# A Review of IFIP TC 11 WG 11.8 Publications through the Ages

Lynn Futcher, Louise Yngström

► To cite this version:

Lynn Futcher, Louise Yngström. A Review of IFIP TC 11 WG 11.8 Publications through the Ages. 8th World Conference on Information Security Education (WISE), Jul 2013, Auckland, New Zealand. pp.113-122, 10.1007/978-3-642-39377-8_12 . hal-01463598

HAL Id: hal-01463598

https://inria.hal.science/hal-01463598

Submitted on 9 Feb 2017

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
# A Review of IFIP TC11 WG11.8 Publications through the Ages

Lynn Futcher¹ and Louise Yngström²

¹ Nelson Mandela Metropolitan University, Port Elizabeth, South Africa
{Lynn.Futcher@nmmu.ac.za}

²Stockholm University & the Royal Institute of Technology, Sweden
[louise@dsv.su.se]

**Abstract.** IFIP WG 11.8 established a series of conferences in 1999 entitled World Information Security Education (WISE). These conferences have been held every second year since then, with the eighth one being held in 2013. Not surprisingly, there has been numerous high quality papers presented and published in the WISE conference proceedings over the years. However, many of these publications are not easily accessible and are therefore not being readily cited. One of the reasons for the inaccessibility of these papers is that they have not been made widely available through either print or a well-known repository on the Web. Furthermore, a need exists to reflect on what has been done in the past in order to realize the future of these conferences and related events. In order to begin the process of addressing this need, this paper presents a review of the IFIP WG 11.8 publications through the ages. It also reflects briefly on the problems relating to the inaccessibility of these publications, the decline in paper submissions and the lack of citations.

**Keywords:** Information security education, WISE conference publications, content analysis, publication classification

## 1 Introduction

‘International Federation for Information Processing (IFIP) is the leading multinational, apolitical organization in information and communications technologies and sciences. It is a non-governmental, non-profit umbrella organization for national societies working in the field of information processing. IFIP is recognized by the United Nations and other world bodies.’ [1].

IFIP began its official existence in 1960, under the auspices of UNESCO, as a result of the first World Computer Congress held in Paris in 1959. Its basic aims are: to promote information science and technology; to advance international cooperation in the field of information processing; to stimulate research, development and application of information processing in science and human activity; to further the dissemination and exchange of information on information processing; to encourage education in information processing [1].
IFIP represents Information Technology (IT) societies from 56 countries, covering all 5 continents, with over half a million members. It links more than 3500 scientists from academia and industry. IFIP is structured according to working groups reporting to 13 Technical Committees (TCs). There are currently in excess of 101 working groups. TC11 (Security and Protection in Information Processing Systems) is one such committee. The aim of TC11 is 'to increase the trustworthiness and general confidence in information processing and to act as a forum for security and privacy protection experts and others professionally active in the field' [2]. TC11 is organized into 13 working groups referred to as WG 11.1 to 11.13 respectively. WG 11.8 (Information Security Education) consists of an international group of people from academia, military, government and private organizations who are dedicated to increasing knowledge in the field of information security education. WG 11.8 was established in 1991 and aims to 'promote information security education and training at the university level and in government and industry' [3].

In order to meet these aims, WG 11.8 established a series of conferences in 1999 entitled World Information Security Education (WISE). These conferences have been held every second year since then, with the eighth one being held in July 2013. Not surprisingly, there has been numerous high quality papers presented and published in the WISE conference proceedings over the years. However, many of these publications are not easily accessible and are therefore not being readily cited. One of the reasons for the inaccessibility of these papers is that they have not been made widely available through either print or a well-known repository on the Web.

