Strategies for Improving Data Protection to Reduce Data Loss from Cyberattacks

Strategies for Improving Data Protection to

Reduce Data Loss from Cyberattacks

Section 1: Foundation of the Study

Data loss continues to present challenges to organizations, which are increasing

with technological advances and information exchange. Business leaders, information

technology (IT) and information system (IS) professionals, and individuals need

strategies to protect data at work, home, or while traveling. Data security is no longer an

IT function of creating a perimeter around the system containing the sensitive data.

Instead, IT practitioners are developing data protection strategies surrounding data

elements. Data security is digital security to secure information systems, enabling the

development and transmission of data electronically. Data security is a combination of

data protection methods for a variety of sociotechnological environments.

Background of the Problem

Data loss is responsible for many businesses experiencing loss of reputation,

revenue, customer loyalty, and competitive advantage (Malecki, 2014). The common

denominators in data loss are humans, weak cybersecurity (Gayomali, 2014), and a false

sense of security in technology. Some people cannot resist the urge to click links, some

companies do not acknowledge the importance of investing in cybersecurity (Gayomali,

2014), and other companies implement technology as their only defense (Ernst & Young

Global Limited, 2014). Victims of cybercrimes lost approximately 55 million dollars in

2015 (Federal Bureau of Investigation Internet Crime Complaint Center [FBI ICCC],

2016). Within the same year, statistics show business managers suffering data breach

damages totaling 11.9 billion dollars and economic impacts of 4.26 billion dollars

(National Intellectual Property Rights Coordination Center, 2015).

Business leaders continue to experience concerns with data breaches and data

loss. The National Cybersecurity and Communications Integration Center recorded

numerous reports of cyberattacks that highlight a gap in data protection strategies used by

business leaders (Claus, Gandhi, Rawnsley, & Crowe, 2015), which allow cyber attackers

cause financial hardships for U.S. business leaders. These continued financial hardships

result in business leaders increasing investment in data protection to mitigate remediation

costs (The Ponemon Institute, 2016). Moreover, in 2018, business leaders faced new cost

concerns with the enactment of the general data protection regulation (GDPR) in Europe

(Ceross, 2018). Business leaders across the globe must now report how European citizens

personal information is controlled or face immense fines (Ceross, 2018; Kennedy &

Millard, 2016). Business leaders require a data protection solution to minimize financial

hardship while enabling innovation and growth. Therefore, business leaders’ lack of

everyday data protection methods was a relevant business problem for research.

Problem Statement

The Government Accountability Office (2015a) reported an increase in

cyberattack attempts from 10,481 in 2009 to 27,624 in 2014 to access sensitive data. In

2014, the Pew Research Center reported 22.9% of medium-sized U.S. businesses

experienced data breaches (Fitzpatrick & Dilullo, 2015). Victim losses reached $1.33

billion in 2016 with corporate data breaches ranking in the top five victim loss categories

(FBI ICCC, 2016). In 2017, the FBI ICCC annual report analysts reported a 5-year total

of 1,420,555 complaints with financial losses of $5.52 billion (FBI ICCC, 2017). The

general business problem is that cyberattacks on businesses cause loss of data and a

negative financial impact. The specific business problem is that some medium-sized

enterprise (ME) business leaders lack strategies to improve data protection to reduce data

loss from cyberattacks.

Purpose Statement

The purpose of this qualitative, single case study was to explore the strategies that

ME business leaders use to improve data protection to reduce data loss from cyberattacks.

The targeted population for this study included three ME business leaders from a global

worldwide services company in Brevard County, Florida. These ME business leaders

implemented strategies that improved data protection and reduced data loss from

cyberattacks. Business leaders’ acceptance of the study’s findings might spread the use of

effective strategies for reducing data losses and recovery costs. ME owners reducing data

loss from cyberattacks can contribute to positive social change by altering attitudes

toward data protection, reducing costs associated with protection against Internet crimes,

and enhancing an individual’s capabilities in the protection of sensitive, proprietary, and

personally identifiable information (PII).

Nature of the Study

I implemented a qualitative methodology for this study. Qualitative researchers

develop a subjective view of a population’s behavior associated with phenomena (Willan,

2016). As the purpose of this study was to explore the strategies that ME business leaders

use to improve data protection to reduce data loss from cyberattacks, a qualitative method

was appropriate. In contrast, quantitative researchers use data in support of a theory or

hypothesis quantifying the rejection of the null hypothesis (Neal & Ilsever, 2016). I

developed an interpretation of data protection strategies versus quantifying the data

protection strategies, which made the goals of a quantitative approach inappropriate for

this study. Additionally, mixed methods are an advanced approach combining qualitative

and quantitative research methods (Neal & Ilsever, 2016); however, I only needed a

qualitative methodology, so a mixed-method approach was unsuitable for this study.

I used a single case study for this study. Researchers use a case study design to

explain why and how (Väyrynen, Hekkala, & Liias, 2013). I used this design to explain

why and how business leaders successfully implemented data protection strategies for

reducing data losses from cyberattacks. Another potential design was ethnography, which

is used for understanding and explaining a group of individuals’ cultures (Baskerville &

Myers, 2014); however, this design was not appropriate because I did not characterize the

culture of ME business leaders. Additionally, because I explored data protection

strategies ME business leaders used to reduce data loss, a phenomenological design was

improper for this study. Finally, researchers using a narrative design gain an

understanding of participants’ stories through ordered events (Kruth, 2015), but I

conducted a study of why and how ME business leaders implemented data protection

strategies, making a narrative design unsuitable for the purpose of this study.

Research Question

What strategies do ME business leaders use to improve data protection to reduce

data loss from cyberattacks?

Interview Questions

1. What strategies have you used to improve data protection to reduce data loss

resulting from cyberattacks?

2. What strategies did you find worked best to improve data protection to reduce

data loss resulting from cyberattacks?

3. What are some examples of technical threats to your firm’s data that

influenced your selection of strategies to improve data protection to reduce

data loss resulting from cyberattacks?

4. What are some examples of nontechnical threats to your firm’s data that

influenced your selection of strategies to improve data protection to reduce

data loss resulting from cyberattacks?

5. What, if any, types of training were offered or required for your personnel to

contribute to the implementation of the selected strategies?

6. How did you determine your chosen strategies were successful in improving

data protection and reducing data loss?

7. How did you address key challenges to implementing your chosen strategies

to improve data protection to reduce data loss?

8. What additional information can you contribute that you have not previously

addressed about improving data protection to reduce data loss resulting from

cyberattacks?

Conceptual Framework

To explore the strategies that ME business leaders use to improve data protection

to reduce data loss from cyberattacks, I used the actor-network theory (ANT) as the

conceptual framework. The ANT was developed as a collaboration between Michel

Callon and John Law (1997) and Bruno Latour (1996). The theorists’ fundamental

concept is anchored on the translations between human (i.e., actors) and nonhuman (i.e.,

actants) entities through the sociology of science and technology (Jackson, 2015). The

theorists suggest that heterogeneous entities, human and nonhuman, join in creation as a

networked system and emerging as a singular entity (Latour, 2011). The fundamental

proposition of the theory is the innovation of an idea that develops into a network through

the interactions of actors and actants (Thumlert, de Castell, & Jenson, 2015; Walls,

2015). The ANT fit the purpose of my study by helping to identify ME business leaders

(i.e., actors) and data protection strategies (i.e., actants) in a network of translations that

spreads ideas to improve data protection and reduce data loss resulting from cyberattacks.

Operational Definitions

The clarification of technical terms in this study is important to deliver

understanding of data protection strategies ME business leaders use to improve data

protection to reduce data loss from cyberattacks.

Actors and actants: Actors and actants are any material or substance (i.e., human

or nonhuman) capable of interacting in a network of aligned interests that propagate an

idea (Desai et al., 2017; Elder-Vass, 2015; Jackson, 2015).

