"The Duality of Information Security Management: Fighting Against Predictable and Unpredictable Threat." Journal of Information Systems Security (2008).