In addition, a need exists to reflect on what has been done in the past in order to realize the future of these conferences and related events. In order to begin the process of addressing this need, this paper presents a review of the IFIP WG 11.8 publications through the ages. It also reflects briefly on the problems relating to the inaccessibility of these publications, the decline in paper submissions and the lack of citations. While Section 2 focuses on a brief background to IFIP WG 11.8 and the first seven WISE conferences, Section 3 presents the approach used to analyse the numerous publications from these conferences. Section 4 provides a 'quick and dirty' analysis and summarises the key findings. This paper is concluded in Section 5 where suggestions for further research within this area are recommended.

## 2 Background to IFIP WG 11.8 and WISE Conferences

Before the inception of the WISE series of conferences in 1999, a number of Information Security Education workshops were hosted by IFIP WG 11.8. The aim of these workshops was to 'investigate current and future needs, problems and prospects within information security education' [4].

The first such workshop was held in Cape Town, South Africa, in 1995, in conjunction with the annual IFIP TC11 Information Security and Privacy Conference. Two papers were presented at this workshop. A first paper entitled '*Concepts, Issues and Resources Structuring Ethical Curricula in the Information Age*' was presented by Sarah Gordon from Indiana University, USA; a second paper entitled '*Education in IT security in Europe*' was presented by Louise Yngström from Stockholm
University in Sweden. Apart from the authors of these papers, there were 7 other workshop participants including 4 from South Africa, 1 from Sweden, 1 from China and 1 from the United Kingdom.

In 1996, the second Information Security Workshop was held in Samos, Greece. This workshop was a continuation of the theme from 1995 and attracted 5 speakers who presented the following papers:

• 'Concepts, Issues and Resources Revisited: Structuring Ethical Curricula for Developing Countries' (Sarah Gordon - Indiana University, USA);

• 'Computer Security Education in South Africa' (Lynette Drevin – Potchefstroom University, South Africa);

• 'Teaching Privacy as Part of the Computer Science Curriculum' (Simone Fischer-Hübner – University of Hamburg);

• 'Teaching Security by Means of Practical Laboratory Experiments' (Erland Jonsson – Chalmers University of Technology, Sweden);

• 'Holistic Approach to InfoSec Education' (Louise Yngström – Stockholm University and Royal Institute of Technology, Sweden).

In 1997, the third Information Security Workshop was held in Copenhagen, Denmark. This workshop was a continuation of the theme from 1995 and 1996 and attracted 5 speakers who presented the following papers:

• 'Framework for Information Security Experiments' (Lech Janczewski – University of Auckland, New Zealand; Erland Jonsson – Chalmers University of Technology, Sweden);

• 'Critical Analysis of Today's Education. New Perspectives' (Louise Yngström – Stockholm University and Royal Institute of Technology, Sweden).

• 'Education of Data Protection Officials' (Simone Fischer-Hübner – University of Hamburg);

• 'The SUSEC school project: Introducing computer security to teachers and pupils' (Gunnar Wenngren, Sweden);

• 'Teaching IS Security – Theory versus Practice' (Helen Fillery-James – Curtin University of Technology, Australia).

The fourth Information Security Education Workshop was held in 1998 on a conference boat between Vienna and Budapest. Five papers were presented at this workshop including:

• 'Teaching Information Security to Network Computing Professionals' (Yuliang Zheng, - Monash University, Australia);

• 'What we can and what we should teach within information security education from an ethical point of view' (Mikko T Sipponen and Jorma Kajava – University of Oulu, Finland);

• 'Information Security Education – a Human Side of the Curriculum' (Jorma Kajava and Mikko T Siponen - University of Oulu, Finland);

• 'IT related ethics education in Southern Africa' (Lynette Drevin – Potchefstroom University, South Africa);

• 'Critical analysis of today's IS education, can we create new perspectives?' (Louise Yngström – Stockholm University and Royal Institute of Technology, Sweden).
All four workshop papers were published by the Department of Computer and Systems Sciences, Stockholm University/Royal Institute of Technology in Sweden. These workshops addressed a number of key issues relating to information security education which are still pertinent today. These include:

* the importance of information security in the Computer Science/Information Systems/Information Technology (CS/IS/IT) curricula;

* the need for a holistic approach to information security education;

* human and ethical aspects of information security education;

* theoretical and practical approaches to teaching information security; and

* information security education for all.

