本論文研究之主要目的是探討不同調節焦點特徵的人接收到資訊安全相關的恐懼訴求訊息時，對於防範威脅的態度會產生什麼影響。為了達成上述目的，本研究整合了調節焦點理論（Regulatory Focus Theory）、保護動機理論（Protection Motivation Theory）與恐懼訴求中，被認為是重要元素之一的恐懼（Fear）來進行研究探討。
本研究將資訊安全宣導訊息以恐懼訴求訊息的型態來進行呈現，訊息內容分 成兩部分，分別為威脅的短文與應對威脅的短文，並結合保護動機理論、調節焦點理論與恐懼，來探討（1）威脅評估（Threat appraisal）、恐懼（Fear）與效能評估（Coping appraisal）是否會對防範威脅的態度產生影響，（2）對於不同調節焦點特徵的人們接收到威脅的短文內容後，產生的威脅評估對於防範威脅的態度是否會有差異，（3）對於不同調節焦點特徵的人們接收到應對威脅的短文內容後，產生的效能評估對於防範威脅的態度是否會有差異，（4）對於不同調節焦點特徵的人們接收到威脅的短文內容後，產生的恐懼對於防範威脅的態度是否會有差異。
研究結果顯示恐懼與效能評估中的應對效能（Response efficacy）與自我效能（Self-efficacy）是主要影響防範威脅態度的因子。對於預防焦點特徵的人（Prevention individual）而言，他們應該要注意恐懼、應對效能與自我效能，這三個是影響他們的防範威脅態度之主要因子。另一方面，對於促進焦點特徵的人（Promotion individual）而言，他們則是要注意效能評估（Coping appraisal）中的應對效能（Response efficacy），應對效能才是影響他們防範威脅態度之主要因素。

This study is to understand the effect of fear-appeal-related messages about information security awareness on individuals’ attitude toward threat defending, specifically individuals with different regulatory focus characteristics. To answer the question, this study integrates the theories of Regulatory Focus, Protection Motivation, and Fear Appeals, in which fear is considered as one of the important elements.
This study presents information security advocacy messages in the form of fear appeal messages. The message includes script of threat and dealing with threat. This study further discusses (1) whether threat appraisal, fear, and/or coping appraisal affects individual’s threat defending attitudes; (2) the extent of threat appraisal upon receiving threat message affecting threat defending attitudes in individuals with different regulatory focus characteristics; (3) the extent of coping appraisal upon receiving counter threat script affecting threat defending attitude in individuals with different regulatory focus characteristics; (4) the extent of fear upon receiving threat message affecting threat defending attitude in individuals with different regulatory focus characteristics.
The results show that fear and response efficacy as well as self-efficacy in coping appraisal are the main factors which affect the attitude of threat defending. For prevention individuals, they should emphasize fear, response efficacy, and self-efficacy, for these three are the keys to affecting their threat defending attitudes. On the other hand, for promotion individuals, they should focus on response efficacy in coping appraisal, for it is the principal factor to affect their threat defending attitude.

論文審定書 ⅰ
中文摘要 ⅱ
Abstract ⅲ
圖片目錄 ⅶ
表格目錄 ⅷ
第一章 緒論 1
第一節 研究背景 1
第二節 研究動機與研究問題 4
第二章 文獻探討 7
第一節 惡意軟體 7
第二節 資訊安全 19
第三節 恐懼訴求 25
第四節 調節焦點理論 30
第三章 研究架構與假說 33
第一節 研究架構 33
第二節 推論與假說 34
第三節 操作型定義 40
第四章 研究方法和資料收集 42
第一節 實驗設計與流程 42
第二節 操縱和測量 44
第三節 資料收集 47
第五章 資料分析 48
第一節 操弄檢測 48
第二節 人口統計 49
第三節 測量驗證 51
第四節 假說測試 54
第六章 結論 64
第一節 總結 64
第二節 貢獻 65
第三節 研究限制與未來建議 66
參考文獻 68

中文部分
黃鈴媚（民88年）。恐懼訴求與健康宣導活動：宣導訊息內容設計之研究。新聞學研究，61期：P99-135。

英文部分
Anderson, J. M. (2003). Why we need a new definition of information security. Computers & Security, 22(4), 308-313.
Anderson, C. L., & Agarwal, R. (2010). Practicing safe computing: a multimedia empirical examination of home computer user security behavioral intentions. MIS Quarterly, 34(3), 613-643.
