Information security management : a case study of an information security culture

This thesis argues that in order to establish a sound information security culture it is necessary to look at organisation's information security systems in a socio- technical context. The motivation for this research stems from the continuing concern of ineffective information security in organisations, leading to potentially significant monetary losses. It is important to address both technical and non- technical aspects when dealing with information security management. Culture has been identified as an underlying determinant of individuals' behaviour and this extends to information security culture, particularly in developing countries. This research investigates information security culture in the Saudi Arabia context. The theoretical foundation for the study is based on organisational and national culture theories. A conceptual framework for this study was constructed based on Peterson and Smith's (1997) model of national culture. This framework guides the study of national, organisational and technological values and their relationships to the development of information security culture. Further, the study seeks to better understand how these values might affect the development and deployment of an organisation's information security culture. Drawing on evidence from three exploratory case studies, an emergent conceptual framework was developed from the traditional human behaviour and the social environment perspectives used in social work, This framework contributes to in- formation security management by identifying behaviours related to four modes of information security practice. These modes provide a sound basis that can be used to evaluate individual organisational members' behaviour and the adequacy of ex- isting security measures. The results confirm the plausibility of the four modes of practice. Furthermore, a final framework was developed by integrating the four modes framework into the research framework. The outcomes of the three case stud- ies demonstrate that some of the national, organisational and technological values have clear impacts on the development and deployment of organisations' informa- tion security culture. This research, by providing an understanding the in uence of national, organi- sational and technological values on individuals' information security behaviour, contributes to building a theory of information security culture development within an organisational context. The research reports on the development of an inte- grated information security culture model that highlights recommendations for developing an information security culture. The research framework, introduced by this research, is put forward as a robust starting point for further related work in this area.

Secure data aggregation in wireless sensor networks

A Wireless Sensor Network (WSN) is a set of sensors that are integrated with a physical environment. These sensors are small in size, and capable of sensing physical phenomena and processing them. They communicate in a multihop manner, due to a short radio range, to form an Ad Hoc network capable of reporting network activities to a data collection sink. Recent advances in WSNs have led to several new promising applications, including habitat monitoring, military target tracking, natural disaster relief, and health monitoring. The current version of sensor node, such as MICA2, uses a 16 bit, 8 MHz Texas Instruments MSP430 micro-controller with only 10 KB RAM, 128 KB program space, 512 KB external ash memory to store measurement data, and is powered by two AA batteries. Due to these unique specifications and a lack of tamper-resistant hardware, devising security protocols for WSNs is complex. Previous studies show that data transmission consumes much more energy than computation. Data aggregation can greatly help to reduce this consumption by eliminating redundant data. However, aggregators are under the threat of various types of attacks. Among them, node compromise is usually considered as one of the most challenging for the security of WSNs. In a node compromise attack, an adversary physically tampers with a node in order to extract the cryptographic secrets. This attack can be very harmful depending on the security architecture of the network. For example, when an aggregator node is compromised, it is easy for the adversary to change the aggregation result and inject false data into the WSN. The contributions of this thesis to the area of secure data aggregation are manifold. We firstly define the security for data aggregation in WSNs. In contrast with existing secure data aggregation definitions, the proposed definition covers the unique characteristics that WSNs have. Secondly, we analyze the relationship between security services and adversarial models considered in existing secure data aggregation in order to provide a general framework of required security services. Thirdly, we analyze existing cryptographic-based and reputationbased secure data aggregation schemes. This analysis covers security services provided by these schemes and their robustness against attacks. Fourthly, we propose a robust reputationbased secure data aggregation scheme for WSNs. This scheme minimizes the use of heavy cryptographic mechanisms. The security advantages provided by this scheme are realized by integrating aggregation functionalities with: (i) a reputation system, (ii) an estimation theory, and (iii) a change detection mechanism. We have shown that this addition helps defend against most of the security attacks discussed in this thesis, including the On-Off attack. Finally, we propose a secure key management scheme in order to distribute essential pairwise and group keys among the sensor nodes. The design idea of the proposed scheme is the combination between Lamport's reverse hash chain as well as the usual hash chain to provide both past and future key secrecy. The proposal avoids the delivery of the whole value of a new group key for group key update; instead only the half of the value is transmitted from the network manager to the sensor nodes. This way, the compromise of a pairwise key alone does not lead to the compromise of the group key. The new pairwise key in our scheme is determined by Diffie-Hellman based key agreement.