It is therefore clear that these four workshops created a solid grounding for the working conferences which followed.

<figure><img src="image_2.png" /><figcaption>**Figure 1:** WISE Publications (1999 to 2011)</figcaption></figure>

The first WG 11.8 working conference (WISE 1) was named 'First World Conference on Information Security Education'. It was held in Stockholm, Sweden in June 1999. The proceedings from WISE 1 were published by the Department of Computer and Systems Sciences, Stockholm University/Royal Institute of Technology in Sweden. The WISE conferences that followed included:

* WISE 2 held in Perth, Australia in 2001 (proceedings published by the School of Computer and Information Science, Edith Cowan University, Perth, Western Australia);

* WISE 3 held in Monterey, California, USA in 2003 (proceedings published by Kluwer Academic Publishers);

* WISE 4 held in Moscow, Russia in 2005 (proceedings published by the Moscow Engineering Physics Institute, Russia);
* WISE 5 held in West Point, New York, USA in 2007 (proceedings published by Springer);

* WISE 6 held in Bento Gonzalves, Brazil in 2009 (proceedings published by the World Conference on Computers in Education);

* WISE 7 held in Lucerne, Switzerland in 2011 (proceedings edited by Lynn Futcher and Ronald Dodge).

Unfortunately, the proceedings for WISE 1, 2 and 4 are inaccessible in practice as they are technical reports; the proceedings from WISE 3 and 5 are accessible as they are published by well-known publishers who have a presence on the Web; and the proceedings from WISE 6 and 7 are difficult to find making them inaccessible in practice. An attempt therefore needs to be made to ensure that all past and future publications are accessible via a well-known repository on the Web.

A further problem is that the number of submissions and publications at WISE conferences has been on the decline in recent years. Figure 1 indicates the number of papers published for each of the first seven WG 11.8 working conferences. From this figure it is evident that the number of papers published increased each year from 1999 (21 papers) to 2005 (36 papers). This reflects an increase of 71%. However, there was a significant drop in 2007 (20 papers) and 2009 (10 papers). The general drop in paper submissions and publications over recent years is of major concern and needs to be addressed to ensure the future of these working conferences. The inaccessibility of some of the previous WISE proceedings may be a significant contributing factor. However, the geographical location of these conferences may also play a role.

As previously mentioned, a need exists to reflect on what has been done in the past in order to realize the future of these conferences and related events. In order to begin the process of addressing this need, this paper presents a review of the IFIP WG 11.8 publications through the ages. The following section describes the approach used to analyze the papers published at each of the seven working conferences.

# 3 Research Approach

There are various approaches that can be used for analyzing qualitative data (for example research publications). Content analysis has been used in many studies and is commonly used for analyzing written, verbal or visual communications. According to Krippendorff [5], content analysis is a research method for making replicable and valid inferences from data to their context. The purpose is to provide knowledge, new insights, a representation of facts and a practical guide to action [5]. Gerbic and Stacey [6] state that qualitative data analysis software programs can be used to make content analysis more manageable and ordered.

In order to carry out the analysis of the seven working conferences, a list of all published papers was compiled including titles, authors, affiliations and keywords. Abstracts were not included in this initial 'quick and dirty' analysis. Furthermore, a web application called TagCrowd [7] was used to create word clouds for each individual set of WISE publications together with a consolidated view of all WISE publications. TagCrowd is a web application for visualizing word frequencies in any text by creating what is commonly known as a word cloud, text cloud or tag cloud. It
was created in July 2006 by Daniel Steinbock, while a PhD student at Stanford University. TagCrowd [7] specializes in making word clouds easy to read, analyze and compare, for a variety of useful purposes including the visual analysis of qualitative data. The text included in this initial analysis included titles and keywords. Although this initial 'quick and dirty' analysis focused primarily on individual words, TagCrowd does allow for the analysis of key phrases, for example '*information security*' which appears 99 times throughout all the WISE publications.

