Michele Carminati
email: michele.carminati@polimi.it

Roberto Caron
email: roberto.caron@polimi.it

Federico Maggi
email: federico.maggi@polimi.it

Ilenia Epifani
email: ilenia.epifani@polimi.it

Stefano Zanero
email: stefano.zanero@polimi.it

BankSealer: An Online Banking Fraud Analysis and Decision Support System

Keywords: fraud detection, bank fraud, anomaly detection

We propose a semi-supervised online banking fraud analysis and decision support approach. During a training phase, it builds a profile for each customer based on past transactions. At runtime, it supports the analyst by ranking unforeseen transactions that deviate from the learned profiles. It uses methods whose output has a immediate statistical meaning that provide the analyst with an easy-to-understand model of each customer's spending habits. First, we quantify the anomaly of each transaction with respect to the customer historical profile. Second, we find global clusters of customers with similar spending habits. Third, we use a temporal threshold system that measures the anomaly of the current spending pattern of each customer, with respect to his or her past spending behavior. As a result, we mitigate the undertraining due to the lack of historical data for building of well-trained profiles (of fresh users), and the users that change their (spending) habits over time. Our evaluation on real-world data shows that our approach correctly ranks complex frauds as "top priority".

Introduction

The popularity of Internet banking has led to an increase of frauds, resulting in substantial financial losses [START_REF] Wei | Effective detection of sophisticated online banking fraud on extremely imbalanced data[END_REF][START_REF] Bolton | Statistical fraud detection: A review[END_REF]. Banking frauds increased 93% in 2009-2010 [START_REF] Fossi | Symantec Internet Security Threat Report trends for[END_REF], and 30% in 2012-2013 [START_REF] Haley | Internet Security Threat Report[END_REF].

Internet banking frauds are difficult to analyze and detect because the fraudulent behavior is dynamic, spread across different customer's profiles, and dispersed in large and highly imbalanced datasets (e.g., web logs, transaction logs, spending profiles). Moreover, customers rarely check their online banking history such regularly that they are able to discover fraud transactions timely [START_REF] Wei | Effective detection of sophisticated online banking fraud on extremely imbalanced data[END_REF].

We notice that most of the existing approaches build black box models that are not very useful in manual investigation, making the process slower. In addition, those based on baseline profiling are not adaptive, also due to cultural and behavioral differences that vary from country to country. Instead of focusing on pure detection approaches, we believe that more research efforts are needed toward systems that support the investigation, and we had the unique opportunity to work on a real-world, anonymized dataset.

In this paper we propose BankSealer, an effective online banking semisupervised decision support and fraud analysis system. BankSealer automatically ranks frauds and anomalies in bank transfer transactions and prepaid phone and debit cards transactions. During a training phase, it builds a local, global, and temporal profile for each user. The local profile models past user behavior to evaluate the anomaly of new transactions by means of a novel algorithm that uses the Histogram Based Outlier Score (HBOS). The global profiling clusters users according to their transactions features via an iterative version of Density-Based Spatial Clustering of Applications with Noise (DBSCAN). For this, we use Cluster-Based Local Outlier Factor (CBLOF). This approach allows to handle undertraining, which is particularly relevant for new users, which lack of training data. The temporal profile aims to model transactions in terms of time-dependent attributes. For this, we design a series of thresholds and measure the anomaly in terms of the percentage gap from the thresholds once they are exceeded. We handle the concept drift of the scores with an exponential decay function that assigns lower weights to older profiles.

We tested the BankSealer on real-world data with a realistic ground truth (e.g., credential stealing, banking trojan activity, and frauds repeated over time) in collaboration with domain experts. Our system ranked fraud and anomalies with up to 98% detection rate. Given the good results, a leading Italian bank is deploying a version of BankSealer in their environment to analyze frauds.

In summary, our main contributions are:

a general framework for online semi-supervised outlier-detection based on the marginal distribution of the attributes of the user's transactions. a combination of different models to discover different types of frauds. The scores calculated by BankSealer have a clear statistical meaning, aiding the analyst's activity. Our approach is adaptive to non-stationary sources and can deal with concept drift and data scarcity. -We developed an automatic decision support system for banking frauds, evaluated it in real-world setting, and deployed it to a large national bank.

Online Banking Fraud Detection: Goals and Challenges

Our goal is to support the analysis of (novel) frauds and anomalies by analyzing bank transfer logs, prepaid cards and phone recharges. From an analysis of the literature (summarized in §6) and a real-world dataset obtained from a large national bank (described in §4.1), we found peculiar characteristics that make the analysis of these datasets particularly challenging: skewed and unbalanced distribution of the attribute values, high number of nominal attributes, high cardinality associated with some of attributes (e.g., IP and IBAN take several thousands of distinct values). We also noticed the prevalence of users who perform a low number of transactions-an issue not considered in the literature.

Given the scarcity of labeled datasets, such a system must be able to work in an unsupervised or semi-supervised fashion. This conflicts with the requirement of the system being able to provide "readable" evidence to corroborate each alert. These peculiarities have remarkable implications for the typical statistical and data mining methods used in the outlier detection field.

Approach and System Description

BankSealer characterizes the users of the online banking web application by means of a local, a global and a temporal profile, which are built during a training phase. As depicted in Fig. 1, the training phase takes as input a list of transactions. As summarized in Tab. 1 we take into account three types of transactions. Each type of profile (i.e., local, global, temporal) extracts different statistical features from the transaction attributes (e.g., average, minimum, maximum, actual value), according to the type of model built.

BankSealer works both under semi-supervised and unsupervised assumptions by using a sample of the unlabeled dataset as training data. In the first case, the assumption is that the training data contains only legitimate transactions. In the second case, which is more realistic, the assumption is that the training dataset contains frauds, although these are a minority. As shown by [START_REF] Chandola | Anomaly detection: A survey[END_REF][START_REF] Noto | FRaC: a feature-modeling approach for semisupervised and unsupervised anomaly detection[END_REF], we can safely assume that the data in input contains frauds but, due to the fact that they are rare, the learned model is unbiased.

Once the profiles are built, BankSealer processes new transactions and ranks them according to their anomaly score and the predicted risk of fraud. The anomaly score quantifies the statistical likelihood of a transaction being a fraud w.r.t. the learned profiles. The risk of fraud prioritizes the transactions by means of anomaly score and amount.

BankSealer is not a classifier: It provides the analysts with a ranked list of fraudulent transactions, along with the anomaly score of each user. Top-ranked transactions have higher priority. As described in §1, the rationale behind this design decision is that analysts must investigate reported alerts in any case: Therefore, the focus is on collecting and correctly ranking evidence that support the analysis of fraudulent behavior, rather than just flagging transactions.

Local Profiling

The goal of this profiling is to characterizes each user's individual spending patterns. During training, we aggregate the transactions by user and approximate each feature distribution by a histogram. More precisely, we calculate the empirical marginal distribution of the features of each user's transactions. This representation is simple, readable and effective. At runtime, we calculate the anomaly score of each new transaction using the HBOS [START_REF] Goldstein | Histogram-Based Outlier Score (HBOS): A Fast Unsupervised Anomaly Detection Algorithm[END_REF] method. The HBOS computes the probability of a transaction according to the marginal distribution learned. As described in §3.1, we improved the HBOS to account for the variance of each feature and to allow the analyst to weight the features differently according to the institution's priorities.

Training and Feature Extraction. The features are the actual values of all the attributes listed in Tab. 1. During training we estimate the marginal distribution of each feature using uni-variate histograms in a way similar to what is done in HBOS [START_REF] Goldstein | Histogram-Based Outlier Score (HBOS): A Fast Unsupervised Anomaly Detection Algorithm[END_REF][START_REF] Yamanishi | On-Line Unsupervised Outlier Detection Using Finite Mixtures with Discounting Learning Algorithms[END_REF][START_REF] Noto | FRaC: a feature-modeling approach for semisupervised and unsupervised anomaly detection[END_REF]. However, we do not consider correlation between features in order to gain lower spatial complexity and better readability of the histograms. Uni-variate histograms are indeed directly readable by analysts who get a clear idea of the typical behavior by simply looking at the profile. In addition, they easily allow to compute the anomaly score as the sum of the contributions of each feature, giving an intuitive justification of the resulting anomaly score. For categorical attributes (e.g., IP, CC), we count the occurrences of each category. For numerical attributes (e.g., Amount, timestamp) we adopt a static binning and count how many values falls inside each bin. After this, we estimate the marginal frequency of the features, computing the relative frequency.

Runtime and Anomaly Score Calculation. We score each new transaction using HBOS [START_REF] Goldstein | Histogram-Based Outlier Score (HBOS): A Fast Unsupervised Anomaly Detection Algorithm[END_REF]. It considers the relative frequency of each bin to quantify the log-likelihood of the transaction to be drawn from the marginal distribution. In other words, for each feature t i of the transaction t we calculate log 1 histi(ti) , where hist i indicates the frequency of the i-th feature. The resulting values are summed to form the anomaly score HBOS i (t). The logarithm makes the score less sensitive to errors caused by floating point precision. To account for the higher relevance of frauds in high-amount transactions, we multiply the anomaly score by the transaction amount.