Advanced persistent threat: Advanced persistent threat is the long-term attack on

an IS orchestrated for an extended period against a business to harvest business critical

information through continuous monitoring of the system by an attacker (Baskerville,

Spagnoletti, & Kim, 2014; Kaukola, Ruohonen, Tuomisto, Hyrynsalmi, & Leppänen,

2017).

Business-critical information (BCI): BCI is the information considered

proprietary, sensitive, or not, within an organization that is an asset requiring a protection

strategy (Kaukola et al., 2017).

C-I-A principle: The C-I-A principle is the three dimensions of data protection

involving the confidentiality, integrity, and availability of data through varying

protections (Rahimian, Bajaj, & Bradley, 2016).

Data loss prevention (DLP): DLP is the detection of data in transit through system

processes to prevent data loss (Arbel, 2015).

Data leakage: Data leakage is the inadvertent or malevolent loss of data through

disclosure to unauthorized users (J.-S. Wu, Lin, Lee, & Chong, 2015).

Data theft: Data theft is the illegal access to a company’s information associated

with the company’s customers (Hinz, Nofer, Schiereck, & Trillig, 2015).

Information technology function: Information technology function is the

perspective of risk to an information security system as a compromise of IT security

controls (Rahimian et al., 2016).

Insider threat: Insider threat is an individual’s use of their authorized access to an

organization’s data to knowingly or unwittingly cause harm (Center for Development of

Security Excellence, 2018).

Security threat: Security threat is the potential exploitation of weakness or

vulnerability within an IS (Kaukola et al., 2017).

Vulnerability: Vulnerability is an attribute of a business asset that indicates the

asset is vulnerable to threats (Hutchins et al., 2015).

Assumptions, Limitations, and Delimitations

Researchers enhance the outcomes of a study by understanding the possible

assumptions, limitations, and delimitations impacting the study (Simon & Goes, 2003). I

understood the importance of acknowledging the study assumptions, limitations, and

delimitations to enhance the outcomes. The following is a discussion of the assumptions,

limitations, and delimitations relative to my study.

Assumptions

An assumption is the formation of beliefs that exist independently and without

confirmation of the knowledge (Ma, 2015). I considered several facts true but unverified

within my study. In qualitative research, an assumption is personal, subjective, unique,

multilayered, and with many interpretations (Ma, 2015). I acknowledged six underlying

assumptions in my study. First, I assumed that semistructured interviews and review of

company documents would provide enough data to develop themes within data

protection, provide an answer to and support the overarching question, and support

triangulation. I also assumed that conducting face-to-face interviews with willing

participants would yield a relative and honest response. Another assumption I made was

that the resulting data protection strategies from this study will provide business leaders a

means to protect sensitive and proprietary data from loss. I further assumed the ANT is a

viable framework for business leaders to comprehend the implementation of data

protection strategies to reduce data loss. A final assumption was that use of the ANT

framework would reduce personal bias sufficiently to demonstrate the usefulness of the

framework in sociotechnical environments. My assertion of assumptions potentially

mitigated bias and supports my objectivity.

Limitations

Limitations are potential weaknesses or problems specific to the research question

with impact on validity and transferability but outside the control of the researcher

(Connelly, 2013; Ellis & Levy, 2009; Yilmaz, 2013). A limitation of this study was the

participant’s responses. As the interviewer, I provided semistructured questions, but the

quality and honesty of the participants’ responses relevant to the research question was

out of my control. Another limitation was the time needed to support this study. A

shortened study timeframe limited the amount of useful data gained. A final limitation

with this study was the use of specific data collection instruments (i.e., interviews and

archival documents). The use of semistructured interviews and review of documents may

have limited the rich data available to support my research question.

Delimitations

A delimitation bounds or scopes a research study (Willan, 2016). There are

several delimitations to my study. The study is delimited to ME business leaders within a

global worldwide services company licensed in Brevard County, Florida. I delimited the

sample size with five IS/IT managers from the population of ME business leaders

available within the selected case study facility. The selected case study company

demonstrated the successful application of data protection strategies against cyberattacks

with zero data breaches within the last 3 years. I delimited the data collection to

semistructured interviews and archival documents excluding other potential types of data

collection that may provide relevance to this research. Another delimiter I implemented

was the use of the ANT to frame my approach to understanding data protection strategies

(Elder-Vass, 2015; Jackson, 2015). Other theories may offer frameworks for business

leaders to comprehend and implement the findings of the study. Finally, I chose Brevard

County, Florida as my geographical location due to the proximity of my home and my

knowledge of the businesses in the area limiting other potential geographical areas.

Significance of the Study

Contribution to Business Practice

The contributions to business practice involve improving data protection to reduce

data losses and recovery costs for business leaders. ME business leaders capable of

improving data loss reduce recovery costs and improve business performance (Hausken,

2014). The repercussions of businesses not protecting their data can include bankruptcy,

loss of competitive advantage, and general financial distress (Srinidhi, Yan, & Tayi,

2015). However, the application of security-enhancement assets positively affects the

financial disposition of a company (Srinidhi et al., 2015). ME business leaders

implementing data protection strategies may improve business operations leading to

improved financial health and overall performance. Companies continue to experience

cyberattacks as a threat to business data (Crowley & Johnstone, 2016), but ME business

leaders proficient in reducing data loss from cyberattacks increase the positive external

perceptions for their company (Martin, Borah, & Palmatier, 2017) and increase

competitive advantage. These study findings may provide information to facilitate

increased organizational performance through a reduction of recovery costs related to

data security breaches.

Implications for Social Change

Data protection is a requirement for public and private business operations. The

digital exchange of information supports hundreds of billions of dollars in yearly

transactions (Government Accountability Office, 2015b). Business and world leaders

must strive for both privacy and security by developing improved data protection

methods to work toward data protection solutions, which can benefit everyone (Hare,

2016). Based on the findings of this study, ME owners might contribute to positive social

change by altering attitudes toward data protection, creating a better environment for

people to live and work; reducing recovery costs from Internet crimes, improving social

well-being; and enhancing methods for the protection of sensitive, proprietary, and PII

advancing the privacy rights for society.

A Review of the Professional and Academic Literature

The purpose of this qualitative, single case study was to explore the strategies that

ME business leaders use to improve data protection to reduce data loss from cyberattacks.

Previous studies have been focused on cybersecurity and the financial impacts from weak

cybersecurity (Cook, 2017; Kongnso, 2015). Business leaders impacted by the data loss

and financial impacts potentially incur increased risks affecting business performance and

competitive advantage (Cook, 2017; Crowley & Johnstone, 2016; Desai et al., 2017;

Martin et al., 2017). Data protection is an element of cybersecurity and is the security

assurances given regarding specific information contained within an IS. A business

owner’s application of data protection strategies means securing the most sensitive data in

terms of the business missions.

The purpose of my literature review was to understand data protection. The

literature included information on data protection in terms of regulation, threats, risks to

sensitive data, how data is breached, the types of data lost, the processes to notify and

recover data from a security breach, and the strategies used in data protection. My focus

for the literature began with the conceptual perspective of ANT and the applications of its

use within IS and IT research. My search efforts continued with an emphasis on current

research associated with the elements of data protection. In the literature review, I

provide a brief analysis of the importance of transitioning from an emphasis on protecting

information systems containing data to protecting data, which was a foundational

perspective of this study. The literature review also includes an analysis of alternative

theories to ANT and rationale for not selecting them as frameworks for this study.

