NSF awards Wetzel and Lechler $144,000 for 2-year information security management study

The Division of Information & Intelligent Systems of the National Science Foundation (NSF) has awarded a two-year grant totaling $144,038 to two Stevens Institute of Technology researchers from different disciplines to study advanced problems of managing information security in an age of massive concentrations of sensitive private information and sophisticated mining and cross-referencing of personal data.

Titled "EAGER: Quantifying Information Security Risks in Complex Systems at the Interface of Users, Policies, and Technologies," the proposal's Principal Investigator is Dr. Susanne Wetzel, an Associate Professor of Computer Science in the Schaefer School of Engineering & Science at Stevens, who specializes in Cybersecurity and who is also the Director of Stevens' Center for the Advancement of Secure Systems and Information Assurance. Her Co-Principal Investigator is Dr. Thomas Lechler, an Associate Professor in the Howe School of Technology Management at Stevens, who specializes in Entrepreneurship, Project Management and Innovation Management, and who is also Director for Academic Entrepreneurship Programs as Stevens.

The PIs' proposal represents an "opportunity to seed a highly innovative interdisciplinary research project that has the potential for significant practical and theoretical impact for the management of information security - an area which is receiving more and more public attention. During the past decade, research in information security has expanded from a purely technical focus to a more general technology-economic focus. Despite its expansion, a multidisciplinary approach to understand and theoretically explain the interaction of security and economy within complex systems of partners is still missing," said Wetzel and Lechler.

The principal objective of this proposed research is to develop an innovative interdisciplinary information security framework to optimize and substantially advance both its system information security and system productivity. "For example," the PIs continued, "consider a hospital that exchanges data records of patients with governmental data bases that - on the other hand - are accessed by insurance companies. Furthermore, hospitals directly exchange information with these insurance companies. This may allow an insurance company to combine and deduce information from different data sources that could pose a security threat which is not addressed by traditional security considerations. From a security economics perspective, the impact of information exchange between partners on their productivity has to be considered to understand the conditions under which partners will obey or violate information security policies."

The proposed project provides the potential for high impact in substantially advancing research in information security as well as in management science. Although the project will address systems information security within the health care industry, its outcomes are expected to be applicable in other industries, e.g., defense. The cross-disciplinary nature of the proposed project is also expected to identify opportunities for interdisciplinary education.

Source: Stevens Institute of Technology