Feature Normalization, Weighting and Rare Values. One of the main drawbacks of the original HBOS is that it does not take into account the variance of the features. For example, if Alice typically uses the banking web application from 5 distinct IPs and Bob from 2, the HBOS for Alice would be much lower than the HBOS for Bob. However, their activity is equally legitimate. To avoid this problem we apply a min-max normalization [9, pp. 71-72] to the histogram, where the minimum is zero, and the maximum is the highest bin.

In addition to the normalization, we added a weighting coefficient w i to each feature to allow the analyst to tune the system according to the institution's priorities. In our experiments, however, we fixed all the weights at 1, except for IP and IBAN, which were fixed at 0.5 because of their high variance.

When a feature value has never occurred during training for a user (i.e., zero frequency within the local profile), the respective transaction may be assigned a high anomaly score. However, a user may have just changed his spending habits legitimately, thus causing false positives. To mitigate this, we calculate the frequency of unseen values as k/1 -f , where f is the frequency of that value calculated within a particular cluster, if the global profiling is able to find a cluster for that user. Otherwise, f is calculated on the entire dataset. This method quantifies the "rarity" of a feature value with respect to the global knowledge. The parameter k is an arbitrarily small, non-zero number. In our experiments we set it to 0.01.

Profile Updating. We update the histograms using an exponential discount factor, expressed in terms of the time window W and its respective sampling frequency. Every month we recursively count the values of the features in the previous months discounted by a factor λ = e -τ /W , where W = 365 days (up to 1 year). The rationale is that business activities are typically carried out, throughout an entire year, with a monthly basis. The parameter τ /W influences the speed with which the exponential decay forgets past data. In our case we empirically we set τ = 5, because it seemed to best discount past data with respect to time and sampling windows.

Undertrained and New Users. An undertrained user is a user that performed a low number of transactions. In BankSealer this value is a parameter, which empirically we set at T = 3 as this is enough to get rid of most of the false positives due to undertraining.

For undertrained users, we consider their global profile (see §3.2) and select a cluster of similar users. For each incoming transaction, our system calculates the anomaly score using the local profile of both the undertrained user and the k nearest neighbor users (according to the Mahalanobis distance as detailed in §3.2). For new users, we adopt the same strategy. However, given the absence of a global profile, we consider all the users as neighbors.

Global Profiling

The goal of this profiling is to characterize "classes" of spending patterns. During training, we first create a global profile for each user. Then, we cluster the resulting profiles using an iterative version of the DBSCAN. Finally, for each global profile we calculate the CBLOF score, which tells the analyst to what extent a user profile is anomalous with respect to its closest cluster. The global profile is also leveraged to find local profiles for undertrained or new users. The rationale is that users belonging to the same cluster exhibit spending patterns with similar local profiles.

Training and Feature Extraction. Each user is represented as a feature vector of six components: total number of transactions, average transaction amount, total amount, average time span between subsequent transactions, number of transactions executed from foreign countries, number of transactions to foreign recipients (bank transfers dataset only). To find classes of users with similar spending patterns, we apply an iterative version of the DBSCAN, using the Mahalanobis distance [START_REF] Mahalanobis | On the generalized distance in statistics[END_REF] between the aforementioned vectors.

To mitigate the drawbacks of the classic DBSCAN when applied to skewed and unbalanced datasets such as ours (i.e., one large cluster and many small clusters), we run 10 iterations for decreasing values of ε from 10 to 0.2, which is the maximum distance to consider two users as connected (i.e., density similar). High values of this parameters yield a few large clusters, whereas low values yield many small clusters. At each iteration, we select the largest cluster and apply DBSCAN to its points with the next value of ε. The smaller clusters at each iterations are preserved. We stop the iterations whenever the number of clusters exhibits an abrupt increase (i.e., a knee). In all of our experiments, we empirically observed that this happens at 0.2. As a result, we obtain a set of clusters, which contain similar user profiles.

Anomaly Score Calculation and Updating. The global profile is used to assign each user profile a global anomaly score, which tells the analyst how "uncommon" their spending pattern is. For this, we compute the unweighted-CBLOF [START_REF] Amer | Nearest-Neighbor and Clustering based Anomaly Detection Algorithms for RapidMiner[END_REF] score, which considers small clusters as outliers with respect to large clusters. More precisely, the more a user profile deviates from the dense cluster of "normal" users, the higher his or her anomaly score will be. The CBLOF anomaly score is the minimum distance of a user profile from the centroid of the nearest largest cluster. CBLOF takes only two parameters (α and β), which we evaluated empirically by considering as "normal" the 90%-percentile of the user profiles. The clustering is re-run according to the sampling frequency (i.e., 1 month). Moreover, we update the CBLOF anomaly score using an exponential discount, as described in §3.1.

Temporal Profiling

The goal of this profiling is to deal with frauds that exploit the repetition of legitimate-looking transactions over time (e.g., frequent wire transfers of After a first training, updating profiles and anomaly scores is necessary because users may change their spending habits. We use a time window, which size can be easily chosen given the hardware resources available, as show by our experiments. Within such time window, the features of the transactions are aggregated with a daily sampling frequency.

Training and Feature Extraction. For each user, we extract the following aggregated features: total amount, total and maximum daily number of transactions. During training, we compute the mean and standard deviation for each feature, and set a threshold at mean plus standard deviation to classify transactions as anomalous. Undertrained users are excluded from temporal profiling because occasional transactions have a high variance, unsuitable for this kind of analysis. The anomaly scores are updated as in the global profile (i.e., exponential discount to account for evolving spending habits).

Runtime and Anomaly Score Calculation. xAt runtime, according to the sampling frequency, we calculate the cumulative value for each of the aforementioned features for each user. Then, we calculate the delta between each cumulative value and the respective threshold. Positive deltas are summed up to form the anomaly score.

Experimental Evaluation

The goals of our evaluation is to measure (1) the effectiveness and (2) the computational resource requirements of BankSealer in correctly ranking fraudulent transactions never seen before among the top.

Dataset Description and Fraud Scenarios

We obtained 3 months of anonymized data collected from a large national consumer bank between April and June 2013: we used 2 months for training and 1 month for testing, as suggested in [9, pp.359-364].

The dataset consists of 371,137 bank transfers (47,650 users), the money transfers made from any account of the bank to any other account, 54,141 prepaid cards transactions (16,093 users), the transactions to top up credit on prepaid cards, and 34,986 phone recharge transactions (8,415 users), the transactions to refill prepaid cellphone accounts. The dataset is unlabeled, but it contains no known frauds as confirmed by the bank we collaborate with.

The evaluation of BankSealer is particularly difficult because, like any unsupervised analysis tool, it produces novel knowledge. In addition, no frauds were known or reported at the bank in the 3 months of observation. Therefore, we relied on domain experts (bank operators) to enrich our testing dataset with generated frauds based on three fraud scenarios that, based on their experience, well replicate the typical real attacks performed against online banking users. We focus on the most important and challenging fraud schemes nowadays, those driven by banking trojans (e.g., ZeuS, Citadel) or phishing.

Scenario 1: Info stealing. The trojan modifies the login form to deceive the victim into entering an one time password (OTP) along with the login credentials. This information is used by the fraudster to execute a transaction (with a high amount) towards a his account, where the victim never sent money to. We test both the case of the connection coming from a national and foreign IP address. To inject the fraud, we randomly choose a victim from the testing dataset and used a random timestamp for the transaction.

Scenario 2: Transaction Hijacking. The trojan, not the fraudster, hijacks a legitimate bank transfer by manipulating the victim's browser. The challenge is that the connection comes from the victim's computer and IP address. Moreover, we execute the fraudulent transaction within ten minutes from a real one, to emulate a session hijacking.

Scenario 3: Stealthy Fraud. The strategy of the fraudster is to execute a series of low-medium amount transactions, repeated daily for one month during working hours, to better blend in. We analyze three cases (very low, low and medium daily amounts). We use the same number of users of the previous scenarios, each performing 30 fraudulent transaction.

For the bank transfers dataset, the money can be transferred to a national or foreign account, whereas for the phone recharges and prepaid debit cards the money is charged on an unknown card. Tab. 2 shows the amounts for each dataset and scenario.

Evaluation Approach and Metrics

After training, we inject n fraudulent transactions (or users) in the testing dataset. Then, we use the local profiles to rank transactions, and the temporal profiles to rank users, according to the respective anomaly scores. The global profiles are used to mitigate undertraining.

We analyze the top n transactions or users in the ranking, where n is the number of injected transactions (or users). In our case, n accounts for 1% of the testing dataset. Depending on the specific scenario, a fraud may trigger either the local or temporal profile, or both. Either way, thanks to the presence of both profiling, the analyst is able to notice the fraud. We count as true positives the number of fraudulent transactions (or users) in the top n positions, and the remainder ones (to the whole n) are either false positives or negatives. The overall results are summarized in Fig. 2. BankSealer outperforms the state of the art. For instance, [START_REF] Wei | Effective detection of sophisticated online banking fraud on extremely imbalanced data[END_REF] detects up to 60-70% of the frauds with an unreported precision. Remarkably, the effect of undertraining is negligible.