Ayuso, P. N., Gasca, R. M., & Lefevre, L. (2012). FT-FW: A cluster-based fault-tolerant architecture for stateful firewalls. Computers & Security, 31(4), 524-539.
Burns, A. J., Posey, C., Roberts, T. L., & Lowry, P. B. (2017). Examining the relationship of organizational insiders' psychological capital with information security threat and coping appraisals. Computers in Human Behavior, 68, 190-209.
Beck, K. H., & Frankel, A. (1981). A conceptualization of threat communications and protective health behavior. Social Psychology Quarterly, 204-217.
Botta, R. A., Dunker, K., Fenson-Hood, K., Maltarich, S., & McDonald, L. (2008). Using a relevant threat, EPPM and interpersonal communication to change hand-washing behaviours on campus. Journal of Communication in Healthcare, 1(4), 373-381.
Brockner, J., & Higgins, E. T. (2001). Regulatory focus theory: Implications for the study of emotions at work. Organizational Behavior and Human Decision Processes, 86(1), 35-66.
Bulgurcu, B., Cavusoglu, H., & Benbasat, I. (2010). Information security policy compliance: an empirical study of rationality-based beliefs and information security awareness. MIS Quarterly, 34(3), 523-548.
Choo, K. K. R. (2011). The cyber threat landscape: Challenges and future research directions. Computers & Security, 30(8), 719-731.
Crowe, E., & Higgins, E. T. (1997). Regulatory focus and strategic inclinations: Promotion and prevention in decision-making. Organizational Behavior and Human Decision Processes, 69(2), 117-132.
Crossler, R. E. (2010). Protection motivation theory: Understanding determinants to backing up personal data. In 2010 43rd Hawaii International Conference on System Sciences, pp. 1-10.
Crossler, R. E., Johnston, A. C., Lowry, P. B., Hu, Q., Warkentin, M., & Baskerville, R. (2013). Future directions for behavioral information security research. Computers & Security, 32, 90-101.
Cherdantseva, Y., & Hilton, J. (2015). Understanding Information Assurance and Security. [online] Tersedia di:< https://www. researchgate. net/publication/2, 83569185.
Cowden B. J., Bendickson J. S. (2018). Impacts of regulatory focus and institutions on innovation. Manag Decision, 56(5), 939-954
Carmines, E. G., & Zeller, R. A. (1979). Reliability and validity assessment . Vol 17, Sage Publications, CA.
Chaoguang, H., Feicheng, M., Yifei, Q., & Yuchao, W. (2018). Exploring the determinants of health knowledge adoption in social media: An intention-behavior-gap perspective. Information Development, 34(4), 346-363.
Dinev, T., Goo, J., Hu, Q., & Nam, K. (2009). User behaviour towards protective information technologies: the role of national cultural differences. Information Systems Journal, 19(4), 391-412.
De Hoog, N., Stroebe, W., & De Wit, J. B. (2007). The impact of vulnerability to and severity of a health risk on processing and acceptance of fear-arousing communications: A meta-analysis. Review of General Psychology, 11(3), 258-285.
Eagly, A. H., & Chaiken, S. (1993). The psychology of attitudes. Forthworth, TX: Harcourt Brace Jovanovich.
Egele, M., Scholte, T., Kirda, E., & Kruegel, C. (2008). A survey on automated dynamic malware-analysis techniques and tools. ACM Computing Surveys (CSUR), 44(2), 1-42.
Ewe, S. Y., Gul, F. A., Lee, C. K. C., & Yang, C. Y. (2018). The role of regulatory focus and information in investment choice: Some evidence using visual cues to frame regulatory focus. Journal of Behavioral Finance, 19(1), 89-100.
Floyd, D. L., Prentice-Dunn, S., & Rogers, R. W. (2000). A meta-analysis of research on protection motivation theory. Journal of Applied Social Psychology, 30(2), 407-429.
Fagnot, I. J. (2007). Behavioral information security. Cyber Warfare and Cyber Terrorism, pp. 199-205.
Fornell, C., & Larcker, D. F. (1981). Evaluating structural equation models with unobservable variables and measurement error. Journal of Marketing Research, 18(1), 39-50.
Gaeth, G. J., Levin, I. P., Cours, D. A., & Combs, S. (1990). Framing of attribute information in product description. Advances in Consumer Research, 17(2), 531-534.