Responsibility to Protect and Sovereignty

The responsibility to protect ('R2P') principle articulates the obligations of the international community to prevent conflict occurring, to intervene in conflicts, and to assist in rebuilding after conflicts. The doctrine is about protecting civilians in armed conflicts from four mass atrocity crimes: genocide, war crimes, crimes against humanity and ethnic cleansing. This book examines interventions in East Timor, Sri Lanka, Sudan and Kosovo. The chapters explore and question UN debates with respect to the doctrine both before and after its adoption in 2005; contrasting state attitudes to international military intervention; and what takes place after intervention. It also discusses the ability of the Security Council to access reliable information and credible and transparent processes to enable it to make a determination on the occurrence of atrocities in a Member State. Questioning whether there is a need to find a closer operational link between the responsibilities to prevent and react and a normative link between R2P and principles of international law, the contributions examine the effectiveness of the framework of R2P for international decision-making in response to mass atrocity crimes and ask how an international system to deal with threats and mass atrocities can be developed in the absence of a central authority. This book will be valuable to those interested in international law, human rights, and security, peace and conflict studies

Improving information security management in nonprofit organisations

All organisations, irrespective of size and type, need effective information security management (ISM) practices to protect vital organisational in- formation assets. However, little is known about the information security management practices of nonprofit organisations. Australian nonprofit organisations (NPOs) employed 889,900 people, managed 4.6 million volunteers and contributed $40,959 million to the economy during 2006-2007 (Australian Bureau of Statistics, 2009). This thesis describes the perceptions of information security management in two Australian NPOs and examines the appropriateness of the ISO 27002 information security management standard in an NPO context. The overall approach to the research is interpretive. A collective case study has been performed, consisting of two instrumental case studies with the researcher being embedded within two NPOs for extended periods of time. Data gathering and analysis was informed by grounded theory and action research, and the Technology Acceptance Model was utilised as a lens to explore the findings and provide limited generalisability to other contexts. The major findings include a distinct lack of information security management best practice in both organisations. ISM Governance and risk management was lacking and ISM policy was either outdated or non- existent. While some user focused ISM practices were evident, reference to standards, such as ISO 27002, were absent. The main factor that negatively impacted on ISM practices was the lack of resources available for ISM in the NPOs studied. Two novel aspects of information security dis- covered in this research were the importance of accuracy and consistency of information. The contribution of this research is a preliminary understanding of ISM practices and perceptions in NPOs. Recommendations for a new approach to managing information security management in nonprofit organisations have been proposed.

China and the "Responsibility to Protect" (R2P) : the implications of the Libyan intervention

The emerging principle of a ���responsibility to protect��� (R2P) presents a direct challenge to China's traditional emphasis on the twin principles of non-intervention in the domestic affairs of other states and non-use of military force. This paper considers the evolution of China���s relationship with R2P over the past ten years. In particular, it examines how China engaged with R2P during the recent Libyan crisis, and considers what impact this conflict may have first, on Chinese attitudes to R2P, and second, on the future development and implementation of the doctrine itself. This paper argues that China���s decision to allow the passage of Security Council resolution 1973, authorising force in Libya, was shaped by an unusual set of pragmatic considerations, and should not be viewed as evidence of a dramatic shift in Chinese attitudes towards R2P. More broadly, controversy over the scope of NATO's military action in Libya has raised questions about R2P���s legitimacy, which has contributed to a lack of timely international action in Syria and Yemen. In the short term at least, this post-Libya backlash against R2P is likely to constrain the Security Council���s ability to respond decisively to other civilian protection situations.