Experiment 1: Well-trained Users. We first tested BankSealer without the noise due to non well-trained users (i.e., we removed users with less than 3 transactions from the dataset). All test are repeated 10 times and the results are averaged to avoid biases.

As Tab. 3 shows, the combination of local and temporal profiles guarantees that frauds are ranked high at either transaction level, thanks to the local profiles, or user level, thanks to the temporal profile.

The results on the information stealing frauds (Scenario 1) are very promising. Transaction hijacking frauds (Scenario 2) are particularly challenging, because the malware does not alter the overall amount of transactions performed: leverages existing transactions by diverting them to a different recipient. The IP address is one of those usually used by the user and, in the case where the recipient fraudulent account is national, these transactions blend in quite easily. It is likely that with more training data these features will become more significant. However, even for this last case, thanks to the temporal profile anomaly score BankSealer correctly ranked 58% of the frauds, up to 89% in the case of the phone recharges dataset. Indeed, if we consider the action of refilling phones or prepaid cards, we expect users to do this only towards a few fixed numbers or cards. This means that a recharge towards an unknown phone number or card is always anomalous, even if the transaction amounts is low and the IP address of the connection is one of those commonly used by the user.

Stealthy frauds (Scenario 3) are also challenging: the local profile performs well when the recipient account is foreign, or with phone recharge and prepaid card frauds. Interestingly, stealthy frauds involving very low amounts (50-100e) are correctly ranked better than transactions involving low amounts (100-500e). The reason is because the very-low amounts are rarer in the dataset, and thus obtain higher anomaly scores.

Experiment 2: Undertrained and New Users. We evaluated the capabilities of the global profile to lookup a good replacement local profile for undertrained and new users. We proceeded similarly to what we did in the previous experiment, injecting 1% of fraudulent transactions, but we spread the injections evenly across well trained, undertrained, and new users.

Tab. 4 summarizes the percentage of correctly ranked transactions overall, for well-trained users only, for undertrained uses only, and finally for new users only. Performance is similar to the previous experiment, even if the percentage of correctly ranked frauds are obviously a little lower due to the additional noise.

The fact that undertrained sometimes obtain better ranking than well-trained users, especially when in the attack scenario the frauds are masked to be similar to common transactions, is an artifact due to the fact that in undertrained users' profiles even frauds designed to appear as legitimate transactions can receive a high score if the (few) transactions already observed for them are very different from the injected ones. Frauds injected in new users, instead, are ranked incorrectly when are designed to be similar to legitimate transactions. This is due to the fact that, for new users, transactions are tested against the average profile of all transactions in the dataset, and thus transaction with common attributes will receive low scores.

In the experiments on the phone recharges dataset, we obtain a slightly lower percentage of correctly ranked frauds than those in Tab. 3. On the other hand, for the stealthy fraud (Scenario 3) the percentages are considerably lower. A factor is the huge number of undertrained users in the phone recharges dataset (2,932 transactions for well trained users vs. 11,505 transactions in total). Similar considerations hold for the prepaid cards dataset, in particular for the higher percentage of correctly ranked frauds with undertrained users.

Experiment 3: Performance and Resource Requirements. To test the performance of BankSealer, we measured both the computational requirements at runtime (as this is a constraint for the practical use of the system in production), and peak memory requirements at training time (as this is a constraint on the dimension of the dataset that can be handled). For computational power requirements, we tested the time to analyze one day and one month of data, both with and without the handling of undertrained and new users explained in §3.1. Our experiments have been executed on a desktop-class machine with a quad-core, 3.40Ghz Intel i5-3570 CPU, 8GB of RAM, running Linux 3.7.10 x86 64. Processing times are taken using the time library. The results are listed in Tab. 5. As we can see, the processing time varies on the basis of the context being tested, and there is a significant difference induced by the handling of undertrained/new users. In production BankSealer will analyze transactions day by day. Therefore, the maximum time required would be 4 minutes per day for the bank transfers context. In conclusion, we believe that BankSealer could be suitable for online fraud monitoring.

We tested the scalability of the system by measuring the RAM consumption at training time, which is the most memory-intensive phase. We used the bank transfers dataset, the largest one. We relied on memory-profiler and psutil . As Fig. 3 shows, the peak RAM consumption increases linearly with the number of days and quadratically with the number of users. This is expected, as the most memory-intensive data structure is the distance matrix, a square matrix of the size of the number of users.

Discussion

The main barrier in this research field is the lack of publicly available, real-world frauds and a ground truth for validation. Indeed, we had to resort to synthetically generated frauds. The absence of non-anonymized text fields does not allow us to analyze, for instance, their semantics. In future extensions, BankSealer will compute the models on the bank side and export privacy-preserving statistics for evaluation.

The prototype is also constrained by the RAM consumption of the clustering phase. This technical limitation can be mitigated in two possible ways. First, a triangular data structure to store the distance matrix. Second, a parallel version of DBSCAN [START_REF] Xu | A Fast Parallel Clustering Algorithm for Large Spatial Databases[END_REF], which splits the dataset on multiple machine. Fraud detection, mainly focused on credit card fraud, is a wide research topic, for which we refer the reader to [START_REF] Chandola | Anomaly detection: A survey[END_REF][START_REF] Phua | A Comprehensive Survey of Data Mining-based Fraud Detection Research[END_REF][START_REF] Bolton | Statistical fraud detection: A review[END_REF].

Limiting our review to the field to banking fraud detection, supervised approaches based on contrast patterns and contrast sets (e.g., [START_REF] Bay | Detecting Group Differences: Mining Contrast Sets[END_REF]) have been applied. Along a similar line [START_REF] Aggelis | Offline Internet Banking Fraud Detection[END_REF] proposed a rule-based Internet banking fraud detection system. The proposed technique does not work in real time and thus is profoundly different from ours. Also, supervised techniques require labeled samples, differently from BankSealer.

The unsupervised approach presented in [START_REF] Wei | Effective detection of sophisticated online banking fraud on extremely imbalanced data[END_REF] is interesting as it mitigates the shortcomings of contrast pattern mining by considering the dependence between events at different points in time. However, [START_REF] Wei | Effective detection of sophisticated online banking fraud on extremely imbalanced data[END_REF] deals with the logs of the online banking web application, and thus does not detect frauds as much as irregular interactions with the application. Among the unsupervised learning methods, [START_REF] Mhamane | Internet banking fraud detection using HMM[END_REF] proposed an effective detection mechanism to identify legitimate users and trace their unlawful activities using Hidden Markov Model (HMM)s. [START_REF] Kovach | Online banking fraud detection based on local and global behavior[END_REF] is based on an unsupervised modeling of local and global observations of users' behavior, and relies on differential analysis to detect frauds as deviations from normal behavior. This evidence is strengthened or weakened by the users' global behavior. The major drawback of this approach is that the data collection must happen on the client side, which makes it cumbersome to deploy in large, real-world scenarios. In general, a major difference between existing unsupervised and semi-supervised approaches and BankSealer is that they do not give the analyst a motivation for the analysis results, making manual investigation and confirmation more difficult.

Conclusions

BankSealer is an effective online banking semi-supervised and unsupervised fraud and anomaly detection approach, with which we implemented a decision support system developed in close collaboration with a large national bank, which deployed it in a pilot project. Even with the strict requirements typical of banking scenarios (e.g., anonymized datasets), we showed that it is possible to create a decision support system that helps the analyst understanding the reasons behind frauds.

Most of the future works that aim to overcome BankSealer's limitations require more detailed datasets, which are often difficult to obtain due to privacy restrictions. Some examples are the semantic analysis of the text attributes, improvements of the temporal profile, and the estimation of the number of transactions required to fully train a profile.

A short-term work is to consider the feedback given by the analyst, which however requires careful evaluation because of the possible biases that an analyst may introduce. To this end, we currently deployed BankSealer in a real world environment, to collect the feedback of banking analysts on the detected anomalies.

Figure 1 :

 1 Figure 1: BankSealer architecture.

Figure 3 :

 3 Figure 3: RAM requirements for increasing values of W (left) and users profiled (right).

Table 1 :

 1 List of attributes for each type of transaction. "CC ASN" is the country code of the autonomous system of the client's IP. "Card type" takes values such as "Mastercard" or "VISA". Attributes in bold are hashed for anonymity needs.

	Dataset	Attributes
	Bank Transfers Amount, CC ASN, IP, IBAN, IBAN CC, Timestamp, Recipient
	Phone recharges Amount, CC ASN, IP, Phone operator, Phone number, Timestamp
	Prepaid Cards Amount, Card type, Card number, CC ASN, IP, Timestamp

Table 2 :

 2 Amount transferred for each dataset and scenario.amounts that not violating the local or global profile). We construct a temporal profile for each user having a sufficient amount of past transactions. During training, we aggregate the transactions of each user over time and calculate the sample mean and variance of the numerical features. These are used as thresholds during runtime to calculate the anomaly score as the delta.