Hovland, C. I., Janis, I. L., & Kelley, H. H. (1953). Communication and persuasion. New Haven, CT: Yale University Press.
Hanus, B., & Wu, Y. A. (2016). Impact of users’ security awareness on desktop security behavior: A protection motivation theory perspective. Information Systems Management, 33(1), 2-16.
Herath, T., & Rao, H. R. (2009). Protection motivation and deterrence: A framework for security policy compliance in organisations. European Journal of Information Systems, 18(2), 106-125.
Higgins, E. T. (1997). Beyond pleasure and pain. American psychologist, 52(12), 1280.
Higgins, E. T. (1998). Promotion and prevention: Regulatory focus as a motivational principle. Advances in Experimental Social Psychology, 30, 1-46.
Higgins, E. T., Bond, R. N., Klein, R., & Strauman, T. (1986). Self-discrepancies and emotional vulnerability: How magnitude, accessibility, and type of discrepancy influence affect. Journal of Personality and Social Psychology, 51(1), 5–15.
Hu, Q., Xu, Z., Dinev, T., & Ling, H. (2011). Does deterrence work in reducing information security policy abuse by employees?. Communications of the ACM, 54(6), 54-60.
Hansen, J. V., Lowry, P. B., Meservy, R. D., & McDonald, D. M. (2007). Genetic programming for prevention of cyberterrorism through dynamic and evolving intrusion detection. Decision Support Systems, 43(4), 1362-1374.
Ifinedo, P. (2012). Understanding information systems security policy compliance: An integration of the theory of planned behavior and the protection motivation theory. Computers & Security, 31(1), 83-95.
Janis, I. L. (1967). Effects of Fear Arousal on Attitude Change: Recent Developments in Theory and Experimental Research. Advances in Experimental Social Psychology Vol 3, pp. 166–224.
Jain, S. P., Agrawal, N., & Maheswaran, D. (2006). When More May Be Less: The Effects of Regulatory Focus on Responses to Different Comparative Frames. Journal of Consumer Research, 33(1), 91–98.
Jeong, B., & Yoon, T. (2014). The role of regulatory focus and message framing on persuasion of anti-piracy educational campaigns. Twentieth Americas Conference on Information Systems. Savannah, GA.
Johnston, A. C., & Warkentin, M. (2010). Fear appeals and information security behaviors: An empirical study. MIS Quarterly, 549-566.
Jansen, J., & van Schaik, P. (2019). The design and evaluation of a theory-based intervention to promote security behaviour against phishing. International Journal of Human-Computer Studies, 123, 40-55.
Kim, Y. J. (2006). The role of regulatory focus in message framing in antismoking advertisements for adolescents. Journal of Advertising, 35(1), 143-151.
Koohborfardhaghighi, S., & Altmann, J. (2017). How organizational structure affects organizational learning. Journal of Integrated Design and Process Science, 21(1), 43-60.
Leventhal, H. (1970). Findings and Theory in the Study of Fear Communications. Advances in Experimental Social Psychology, Vol 5, pp. 119–186.
Leventhal, H. (1971). Fear appeals and persuasion: The differentiation of a motivational construct. American Journal of Public Health, 61, 1208-1224.
Lacey, D. (2009). Managing the Human Factor in Information Security: How to win over staff and influence business managers. John Wiley & Sons.
Luo, X., Brody, R., Seazzu, A., & Burd, S. (2011). Social engineering: The neglected human factor for information security management. Information Resources Management Journal (IRMJ), 24(3), 1-8.
Li, Y., & Siponen, M. T. (2011). A Call For Research On Home Users' Information Security Behaviour. In PACIS (p. 112).
Lee, Y., & Larsen, K. R. (2009). Threat or coping appraisal: determinants of SMB executives’ decision to adopt anti-malware software. European Journal of Information Systems, 18(2), 177-187.
Lee, A. Y., Keller, P. A., & Sternthal, B. (2010). Value from regulatory construal fit: The persuasive impact of fit between consumer goals and message concreteness. Journal of Consumer Research, 36(5), 735-747.
McGuire, W. J. (1968). Personality and attitude change: An information-processing theory. In A. G. Greenwald, T. C, Brock, & T. M. Ostrom (Eds.). Psychological foundations of attitudes, 171-196. New York: Academic Press.
McGuire, W. J. (1969). The nature of attitudes and attitude change, The handbook of social psychology, The individual in a social context, 2e édition, vol. 3, éds. G. Lindzey et E. Aronson.