Enabling sustainable property practices by ensuring security of tenure

Sustainable property practices will be essential for Australia���s future. The various levels of government offer incentives aimed at encouraging residents to participate in sustainable practices. Many of these programmes however are only accessible by owner occupiers, or landlords and tenants with long term tenancies. Improving security of tenure for tenants, to enable longer term tenancies, would positively impact upon property practices. This article explains what security of tenure is and identifies how a lack of security of tenure adversely impacts property practices. By comparison with Genevan property practices, it concludes by making suggestions as to how security of tenure can be reinforced.

Introduction to special issue on what criminology can say about the war on terror

On 20 September 2001, the former US President, George W. Bush, declared what is now widely, and arguably infamously, known as a ���war on terror���. In response to the fatal 9/11 attacks in New York and Washington, DC, President Bush identified the US military response as having far-reaching and long-lasting consequences. It was, he argued, ���our war on terror��� that began ���with al Qaeda, but ��� it will not end until every terrorist group of global reach has been found, stopped and defeated��� (CNN 2001). This was to be a war that would, in the words of former British Prime Minister, Tony Blair, seek to eliminate a threat that was ���aimed at the whole democratic world��� (Blair 2001). Blair claimed that this threat is of such magnitude that unprecedented measures would need to be taken to uphold freedom and security. Blair would later admit that it was a war that ���divided the country��� and was based on evidence ���about Saddam having actual biological and chemical weapons, as opposed to the capability to develop them, has turned out to be wrong��� (Blair 2004). The failures of intelligence ushered in new political rhetoric in the form of ���trust me��� because ���instinct is no science��� (Blair 2004). The war on terror has been one of the most significant international events in the past three decades, alongside the collapse of the former Soviet Union, the end of apartheid in South Africa, the unification of Europe and the marketization of the People's Republic of China. Yet, unlike the other events, it will not be remembered for advancing democracy or sovereignty, but for the conviction politics of particular politicians who chose to dispense with international law and custom in pursuit of personal instincts that proved fatal. Since the invasions of Afghanistan in October 2001 and ���

Enterprise information security policy assessment : an extended framework for metrics development utilising the goal-question-metric approach

Effective enterprise information security policy management requires review and assessment activities to ensure information security policies are aligned with business goals and objectives. As security policy management involves the elements of policy development process and the security policy as output, the context for security policy assessment requires goal-based metrics for these two elements. However, the current security management assessment methods only provide checklist types of assessment that are predefined by industry best practices and do not allow for developing specific goal-based metrics. Utilizing theories drawn from literature, this paper proposes the Enterprise Information Security Policy Assessment approach that expands on the Goal-Question-Metric (GQM) approach. The proposed assessment approach is then applied in a case scenario example to illustrate a practical application. It is shown that the proposed framework addresses the requirement for developing assessment metrics and allows for the concurrent undertaking of process-based and product-based assessment. Recommendations for further research activities include the conduct of empirical research to validate the propositions and the practical application of the proposed assessment approach in case studies to provide opportunities to introduce further enhancements to the approach.

Stakeholder service delivery expectations of military facilities management

Purpose ��� The purpose of this paper is to examine the quality of service of a South East Asian country's military facilities management organisation. Design/methodology/approach ��� An interview survey and questionnaire survey were used to obtain a description and summary of stakeholders��� expectations and the extent to which they were being satisfied by the services provided. Findings ��� The method provides a useful means of identifying and prioritising varying expectations between stakeholder groups and of indicating any mismatch in expectations in the management of military facilities. Social implications ��� The development and use of a method to test and improve the effectiveness and efficiency of the management of military facilities helps in providing better value for money. Originality/value ��� In addition to re-affirming Parasuraman's overall dimensions of service expectation, the empirical summary of the stakeholders��� expectations obtained in this way is of practical value for the service provider in developing a strategy for expectation management. For the case studied, it is also apparent that although the current processes in service delivery are well understood by all involved stakeholders, there is a need for further improvement with regards to their expectation levels. It is also one of the very few reported studies on the management of military facilities.