	Fraud scenario	Amount transferred (e)
		Bank transfers Phone recharges Prepaid cards
	1: Information Stealing	10,000-50,000	250-255	750-1,000
	2: Transaction Hijacking	10,000-50,000	250-255	750-1,000
	3: Stealthy Fraud very low amount	50-100	5-10	50-100
	low amount	100-500	10-25	100-250
	medium amount	500-1,000	25-50	250-500

Table 3 :

 3 Experiment 1 results on transactions and users. Blank cells indicate inapplicable dataset-scenario combinations (e.g., phone recharge transactions have no IBAN, phone recharge or prepaid card transactions are only nation-wise).

	Fraud scenario			Correctly ranked frauds (%)
			Bank transfers Phone recharges Prepaid cards
			Transactions	Users	Transactions	Users	Transactions	Users
	1: Information Stealing		foreign IP and IBAN 98	57	96	87	95	68
	foreign IP, national IBAN 91	57
	national IP, foreign IBAN 98	57	87	95	67	96
			national IP and IBAN 91	57
	2: Transaction Hijacking	foreign 75	58
			national 22	58	83	89	71	77
	3: Stealthy Fraud	foreign, very low amount 73	64
			foreign, low amount 68	67
		foreign, medium amount 69	73
	national, very low amount 42	64	64	97	99	93
			national, low amount 37	67	94	99	92	97
	national, medium amount 42	72	95	99	94	98

Table 4 :

 4 Experiment 2 results on well-trained, undertrained, new users only, and overall. As in Tab. 3, blank cells indicate inapplicable dataset-scenario combinations.

	Fraud scenario				Correctly ranked frauds (%)
			Bank transfers Phone recharges Prepaid cards
			Overall	Well trained	Undertrained	New	Overall	Well trained	Undertrained	New	Overall	Well trained	Undertrained	New
	1: Information Stealing		foreign IP and IBAN 96 98 99 92 80 99 99	43 80 85 94 59
	foreign IP, national IBAN 75 81 95 52
	national IP, foreign IBAN 95 97 93 88 76 97 100 29 73 81 96 42
			national IP and IBAN 73 84 93 41
	2: Transaction Hijacking	foreign 63 43 91 51
			national 24 13 57 3 40 29 83	6
	3: Stealthy Fraud	foreign, very low amount 52 40 91 22
			foreign, low amount 56 38 92 39
		foreign, medium amount 61 42 93 49					32 18 73 6
	national, very low amount 27 13 68 1 16 3 42	4	56 45 94 28
			national, low amount 29 14 71 2 19 5 51	0	59 40 91 47
	national, medium amount 34 19 78 3 19 2 56	0	72 64 94 59

Table 5 :

 5 Computation time required at runtime under various conditions. In the typical use case, the system works on a daily basis, thus requiring 6 minutes (worst case).

	Testing interval		Elapsed time
		Bank transfers Phone recharge Prepaid cards
	1 day, no undertrained/new users	1 00	0 18	0 07
	1 day, undertrained/new users	4 00	0 24	0 10
	1 month, no undertrained/new users	6 00	0 30	0 12
	1 month, undertrained/new users	93 00	2 30	1 00

Acknowledgements

The research leading to these results has received funding from the European Union Seventh Framework Programme (FP7/2007-2013) under grant agreement n 257007, as well as from the TENACE PRIN Project (n. 20103P34XC) funded by the Italian Ministry of Education, University and Research.


Lena Connolly
email: y.connolly1@nuigalway.ie

Michael Lang

Managing Employee Security Behaviour in Organisations: The Role of Cultural Factors and Individual Values

Keywords: Information Security, Information Security Culture, Organisational Culture, National Culture, Employee Behaviour, Individual Values

An increasing number of information security breaches in organisations presents a potentially serious threat to the privacy and confidentiality of personal and commercially sensitive data. Recent research shows that human beings are the weakest link in the security chain and the root cause of a great portion of security breaches. In the late 1990's, a new phenomenon called "information security culture" has emerged as a measure to promote security-cautious behaviour of employees in organisational settings. The concept of information security culture is relatively new and research on the subject is still evolving. This research-in-progress paper contributes to our understanding of this very important topic by offering a conceptualisation of information security culture. Additionally, this study indentifies factors that instigate adverse employee behaviour in organisations.

Introduction

With the arrival and the widespread of the Internet and the personal computer, the Information Age has swiftly replaced the era of industrialisation and the knowledgedriven economy transformed the way various industries run their operations. The automobile industry is an obvious illustration of this shifta new car today is less and less a manufacturing product and more a smart machine that uses computer technology to combine safety, emissions, entertainment and performance. Technological advances rely on knowledge, and knowledge turns into information once it is shared. Therefore, information is a valuable asset for a lot of organisations.

As online presence has also developed into a key business value, many companies have been pushed to move their operations on the Web along with this information, stored and managed by computerised information systems.

While online presence entails a myriad of benefits such as reduced costs and an extended customer base, major risks are involved, including the potential loss or violation of vital information. Protecting these assets is the highest ranked priority for many businesses as their very existence depends on certain information. The consequences of lost information may vary from a breach of privacy for customers to complete disruption of business operations for organisations. While information predators have become more sophisticated, many legitimate businesses are either not aware or neglect the fact that the consequences of an information security breach can be rather dramatic. A recent attack on Loyaltybuild, a company that manages customer loyalty schemes across Europe, is an evident example of negligence. Attackers exploited enormous weaknesses in Loyaltybuild's security system, leading to the loss of personal information of more than 1.5 million customers. As was revealed later, the company kept sensitive information in an unencrypted form [START_REF] Pope | Over 1.5 million affected by Ennis data breach[END_REF].

A number of critical measures to manage information security breaches in organisations have been highlighted within the literature, including reliable internal processes and good corporate governance as well as technical and socio-cultural measures [START_REF] Da Veiga | A framework and assessment instrument for information security culture[END_REF]. Historically the use of technical controls has prevailed over sociocultural solutions in organisational settings. However, in the late 1990s, Information Systems (IS) researchers have brought attention to the latter because technical controls are powerless to manage all types of security violations. For instance, a technical control is unable to prevent employees from writing passwords down. Besides, empirical studies show that although businesses are spending more on technology-based solutions, the number of information security breaches is actually on the rise [START_REF] Solms | Information Security -The Third Wave?[END_REF].

In the late 1990's, the new concept of Information Security Culture (ISC) has emerged as a measure that promotes security-cautious behaviour of staff [START_REF] Lim | Exploring the Relationship between Organizational Culture and Information Systems Security Culture[END_REF]. In a general sense, ISC can be defined as the "behaviour in an organisation that contributes to the protection of data, information and knowledge" [START_REF] Kuusisto | Information security culture in small and medium size enterprises[END_REF]. A more comprehensive definition of ISC is that put forward by da Veiga and Eloff [START_REF] Da Veiga | A framework and assessment instrument for information security culture[END_REF] as: "attitudes, assumptions, beliefs, values and knowledge that employees/stakeholders use to interact with the organisation's systems and procedures at any point in time".

Since its arrival, research on the topic of ISC has rapidly expanded. A great number of ISC theories and assessment instruments have been developed by IS scholars. ISC has been described using theories adapted from various disciplines including psychology [START_REF] Boss | If Someone Is Watching, I'll Do What I'm Asked: Mandatoriness, Control, and Information Security[END_REF], economics [START_REF] Van Niekerk | Information security culture: A management perspective[END_REF], behavioural sciences [START_REF] Ajzen | Attitudes, Personality, and Behavior[END_REF] and management [START_REF] Ray | Corporate Culture: The Last Frontier of Control?[END_REF]. Most commonly, ISC has been explained using organisational culture theories, Schein's [START_REF] Schein | Organizational Culture and Leadership: The Dynamic View[END_REF] model been the most predominant [START_REF] Da Veiga | A framework and assessment instrument for information security culture[END_REF].

Although prior research on ISC greatly contributes to the body of IS research, a number of areas require further investigation [START_REF] Lim | Exploring the Relationship between Organizational Culture and Information Systems Security Culture[END_REF][START_REF] Malcomson | What is security culture? Does it differ in content from general organisational culture?[END_REF]. In particular, there is little information about what constitutes or conceptualises security culture [START_REF] Alnatheer | Understanding and measuring information security culture[END_REF]. A literature review conducted in the course of this research also has revealed a dearth of quantitative studies in the area of ISC. Furthermore, prior research in the information security area demonstrates that studies that include organisational culture generally lack strong theoretical foundations for linking organisational culture values to information security outcomes [START_REF] Hu | Managing employee compliance with information security policies: The critical role of top management and organizational culture[END_REF]. Moreover, Dinev et al. [START_REF] Dinev | User behaviour towards protective information technologies: the role of national cultural differences[END_REF] point out to the lack of cross-cultural research in the IS field. This research-in-progress paper aims to address the aforementioned research gaps and accomplish the following objectives:

1. Identify the factors that impact upon employee behaviour with regards to information security in organisational settings using an exploratory research approach. 2. Test the relationships between these factors and employee security behaviour using a confirmatory research approach. This paper is organised as follows. We first present a theoretical framework that guides this study followed by a definition of culture adopted in this research. This is followed by research methodology and preliminary results of qualitative data analysis. The paper then wraps up by outlining future research directions, and alluding to some of the limitations and challenges that lie ahead for us.