Maddux, J. E., & Rogers, R. W. (1983). Protection motivation and self-efficacy: A revised theory of fear appeals and attitude change. Journal of Experimental Social Psychology, 19(5), 469-479.
McMahan, S., Witte, K., & Meyer, J. A. (1998). The perception of risk messages regarding electromagnetic fields: Extending the extended parallel process model to an unknown risk. Health communication, 10(3), 247-259.
Micu, C. C., & Chowdhury, T. G. (2010). The effect of message's regulatory focus and product type on persuasion. Journal of Marketing Theory and Practice, 18(2), 181-190.
Metalidou, E., Marinagi, C., Trivellas, P., Eberhagen, N., Skourlas, C., & Giannakopoulos, G. (2014). The human factor of information security: Unintentional damage perspective. Procedia-Social and Behavioral Sciences, 147, 424-428.
Menard, P., Bott, G. J., & Crossler, R. E. (2017). User motivations in protecting information security: Protection motivation theory versus self-determination theory. Journal of Management Information Systems, 34(4), 1203-1230.
Moody, G. D., Siponen, M., & Pahnila, S. (2018). Toward a unified model of information security policy compliance. MIS Quarterly, 42(1), 285-311.
Mwagwabi, F., McGill, T., & Dixon, M. (2018). Short-term and long-term effects of fear appeals in improving compliance with password guidelines. Communications of the Association for Information Systems, 42(1), 147-182.
Ng, B. Y., & Rahim, M. (2005). A socio-behavioral study of home computer users' intention to practice security. PACIS 2005 Proceedings, 20, 234–247.
Pechmann, C., Zhao, G., Goldberg, M. E., & Reibling, E. T. (2003). What to convey in antismoking advertisements for adolescents: The use of protection motivation theory to identify effective message themes. Journal of Marketing, 67(2), 1-18.
Pham, M. T., & Avnet, T. (2009). Contingent reliance on the affect heuristic as a function of regulatory focus. Organizational Behavior and Human Decision Processes, 108(2), 267-278.
Vadrevu, P., Rahbarinia, B., Perdisci, R., Li, K., & Antonakakis, M. (2013). Measuring and detecting malware downloads in live network traffic. In European Symposium on Research in Computer Security (pp. 556-573). Springer, Berlin, Heidelberg.
Pahnila, S., Siponen, M., & Mahmood, A. (2007). Employees' behavior towards IS security policy compliance. In 2007 40th Annual Hawaii International Conference on System Sciences (HICSS'07) (pp. 156b-156b). IEEE.
Piquero, A. R., Paternoster, R., Pogarsky, G., & Loughran, T. (2011). Elaborating the individual difference component in deterrence theory. Annual Review of Law and Social Science, 7, 335-360.
Posey, C., Roberts, T. L., & Lowry, P. B. (2015). The impact of organizational commitment on insiders’ motivation to protect organizational information assets. Journal of Management Information Systems, 32(4), 179-214.
Rippetoe, P. A., & Rogers, R. W. (1987). Effects of components of protection-motivation theory on adaptive and maladaptive coping with a health threat. Journal of Personality and Social Psychology, 52(3), 596.
Roberto, A. J., & Goodall, C. E. (2009). Using the extended parallel process model to explain physicians' decisions to test their patients for kidney disease. Journal of health communication, 14(4), 400-412.
Rogers, R. W. (1975). A protection motivation theory of fear appeals and attitude change1. The Journal of Psychology, 91(1), 93-114.
Rogers, R. W. (1983). Cognitive and psychological processes in fear appeals and attitude change: A revised theory of protection motivation. Social Psychophysiology: A Sourcebook, 153-176.
Roy, R., & Phau, I. (2014). Examining regulatory focus in the information processing of imagery and analytical advertisements. Journal of Advertising, 43(4), 371-381.
Robberson, M. R., & Rogers, R. W. (1988). Beyond fear appeals: Negative and positive persuasive appeals to health and self-esteem. Journal of Applied Psychology, 18(3), 277–287.
Roberto, A. J., Eden, J., Savage, M. W., Ramos-Salazar, L., & Deiss, D. M. (2014). Outcome evaluation results of school-based cybersafety promotion and cyberbullying prevention intervention for middle school students. Health Communication, 29(10), 1029-1042.
