Enterprise information security policy assessment : an extended framework for metrics development utilising the goal-question-metric approach

Effective enterprise information security policy management requires review and assessment activities to ensure information security policies are aligned with business goals and objectives. As security policy management involves the elements of policy development process and the security policy as output, the context for security policy assessment requires goal-based metrics for these two elements. However, the current security management assessment methods only provide checklist types of assessment that are predefined by industry best practices and do not allow for developing specific goal-based metrics. Utilizing theories drawn from literature, this paper proposes the Enterprise Information Security Policy Assessment approach that expands on the Goal-Question-Metric (GQM) approach. The proposed assessment approach is then applied in a case scenario example to illustrate a practical application. It is shown that the proposed framework addresses the requirement for developing assessment metrics and allows for the concurrent undertaking of process-based and product-based assessment. Recommendations for further research activities include the conduct of empirical research to validate the propositions and the practical application of the proposed assessment approach in case studies to provide opportunities to introduce further enhancements to the approach.

Comments on the Australian Accounting Research Foundation's Legislation Policy Discussion Paper NO.4 (A framework for financial reporting by incorporated associations)

The Australian Accounting Research Foundation (AARF) recently issued Legislative Policy Discussion Paper No.4 which proposes a framework for financial reporting by Australian incorporated associations.This paper comments on both the merits and deficiencies of the proposal. In particular it notes that the proposal simply advocates that the application of differential reporting, accounting standards, and the conceptual framework be imposed on incorporated associations by amended statutes. It is noted that in light of long experience in the corporate sector, he espoused benefits of such a move may not eventuate. Further, concern is expressed that the proposal is a blank cheque one because of the inadequacy of existing relevant accounting standards and the proposal to introduce new relevant standards. Another major defect in the proposal is that it emanates from accountants who acknowledge in their conceptual framework, the need for external reports to report on performance through both financial and non-financial reporting methods. Despite that acknowledgment, the standard set of external reports prepared by accountants do not measure performance as defined in their own conceptual framework (SAC 2) and in their auditing pronouncements (AUP 33), and they have restricted their domain to financial reporting (SAC 2). Accordingly the proposal appears to be seriously deficient and it is suggested that it be rejected and a new proposal be prepared by a multi-party group free from vested interests.

Sharing environmental data : the role of an information policy framework and copyright licensing

Advances in information and communication technologies have brought about an information revolution, leading to fundamental changes in the way that information is collected or generated, shared and distributed. The importance of establishing systems in which research findings can be readily made available to and used by other researchers has long been recognized in international scientific collaborations. If the data access principles adopted by international scientific collaborations are to be effectively implemented they must be supported by the national policies and laws in place in the countries in which participating researchers are operating.

Enabling access to research data in developing countries : designing a policy and practice framework for Malaysia’s Public Research Universities

Members of the World Trade Organisation (WTO) are obliged to implement the Agreement on Trade-related Intellectual Property Rights 1994 (TRIPS) which establishes minimum standards for the protection and enforcement of intellectual property rights. Almost two decades after TRIPS was adopted at the conclusion of the Uruguay Round of trade negotiations, it is widely accepted that intellectual property systems in developing and least-developed countries must be consistent with, and serve, their development needs and objectives. In adopting the Development Agenda in 2007, the World Intellectual Property Organisation (WIPO) emphasised the importance to developing and least-developed countries of being able to obtain access to knowledge and technology and to participate in collaborations and exchanges with research and scientific institutions in other countries. Access to knowledge, information and technology is crucial if creativity and innovation is to be fostered in developing and least-developed countries. It is particularly important that developing and least-developed countries give effect to their TRIPS obligations by implementing intellectual property systems and adopting intellectual property management practices that enable them to benefit from knowledge flows and support their engagement in international research and science collaborations. However, developing and least-developed countries did not participate in the deliberations leading to the adoption in 2004 by Organisation for Economic Co-operation and Development (OECD) member countries of the Ministerial Declaration on Access to Research Data from Public Funding, nor have they formulated policies on access to publicly funded research outputs such as those developed by the National Institutes of Health in the United States, the United Kingdom Research Councils or the Australian National Health and Medical Research Council. These issues are considered from the viewpoint of Malaysia, a developing country whose economy has grown strongly in recent years. Lacking an established policy covering access to the outputs of publicly funded research, data sharing and licensing practices continue to be fragmented. Obtaining access to research data requires arrangements to be negotiated with individual data owners and custodians. Given the potential for restrictions on access to impact negatively on scientific progress and development in Malaysia, measures are required to ensure that access to knowledge and research results is facilitated. This paper proposes a policy framework for Malaysia‘s public research universities that recognises intellectual property rights while enabling the open access to research data that is essential for innovation and development. It also considers how intellectual property rights in research data can be managed in order to give effect to the policy‘s open access objectives.