In order to highlight the issue of citations, the authors have chosen to use Harzing's
[8] 'Publish or Perish' software that retrieves and analyzes academic citations. It uses
Google Scholar to obtain the raw citations, then analyzes these and presents various
statistics including: total number of papers; total number of citations; average number
of citations per paper; average number of citations per author; average number of
papers per author; and average number of citations per year. For this initial analysis,
only WISE 6 publications were analyzed for citation frequencies.

The analysis of previous WISE publications was performed in order to reflect on
what has been done in the past. This is deemed necessary in order to realize the future
of these conferences and related events. The following section highlights some of the
key findings relating to the analysis of previous WISE publications.

4 **Analysis and Findings**

Using TagCrowd [7] to perform a ‘quick and dirty’ analysis of previous WISE
publications provided some interesting findings.

<figure><img src="image_3.png" /><figcaption>**Figure 2: Titles and Keywords Word Cloud: All Papers for all WISE Conferences**</figcaption></figure>
As can be seen in Figure 2, TagCrowd clearly highlights the words that occur most frequently by increasing the font size and its boldness. In addition, words are placed in alphabetical order and the frequency is indicated in parentheses after each word. This improves the ease of analysis of the word clouds created using TagCrowd. In addition, TagCrowd caters for synonyms. However, since this 'quick and dirty' analysis only included paper titles and keywords, it was not deemed necessary at this initial stage.

Figure 2 is a consolidated word cloud for all papers presented at all WISE conferences based on titles and keywords. It clearly shows that the word 'security' appears the most number of times (266), followed by 'information' at 142 and 'education' at 118. This confirms that the primary focus of these publications is information security education. Similar word clouds were created for all papers published at each individual WISE conference based on titles and keywords. However, due to space limitations, this paper does not present the actual word clouds for each individual working conference. Instead, the findings from these word clouds are summarized in Table 1 which depicts the top 20 words used in the titles and keywords of the papers presented at the various individual WISE conferences.

<table><caption>**Table 1.** Top 20 Words based on Word Frequency (WISE 1 to WISE7)</caption><thead><tr><th>No.</th><th>Word</th><th>WISE1</th><th>WISE2</th><th>WISE3</th><th>WISE4</th><th>WISE5</th><th>WISE6</th><th>WISE7</th></tr></thead><tbody><tr><td>1</td><td>security</td><td>40</td><td>27</td><td>54</td><td>60</td><td>31</td><td>17</td><td>34</td></tr><tr><td>2</td><td>information</td><td>21</td><td>19</td><td>28</td><td>32</td><td>14</td><td>8</td><td>20</td></tr><tr><td>3</td><td>education</td><td>21</td><td>14</td><td>30</td><td>26</td><td>17</td><td>7</td><td>20</td></tr><tr><td>4</td><td>training</td><td>7</td><td>9</td><td>8</td><td>12</td><td>12</td><td>4</td><td>5</td></tr><tr><td>5</td><td>computer</td><td>16</td><td>3</td><td>9</td><td>10</td><td>10</td><td></td><td>6</td></tr><tr><td>6</td><td>teaching</td><td>5</td><td>7</td><td>8</td><td>6</td><td>4</td><td></td><td>3</td></tr><tr><td>7</td><td>learning</td><td>3</td><td>12</td><td>4</td><td>3</td><td>4</td><td></td><td>3</td></tr><tr><td>8</td><td>awareness</td><td>6</td><td>3</td><td>2</td><td>8</td><td>2</td><td>4</td><td></td></tr><tr><td>9</td><td>laboratory</td><td>3</td><td></td><td>7</td><td>9</td><td></td><td>2</td><td></td></tr><tr><td>10</td><td>curriculum/curricula</td><td>3</td><td>4</td><td>3</td><td>9</td><td></td><td></td><td>4</td></tr><tr><td>11</td><td>assurance</td><td></td><td></td><td>14</td><td>3</td><td></td><td></td><td>2</td></tr><tr><td>12</td><td>cyber</td><td></td><td></td><td>7</td><td>4</td><td>2</td><td></td><td>5</td></tr><tr><td>13</td><td>system</td><td>2</td><td>4</td><td>3</td><td>7</td><td></td><td></td><td>2</td></tr><tr><td>14</td><td>network</td><td></td><td>2</td><td>6</td><td>3</td><td>3</td><td></td><td>2</td></tr><tr><td>15</td><td>professional</td><td>5</td><td></td><td></td><td>9</td><td>2</td><td></td><td></td></tr><tr><td>16</td><td>course</td><td>2</td><td>2</td><td></td><td>5</td><td>2</td><td></td><td>4</td></tr><tr><td>17</td><td>forensics</td><td></td><td></td><td>2</td><td>4</td><td>7</td><td>2</td><td></td></tr><tr><td>18</td><td>research</td><td></td><td></td><td>4</td><td>4</td><td>4</td><td></td><td>2</td></tr><tr><td>19</td><td>cryptography</td><td></td><td></td><td></td><td>9</td><td>4</td><td></td><td></td></tr><tr><td>20</td><td>development</td><td>2</td><td>3</td><td>3</td><td>4</td><td></td><td></td><td></td></tr></tbody></table>