Sutton, S. R. (1982). Fear-arousing communications: A critical examination of theory and research. Social Psychology and Behavioral Medicine, 303-337.
Siponen, M., Pahnila, S., & Mahmood, A. (2007). Employees’ adherence to information security policies: An empirical study. In IFIP International Information Security Conference (pp. 133-144). Springer, Boston, MA.
Siponen, M., Pahnila, S., & Mahmood, A. (2006). Factors influencing protection motivation and IS security policy compliance. In 2006 Innovations in Information Technology (pp. 1-5). IEEE.
Boss, S., Galletta, D., Lowry, P. B., Moody, G. D., & Polak, P. (2015). What do systems users have to fear? Using fear appeals to engender threats and fear that motivate protective security behaviors. MIS Quarterly, 39(4), 837-864.
Song, D., & Morton, C. R. (2016). The influence of regulatory focus on the effect of product cues. Psychology & Marketing, 33(11), 917-933.
Smith, S. M., & Petty, R. E. (1996). Message framing and persuasion: A message processing analysis. Personality and Social Psychology Bulletin, 22(3), 257-268.
Smith, K. H., & Stutts, M. A. (2003). Effects of short‐term cosmetic versus long‐term health fear appeals in anti‐smoking advertisements on the smoking behaviour of adolescents. Journal of Consumer Behaviour: An International Research Review, 3(2), 157-177.
Safa, N. S., Von Solms, R., & Futcher, L. (2016). Human aspects of information security in organisations. Computer Fraud & Security, 2016(2), 15-18.
Sasse, M. A., Brostoff, S., & Weirich, D. (2001). Transforming the ‘weakest link’—a human/computer interaction approach to usable and effective security. BT technology Journal, 19(3), 122-131.
Shen, L., & Dillard, J. P. (2007). The influence of behavioral inhibition/approach systems and message framing on the processing of persuasive health messages. Communication Research, 34(4), 433-467.
Sher, M. L., Talley, P. C., Yang, C. W., & Kuo, K. M. (2017). Compliance with electronic medical records privacy policy: An empirical investigation of hospital information technology staff. INQUIRY: The Journal of Health Care Organization, Provision, and Financing, 54, 0046958017711759.
Tanner Jr, J. F., Hunt, J. B., & Eppright, D. R. (1991). The protection motivation model: A normative model of fear appeals. Journal of Marketing, 55(3), 36-45.
Nelms, T., Perdisci, R., Antonakakis, M., & Ahamad, M. (2015). Webwitness: Investigating, categorizing, and mitigating malware download paths. In 24th {USENIX} Security Symposium ({USENIX} Security 15) (pp. 1025-1040).
Vroom, C., & Von Solms, R. (2004). Towards information security behavioural compliance. Computers & Security, 23(3), 191-198.
Vance, A., Siponen, M., & Pahnila, S. (2012). Motivating IS security compliance: insights from habit and protection motivation theory. Information & Management, 49(3-4), 190-198.
Van Bavel, R., Rodríguez-Priego, N., Vila, J., & Briggs, P. (2019). Using protection motivation theory in the design of nudges to improve online security behavior. International Journal of Human-Computer Studies, 123, 29-39.
Wan, E. W., Hong, J., & Sternthal, B. (2009). The effect of regulatory orientation and decision strategy on brand judgments. Journal of Consumer Research, 35(6), 1026-1038.
Wang, J., Li, Y., & Rao, H. R. (2017). Coping responses in phishing detection: An investigation of antecedents and consequences. Information Systems Research, 28(2), 378-396.
Witte, K. (1992a). Putting the Fear Back Into Fear Appeals: The Extended Parallel Process Model.Communication Monographs, 59(4), 329-349.
Witte, K. (1992b). The role of threat and efficacy in AIDS prevention. International Quarterly of Community Health Education, 12(3), 225-249.
Witte, K. (1994). Fear Control And Danger Control: A Test Of The Extended Parallel Process Model (EPPM). Communication Monographs, 61(2), 113-134.
Witte, K., & Allen, M. (2000). A Meta-Analysis of Fear Appeals: Implications for Effective Public Health Campaigns. Health Education & Behavior, 27(5), 591-615.
Whitman, M. E., & Mattord, H. J. (2011). Principles of information security. Cengage Learning.
Xu, S., Yang, T., Guo, R., & Zhang, W. (2019). The antecedents and consequences of employees’ followership behavior in social network organizational context: A longitudinal study. EURASIP Journal on Wireless Communications and Networking, 2019(1), 259.