Competition policy review : draft recommendations on competition laws

On 4 December 2013, the Prime Minister and the Minister for Small Business announced a “root and branch” review of Australia’s competition policy. The Minister for Small Business released the final Terms of Reference for the competition policy review on 27 March 2014, following consultation with the States and Territories, and announced the Review Panel headed by Professor Ian Harper. Under the terms of reference the Competition Policy Review Committee (the Harper Committee) is required to focus on three broad areas: •examining what can be done to create more competition in service areas such as health, education and intellectual property; •considering whether the structure and powers of the competition institutions (the ACCC , the NCC, the Tribunal and the AER) remain appropriate; and •examining the effectiveness of the competition provisions of the Competition and Consumer Act 2010 (Cth) (CCA) and laying down a broad framework through which the law can be streamlined and reformed over time.

Reframe QUT's evaluation framework : a case study of planning, policy and positioning leading to educational best practice

Every university in Australia has a set of policies that guide the institution in its educational practices, however, the policies are often developed in isolation to each other. Now imagine a space where policies are evidence-based, refined annually, cohesively interrelated, and meet stakeholders’ needs. Is this happenstance or the result of good planning? Culturally, Queensland University of Technology (QUT) is a risk-averse institution that takes pride in its financial solvency and is always keen to know “how are we going?” With a twenty-year history of annual reporting that assures the quality of course performance through multiple lines of evidence, QUT’s Learning and Teaching Unit went one step further and strategically aligned a suite of policies that take into consideration the needs of their stakeholders, collaborate with other areas across the institution and use multiple lines of evidence to inform curriculum decision-making. In QUT’s experience, strategic planning can lead to policy that is designed to meet stakeholders’ needs, not manage them; where decision-making is supported by evidence, not rhetoric; where all feedback is incorporated, not ignored; and where policies are cohesively interrelated, not isolated. While many may call this ‘policy nirvana’, QUT has positioned itself to demonstrate good educational practice through Reframe, its evaluation framework. In this case, best practice was achieved through the application of a theory of change and a design-led logic model that allows for transition to other institutions with different cultural specificity. The evaluation approach follows Seldin’s (2003) notion to offer depth and breadth to the evaluation framework along with Berk’s (2005) concept of multiple lines of evidence. In summary, this paper offers university executives, academics, planning and quality staff an opportunity to understand the critical steps that lead to strategic planning and design of evidence-based educational policy that positions a university for best practice in learning and teaching.

A primer in public policy for the construction industry

The purpose of this document is to introduce non-specialists to the discipline and practice of public policy, particularly in relation to the construction sector in Australia. In order to do this, a brief overview of Australia’s government structure, and some of the main approaches to public policy analysis are outlined. Reference to construction related examples are provided to ensure issues discussed are relevant and understandable to construction professionals. Government is a significant player in the construction industry, and has multiple roles: adjudicator, regulator, constructor, purchaser and client of construction projects. Moreover there are many spheres of government that are typically engaged in construction projects at multiple stages. The machinery of government can be difficult to understand, even for long term public servants. Demystifying the processes within government can help to improve communication and therefore performance in the industry. A better understanding of how policy-making and government policies affect the construction industry will enhance communication and assist construction professionals and academics to understand and work with government. Additionally the document will provide an opportunity to demonstrate the relevance of policy analysis to inquiries of construction policies and regulation.

Developing a consumer policy for the 21st century

In light of the Productivity Commission's inquiry into Australia's consumer policy framework and administration, this article explores three assumptions that have underpinned our consumer protection framework to date: assumptions about the benefits of competition, self-regulation, and information. It argues that the benefits can be over-stated, and do not always reflect the reality of consumer experience. The article calls for the development of an overarching framework or principles document, with a more moderated approach to competition, self-regulation and information. While the Productivity Commission's draft report has admirably dealt with many of these issues, there is scope for the proposed objectives and recommendations in the final report to reflect more consistently the disparate impact of markets and competition on consumers, and the findings of behavioural economics.

Advancing e-learning policy and practice : influences on academics’ adoption, integration and development of multimodal e-learning courses

Tertiary education is increasingly a contested space where advances in Information Communications Technologies and their application to technology-mediated e-learning environments have forced university administrators and educators to dislocate themselves from traditional correspondence modes of student engagement. Compounding this paradigmatic shift within the traditional sphere of distance education pedagogy are multiple and conflicting pressures on academics to develop flexible, engaging, cost-effective and sustainable interactive learning resources that incorporate both multimedia and hypermedia. This chapter reports on a study that examined factors that influence educators’ decision to adopt and integrate educational technology and convert traditional print-based distance education materials into interactive multimodal e-learning formats. Although the broader study was conducted in a single Australian university and investigated pedagogical, institutional and individual factors, this chapter restricts its focus to solely the pedagogical motivations and concerns of educators. It is argued that findings from the study have significance at the institutional level, particularly in terms of developing an underlying pedagogical rationale that can permeate the e-learning culture throughout the university, while at the same time, providing a roadmap for educators who are yet to fully engage with the e-learning format.