Theoretical Framework

We submit that various cultural aspects should be taken in consideration when studying adverse behaviour of employees in organisational settings. Numerous national and organisational culture scholars have demonstrated the effect of cultural aspects on human behaviour. For example, Hofstede [START_REF] Hofstede | Culture's Consequences: International Differences in Work-related Values[END_REF] compares culture with an onion consisting of multiple layers; values are the inner layer of the onion and the core element of culture. They are invisible until they become evident in behaviour. Furthermore, Hofstede [START_REF] Hofstede | Culture's Consequences: International Differences in Work-related Values[END_REF] and Spector [START_REF] Spector | Behavior in Organizations as a Function of Employee's Locus of Control[END_REF] demonstrate a connection between national culture values and employees' compliance with authority and organisational policies and rules. Typically, organisational culture researchers define culture as a "set of shared values, beliefs, assumptions and practices that shape and direct members attitude and behaviour in the organisations" [4, p.88]. Kilmann [START_REF] Kilmann | Managing Your Organization's Culture[END_REF] describes culture as a separate and hidden force that controls behaviours and attitudes in organisations. A study conducted by Porter and McLaughlin [19] further demonstrates the significant role that organisational climate plays in shaping employee behaviour.

The notion of ISC culture has been also linked to human behaviour. For instance, Kraemer and Carayon [START_REF] Kraemer | Computer and Information Security Culture: Findings from Two Studies[END_REF] stress that ISC emerges from the way in which people behave towards information and the security thereof. In particular, ISC influences behaviour in such a way that employees develop "good" practices based on security standards and policies of a particular organisation. Schlienger and Teufel [START_REF] Schlienger | Information security culture: The socio-cultural dimension in information security management[END_REF] emphasise the importance of establishing ISC as important measure to address the "human error" factor.

We propose a theoretical model that combines De Long and Fahey's taxonomy of organisational culture [START_REF] De Long | Diagnosing cultural barriers to knowledge management[END_REF], Wallach's organisational culture model [START_REF] Wallach | Individuals and Organizations: The Cultural March[END_REF], Hofstede's original taxonomy of national culture [START_REF] Hofstede | Culture's Consequences: International Differences in Work-related Values[END_REF] and Schwartz's Theory of Motivational Types of Values [START_REF] Schwartz | Universals in the content and structure values: Theoretical advances and empirical tests in 20 countries[END_REF] as presented in Figure 1. In IS research, organisational and national culture have been predominantly measured in terms of values [START_REF] Leidner | Review: A review of culture in information systems research: Toward a theory of information technology culture conflict[END_REF]. Following Leidner and Kayworth's catalogue of organisational and national culture taxonomies [START_REF] Leidner | Review: A review of culture in information systems research: Toward a theory of information technology culture conflict[END_REF], a variety of cultural frameworks has been examined in order to choose appropriate models for this research. Wallach's comprehensive framework of organisational culture [START_REF] Wallach | Individuals and Organizations: The Cultural March[END_REF] was selected to form the organisational culture part of our model. Wallach identified and defined three distinct organisational cultures, -bureaucratic, innovative and supportive, -covering almost all the values outlined by Leidner and Kayworth [START_REF] Leidner | Review: A review of culture in information systems research: Toward a theory of information technology culture conflict[END_REF]. Additionally, Wallach's model has been adapted in quantitative [START_REF] Lincoln | Naturalistic Inquiry[END_REF] as well as cross-cultural [START_REF] Lok | The effect of organisational culture and leadership style on job satisfaction and organisational commitment: A cross-national comparison[END_REF] studies in IS research. Wallach's Organisational Culture Index will be used in this research to measure organisational culture.

To date, Hofstede's taxonomy of cultural values [START_REF] Hofstede | Culture's Consequences: International Differences in Work-related Values[END_REF] has been the most popular conceptualisation of national culture. Hofstede defines culture in terms of four values power distance, uncertainty avoidance, individualism-collectivism and masculinityfemininity. Hofstede's scores of cultural values will be used as the measure of culture because they have been subject to more checks of internal validity, external validity and reliability than the measures used in any other cross-cultural study. Additionally, Hofstede's research is the largest study of cultural values ever undertaken both in terms of number of countries and number of respondents [START_REF] Shane | Cultural Differences in Innovation Championing Strategies[END_REF]. National culture needs to be considered in terms of its impact on organisations and also individuals.

To test the influence of individual values on behaviour with regards to information security, the Theory of Motivational Types of Values by Schwartz [START_REF] Schwartz | Universals in the content and structure values: Theoretical advances and empirical tests in 20 countries[END_REF] was chosen. Schwartz's model is viewed as the most comprehensive approach, covering 56 values grouped into 10 categories. The Theory of Motivational Types of Values demonstrates strong generalisability as it has been successfully tested in more than 60 countries [START_REF] Myyry | What Levels of Moral Reasoning and Values Explain Adherence to Information Security Rules? An Empirical Study[END_REF].

2.1

Culture

For the purpose of this research, culture is viewed as a phenomenon that can be observed at multiple levels in an organisation. Culture is reflected in three levelsvalues, norms and practices [START_REF] De Long | Diagnosing cultural barriers to knowledge management[END_REF].

At the deepest level, culture consists of values, which are embedded tacit preferences about what the organisation should strive to attain and how it should do so. For instance, if an organisation values customer confidentiality, employees will treat customer information with extra caution by following data protection requirements outlined by this organisation.

Norms generally stem from values, but they are more observable [START_REF] De Long | Diagnosing cultural barriers to knowledge management[END_REF]. For instance, if rules with regards to customer confidentiality are breached, a termination of employment may be a norm in an organisation that puts high emphasis on customer confidentiality.

Practices are the most visible symbols and manifestations of a culture. In the context of information security, this level is related to the implemented security measures and processes [START_REF] Vroom | Towards Information Security Behavioural Compliance[END_REF].

Values, norms, and practices are interrelated: values are revealed in norms that, in turn, shape specific practices. While values shape norms and practices, sometimes managers will change practices and norms in an attempt to reshape values over time. Values, norms and practices directly influence employee behaviour [START_REF] De Long | Diagnosing cultural barriers to knowledge management[END_REF].

Research Methodology

This study follows Clark and Creswell's [START_REF] Clark | The Mixed Methods Reader[END_REF] Sequential Exploratory Mixed Method approach consisting of a qualitative phase to be subsequently followed by a quantitative phase. Data collection for the qualitative phase of this study was carried out using semi-structured interviews. The interview guide was built on Wallach's taxonomy of organisational culture. Additionally, general questions about ISC were asked in order to tease out ISC values. Interview guide topics including corresponding values and questions are demonstrated in Table 1. Overall seven organisations were interviewed, all based within the United States. Initially, we planned to conduct two interviews in each organisationone with an executive and another with an employee to gather various views. However, the subject of information systems security is rather sensitive, therefore access to potential interviewees was restricted. In total, nine interviews were conducted. All interviews were recorded and transcribed using a professional service. To preserve confidentiality, all companies have been assigned aliases when referred to herein.

The methodology adopted for the qualitative phase of this study is based on the constant comparative method according to Maykut and Morehouse [START_REF] Maykut | Beginning Qualitative Research: A Philosophic and Practical Guide[END_REF] who draw on the work of Glaser and Strauss [START_REF] Glaser | The Discovery of Grounded Theory[END_REF] and Lincoln and Guba [START_REF] Lincoln | Naturalistic Inquiry[END_REF] in their development of this methodological framework. "In the constant comparative method the researcher simultaneously codes and analyses data in order to develop concepts; by continually comparing specific incidents in the data, the researcher refines these concepts, identifies their properties, explores their relationships to one another, and integrates them into a coherent explanatory model" [START_REF] Taylor | Introduction to Qualitative Research Methods: The Search for Meanings[END_REF].

Findings

In the first phase of qualitative data analysis, Open Coding, we identified and labeled discrete incidents of data related to cultural values, norms and practices. An example of our coding is shown in Table 2. In further data analysis, the initial codes were grouped into organisational and information security values, norms and practices following De Long and Fahey's taxonomy of organisational culture [START_REF] De Long | Diagnosing cultural barriers to knowledge management[END_REF]. Consistent with Wallach's model of organisational culture [START_REF] Wallach | Individuals and Organizations: The Cultural March[END_REF], eight organisational values have been identified: hierarchy, rule-orientation, pressure, stimulation, sociability, relationships, equality, and drive. In accordance with Schwartz's Theory of Motivational Types of Values, three individual values have been defined: achievement, benevolence, conformity, and self-direction. Additionally, a self-defined classification of Information Security Culture has emerged containing four values: information security (high vs. low), information confidentiality (high vs. low), rule-orientation, and equality. Each of these ISC values are briefly described below, along with examples of how these values are manifested in interview data.