I collected literature that encompassed books, a proceeding, a working paper,

multiple peer-reviewed journals, several dissertations, several executive orders, an

enacted law, government websites, and selected government reports. I determined two

overarching themes from my synthesis of the literature centered on prevention and

response associated with subthemes of regulatory, risks, breaches, loss, recovery, and the

specific aspects of data protection. I obtained electronic information from databases

residing within Walden University Library. I used Academic Search Complete, ACM

Digital Library, Business Source Complete, EBSCOhost, ProQuest Central, SAGE

Premier, SAGE Journals, Science Direct, and Taylor and Francis Online to comprise my

scholarly review of the professional and academic literature on data protection.

The search criteria included the keywords 5G technology actant, actor,

actornetwork, actor-network theory, cloud-based computing, computer, computer security,

cyber security, data, data breaches, data loss, data prevention, data protection, data

response, data risk, data security, data theft, design, hackers, hacking, information,

information loss, information security, Internet of things (IoT), regulations, security,

sectoral law, unified law, United States, and qualitative. The literature review contains a

total of 120 references. Of these sources, 96% are peer-reviewed, and 88% (97) appear in

published works from 2015 through 2019.

Actor-Network Theory (ANT)

A conceptual framework in research is used to make sense of the findings. The

ANT is a conceptual framework with previous research applications in sociological and

technological environments. For example, ANT can be used in sociology by evaluating

interactions occurring between events and the entities involved in the events (Elder-Vass,

2015), though this depends on the investigator’s ability to explain events based on

interactions occurring with or without the investigator’s presence (Elder-Vass, 2015;

Latour, 1996). Iyamu and Mgudlwa (2018) also demonstrated the use of ANT as a guide

for analyzing the interactions of people and objects with health care data. The application

of the ANT is supported by the fact that a key characteristic of ANT application is

symmetry, which refers to treating people and objects as the same and means that all

actants and actors from an analytical stance become equals (Kurokawa, Schweber, &

Hughes, 2017).

The ANT can also be applied to the IS field. Mӓhring, Holmström, Keil, and

Montealegre (2004) used the escalation theory paired with ANT and discovered unique

aspects of ANT for improving IS research. One, ANT is a framework focused on

understanding the how and why actors and actants translations evolve. Two, ANT

framework is a tool for researchers to understand ideas and assumptions about a

phenomenon early in the process (Mӓhring et al., 2004). Silvis and Alexander (2014)

advanced the application of ANT as an IS research methodology in sociotechnological

research by using a graphical syntax tool to translate sociological and technological

interactions. Additionally, Cavalheiro and Joia (2016) used the ANT concepts of

problematization, interessement, enrollment, and mobilization as an analytical guide to

provide awareness of gaps in hardware, software, and human skills that prevented a

successful transformation to e-government technology. The ANT was an acceptable

framework to explain the sociotechnological convergence of the network influences

within data protection network assemblages.

Using the ANT in IS research has revealed benefits and limitations. One benefit of

ANT is having a different conceptual framework for conceptualizing issues in IS research

from more common approaches (i.e., systems theory). The ANT is distinct from systems

or systems thinking theory, which emphasizes the interactions of things with their smaller

homogenous parts. In contrast, ANT is the focus on associations between assemblages

(i.e., things) of a network (Elder-Vass, 2015; Jackson, 2015; Law, 2008). Assemblages

are heterogeneous elements intertwined together without a static shape that influence

interactions (Jackson, 2015). For example, the ANT introduces the concept of an actor

network assemblage (Aradau & Blanke, 2015). This concept can be applied to data

protection with the use of algorithms to address data-security assemblage based on

knowledge of the systems and the people managing the systems (Aradau & Blanke,

2015).

Researchers have also expressed benefits from using ANT to introduce key

concepts with translation of data protection assemblages (see Jackson, 2015; Kurokawa et

al., 2017). The key elements of ANT (i.e., actants, actors, networks, translation,

quasiobjects, problematization, interessement, enrollment, and mobilization) have

simplified understanding of sociotechnological research findings (Jackson, 2015). The

ANT has also simplified complexities between the sociotechnological aspects of science

and technology (Iyamu & Mgudlwa, 2018), which supports its use as a framework

extending to a sociotechnological study. The theory’s concepts help researchers apply

equally scientific claims to all components of the research to include human and

nonhuman aspects involved in the phenomena (Kurokawa et al., 2017). In this study, I

benefited from ANT as a framework for a vocabulary to capture network assemblages

used in data protection. The use of the ANT framework in previous IS research furthered

the understanding of the sociotechnical and political processes involving data protection,

business leaders, and information systems.

The ANT provides a simplified conceptualization of an investigation into

technology and data as an actor. For example, Burga and Rezania (2017) related the

factors of project governance, management stakeholders, and control and monitoring

systems to data protection as actors and actants. Cavalheiro and Joia (2016) established a

European patent office, Brazilian government, information systems, and patent data as

actors and actants within an e-governance system. The study of patient experience data is

another example of defining actors as bureaucratic documents, policies, and technologies

(Desai et al., 2017). Based on this conceptualization, the ANT can be used for

discovering connections between networks. For example, Iyamu and Mgudlwa (2018)

demonstrated how the interactions move from individuals and objects to the agency of a

network or groups of both. Further, the ANT provides vocabulary to interpret both

phenomena (see Silvis & Alexander, 2014).

Another benefit is that ANT, as a social theory of technology, is a pathway for IT

and IS researchers to understand a multitude of phenomena on how humans create or

impact society through technology. For instance, Akhunzada et al. (2015) used the theory

to address the complexity of humans influencing technology associated with data

protection from the perspective of the threat. Jackson (2015) furthered this concept and

reflected on the benefit of studying humans and non-humans equally from a combined

social and technological approach. In IT research, many theorists do not address technical

and social aspects of IT, instead research is conducted with a singular focus on social

aspects (Hanseth, Aanestad, & Berg, 2004). Baron and Gomez (2016) substantiated this

view through a historical and conceptual development of ANT as a sociotechnological

construct. ANT is an opportunity for a researcher to view the relationship between

technology artifacts and the technological aspects (Hanseth et al., 2004). The ANT as a

conceptual approach is a tool to understand societal and technological entanglements in

sociotechnical networks and how these networks communicate on multiple sociotechnical

networks (Baron & Gomez, 2016; Hanseth et al., 2004).

The ANT framework is beneficial, limitations exist within the application. One

minor limitation of the ANT framework is the continued challenges against the use of it

as a conceptual framework. For example, Elder-Vass (2015) argued the ANT framework

when used conceptually contains gaps with the inclusion of people as part of the groups

(i.e., assemblages). People are an important as a source of action for the actors and

actants that comprise assemblages (Callon & Law, 1997). A researcher may evaluate

people separately from information systems or vice versa, but the conclusions are

meaningless for understanding sociotechnological networks if the people were not

evaluated as part of the entire network (i.e., people and IS). Unless the interactions of

people and information systems are investigated simultaneously within the heterogenous

assemblage—relationships between different elements of a network (Vicsek, Király, &

Kónya, 2016)—then the premise of the framework is uncorroborated (Jackson, 2015). In

a heterogenous assemblage, the action of the relationship motivates elements of the

network and causes an effect to the network (Sayes, 2014). This key premise is the

differentiator of the ANT framework when compared with systems or game theory, but it

is also this principle that limits the use of ANT framework in IS/IT research.

The dual use of ANT as a conceptual framework and a methodology also poses a

limitation. Silvis and Alexander (2014) combined their approach of ANT as a theory and

a framework and influenced the interpretations from the research. But a potential limiting

factor is an accurate translation of the roles of the actor-network established for the

research (Cresswell, Worth, & Sheikh, 2010). For example, a researcher can use ANT to

identify people and nonhuman systems interactions but not acknowledge the success or

failure of the person’s interaction with the object (Kurokawa et al., 2017).