Table 1 clearly confirms that the primary focus of these individual conference publications relate to information security education, training and awareness together with teaching and learning. This is addressed within the CS/IS/IT curricula including specific examples of practical implementations through various laboratory experiments. In addition, cyber, system and network security are addressed throughout the various years of publications. Furthermore, forensics and research
aspects are introduced as important topics from WISE 3 onwards, while cryptography is introduced in WISE 4 and 5.

While Table 1 only highlights individual words, a similar analysis can be done for key terms. As previously mentioned, the term 'information security' occurs 99 times, 'security education' occurs 69 times, 'network security' occurs 9 times and 'cyber security' occurs 6 times. This type of 'term analysis' can therefore be useful to develop a folk taxonomy for IFIP WG 11.8 publications, similar to that of Botha and Gaadingwe [9]. Such a taxonomy is based on a particular group's 'language' that is vernacular in nature [9]. Botha and Gaadingwe [9] specifically reflected on 20 IFIP SEC conferences totalling 802 papers.

Similarly, Bjorck and Yngström [10] presented a classification model for research in information security based on an analysis of 125 papers from the IFIP World Computer Congress/SEC 2000. This model suggested categorising information security research on three dimensions namely X, Y and Z. Dimension X addresses the level of abstraction ranging from theories and models to empirical world; dimension Y addresses the domain ranging from technical, via formal to informal; and, dimension Z addresses context in order to cater for time and space. A similar classification model could be used to analyse the various WISE publications. However, this would require a more in depth analysis which is planned for the near future.