Information Security Culture Taxonomy

Information Security (High). Modern organisations accumulate huge volumes of information including sensitive information. The breach of this information first leads to its exposure and then may result in a breach of privacy and financial losses. Security of a computer-based information system should, by design, protect the confidentiality, integrity, and availability of the system that contains sensitive information [START_REF] Gordon | The Economics of Information Security Investment[END_REF].

CloudSer is a software company that provides cloud and virtualisation software and services. Therefore, protecting customer information is a high priority for this organisation. A Software Engineer of CloudSer was clear about the company's standpoint with regards to information security: "Everybody understands that security is a big concern from a lot of aspects, so I would tend to think they [information security rules] are working … Information security is a central function across the organisation."

RetCo, a company that manages retirement and health plans, also puts high emphasis on information security due to sensitive nature of the information they store. A RetCo Security Officer states: "We use several different levels of rules in the organisation. We have policies that are very high level statements and those are informed by our company values, and then below the policies we have standards. So we have information security standards and privacy standards that we follow, and then underneath that we have specific practices and procedures, and those are very rigid … And then in some cases we have even published and maintained some guidelines on how to do certain things and recommendations on security, not just at work but in the home too, so employees are given information on how to protect themselves at home on information security, and those are more guidelines, of course, because we don't have controls over what people do at home, but we feel that if people are practising good safe practices at home, it's going to translate over at the work environment as well."

Information Security (Low). On the contrary, EducInst, a higher education institution, has a different attitude towards information security. Although the organisation seems to have in place various security measures, e.g. technical controls, education and training, and ISP, information security is not a priority in EducInst. For instance, although ISP exists, employees are not aware of its presence, and education and training is poorly organised. The interviewee commented: "There is a formal set of rules and practices are online, and they're far too detailed to discuss here … [For example, we have] very specific rules about personally identifiable information such as a social security number. Information Confidentiality (High). Understandably, companies that acquire and store confidential information, must prioritise information confidentiality. An unauthorised use and disclosure of confidential data leads to dramatic consequences for individuals and organisations. The goal of confidentiality is to ensure that information is not accessed by an unauthorised person [START_REF] Joshi | Security models for Web-based Applications[END_REF].

CloudSer has a large customer base and retains confidential information of their clients. Keeping this information secure is of most important value as its disclosure may damage companies' ability to run business. A Software Engineer of CloudSer says:

"…any company which is providing software, which other companies rely on or possesses, like details about company, the customers enterprise deployment, you need to value that trust, so you can't break some rules with respect to that. We have 300,000 customers, some of those customers are competitors of the other guys. So let's just hypothetically say I have Pepsi and Coke as my customers, right…I can't tell Pepsi what Coke is doing, I can't tell Coke what Pepsi is doing. So our customers trust us with that information knowing that we might as well be serving Pepsi. So, yeah, there are certain rules that you cannot break without getting fired."

Due to its nature of business, RetCo holds a lot of personally identifiable information (PII). Therefore, information confidentiality is highly prioritised by this organisation as stated by their Security Officer:

"We have security standards and practices around encryption, such as what type of encryption is approved to use in the environment, what has to be encrypted, and to what level, and also how these encryption keys are handled and managed in the organisation. We have policies and practices around physical access to the computer room, and so we have certain levels of access and certain approval processes in place like who can access our protected areas, and what levels of approval have to happen, and we have things in place like not just card key electronic access, but we have things like Iris scanner technology to get in to the computer rooms and things of that nature, and, of course, we've got these practices and procedures and processes that are in place to support that physical access."

Information Confidentiality (Low).

Although EducInst also possesses PII, our informant revealed that this organisation is not particularly concerned about information confidentiality of their customers: "As I said, I think things tend to be fairly casual in terms of protecting people's privacy. For example you know, let me give an example. So protecting credit card numbers, right. So people's credit card numbers are floating all around this organisation. If you were interested in stealing a lot of credit card numbers, it would be so easy to do in this organisation. Again, just because of the casualness with which people treat information … Let me give you an example, at EducInst we are rolling out a new system for paying disbursements. We have a chief privacy officer who is supposed to be in charge of protecting privacy at EducInst. But my secretary was able to use that system to find out things like the Provost's credit card number, or names of all the students who'd been treated for genital warts, or the names of a police officer who had to undergo a psychological help after an incident. She pointed these problems out to the chief privacy officer, and the chief privacy officer could do squat about them … So my point is that we have all the stuff on the book, and there's State laws about it, but it's largely ignored because it's not a value of the organisation."

Equality. CloudSer and RetCo are two companies that emphasise employee input with regards to information security measures. At CloudSer and RetCo, employees are encouraged to provide feedback about information security rules. According to both interviewees, based on employees' comments, rules can be changed. In these organisations everyone has equal voice and ability to speak up regardless of rank or position. It's a highly collaborative and opinionated environment where employees at all levels are easy to approach [START_REF] Wallach | Individuals and Organizations: The Cultural March[END_REF]. A Software Engineer at CloudSer explained that: "For the security measures they bring about, they introduce it to the employees before its roll out, they test it out, and then they take employee feedback to see if it's too intrusive or too restrictive for that matter. So it's generally participative, but I haven't really seen any security measure being repealed because employees do not like it … Generally, people do accept that [security rules are] there for a good reason, unless it's like prohibitively restrictive which it's not the case in my company"

A Security Officer at RetCo adds: "I think a lot of times employees having this open dialogue, they can change the rules by bringing things up. I've seen it happen in the past, where the enterprise will make a decision to lock computers, the keyboards on computers, after a certain amount of time, when the computer is idle, and that's because people may get up and walk away from their computer, and they want to lock the screen and make sure that nobody else can walk by and access the information. So employees feeling empowered to challenge or to at least bring up the issues, have made a lot of changes in their user environments because of that. So, for example, if it's 10 minutes of inactivity and the computer locks, the screen lock, employees have complained and said, 'you know, it's really closer to 20 before we really are not working on it', and so the policies have been changed based upon the use of the users and them providing that feedback."

Rule-orientation. In the rule-oriented organisations, rules are very important and are not allowed to break. These companies are procedural, regulated, and cautious and put high emphasis on following information security policies and procedures [START_REF] Myyry | What Levels of Moral Reasoning and Values Explain Adherence to Information Security Rules? An Empirical Study[END_REF]. A Security Officer at RetCo reveals: "It's not acceptable to break rules in our organisation. Mostly because most of our rules are derived from regulations and laws so that's something that is not normally accepted in the organisation …We use several different levels of rules in the organisation. We have policies that are very high level statements, and those are informed by our company values, and then below the policies we have standards, so information security standards and privacy standards, that we follow, and then underneath that we have specific practices and procedures, and those are very rigid, those are if you're going to do a certain thing, you need to follow a procedure."

A Security Consultant at FinCo adds: "If there is a rule in place, the rule is in place for a reason and you don't break it, you request an exception and you have to talk to the right people to request an exception. So you never just break a rule … The security practices are fairly extensive for SOX and GLBA compliant environment, so we have to be audited for both of those on a yearly basis, although actually we go through audits I think twice a year. And then we have an internal audit office that basically does audits twice a year as well, to make sure that we're going to be able to pass those Federal Mandated Audits … So we pretty much follow best practices that are mandated."

Interpretation and Further Propositions

In most organisations interviewed for this study, employees circumvent information security rules. Following De Long and Fahey's [START_REF] De Long | Diagnosing cultural barriers to knowledge management[END_REF] framework of organisational culture, organisational values, norms and practices have to be aligned and this alignment encourages behaviour that is in accordance with organisational values. However, in companies where dysfunctional behaviour was recorded, our results are inconsistent with De Long and Fahey's framework. For instance, while these organisations put high value on information security, conflicting practices (e.g. lack of education) and norms (e.g. casualness in terms of protecting confidential information, circumventing rules, nobody ever reads policy because it is too big, policy is not taught, rules are hard to implement, and screw-ups are tolerated) were recorded. Based on this analysis, we suggest that: Proposition 1: A misalignment between values, norms and practices leads to employee non-compliance with an organisation's information security rules and practices.

Further analysis revealed that clash of organisational culture values may also lead to employee adverse behaviour. For instance, TechCorp encourages employees to take risks and at the same time puts high emphasis on following procedures. In CivEngCo, higher management enforces hierarchical structure and utilises power and control in managing employees while front-line managers value equality and collaboration. Therefore, whilst employees' various opinions and new ideas are supported by lower level management, executives are resistant to except initiatives and change old processes. As a result, ambitious employees lose motivation and respect for the organisation and circumvent information security rules. Therefore, we propose that: Proposition 2: A conflict between organisational culture values leads to employee non-compliance with an organisation's information security rules and practices.