Despite limitations of the theory, the ANT is a practical, conceptual framework

for understanding complex data protection challenges. Hospitals, governments, and

construction industries are examples of different industries faced with complex data

protection challenges. For instance, Cresswell et al. (2010) evaluated health services, IT

systems research with ANT, and determined that actors and actants within a network may

influence other networks simultaneously based on the context. This demonstrates the

concept of multiplicities. Researchers using ANT must understand the implications

behind multiplicities and the existence of network layers (Cresswell et al., 2010). As

multiplicities exist within layered networks, the defined roles and responsibilities of

actors and actants are used by researchers to discern the context (Cresswell et al., 2010;

Jackson, 2015; Silvis & Alexander, 2014). IT systems are an example of multiplicities

with some users of the system functioning as administrators or architects of the system

infrastructure (Cresswell et al., 2010). Each role of a user created a multiplicity of the

network altering the assemblage.

The ANT can be an alternative decision-making process that emphasizes the

importance of certain actors who may be overlooked in traditional research frameworks

(Desai et al., 2017). The ANT can be used as a conceptual approach to optimize

examination of complex micro-level sociotechnical processes between actors and actants

within an environment at a point in time (Kurokawa et al., 2017). Understanding the

above points, ANT was an appropriate framework for realizing decision-making in

developing data protection strategies.

Data Regulation

The United States currently lacks a unified law for data protection. In the United

States, individuals and entities apply a sectoral approach to data protection laws and

regulations based on private sector trends regarding data protection (Diorio, 2015). The

U.S. Code of Federal Regulations lists many acts designed to protect an individual’s or

entity’s privacy associated with data but only when a specific action or precedence

mitigates protection (Diorio, 2015; Office of the Law Revision Counsel, 2018a). The

U.S. Constitution lacks a specific right to privacy, only provisioning terms that imply

privacy rights are contained within the U.S. Constitution (Office of the Law Revision

Counsel, 2018b). Other countries have a different approach to data protection laws such

as unified data protection laws like the European Union GDPR (Diorio, 2015). The

GDPR is a single unified law for EU citizens that applies to many online businesses

around the world to consider privacy by design, entailing privacy rights designed within

information and communication technology from the initial concept of the information

and communication technology system (Koops & Leenes, 2014). This lack of a

foundational constitutional right to privacy correlates to a society that self-regulates their

data protection. For business leaders, this necessitates developing data protection

strategies not based on data protection law but an ad hoc basis against the threats to their

data.

The deficiency of an overarching data protection law has led to multiple

regulations addressing specific aspects of data protection. Like cybersecurity, many of

the laws address enforcement actions, recovery notifications, or monetary penalties for

the use of data in malicious practices (Schubert, Cedarbaum, & Schloss, 2015). For

example, Senator Blumenthal introduced a new regulation into the Senate in 2017

detailing data breach accountability and enforcement for the protection of data (S. 1900,

2017). This proposed regulation is targeted at persons or businesses that handle or

require, maintain, or use sensitive data (e.g., PII). These private and public entities must

develop cybersecurity policies and procedures for the protection of the data in their

possession (Data Breach Accountability and Enforcement Act, 2017).

In contrast, the Federal Information Security Modernization Act (2017) is a law

that requires government agencies to have protections against cyberattacks. Other

examples of ad hoc laws that emphasize oversight regarding sensitive data are the Federal

Trade Commission Act (2017), the Health Insurance Portability and Accountability Act

(2017), the United States Privacy Act (2017), and the Safe Harbor Act (2017). There is

no one regulation specific to the act of protecting data from cyberattacks. The newly

introduced data breach accountability and enforcement bill, if passed, will signify a

change of focus from more than cybersecurity to an emphasis on data security.

In the absence of a unified data protection law, business owners relying on ad hoc

regulations refer to regulatory and nonregulatory agencies for data protection standards.

In the absence of adequate data protection laws, agencies voluntarily seek out ways to

improve data protection (Sarabdeen & Moonesar, 2018). This is emphasized by President

Trump, who issued Executive Order No. 13800 directing all federal agencies to manage

cybersecurity risks to their respective enterprise systems (Executive Order No. 13800,

2017). The National Institute of Standards and Technology (NIST) Framework for

Improving Critical Infrastructure Cybersecurity publication is now the lead standard in

data security following the issuance of the executive order (NIST, 2018). NIST personnel

function as collaborators and facilitators to establish NIST standards, guidelines,

education, and training (ITL Bulletin, 2012). To define data regarding BCI, businesses

need an understanding of the data in association with the respective law or standard

(Rumbold & Pierscionek, 2018). In essence, the lack of an overarching data protection

regulation and implementation of ad hoc regulations necessitated businesses voluntary

application of data security controls and protection strategies.

In a more recent move toward regulation as a requirement for data protection, as

opposed to the voluntary application of data protection, the U.S. government is

attempting to standardize the handling of unclassified information. President Obama

signed Executive Order No. 13556, Controlled Unclassified Information (CUI), with the

goal of providing federal agencies an initial legal framework to achieve standardization

of CUI (Executive Order No. 13556, 2010). To compliment this executive order, federal

agency leaders worked with the executive agent of CUI, National Archives and Records

Administration, and NIST to develop or use previously developed publications for

distributing policy frameworks to assist nonfederal business leaders with the

implementation of CUI requirements. The importance of these recent actions by the U.S.

government is the acknowledgment that the nation’s critical business data, which is the

basis of U.S. competitive technological advantage, is threatened and requires a new

mindset in the way data is handled and protected.

Data Threats

Data threats and vulnerabilities are persistent and evolving. A security threat is a

potential exploitation of data exposing vulnerabilities as weaknesses (Kaukola et al.,

2017). Threats are sophisticated and customized to circumvent established security

controls or protection methods (Baskerville et al., 2014). Data theft is a persistent threat

to a company’s personal information on their customers (Hinz et al., 2015). Hutchins et

al. (2015) defined threat as an item that signifies potential impairment to another person,

place, or thing. Kaukola et al. (2017) explained that business-critical information (i.e.,

proprietary, sensitive, or not) is subject to persistent and advanced persistent threats

(APT; i.e., those threats to data on information systems over a longer period). National

Cybersecurity Center of Excellence Information Technology Lab presenters posited the

challenge for business leaders is balancing technology, growth, and innovation

(Kauffman, Lesser, & Abe, 2015). The challenge is with maintaining an understanding of

the changing threat landscape and protection strategies available for protecting data

(Kauffman, Lesser, & Abe, 2015). Hintze (2018) distinguished organizations as the

controllers of data and third-party to the other firms functioning as the processors of the

data. From these categorizations, understanding the threat is relegated to a firm’s

understanding of the complexities associated with the movement of data, data at rest, and

the protection of data to meet compliance requirements (Calvard & Jeske, 2018; Hintze,

2018).

The human threat. Humans are one of the greatest threats to data. The human

mindset contributes to how data security is regarded (Kaukola et al., 2017). Mindsets

manifest as perceptions of risk or value regarding the data (Kaukola et al., 2017). The

human mindset is a compounded threat to data when technology and security are required

(Akhunzada et al., 2015). Connolly, Lang, Gathegi, and Tygar (2017) demonstrated how

applications of technology and security techniques are a direct result of human behaviors

regarding procedures. Connolly et al. indicated security procedure gaps related to human

behavior might influence adherence to data security. Jenkins, Grimes, Proudfoot, and

Lowry (2014) correlated this concept with the vulnerabilities of passwords and human

behaviors towards security controls. Bonneau, Herley, Van Oorschot, and Stajano (2015)

captured the weaknesses in passwords as a divergence between the theory of protections

and the reality of practice. Compound these technology and security technique

applications with data complexities, competing priorities, labor turnover, burnout,

staffing, decision making, and a business leader’s capability to manage data is a direct

result of human error (Calvard & Jeske, 2018); indirectly this human error increases

vulnerabilities and risks to data.

