Insider threats: the major challenge to security risk management

Security risk management is by definition, a subjective and complex exercise and it takes time to perform properly. Human resources are fundamental assets for any organization, and as any other asset, they have inherent vulnerabilities that need to be handled, i.e. managed and assessed. However, the nature that characterize the human behavior and the organizational environment where they develop their work turn these task extremely difficult, hard to accomplish and prone to errors. Assuming security as a cost, organizations are usually focused on the efficiency of the security mechanisms implemented that enable them to protect against external attacks, disregarding the insider risks, which are much more difficult to assess. All these demands an interdisciplinary approach in order to combine technical solutions with psychology approaches in order to understand the organizational staff and detect any changes in their behaviors and characteristics. This paper intends to discuss some methodological challenges to evaluate the insider threats and its impacts, and integrate them in a security risk framework, that was defined according to the security standard ISO/IEC_JTC1, to support the security risk management process.

Design of a case-based reasoner for information security in military organizations

Information security is concerned with the protection of information, which can be stored, processed or transmitted within critical information systems of the organizations, against loss of confidentiality, integrity or availability. Protection measures to prevent these problems result through the implementation of controls at several dimensions: technical, administrative or physical. A vital objective for military organizations is to ensure superiority in contexts of information warfare and competitive intelligence. Therefore, the problem of information security in military organizations has been a topic of intensive work at both national and transnational levels, and extensive conceptual and standardization work is being produced. A current effort is therefore to develop automated decision support systems to assist military decision makers, at different levels in the command chain, to provide suitable control measures that can effectively deal with potential attacks and, at the same time, prevent, detect and contain vulnerabilities targeted at their information systems. The concept and processes of the Case-Based Reasoning (CBR) methodology outstandingly resembles classical military processes and doctrine, in particular the analysis of “lessons learned” and definition of “modes of action”. Therefore, the present paper addresses the modeling and design of a CBR system with two key objectives: to support an effective response in context of information security for military organizations; to allow for scenario planning and analysis for training and auditing processes.

VET: a strategic approach for economic, organisational and personal development in EU countries

Vocational Education and Training (VET) is a continuous long-term process of economic, organisational and personal development. It envisions the construction of dynamic skills to improve performance, productivity and organisational, personal and social development. This article focuses on generating skills. It frames training as a process of work-linked training and as a primary source for generating skills whilst seeking to boost creativity. It sheds light upon the discussion pertaining to learning transfer as a necessary condition to structure performance and competitiveness. It highlights the Learning Transfer System Inventory (LTSI), because it allows to measure the effectiveness of training and it identifies the organisations' weaknesses. The data used were collected from the Eurostat Database.

Videovigilância: privacidade e segurança: análise especial da situação do trabalhador

Dissertação de mestrado em Direitos Humanos

Factores de risco de abuso no relacionamento íntimo: Estudo de validação da versão portuguesa do questionário “Personal and Relationships Profile”

O presente artigo trata do estudo das características psicométricas da versão portuguesa do questionário “Personal and Relationships Profile" (PRP, Straus, Hamby, Boney-McCoy, & Sugarman, 1999). Este instrumento destina-se a avaliar os principais factores relacionados com a ocorrência de abuso no relacionamento com o companheiro; integra 21 sub-escalas substantivas e uma sub-escala de desejabilidade social. Foram participantes 551 estudantes universitários (60.3% do sexo feminino), na sua maioria com idades compreendidas entre os 19 e os 25 anos e com uma relação do tipo namoro. O questionário apresenta elevada consistência interna (α=.90), e as sub-escalas têm valores de alpha de Cronbach compreendidos entre .50 e .84. Confirma-se também a validade externa dado que um elevado número de sub-escalas do PRP, se encontra significativamente correlacionado com a escala de abuso físico sem sequelas (CT52). Os resultados obtidos confirmam a validade da versão portuguesa do questionário PRP, possibilitando a investigadores e práticos no âmbito das relações maritais um instrumento de screening para sinalização, aprofundamento e orientação das linhas de acção específicas no tratamento e/ou investigação dos principais factores associados à violência conjugal.