Moreover, we observed that possibly employees' individual values influence behaviour with regards to information security. For instance, two employees who work for the same organisation and share identical status and nature of work, have different attitude towards information security rules. IT Corp is bureaucratic in nature and enforces religious obedience to procedures which sometimes hurt employees' productivity. Employee 1 is ambitious and hard-working but still accepts the procedure-oriented environment (individual value of conformity). On the contrary, Employee 2 circumvents information security rules because they are too restrictive (individual value of self-direction). Therefore, we conclude that incongruence between organisational and individual values leads to employee non-compliance with security rules and hence, the following proposition is derived: Proposition 3: A conflict between individual values and organsiational values leads to employee non-compliance with an organisation's information security rules and practices.

Conclusions and Future Work

In the literature, human beings have been referred as "the weakest link in the security chain". While the importance of technical controls to prevent the "human error" factor is absolutely undeniable, technology is unable to manage all types of human violations. A socio-cultural approach addresses this problem by having a direct affect on human behaviour. Prior research has emphasised the significance of socio-cultural measures. However, there are areas that require further enquiry. This research-inprogress is an attempt to address a research gap in the area of ISC.

In the next stage of our research, we conduct further qualitative data analysis (based on a European sample, for comparative purposes), and will then develop a survey instrument based on qualitative findings. The original purpose of the qualitative phase is to develop research hypothesis, which then can be tested in the quantitative phase. In the near future, we also to plan extend this research by adding other environments including important emerging digital economies in regions such as East Asia, the Indian subcontinent, Brazil, and the former Easter Bloc. This work may allow us to better model the notion of adversarial behaviour in different regions. Therefore, from the standpoint of information security, this research has potential to make a valuable contribution to theory and practice.

In terms of shortcomings and limitations, studies that involve culture tend to be rather complex. As Straub et al. [START_REF] Straub | Toward a theory-based measurement of culture[END_REF] put it, "culture has always been a thorny concept and an even thornier research construct". Furthermore, studies that include several cultural aspects tend to be even more complex. In particular, it may be hard to separate effects of national and organisational cultures in organisational settings due to similar characteristics. For example, hierarchy in an organisation can be a result of a bureaucratic culture of this organisation or a societal norm of the country where this organisation is located. Quantifying the concept of culture is another challenge that is anticipated in this project. In order to measure culture in a meaningful way, a value-based approach will be employed. Taking in consideration the aforementioned complexities, we would therefore welcome feedback and suggestions from other researchers who may have encountered this same difficulty or are contemplating similar avenues of enquiry.

Fig. 1 .

 1 Fig. 1. Theoretical framework.

Table 1 .

 1 Interview guide topics

	Topics	Values	Examples of questions
	Information Security	unknown	What information security values are
	Culture values, norms and practices		promoted in your organisation? In your opinion how well confidential information is protected in your
			organisation?
	Orientation to rules Procedural, regulated,	Is it acceptable to break rules in your
		cautious	organisation?
	Hierarchy vs.	Hierarchical, power-oriented,	Is it common in your organisation to
	Equality	equality, collaboration, ordered, structured vs.	socialise with management?
		personal freedom
	Competitive	Driving, challenging,	Is competition between colleagues

Table 2 . Interview guide topics Example excerpt from interview at RetCo, October 2012 Open Coding We

 2 use several different levels of rules in the organisation. We have policies that are very high level statements and those are informed by our kind of company values and then we have below the policies we have standards, so information security standards and privacy standards, that we follow and then underneath that we have specific practices and procedures and those are very rigid, those are if you're going to do a certain thing you need to follow a procedure and those are all published and accessible to all of our employees on an intranet website so there's no question about if people want to learn how to do something or learn what those are that's readily available in addition of training that informs employees about them as well. So that's kind of the hierarchy and then in some cases we have even published and maintained some guidelines on how to do certain things and recommendations on security, not just at work but in the home too, so employees are given information on how to protect themselves at home on information security and those are more guidelines of course because we don't have controls over what people do at home but we feel that if people are practising good safe practices at home it's going to translate over at the work environment as well

	Values:
	 Information
	Security
	 Individual
	Privacy
	Norms:
	 Keeping
	information
	secure


Gurpreet Dhillon
email: gdhillon@vcu.edu

Romilla Chowdhuri

Cristiane Pedron
email: cdpedron@gmail.com

Organizational Transformation and Information Security Culture: a telecom case study

Keywords: Security Culture, Organizational Transformation, Formal & Informal security 1

 theory of cultural message streams to evaluate the disruptions in security culture following a merger. Findings from our analysis would be beneficial to researchers to theorize about security culture formulation during a merger. At a practical level decision makers would find the analysis useful for engaging in strategic security planning.

Introduction

The merger of the companies cause significant challenges in terms of integrating their technical infrastructure, policies and procedures, and normative aspects related to how work gets done. The changes also have a consequent effect on the security and integrity of the enterprise. Previous research shows (see [START_REF] Dhillon | Managing information system security[END_REF], [START_REF] Segev | Internet security and the case of Bank of America[END_REF]), that structural and business process related changes indeed make an organizational vulnerable. Research also shows that building and sustaining a good security culture is extremely important in times of radical change. In this paper we use E.T. Hall's theory of cultural messages [START_REF] Hall | The silent language[END_REF] to evaluate information security consequences of an organizational transformation In the extant literature, security culture is deemed important for the protection of organization's information assets. Various definitions of security culture have been proposed. For example, Dhillon [START_REF] Dhillon | Managing information system security[END_REF] defines it as behavior, values, and assumptions that ensure information security. Helokunnas and Kuusisto [START_REF] Helokunnas | Information security culture in a value net[END_REF] define security culture as a system in which attitude, motivation, knowledge, and mental model about information security interact. With respect to organization's information as-sets, researchers express the need for coherent security culture that focuses beyond the technical and formal controls [START_REF] Dhillon | Managing information system security[END_REF], [START_REF] Ruighaver | Organizational Security Culture: Extending the End-user Perspective[END_REF], [START_REF] Solms | Information Security-The Third Wave?[END_REF], [START_REF] Vroom | Towards Information Security Behavioral Compliance[END_REF]. Recent literature review by Ramachandran et al. [START_REF] Ramachandran | Variations in Information Security Cultures across Professions: A Qualitative Study[END_REF] indicates that very few studies focus on security culture. Moreover cultural conflict in information security has not been studied very well.

Case Description and Analysis

In this study we adopt an interpretive case study research approach [START_REF] Walsham | Interpreting information systems in organizations[END_REF]. Data was collected primarily through semi-structured interviews and informal conversations. Participants were the employees at different management level in the two merging companies. The participation was voluntary and each interview lasted about 60 minutes. Majority of the data was collected over an eight-month period while the merger was in progress.

The setting of the case study is an Organizational Customer and Relationship Management (OCRM) project that was launched due to the merger of the two companies -AirTelco and Relicom. The project aims to support the business goals of the transformed organization by integrating the CRM systems of the two merged organizations. Both AirTelco and Relicom belong to a business group that is greatly projected in Europe and has diversified business portfolio. Relicom was the industry leader of landline phones. The company offered its customers a wide range of services and solutions that cover more than the normal fixed network services like data communications, broadcasting, video conferencing, and broadband solutions. AirTelco was the market leader of the mobile segment. Its main goal is technological innovation and customer orientation. The differences in the strategic focus of the two companies stem from how they originated. While AirTelco was a product of a competitive market space, Relicom grew up in a monopolistic market. These differences in origin were evident in the approaches that the two companies had adopted towards technological innovation and customer management.

The cultural map analysis is performed using E.T. Hall's ten streams of cultural messages. The interpretations about the impact on information security are drawn by reflexive thinking in relation to cultural messages and data provided by the participants. Per our analysis, gender did not emerge to be significant. The summary of the analysis is presented in Table 1.

Interaction. The OCRM project affected the interactions between the higher management and operational teams. Inclined towards technological innovations, AirTelco employees occupied dominant technology positions whereas Relicom employees occupied managerial roles. This segregation of technological and managerial roles not only created division of power and space but also caused a lack of clarity in terms of privacy and security of customer data that resided on OCRM servers. Association. As the two organizations had different approaches towards customer management, a sense of sub-communities caused resistance towards adopting OCRM. In addition, lack of governance structures further increased the distance in security culture. Subsistence. Although employees were trained for using OCRM, no knowledge about the changes OCRM instigated in the business processes was disseminated. OCRM was of little to employees in overcoming their comfort zones. Additionally, the legal and regulatory differences prevented the integration of some of the databases, leading to information availability and integrity issues. Territoriality. The OCRM system defined new work boundaries for AirTelco and Relicom employees. Relicom employees felt that they were forced to follow the division and space determined by AirTelco employees. Work remained compartmentalized, formal boundaries changed and new group boundaries emerged. Such hostility between groups makes them prone to social engineering attacks. Temporality. The requirements for the design and implementation of OCRM system were collected in just five weeks. Additionally, AirTelco employees had a laid back attitude in dealing with day to day issues whereas Relicom employees were more aggressive. There were frequent changes in the process and people involved in requirement gathering. As a result, employees were inventing unique ways of getting work done faster. Learning. Few employees were selected to give training to other employees. However, the manuals put together by trainers were based on what they wanted others to know. Training between AirTelco and Relicom was not synced. Relicom for example knew more about wireless products and services relative to AirTelco. Training was limited to technical knowledge; employees were not made aware of the security policies. Lack of clarity in terms of security and privacy. New organization had limited grip on protection of critical company and customer data.