The human threat factor is important to understand from the perspective of intent.

The human threat factor encompasses insiders and outsiders (Padayachee, 2016).

Padayachee (2016) contended that opportunity is a dividing factor for outsider and insider

threats. This division means outsiders need a vulenerabilty to threaten an information

system (Padayachee, 2016). From the perspective of outsiders, these are the hackers

responsible for cyberattacks (Bashir, Wee, Memon, & Guo, 2017). A hacker is an

individual with malicious or non-malicious behavior profiles (Bashir et al., 2017). The

hacker’s intent is to gain technical or physical access to a digital environment using

knowledge obtained by illegal methods to infiltrate or compromise security (Bashir et al.,

2017). Examples of human mindsets grounded with ill intent are Man-at-the-end (MATE)

and remote-MATE (RMATE; Akhunzada et al., 2015). A person’s intent translates to

different threats and risks for data security controls and protections (Bashir et al., 2017).

The complimenting factor to a person’s intent is a propensity to mindsets of efficacy,

vertical individualism, and self-control (Bashir et al., 2017). These mindsets are an

indication of a human’s propensity towards hacking (Bashir et al., 2017). Parsons,

McCormac, Butavicius, Pattinson, and Jerram (2014) posited a direct connection between

non-compliant human behaviors with employee knowledge, attitude, and behavior when

associated with an organization’s security program. Connolly et al. (2017) indicated that

employee intent is influenced by procedural security countermeasures and organizational

culture. These values are causes for negative security behaviors within a task-oriented

organizational culture (Connolly et al., 2017).

Insider threat. Directly connected with human behaviors and intent is the insider

threat. The insider threat is a growing human-based vulnerability with data control (Tu,

Spoa-Harty, & Xiao, 2015). The insider threat is an individual’s use of their privileged

access to an organization’s data or the systems where the data resides, to knowingly or

unwittingly, cause harm (Center for Development of Security Excellence, 2018;

Padayachee, 2016). Defense Security Service specialists identify abnormal human

behaviors as a cause for a potential insider threat (Center for Development of Security

Excellence, 2018). Opportunities for insider threats arise from daily activities, valuable,

visible, accessible, and transferable data assets, as well as technological innovations and

changes (Padayachee, 2016). An insider vulnerability is the weakness created when an

organization’s capability to monitor the insider is lacking or non-existent (Tu et al.,

2015). The existence of a potential insider threat means business professionals must

understand the vulnerabilities to PII, BCI, or technologically valued data and mitigate

those risks (Hubaux & Juels, 2016). J.-S. Wu et al. (2015) identified a link between

corrupt human behaviors associated with data risk and loss referred to as data leakage.

Business leaders understanding the human implications with data protection might make

more informed decisions with data security.

The data portability threat. Business leaders are facing an evolving threat on a

global scale known as data portability. Data portability is a new right established with the

implementation of the GDPR (Mitchell, 2016). Data portability is the data subjects right

to privacy, protection of personal data, and control over their data (Ursic, 2018). As

mentioned earlier, the writers of the GDPR identified data controllers and data

processors, each having specific rights associated with data portability (Vanberg, 2018).

Under the GDPR, a controller or processor may be an individual, a group, or an

organization (Vanberg, 2018). The key point of the data portability right is that a data

subject is authorized to direct a controller to transmit the data in question to another

controller or processor (Engels, 2016).

The data portability right is a shift in how corporations approach securing data.

Mitchell (2016) described the data portability right as a shift from corporations securing

big data reservoirs to firms using a decentralized, distributed infrastructure approach in

managing consumer data. Data security from the latter approach is now an issue for

business leaders in determining how to improve data protection to minimize or avoid the

risks and liabilities associated with possessing and transmitting a subject’s data (Mitchell,

2016). Mitchell surmises the risk as a determination of retaining and maintaining

personal data or creating portals of access to data. Engels (2016) and Mitchell captured

the evolving threat as an impact to innovation and competitive advantage. Engels and

Mitchell rationalized that a competitor indirectly gains access to another competitor’s

data under the GDPR data portability right.

Future threats to data. Future threats to business and personal data categories

consist of cloud-based computing, the Internet of things (IoT), and 5G technology. These

future threats require complex security solutions to implement improved data protection

(Au, Liang, Liu, Lu, & Ning, 2018; Chaudhary, Kumar, & Zeadally, 2017; Choi, Yang,

& Kwak, 2018; Fan, Ren, Wang, Li, & Yang, 2018; Jadhav et al., 2017; Suomalainen,

Ahola, Majanen, Mämmelä, & Ruuska, 2018). Business professionals and individuals

must understand the security complexities required to implement evolving data protection

schema.

Cloud-based computing. Cloud-based computing has created a target rich

environment for hackers to obtain BCI and personal data. The centralized architecture of

cloud-based computing, by which businesses and individuals store or access data, is a

central issue for implementing a practical protection method (Yan, Li, & Kantola, 2015).

Chaudhary et al. (2017) explained the bi-directional flow of information between

geodistributed systems presents another set of challenges for businesses. Au et al. (2018)

focused on the problems with data protection in mobile cloud computing (i.e., the use of

cloud-based computing from mobile devices) that included issues with authentication,

encryption, and data integrity. Business leaders may realize cloud-based computing

benefits from decreased storage costs and increased storage capabilities. However, the

increased mobility coupled with the demand for access is creating complex issues for

securing data.

Internet of things. IoT are individual devices with specific functions connected to

the Internet with their own Internet protocol (IP) address through a distributed

infrastructure (Chaudhary et al., 2017). Choi et al. (2018) identified gaps (i.e., lack of

efficient security of user data) in the security by design associated with the

implementation of IoT devices. The device makers overlooked the protection of data

within the software platforms. This oversight has increased vulnerabilities and

opportunity for hackers. Au et al. (2018) corroborated the weak security by design and

the increased amount of IoT (e.g. 1.9 billion mobile devices by 2018) will compound the

challenge of data protection. As IoT increases virtualization and enables transfer of

information between machines (e.g., machine to machine learning) the potential for

malicious based threats to the data within the devices exponentially increased (Chaudhary

et al., 2017; Choi et al., 2018; Jadhav et al., 2017). Chaudhary et al. (2017) explained that

50 billion IoT devices will exist and connect to the Internet by the year 2020. Choi et al.

reported the increase of security vulnerabilities from six reports in 2014 to 362 incident

reports in 2016 with most incidents associated with broadband devices. Popescul and

Radu (2016) outlined the IoT vulnerabilities as insufficient password complexities, weak

account enumeration, unencrypted network services, and user interface security concerns.

Choi et al. outlined additional vulnerabilities associated with administrative processes,

Internet, cloud, and device interfaces, mobile applications, coding issues, and device

firmware and software updates combined with the lack of or weak update processes.

Cloud-based computing and IoT are subordinate technologies within the world wide web

that will advance as 5G technology develops.

5G technology. The fourth generation (4G) of wireless technology in 2018 is

reliant mainly on operators, end users, and service providers monitoring information

systems and mitigating threats through encryption technology (Fan et al., 2018;

Suomalainen et al., 2018). Traditional cryptography for encryption is derived from the

computational complexity associated with keys (Y. Wu et al., 2018). Smart devices with

5G technology are capable of computational capacities to overcome 4G encryption (Y.

Wu et al., 2018). Fang, Qian, and Hu (2018) noted four crucial threats with 5G

technology: (a) eavesdropping and traffic analysis, (b) jamming, (c) denial of service

(DoS) and distributed denial of service (DDOS), and (d) man-in-the-middle (MITM)

attacks.

Data protection strategies in the future threat environment. As the world moves

from 4G to 5G, data protection is a present-day and future problem for business leaders.

