/ mental conditions caused by work. The problem with work merits scrutiny not only from medical, corporate or legal perspectives. It needs tackling without an agenda of productivity, with an open regard and embodied, intuitive research. Artistic research has this scope. It taps into knowledges that are underused/repressed, by involving the body, harnessing intuition, experience and situatedness, and activating a plurality of voices. The aim of this research is to gain a deeper understanding of what is (not) work, who we are when we perform work, and when we don’t or are not able to work. Why are certain activities or roles called work and what happens when the term is applied to activities that are not normally deemed work, but which include comparable elements? Three research questions are addressed: 1. What can be learned about work by regarding every job, or all the work, as a performance? 2. What can be learned about performance (art) by looking at it through the lens of work? 3. What are ethical practices in collaborative and participative work processes? The research is carried out through an artistic approach that contains a particular way of making, teaching and researching which is collaborative, performative and transdisciplinary. It proposes the body as a thinking apparatus, experience as a way of gathering information and doing, writing, exchanging and performing as both method and dissemination. This research aims to contribute to a better understanding of what work is in our lives. The research has social, artistic and educational targets and target groups, which are also intertwined.