Improvising a future in the performing arts : a new strategy to help performance studies students successfully shift between academic culture, professional culture, industry and career?

If there is one thing performance studies graduates should be good at, it is improvising ��� play and improvisation are central to the contemporary and cultural performance practices we teach and the methods by which we teach them. Objective, offer, acceptance, advancing, reversing, character, status, manipulation, impression management, relationship management ��� whether we know them from Keith Johnson���s theatre theories or Erving Goffman���s theatre theories, the processes by which we play out a story, scenario or social situation to our own benefit are familiar. We understand that identity, action, interaction and its personal, aesthetic, professional or political outcomes are unpredictable, and that we need to adapt to changeable and uncertain circumstances to achieve our aims. Intriguingly, though, in a Higher Education environment that increasingly emphasises employability, skills in play, improvisation and self-performance are never cited as critical graduate attributes. Is the ability to play, improve and produce spontaneous new self-performances learned in the academy worth articulating into an ability to play, improvise and product spontaneous new self-performances after graduates leave the academy and move into the role of a performing arts professional in industry? A study of the career paths of our performance studies graduates over the past decade suggests that addressing the challenges they face in moving between academic culture, professional culture, industry and career in terms of improvisation and play principles may be very productive. In articles on performing arts careers, graduates are typically advised to find a market for their work, and develop career self-management, management and marketing skills, together with an ability to find, make and maintain relationships and opportunities for themselves. Transitioning to career is cast as a challenging process, requiring these skills, because performing arts careers do not offer the security, status and stability of other careers. Our data confirms this. In our study, though, we found that strategies commonly used to build the resilience, self-reliance and persistence graduates require ��� talking about portfolio careers, parallel careers, and portable, transferable or translatable skills, for example ��� can engender panic as easily as they engender confidence. In this paper, I consider what happens when we re-articulate some of the skills scholars and industry stakeholders argue are critical in allowing graduates to shift successfully from academy to industry in terms of skills like improvisation, play and self-performance that are already familiar, meaningful and much-practiced amongst performance studies graduates.

What are the implications of peri-urban agriculture on food security in Australian cities?

Background: Periurban agriculture refers to agricultural practice occurring in areas with mixed rural and urban features. It is responsible 25% of the total gross value of economic production in Australia, despite only comprising 3% of the land used for agriculture. As populations grows and cities expand, they are constantly absorbing surrounding fringe areas, thus creating a new fringe, further from the city causing the periurban region to constantly shift outwards. Periurban regions are fundamental in the provision of fresh food to city populations and residential (and industrial) expansion taking over agricultural land has been noted as a major worldwide concern. Another major concern around the increase in urbanisation and resultant decrease in periurban agriculture is its potential effect on food security. Food security is the availability or access to nutritionally-adequate, culturally-relevant and safe foods in culturally-appropriate ways. Thus food insecurity occurs when access to or availability of these foods is compromised. There is an important level of connectedness between food security and food production and a decrease in periurban agriculture may have adverse effects on food security. A decrease in local, seasonal produce may result in a decrease in the availability of products and an increase in cost, as food must travel greater distances, incurring extra costs present at the consumer level. Currently, few Australian studies exist examining the change in periurban agriculture over time. Such information may prove useful for future health policy and interventions as well as infrastructure planning. The aim of this study is to investigate changes in periurban agriculture among capital cities of Australia. Methods: We compared data pertaining to selected commodities from the Australian Bureau of Statistics 2000-01 and 2005 -2006 Agricultural Census. This survey is distributed online or via mail on a five-yearly basis to approximately 175,000 Agricultural business to ascertain information on a range of factors, such as types of crops, livestock and land preparation practices. For the purpose of this study we compared the land being used for total crops, and cereal , oil seed, legume, fruit and vegetable crops separately. Data was analysed using repeated measures anova in spss. Results: Overall, total area available for crops in urbanised areas of Australia increased slightly by 1.8%. However, Sydney, Melbourne, Adelaide and Perth experienced decreases in the area available for fruit crops by 11%, 5%,and 4% respectively. Furthermore, Brisbane and Perth experienced decreases in land available for vegetable crops by 28% and 14% respectively. Finally, Sydney, Adelaide and Perth experienced decreases in land available for cereal crops by 10 ��� 79%. Conclusions: These findings suggest that population increases and consequent urban sprawl may be resulting in a decrease in peri-urban agriculture, specifically for several core food groups including fruit, breads and grain based foods. In doing so, access to or availability of these foods may be limited, and the cost of these foods is likely to increase, which may compromise food insecurity for certain sub-groups of the population.