<table><caption>**Table 2.** Total Number of Citations for WISE 6 (2009)</caption><thead><tr><td>Paper Title</td><td>Authors</td><td>Citations</td></tr></thead><tbody><tr><td>Reaching Today's Information Security Students</td><td>Helen Armstrong, Ron Dodge, Colin Armstrong</td><td>0</td></tr><tr><td>Some 'Secure Programming' Exercises for an Introductory Programming Class</td><td>Matt Bishop</td><td>2</td></tr><tr><td>A SWOT Analysis of Virtual Laboratories for Security Education</td><td>Alan Davidson, Javier de La Puente Martinez, and Markus Huber</td><td>1</td></tr><tr><td>Determinants of password security: some educational aspects</td><td>Lynette Drevin, Hennie Kruger, Tjaart Steyn</td><td>1</td></tr><tr><td>Improving Awareness of Social Engineering Attacks</td><td>Aaron Smith, Maria Papadaki and Steven Furnell</td><td>0</td></tr><tr><td>A Risk-Based Approach to Formalise Information Security Requirements for Software Development</td><td>Lynn Futcher and Rossouw von Solms</td><td>0</td></tr><tr><td>Two Case Studies in Using Chatbots for Security Training</td><td>Stewart Kowalski, Katarina Pavlovska, Mikael Goldstein</td><td>5</td></tr><tr><td>Information Security Specialist Training on the Basis of ISO/IEC 27002</td><td>Natalia Miloslavskaya, Alexander Tolstoy</td><td>0</td></tr><tr><td>Using Bloom's Taxonomy for Information Security Education</td><td>Johan Van Niekerk and Rossouw Von Solms</td><td>0</td></tr><tr><td>Advancing Digital Forensics</td><td>Katrin Franke, Erik Hjelmås, and Stephen D. Wolthusen</td><td>0</td></tr><tr><td>TOTAL NUMBER OF CITATIONS</td><td></td><td>9</td></tr></tbody></table>
As discussed in Section 3, Harzing's [8] 'Publish or Perish' software was used to highlight the issue pertaining to citations. As an example, Table 2 presents the number of citations for the WISE 6 publications according to Harzing [8].

Of the 10 papers published, only four of these have been cited, with 9 citations in total. These figures indicate the general lack of citations for WISE publications. An obvious explanation for this may be the general inaccessibility of WISE papers and the fact that the WISE conferences may not be well known in the relevant communities. This is a further concern for the IFIP WG 11.8 which needs to be addressed.

## 5 Conclusion

This paper presents a review of the IFIP WG 11.8 publications including the four workshops held from 1995 to 1998 and the seven working conferences held from 1999 to 2011. In addition, it highlights a number of key issues that are pertinent to the future of the working group. These include the lack of accessibility of the various publications, the meager number of citations of these publications and the decline in the number of submissions and publications at the various working conferences.

Further research is being considered to develop a folk taxonomy for IFIP WG 11.8 publications by carrying out a more in depth study of all previous WISE publications. The development of a classification model for information security education publications is also being considered. These further developments could be useful in understanding the publications from previous publications. In addition, such a detailed analysis could assist in identifying any potential gaps in the research previously carried out and in so doing highlight opportunities for future possible research.

## References

1. International Federation for Information Processing. (2013). *About IFIP*. Retrieved March 18, 2013, from International Federation for Information Processing (IFIP): http://www.ifip.org/

2. International Federation for Information Processing. (2013). *IFIP TC-11 WG 11.8*. Retrieved March 18, 2013, from IFIP TC-11 WG 11.8: http://www.ifiptc11.org/

3. International Federation for Information Processing. (2013). *IFIP TC11 Working Groups*. Retrieved March 18, 2013, from IFIP TC11: http://www.ifiptc11.org/

4. Yngström, L. (1996). *IFIP TC11 Wroking Group 11.8 Information Security Second Workshop. Information Security Education - Current and Future Needs, Problems and Prospects*. Samos, Greece: DSV Department of Computer and Systems Sciences.
5. Krippendorff, K. (1980). *Content Analysis: An Introduction to its Methodology*. Newbury Park: Sage Publications.

6. Gerbic, P., & Stacey, E. (2005). A purposive approach to content analysis: designing analytical frameworks. *Internet and Higher Education*, 8, 45-59.

7. Steinbock, D. (2006). TagCrowd. Retrieved March 15, 2013, from http://tagcrowd.com/

8. Harzing, A. (2007). *Publish or Perish*. Retrieved April 4, 2013, from http://www.harzing.com/pop.htm

9. Botha, R. A., & Gaadingwe, T. G. (2006). Refelcting on 20 SEC conferences. *Computers & Security*, 25, 247-256.

10. Bjorck, F., & Louise, Y. (2001). IFIP World Computer Congress/SEC 2000 Revisited. *IFIP TC11 WG 11.8 Second World Conference on Information Security Education* (pp. 209-222). Perth, Western Australia: School of Computer and Information Science, Edith Cowan University.