Chaudhary et al. (2017) proposed integrating software-defined networking (SDN),

network service chaining (NSC), and mobile edge computing (MEC) to create a secure

infrastructure for data exchange with evolving technologies like cloud-based computing.

Y. Wu et al. (2018) worked with physical layer security to improve data protection in

cloud-based and IoT computing. Au et al. (2018) argued data protections in

cloudcomputing, specifically mobile devices uploading to the cloud, require a focus on

usercentric behaviors in the areas of identity authentication, data encryption, and data

integrity check. Au et al. recommended these types of data protection strategies based on

biometric-based authentication, symmetric and asymmetric encryption (i.e., advanced

encryption standard [AES] or public key encryption [PKE]), and the use of audio, video,

and bio-based data integrity checks. Yan et al. (2015) discussed symmetric and

asymmetric encryption as beneficial to data protection in cloud-computing. However, it is

recommended to use proxy encryption through reputation centers as an alternative

method in data protection for cloud-computing (Yan et al., 2015). Reputation centers are

a method based on a cloud-computing service center reputation and that of the data

requestor. Business leaders need to understand their data to determine the best strategy to

prepare for the future threat environment.

Ultimately, business leaders must understand threats to their data to determine

vulnerabilities associated with the data to administer an acceptable risk tolerance

approach. Threats are sophisticated and customized to circumvent the established threat

control processes (Baskerville et al., 2014). Unmitigated threats lead to increased risks

affecting a company’s costs, reputation, performance, and competitive advantage (NIST,

2018). The problem with understanding threats is people, processes, and technology

comprise the threats. The complement of this problem is the security protocols executed

as countermeasures to the threats are executed by people, or through procedural

modifications, or with technological innovations, changes, and efficiencies. Business

leaders require continued focus on identifying threats to their data to ensure an

appropriate risk tolerance approach.

Data Risk

Different threats translate into different vulnerabilities that impact the types of

risks to a firm’s data. Hutchins et al. (2015) defined risk as an undesirable outcome of an

event. Aven (2016) explained risks as an uncertain event linked to the probability of loss

or damage to a business asset. Some ME rely on the experience of their leaders and staff

to predict risks (Naude & Chiweshe, 2017). Naude and Chiweshe (2017) posited a risk

management framework tool for ME businesses to manage risk identification,

assessment, mitigation, and monitoring. Lavastre, Gunasekaran, and Spalanzani (2012)

and Blome, Schoenherr, and Eckstein (2014) identified operational risks affecting ME as

weak alignment to business strategies, adherence to imposed regulatory requirements,

dynamic consumer preferences, low or missing employee skill sets, unreliable or lack of

vetting vendors and suppliers, economic impacts, technological, social aspects, weak

infrastructure of IS/IT equipment, and natural disasters. Yahoo organizational leaders and

stakeholders compounded their pre-existing risks with a failure to make cybersecurity a

strategic priority (Whitler & Farris, 2017). Yahoo leader's failures in strategic thinking

exposed 1 billion user accounts and their respective data resulting in a stock market loss

of 1.5 billion U.S. dollars. Businesses need standardized risk practices to decrease

organizational risk and maximize cost savings (Hutchins et al., 2015). Many IS/IT

professionals recognize risk as a function of threats and vulnerabilities.

Data Breaches

James B. Comey, Director, Federal Bureau of Investigations, emphasized the fact

that dealing with a data breach means understanding the impact specifically on the data

(FBI, 2017). A data breach is a type of security incident that involves the unauthorized

exfiltration of a firm’s data by an attacker (Whitler & Farris, 2017). Kongnso (2015)

analyzed the impacts of data breaches as financial, performance, and competitive

advantage. Naude and Chiweshe (2017) contended that data breaches are responsible for

greater operational risks with an ME that negatively affect production, expenses, and

returns on revenues. The next step for businesses is evaluating how and why a

cyberattack on the data occurs.

Business leaders might not understand the connections between data breaches and

security controls or protections without evaluating how and why a cyberattack occurs. In

a series of published academic research articles from 2014 through 2017, researcher

findings noted business leaders that incorporated newer technology (i.e., social media and

cloud computing) with existing technological and security platforms experienced an

increase in data breaches due to a lack of updated security measures to support the newer

technology (Angst, Block, D’Arcy, & Kelley, 2017; Ashenmacher, 2016; Hemphill &

Longstreet, 2016; Holt, Smirnova, & Chua, 2016; Layton & Watters, 2014). Layton and

Watters (2014) noted businesses incorporating new technologies overlooked or

minimized the laborious need for updated security controls to compliment the newer

technology. The Target store data breach is an example of how the overlooked security

controls resulted in negative impacts for data protection affecting over 70 million

consumers and 40 million credit and debit card records (Foresman, 2015; Plachkinova &

Maurer, 2018). Gwebu, Wang, and Wang (2018) used cognitive dissonance theory to

understand how a firm’s knowledge levels of available tools for preventing data breaches

and safeguarding data impacted the firm’s reputation and financial stability. When a

firm’s IT professionals employed response strategies, Gwebu et al. found these strategies

provided increased data protection minimizing data breaches and financial impacts.

Business leaders’ misunderstanding of the threat to their data might result in harm

to the organization and the stakeholders. Ashenmacher (2016) examined the potential

harm caused to consumers when entities incur data breaches and are unable to protect the

PII. Holt et al. (2016) researched the cost earned on the stolen data (i.e., PII) by

cybercriminals and the profit on the black market (i.e., open markets online). Like

Ashenmacher and Holt et al., Hemphill and Longstreet (2016) and Angst et al. (2017)

examined the security practices and theory established to prevent the susceptibility of

data breaches over a specific period. Both Hemphill and Longstreet and Angst et al.

hypothesized specific characteristics of an organization’s security standards minimized

the potential occurrence of a data breach. Connolly et al. (2017) provided the example of

how flat organizational structures, solidarity, and people-oriented cultures enabled

information security standards and practices. A lack of security controls and protections

are shown to increase the potential for data breaches.

Layton and Watters (2014), Hemphill and Longstreet (2016), Holt et al. (2016),

and Ashenmacher (2016) research various aspects of data breaches. Layton and Watters

evaluated and defined future data breaches and the impact to cost. Hemphill and

Longstreet concentrated on the theory and practices established by the Payment Card

Industry Security Standards Council (Council) that fights against cybercrime globally.

Holt et al. reviewed the variety of profits made on the black markets through buyers.

Ashenmacher researched statistics of stolen PII associated with data breaches. Angst et

al. (2017) characterized the adaptiveness with the effectiveness of IT security investments

in preventing a data breach. The trend with data breaches is businesses evaluated the cost

regarding the least expensive route; protect against the data breach or spend in recovery

costs.

The findings of the above researchers noted key themes. Angst et al. (2017)

discussed how business leaders that symbolically adopted IT security, regardless of IT

security investments made, faced greater chances of a data breach versus those business

leaders with the rigorous adoption of IT security (i.e., substantive adopters). Hemphill

and Longstreet (2016) recommended the Council improve the security standards and

cyber liability insurance coverage as technologies advanced to ensure the protection of

consumers PII during data breaches. Similarly, Ashenmacher (2016) found the Federal

Trade Commissions’ (FTC) lack of enforcement contributed to data breaches and

consumers with stolen PII. Ashenmacher noted with the FTC failing to enforce data

security and ensuring the protection of consumer dignity; data breaches continued to

result in hackers obtaining proprietary and consumer personal data. Holt et al. (2016)

revealed that revenues earned from the stolen transactions were minuscule compared to

stealing, selling, and using a consumer’s identity. Layton and Watters (2014) discovered

that data loss suffered from a data breach had a significant impact on a business’ tangible

costs. The firm leaders still operated successfully because the breach became a business

write-off (Layton & Watters, 2014). The tradeoff for the business owner is to pay the loss

sacrificing the lost data (i.e., PII or BCI) or protect against the potential of a data breach

and reduce data loss.