Militarism and International Relations : Political economy, security, theory, edited by Anna Stavrianakis and Jan Selby, Abingdon, Routledge, 2012, 212 pp., ��80.00 (hardback), ISBN 978-0-415-61491-7

An engaging narrative is maintained throughout this edited collection of articles that address the issue of militarism in international relations. The book seamlessly integrates historical and contemporary perspectives on militarism with theory and relevant international case studies, resulting in a very informative read. The work is comprised of three parts. Part 1 deals with the theorisation of militarism and includes chapters by Anna Stavrianakis and Jan Selby, Martin Shaw, Simon Dalby, and Nicola Short. It covers a range of topics relating to historical and contemporary theories of militarism, geopolitical threat construction, political economy, and the US military���s ���cultural turn���.

Indigenous knowledge and IP food security : a review of concepts and cases

D��wat, Pamah��nd��, Taw��d, S��gda, Lamp��sa, Ibab��sok, Lap��t, Panedl��k: for most of us gathered here, these are words that we don���t usually use in our daily lives. Others may consider them as exotic, alien, funny and even backward. However, for indigenous kindred among us, these words denote an intimate identity and deep understanding of the world around them. It constitutes a broader knowledge system, be written or otherwise, which guides them in the management of resources within their ancestral land. This paper will provide a brief theoretical framework of the concepts of indigenous knowledge systems���hereinafter called IKS, and indigenous peoples food security, and hopefully a deeper or continued appreciation in the study of both concepts in general.

Security ceremonies : including humans in cryptographic protocols

Whether by using electronic banking, by using credit cards, or by synchronising a mobile telephone via Bluetooth to an in-car system, humans are a critical part in many cryptographic protocols daily. We reduced the gap that exists between the theory and the reality of the security of these cryptographic protocols involving humans, by creating tools and techniques for proofs and implementations of human-followable security. After three human research studies, we present a model for capturing human recognition; we provide a tool for generating values called Computer-HUman Recognisable Nonces (CHURNs); and we provide a model for capturing human perceptible freshness.

Co-production of actions and activities at airport security screening

In this paper we will examine passenger actions and activities at the security screening points of Australian domestic and international airports. Our findings and analysis provide a more complete understanding of the current airport passenger security screening experience. Data in this paper is comprised of field studies conducted at two Australian airports, one domestic and one international. Video data was collected by cameras situated either side of the security screening point. A total of one hundred and ninety-six passengers were observed. Two methods of analysis are used. First, the activities of passengers are coded and analysed to reveal the common activities at domestic and international security regimes and between quiet and busy periods. Second, observation of passenger activities is used to reveal uncommon aspects. The results show that passengers do more at security screening that being passively scanned. Passengers queue, unpack the required items from their bags and from their pockets, walk through the metal-detector, re-pack and occasionally return to be re-screened. For each of these activities, passengers must understand the procedures at the security screening point and must co-ordinate various actions and objects in time and space. Through this coordination passengers are active participants in making the security checkpoint function ��� they are co-producers of the security screening process.