Multi-level order, friction and contradiction : the evolution of Australian film industry policy

Cultural policy studies have previously highlighted the importance of multiple logics, friction and contradiction in cultural policy. Recent developments in institutional theory provide a framework for analysing change in cultural policy which explores movement between these multiple and sometimes contradictory logics. This paper analyses the role of friction in the evolution of Australian film industry policy and in particular the tension between competing logics regarding nationalism, commercialism and the state. The paper is suggestive of the relevance of institutional theory as a framework for understanding cultural policy evolution.

A framework for network RTK data processing based on grid computing

Real-Time Kinematic (RTK) positioning is a technique used to provide precise positioning services at centimetre accuracy level in the context of Global Navigation Satellite Systems (GNSS). While a Network-based RTK (N-RTK) system involves multiple continuously operating reference stations (CORS), the simplest form of a NRTK system is a single-base RTK. In Australia there are several NRTK services operating in different states and over 1000 single-base RTK systems to support precise positioning applications for surveying, mining, agriculture, and civil construction in regional areas. Additionally, future generation GNSS constellations, including modernised GPS, Galileo, GLONASS, and Compass, with multiple frequencies have been either developed or will become fully operational in the next decade. A trend of future development of RTK systems is to make use of various isolated operating network and single-base RTK systems and multiple GNSS constellations for extended service coverage and improved performance. Several computational challenges have been identified for future NRTK services including: • Multiple GNSS constellations and multiple frequencies • Large scale, wide area NRTK services with a network of networks • Complex computation algorithms and processes • Greater part of positioning processes shifting from user end to network centre with the ability to cope with hundreds of simultaneous users’ requests (reverse RTK) There are two major requirements for NRTK data processing based on the four challenges faced by future NRTK systems, expandable computing power and scalable data sharing/transferring capability. This research explores new approaches to address these future NRTK challenges and requirements using the Grid Computing facility, in particular for large data processing burdens and complex computation algorithms. A Grid Computing based NRTK framework is proposed in this research, which is a layered framework consisting of: 1) Client layer with the form of Grid portal; 2) Service layer; 3) Execution layer. The user’s request is passed through these layers, and scheduled to different Grid nodes in the network infrastructure. A proof-of-concept demonstration for the proposed framework is performed in a five-node Grid environment at QUT and also Grid Australia. The Networked Transport of RTCM via Internet Protocol (Ntrip) open source software is adopted to download real-time RTCM data from multiple reference stations through the Internet, followed by job scheduling and simplified RTK computing. The system performance has been analysed and the results have preliminarily demonstrated the concepts and functionality of the new NRTK framework based on Grid Computing, whilst some aspects of the performance of the system are yet to be improved in future work.

National consumer credit laws, financial exclusion and interest rate caps : The case for diversity within a centralised framework

Australia is going through a major reform of consumer credit regulation, with the implementation of a proposal to transfer regulatory responsibility from the State and Territory Governments to the Commonwealth Government. While the broad policy approach is supported, the reform process has missed a significant opportunity to engage directly with issues of financial exclusion and with the potential role of regulation to reduce financial exclusion. The imposition of an interest rate cap can limit the impact of financial exclusion. However, the future of the existing interest rate caps is uncertain, given the diversity of approaches, and the heated debate that surrounds this issue. In the absence of support for regulatory initiatives to increase the availability of low cost, small loans, permitting regulatory diversity on this issue of interest rate caps, within an otherwise centralised regulatory framework., can minimise the impact of financial exclusion on consumers.

In Pursuit of Excellence : A Policy Driven Systemic Initiative to Embed Gifted Education

Embedding gifted education practices requires major professional development strategies supported by transparent, credible and enforceable policy. This paper describes an analysis of a state-wide initiative involving the establishment of a series of schools tasked to develop and disseminate gifted education principles. The authors have been involved with this initiative at a number of levels over a ten-year period. Their involvement culminated in a commissioned review of the program. Extensive qualitative data were purposively collected from all stakeholders and the effectiveness of the initiative is examined from a theoretical framework of policy development and excellence. The findings summarised in this proposal, indicate the achievement of excellence at a systemic level was constrained by lack of vision, leadership and commitment to long term achievements of excellence. At a local level evidence exists that excellence can be manifested when there is synchronicity of vision, purpose, decisions, and actions.

A Proposed Framework for Understanding Information Security Culture and Practices in the Saudi Context

An examination of Information Security (IS) and Information Security Management (ISM) research in Saudi Arabia has shown the need for more rigorous studies focusing on the implementation and adoption processes involved with IS culture and practices. Overall, there is a lack of academic and professional literature about ISM and more specifically IS culture in Saudi Arabia. Therefore, the overall aim of this paper is to identify issues and factors that assist the implementation and the adoption of IS culture and practices within the Saudi environment. The goal of this paper is to identify the important conditions for creating an information security culture in Saudi Arabian organizations. We plan to use this framework to investigate whether security culture has emerged into practices in Saudi Arabian organizations.