Data Loss Prevention

Businesses experienced data loss from internal and external threats to data. DLP

personnel must address insiders and outsiders attacking their data to mitigate data loss.

Arbel (2015) defined DLP as the detection of data in transit through system processes to

prevent data loss. People prevent loss of data through the development and analysis of

infrastructures regarding cyber threats and risks (Miron & Muita, 2014). Miron and Muita

(2014) discussed the nature of DLP involving standards and controls to prevent future

cyberattacks. Vitel and Bliddal (2015) used France’s cyber defense to demonstrate the

use of standards and controls in DLP. French cybersecurity professionals realized

preventing data loss involved understanding the attacks through counter-attack

disciplines via online environments, cyber security levels, and increased knowledge of

cyber-crimes. Plachkinova and Maurer (2018) used the Target data breach as a teaching

case study to demonstrate how data prevention and response strategies improved

customer loyalty, cybersecurity, chip readers. Plachkinova and Maurer demonstrated that

the right leadership provided improvements and guidance for businesses practicing DLP.

Arlitsch and Edelman (2014) expanded the idea of understanding cyber-crimes to the

techniques used by the cyber attacker. Arlitsch and Edelman suggested simple best

practices like (a) proper device management, (b) data stewardship, (c) password use and

protection, (d) password vault software, and (e) personal monitoring of credit cards to

prevent future cyberattacks.

DLP is a process of awareness in the physical protection of data, prevention of

data loss, and response to data loss. The methods of DLP included data categorization,

user profiling, and tracking and restricting data access (Arbel, 2015). In the case of the

latter, IS/IT professionals rely on intrusion detection systems (IDS) to detect cyberattacks

(Ben-Asher & Gonzalez, 2015). IDS is a system of generated warnings to enable network

administrators the ability to thwart an attacker’s control of the corporate network and

prevent data loss (Ben-Asher & Gonzalez, 2015). When businesses failed to implement

adequate DLP measures a data recovery plan became necessary.

Data Security Breach Notification and Recovery

Data security breach notification was an expensive solution to DLP. The cost

burden for data recovery is notification centric (Agelidis, 2016). Business leaders

followed security breach notification laws that outlined the requirements for businesses to

make formal notifications to victims of data breaches (Agelidis, 2016). Approximately 47

states adopted security breach notification laws and experienced a decrease in the number

of data breaches with a cost savings of 93 million dollars (Sullivan & Maniff, 2016).

Sullivan and Maniff (2016) argued the concept behind the security breach notification

laws is one of a legal duty for an organization to protect a consumer’s data. After the

Target data breach, Target representatives sent notifications to victims and offered 1 year

free of credit monitoring services (Plachkinova & Maurer, 2018). The government

representatives from the Office of Personnel Management (OPM) offered the 21.5

million victims of their data breach a similar option for 3 years of monitoring services at

the cost of 133 million dollars (Gootman, 2016).

The OPM data breach indirectly impacted the entities outside of the victims and

organizations related to the data breach (Hemphill & Longstreet, 2016). Target’s data

breach is another example of costs from data breaches impacting an organization

indirectly. Target’s supporting financial institutions lost 200 million dollars as opposed to

Target’s loss of 148 million dollars that was offset by the 38-million-dollar insurance

payout the company received following the data breach (Hemphill & Longstreet, 2016).

Whitler and Farris (2017) expounded on the hidden costs associated with image,

branding, and reputation noting the negative effects from slow responses (e.g., Sullivan

and Maniff [2016] noted an average of 117 days between breach and notification),

deniability (e.g., Yahoo’s failure to acknowledge the breach), lawsuits, and

investigations. Businesses need to evaluate the repercussions of preceding DLP for

recovery actions as these direct costs, indirect costs, and hidden costs negatively affect

financial solvency.

Data recovery is the second aspect of a business’s response to a data breach.

Businesses’ ability to respond to data breaches is a key focus for many federal institutions

(Pipelines, 2016). The Department of Transportation (DOT) is incorporating planning

response as a strategy for their agency with protecting U.S. pipelines from cyberattacks

(Pipelines, 2016). Organizations’ computer response teams must establish data integrity

as part of the recovery process (Agelidis, 2016). Plachkinova and Maurer (2018)

explained how investigating a data breach is an important facet of recovery. Plachkinova

and Maurer further explained how the purpose of the investigation is to identify

weaknesses and improve those vulnerabilities. Gootman (2016) identified OPM efforts at

data recovery involving a Cybersecurity Action Report with the assistance of external

stakeholders to identify 15 strategies to improve data security. Businesses need to

evaluate the cost-benefits of investing in security to prevent data breaches or the

costimpacts of investing in notification and recovery to respond to data breaches.

Data Protection

Data protection involves a business leader determining the importance of BCI

(i.e., a firm’s most important data) or PII. Kaukola et al. (2017) defined BCI as the

organizational data considered proprietary or sensitive and an asset to the firm that

requires increased protection. Rumbold and Pierscionek (2018) posited a problem for

businesses with data protection is the ability to distinguish between what are data and

what is information. Rumbold and Pierscionek distinguished the relationship between

data and information as the context. An illustration of this problem may be demonstrated

by the case of a scientist who analyzes raw data to form information for a purpose used in

decision-making, innovation, and conclusions (Rumbold & Pierscionek, 2018). Data give

value to information and to protect data business leaders must understand that

informational value relative to their specific firm or organization.

Data protections evaluated regarding technical and organizational measures are

commensurate to the risk (Hintze, 2018). Businesses need to assess the data as a function

of threats and vulnerabilities through the confidentiality, integrity, and availability (CIA)

principle to understand risk. CIA is a means to categorize consequences associated with

the loss, compromise, or suspected compromise of data (Hutchins et al., 2015).

Businesses determine the risk tolerance by evaluating the cost of data loss, compromise,

or suspected compromise (NIST, 2018). Anugerah and Indriani (2018) recommended the

development of data protection strategies based on the analysis of threats and risks

regarding identification, detection, response, and recovery of the data.

A variety of major themes existed for data protection in academic research during

the years 2016 through 2018; some researchers focused on individual data privacy

protections relative to technological, methodological, and managerial aspects of data

(Hardy, Hughes, Hulen, & Schwartz, 2016; Hubaux & Juels, 2016; Jackson, 2018; Kuang

et al., 2018; O’Connor et al., 2017; Schneider, Jagpal, Gupta, Li, & Yu, 2017).

Arguments and considerations associated with the release of the GDPR and the impacts

to individual privacy are another area of focus in academia (Ceross, 2018; Kennedy &

Millard, 2016), big data protection issues related to large-scale data analytics about

individuals and privacy when sharing the data (Altman, Wood, O’Brien, & Gasser, 2018;

Iyamu & Mgudlwa, 2018), and the various data protection schema stemming from

technological harms (Arlitsch & Edelman, 2014; Bonneau et al., 2015; Gellert, 2015;

Ghafoor, Sher, Imran, & Derhab, 2015; Hubaux & Juels, 2016; Jenkins et al., 2014;

Miron & Muita, 2014; Olaniyi, Folorunso, Aliyu, & Olugbenga, 2016; Parsons et al.,

2014; Tanev, Tzolov, & Apiafi, 2015; Tu et al., 2015; Wang et al., 2017; Zuva, Esan, &

Ngwira, 2014). These major themes are focused on the distinctiveness of data as a

standalone element of IS and IT exposed to unique threats. Data, as an element, require

tailored and specific protection against these unique threats with more rigorous controls

than traditional cybersecurity protections.