Zafar, H., & Clark, J. G. (2009). Current state of information security research in IS. Communications of the Association for Information Systems, 24(1), 34.
Zhang, X., & Yang, H. (2018). Impact of Cross-Culture on Behavioral Information Security. Journal of Integrated Design and Process Science, 22(2), 63-80.

網站部分
臺北市政府警察局（民105年3月15日）。「資訊安全要注意，瀏覽下載要警覺」機密維護宣導海報【網站資料】。取自https://police.gov.taipei/News_Content.aspx?n=89EC164B5E3C75A7&sms=3F8F313D905A94D7&s=9BE9A282745A351E
T. L. 趨勢科技全球技術支援與研發中心（民107年11月6日）。《電腦病毒30演變史》1988-2018年電腦病毒/資安威脅演變史【部落格資料】。取自
https://blog.trendmicro.com.tw/?p=57624
T. L. 趨勢科技全球技術支援與研發中心（民102年7月29日）。認識惡意威脅：病毒（Virus），木馬（Trojan Horse）等11個網路威脅定義及安全小秘訣【部落格資料】。取自
https://blog.trendmicro.com.tw/?p=5795
Digicert （n.d.）。什麼是惡意程式、病毒、間諜程式與Cookie【網站資料】。取自
https://www.websecurity.digicert.com/zh/tw/security-topics/what-are-malware-viruses-spyware-and-cookies-and-what-differentiates-them
Digicert （n.d.）。病毒、蠕蟲、與特洛伊木馬程式的不同【網站資料】。取自
https://www.websecurity.digicert.com/zh/tw/security-topics/difference-between-virus-worm-and-trojan-horse
CTIMES（民95年11月23日）。中國網際網路協會公佈「惡意軟體」定義【新聞資料】。取自
https://ctimes.com.tw/DispNews/tw/%E4%B8%AD%E5%9C%8B%E7%B6%B2%E9%9A%9B%E7%B6%B2%E8%B7%AF%E5%8D%94%E6%9C%83/yahoo/%E7%B6%B2%E9%9A%9B%E5%AE%89%E5%85%A8%E7%B3%BB%E7%B5%B1/06112317152F.shtml
東方財經（民95年11月9日）。流氓軟體官方定義公布 八大惡形定義“流氓”【新聞資料】。取自
http://big5.eastday.com:82/gate/big5/finance.eastday.com/eastday/finance1/m/20061109/u1a2432361.html
Leadership Editors（民105年11月2日）。ISO/IEC 27001：2013資訊安全管理系統Information Security Management System , ISMS【網站資料】。Retrieved from https://www.isoleader.com.tw/home/iso-coaching-detail/ISO27001
Statista (2019, April). Most commonly encountered types of malware used in industrial cyber attacks worldwide in 2018 [Web message]. Retrieved from https://www.statista.com/statistics/271037/distribution-of-most-common-malware-file-types/
Statista (2019, July). Distribution of leading Windows malware types as of 1st quarter 2018 [Web message]. Retrieved from
https://www.statista.com/statistics/221506/share-of-new-types-of-malware/
PANDORAFMS (2018, October 10). History of computer viruses: Creeper and Reaper [Web blog message]. Retrieved from
https://pandorafms.com/blog/creeper-and-reaper/
Exabeam (2019, March 5). Creeper: The World’s First Computer Virus [Web blog message]. Retrieved from
https://www.exabeam.com/information-security/creeper-computer-virus/
CNSS (2016, May 6). Committee on National Security Systems (CNSS) Glossary [Web message]. Retrieved from
http://www.cnss.gov/CNSS/issuances/Instructions.cfm
ISO (2013). ISO/IEC 27001:2013(en) Information technology — Security techniques — Information security management systems — Requirements [Web blog message]. Retrieved from
https://www.iso.org/obp/ui/#iso:std:iso-iec:27001:ed-2:v1:en
ISO (2013). ISO/IEC 27002:2013(en) Information technology — Security techniques — Code of practice for information security controls [Web blog message].
Retrieved from
https://www.iso.org/obp/ui/#iso:std:iso-iec:27002:ed-2:v1:en
COMTACT (2019, July 2). WHAT IS THE CIA TRIAD? [Web blog message]. Retrieved from
https://www.comtact.co.uk/blog/what-is-the-cia-triad