Association: Prior to merger, AirTelco and Relicom had multiple groupings and perspectives for CRM implementation. Conflicts were rampant. Merger of two companies results in "them" vs. us" attitude.

Conflict among groups was rampant. This resulted in lack of agreement on the kind of controls that were to be established.

Absence of formal associations caused a lack of shared vision which is detrimental to system success. There was no sense of ownership about customer data.

Subsistence: Prior to the merger, AirTelco employees had very little interest in customer service because a) it was difficult to cross sell products/services b) performance was loosely linked to employee earnings. Following the merger, however lack of customer responsiveness and inability to sell telecom services would result in reprimands. At the same time OCRM made sales and service efforts easier.

While the merger took place, the databases of the two companies cannot be merged because of legal and regulatory reasons. This results in issues pertaining to management of security, data integrity, and availability.

Territoriality: Following the merger, Relicom employees felt that they had to follow the divisions and space allocations of AirTelco. Merger brought two companies to share resources and equipment. The manner in which they approached work remained compartmentalized.

A lack of clarity of business processes, formal and informal spaces creates issues regarding 'social obligations' and 'responsibilities' that go beyond the law of the letter. Typically such environments can be excellent candidates for social engineering attacks/manipulations. Temporality: Requirements for the new OCRM were collected in just 5 weeks and every few weeks the process and responsibilities changed. AirTelco had a more laid back attitude in dealing with issues, problems and customer complaints, while Relicom was more aggressive.

One of the biggest concerns with respect to temporality is flawed assumptions leading to incorrect specification. The flawed or buggy systems are not only costly and time consuming to fix, but also pose significant security hazards.

Frequent changes in routines results in human error, which is a serious security threat.

Learning: Learning was undertaken in 'train the trainer' mode. The training program was technical in nature. Employees were however left to themselves to articulate the training content. In many instances new products and services were offered without adequate training or making employees aware about such products or services.

The nature and scope of training impacts the kind of a policy that is developed. If the new company wanted to create well balanced security policies, their training should go beyond the technical edifice. However, this was not the case. While employees seemed to be well versed with the technical, products, and services, they were unsure if the processes were broken or routines were inappropriate. This is a serious security threat because of exclusive reliance on the technical fix.

Recreation and Humor: Post merger the company created a "stock market" for ideas where employees could invest their virtual money.

Creating homogeneous culture for ensuring security is always preferred. The new AirTelco/Relicom organization did a good job in creating such an environment. However, there was no means for them to ensure con-tinuous improvement and integrating cultural process back for a sustained cultural integration. Failure to do so usually causes disillusionment and results in employees abandoning their integrative efforts -a serious security concern.

Defense: OCRM enforces formal controls on employees. Employees were expected to comply with the inbuilt controls.

The manner in which the changes panned out or were interpreted resulted in discordance between different stakeholders. Employees seemed to be at the mercy of the newly established routines. While this was necessary at the lower end of the organization, managers themselves felt that OCRM imposed an over-engineered solution. Increased possibility of employees circumventing control, which is a major security issue.

Exploitation: The organization (post-merger) has created a "laboratory of new ideas". Employees from different divisions are encouraged to brainstorm and test the efficacy of new ideas.

While the intent of the laboratory was very good, it received mixed reviews. In some cases employees felt involved, but in others they seemed to be Organizations need to ensure sustainability and correct direction of such innovative arrangements in order to ensure correct exploitation, else there is a risk of failure/abuse.

Recreation and Humor.

To facilitate cultural homogeneity between employees, senior management encouraged employees to discuss investment options. However, there was no effort made to improve such interaction. Failure to do so usually causes disillusionment and results in employees abandoning their integrative efforts.

Defense. Although, inbuilt controls in OCRM ensured security, these formal controls imposed restrictions on employees and forced them to work as per defined processes. Employees learned to circumvent the system to ensure that the work gets done as per their way. Exploitation. A "laboratory" setting was created to allow employees discuss innovative ideas. In some cases employees felt involved, but in others they seemed to be disillusioned. Although innovative ideas were generated and implemented, few of them were pushed through because of the power of the people who promoted those ideas.

Discussion

The case study presents an interesting basis for interpreting silent messages and hence the prevalent security culture. Based on our analysis we identify several principles that form the basis for good information security management.

1. Good information security management is a function of effective communication structures. While the need for establishing communication structures may seem intuitive, the importance of such structures in ensuring good information security cannot be underestimated. It was Giddens [START_REF] Giddens | The consequence of modernity[END_REF] who proposed that two disembedding mechanisms exist -tokens and expert systems. For Giddens tokens is any media of interchange that could be passed from one place to the other such as physical artifacts, conceptual structures or information. In the context of the merger between AirTelco and Relicom, while the OCRM system could have been a token, there clearly was significant confusion regarding how the system could be used to ensure customer responsiveness. On the contrary, the system imposed its own way of working and hence created confusion amongst the stakeholders. In the literature, the importance of tokens has been noted as significant as they ensure a common basis for establishing a communication structure (see [START_REF] Dhillon | Managing information system security[END_REF], [START_REF] Giddens | The consequence of modernity[END_REF]).

The second disembedding mechanism noted by Giddens [START_REF] Giddens | The consequence of modernity[END_REF] is that of expert systems-a collection of people who have specialized knowledge. While the merger between AirTelco and Relicom went ahead and various systems were inherited, there was no effort whatsoever in establishing expert systems. Hence conflict among groups was rampant, which resulted in lack of agreement on the kind of controls that should be established.

Information security management is a consequence of how business

processes are redesigned taking into consideration the informal, formal, and technical aspects. Hall [START_REF] Hall | The silent language[END_REF] argues, "Change is a complex circular process. It proceeds from formal to informal to technical to new formal, with the emphasis shifting rather rapidly at certain junctures" (pg 93). It is interesting to note that both AirTelco and Relicom recognized the importance of creating a homogeneous culture, which would ensure security. The new AirTelco/Relicom organization indeed did a good job in creating such an environment. However, there was no means for them to ensure continuous improvement and integrating cultural process back for a sustained cultural integration. Failure to do so usually causes disillusionment and results in employees abandoning their integrative efforts -a serious security concern. As Hall notes change is a complex and a circular process and there is a need to continuously evaluate and reevalu-ate how formal changes impact the informal and subsequently get institutionalized. Typically organizations stop the change management process at this juncture. Majority of security breaches however occur post implementation of the technical edifice. There typically is another set of redefinition of formal structures following a technical implementation, and many failures become obvious at this point.

Organizational stability relies on having well defined formal and informal group boundaries thus reducing friction and confusion.

As discussed before, a major concern is the scope of change and how such changes affect stakeholder groups and current boundaries. By clearly defining roles and responsibilities, management can reduce animosity among stakeholders and streamline business processes to achieve maximum project benefit. Understanding formal and informal business processes is critical to an organization's ability to create new opportunities through project development. Any rancor and conflict because of such issues can be a cause of significant concern. Institutions that are unable to clearly demarcate the formal and informal boundaries typically result in confusing the roles and responsibilities see [START_REF] Backhouse | Structures of responsibility and security of information systems[END_REF]. In our case study organization a lack of clarity of business processes, formal and informal spaces created issues related to 'social obligations' and 'responsibilities' that go beyond the law of the letter. Typically such environments can be excellent candidates for social engineering attacks and manipulations.

Balancing the informal, formal and technical controls is essential to

prevent over-engineered solutions. It goes without saying that a technical solutions to mergers and management of security are essential. Simply implementing a customer relationship system and hoping that communication needs can be addressed is not sufficient. What is required is linking technical solutions to the formal rules and obligations of various stakeholders. This necessitates the need for formal structures that support the technical edifice. Managing security after all is a holistic activity and there is a need to maintain integrity amongst the formal and the technical components. Finally the more pragmatic and normative aspects need to be evaluated as well. Ongoing education and training programs form the basis for building a security culture and a common belief system.

Conclusion

In this paper we presented the cultural analysis of two organizations undergoing merger and identified the impact of such transformations on the pertinent information security culture. We used E.T. Hall's [START_REF] Hall | The silent language[END_REF] theory of silent messages to interpret the impact of radical organizational transformation on information security. The analysis allowed us to define the principles of information security in the context of organization transformations. We believe that these principle set the ground for further theorizing about culture and information security. These principle could also help practitioners to plan for information security management during such transformations.

.

Table 1 .

 1 -Cultural Analysis Mapping

	Direct Organizational Intervention through	Implications for Security
	the OCRM system
	Interaction: Communication patterns changed
	because people from both companies need to
	work together formally and informally.OCRM
	forces AirTelco and Relicom to cross sell and
	be customer responsive.