Some researchers presented data protection schema focused on different aspects

of data but not the protection of data itself as a foundational element of information.

Genkin, Pachmanov, Pipman, Shamir, and Tromer (2016) discussed cryptographic

software development grounded in theory to protect information systems against

evaluating cryptography on specific BCI. Arlitsch and Edelman (2014) expanded the

understanding of hacker techniques focused on data as an element of information.

Arlitsch and Edelman (2014) indicated hacker techniques are an area of protection that

must be considered for data at rest (i.e., stored data). Jenkins et al. (2014) identified

keystrokes used in the development of passwords. Again, this is an area of protecting data

at rest. Wang et al. (2017) evaluated data transmission and access protection processes.

This research is primarily the understanding of data protection while data is in transit. Tu

et al. (2015) conducted analyses of data protection within a medical enterprise but

narrowly focused on internal access data control mechanisms associated with insider

threat. Zuva et al. (2014) tested facial and fingerprint technology to evaluate the accuracy

of user identification. This narrow focus on user identification accuracy improved aspects

of data protection for confidentiality and integrity. While the scholarly research on data

protection was present, there was a limited amount of academic research specifically

analyzing and understanding data protection strategies for data as the foundational

element of information. More specifically for businesses, there are gaps in the research

on data protection correlated to the protection strategies for BCI or PII.

Some researchers understood the necessities of evaluating data protection as a

holistic concept for protecting against potential harms to data. Gellert (2015) defined

harms to data in the age of advanced computer-based technologies in terms of the

increased data amounts, greater access to the data, and data as a technological means to

manage society. These harms are noted as responsible for the additional problems: (a) a

lack of trust at the individual level (i.e., due to the inaccuracy of data whether intentional

or non-intentional), (b) the burden of proof for the accuracy in the data becomes an

individual’s responsibility, and (c) the potential for loss of control when data is accessed

with or without intent is a concern for the data owner. Last, data becomes information

within a digital system used to structure society through regulation and policy processes

(Gellert, 2015). Hung (2017) applied the ANT to the understanding of protecting data as

the whole network assemblages of humans and technologies, the translation of

assemblages’ interactions, and the multiplicity of other actor-network assemblages

influencing the network outcomes. Using a gaming software environment, Hung

demonstrated the how and why of player strategy selection in protection schema to

counter constraints, challenges, and opportunities to the sociotechnological environments

of the game assemblage. Fielder, Panaousis, Malacaria, Hankin, and Smeraldi (2016)

pursued a similar viewpoint with decision-making models in understanding

vulnerabilities and risks to data to mitigate the costs of data loss. Cresswell et al. (2010)

illustrated the importance of data as a record influencing the relationships between

humans and non-humans with the ANT as a framework. Cresswell et al. demonstrated the

value of the ANT in the context of micro aspects of an environment to translate or infer

an understanding of macro complex social processes. The importance of the research

denoted above is the evolution from protecting information systems to the foundational

level of protecting data.

Alternative Theories

I researched several alternative theories (i.e., moving target defenses, systems

theory, and systems thinking theory). Zhuang, Bardas, DeLoach, and Ou (2015)

developed a theory of cyberattacks relating to moving target defenses. Zhuang et al.

postulated moving target defenses theory as a game changer for cyber security by

establishing a framework for continually changing defenses versus using static defenses.

The theorists of moving target defenses theory acknowledged the ongoing need for

further support of the newer theory (Zhuang et al., 2015). Due to the novelty of moving

target defenses theory, I pursued a more established conceptual framework within ANT.

Salim (2014) presented a working paper that discussed cyber safety using systems

and systems thinking theory. Salim argued cyberattacks continued due to the belief by

business owners that jurisdictions exist in the cyber world. Attackers operate without

geographical boundaries with the support of an underground economy. Salim theorized

cybersecurity as imperceptible through physical means alone recommending IT leaders

require a holistic approach. IT leaders embracing a holistic approach for countering

attacks required technical and nontechnical protection methods (Salim, 2014). A

comprehensive examination of technical (i.e., data protection methods) and nontechnical

(i.e., people) interactions offered a complicated but feasible approach. ANT provided a

simple framework to understand all variables in the problem as actors and actants

regardless of whether the actor or actant is human or non-human.

Similar to Salim (2014), dissertations on cybersecurity published between the

years of 2015 through 2017 used general systems theory focused on the protection of

information and the systems housing the data (Cook, 2017; Kongnso, 2015; Saber, 2016).

Cook (2017) framed the investigation into effective strategies small to medium-sized

(SMEs) businesses used to protect themselves from cyberattacks by using the general

systems theory (GST). Von Bertalanffy (1968) envisioned systems theory as a means for

characterizing the interrelationships between modules of systems versus the individual

modules. Systems theory is expanded by Kuhn (1970) to capture the procedural aspects

of systematically increasing knowledge through scientific discovery. Cook’s premise is

that people facilitate cybersecurity through strategies, procedures, risk assessments, and

efficient network protocols (i.e., a systematically secure operation). Kongnso (2015)

evaluated cybersecurity best practices for minimizing data breaches using general

systems theory. Saber (2016) investigated the cybersecurity strategies associated with

protecting information systems from data breaches within the framework of general

systems theory as well. Saber provided an additional framework for the qualitative

exploratory case study to explore cybercrime activities using Cohen and Felson’s (1979)

routine activity theory.

Sayin (2016) presented the requirements for converting systems theory to a social

context. A critical component of the conversion rests with identifying the human errors

within the social system (Sayin, 2016). For a successful conversion, a decrease in human

error must occur for the system to remain viable (Sayin, 2016). The concern with the

selection of a systems theory framework is the division created by identifying all the

elements as unique entities (Sayin, 2016). General systems theory and routine activities

theory share a similar characteristic in that each evaluates cybersecurity through a human

lens. This characteristic is also a gap. The gap in the research with understanding the

dynamics between human and non-human interactions as a sociotechnological

assemblage (Jackson, 2015). ANT is a framework offering an analytical approach beyond

the human-centered view (Jackson, 2015). The application of the ANT framework

decreases a gap in information systems based research.

Transition

In Section 1, I provided the objectives of my study. The objectives included the

identification of the problem, purpose, and nature of the study. I detailed the potential

outcomes and benefits of this study with the business impact and significance of this

study. Section 1 concluded with a professional and academic literature review.

Section 2 contains a restatement of the study purpose with comprehensive details

of the project. These details include the role of the researcher, the participants, research

methodology, and design of the study in greater detail. I also discuss the population and

sampling criteria, data collection instrument, techniques, organization, and analysis

methodologies. Section 2 concludes with reliability and validity criteria as well as a

transition from Section 2 to Section 3. Section 3 will encompass an analysis of the

findings from the research conducted in this study. Topics in Section 3 will evaluate the

applications to professional practice and implications for social change.

Section 2: The Project

My review of literature in Section 1 provided a synthesis of ANT, the elements of

data protection, the supporting themes on protecting data as the critical component of

information, and contrasting theories used in previous IS/IT research. The literature also

indicated a gap in research regarding data protection strategies as a foundational element

of BCI. As virtualization grows from 1.9 billion mobile devices in 2018 to 50 billion

devices by 2020, the dependence on wireless technology drives an increased threat

environment within these complex networks (Au et al., 2018; Chaudhary et al., 2017; Y.

Wu et al., 2018). My objective with this study was to explore the effective data protection

strategies ME business leaders use to improve data protection to reduce data loss from

cyberattacks.

Section 2 is a presentation of the research method, design, the role I played as the

researcher, the selection requirements for the participants, and the characteristics of the

population and sample for the conducted study. I also provide a discussion of the ethical

requirements regarding this research and details surrounding the data collection. The data

collection details include the instruments, techniques, organization techniques, analysis,

reliability, and validity to support the selected method and design of this study.