Capturing industry experience for an effective information security assessment. - Shu-Chuan Chao; Kuanchin Chen; Chien-Hua Lin (Int. J. Inf. Syst. Chang. Manag., 2006)