Information security culture : a behaviour compliance conceptual framework

Understanding the complex dynamic and uncertain characteristics of organisational employees who perform authorised or unauthorised information security activities is deemed to be a very important and challenging task. This paper presents a conceptual framework for classifying and organising the characteristics of organisational subjects involved in these information security practices. Our framework expands the traditional Human Behaviour and the Social Environment perspectives used in social work by identifying how knowledge, skills and individual preferences work to influence individual and group practices with respect to information security management. The classification of concepts and characteristics in the framework arises from a review of recent literature and is underpinned by theoretical models that explain these concepts and characteristics. Further, based upon an exploratory study of three case organisations in Saudi Arabia involving extensive interviews with senior managers, department managers, IT managers, information security officers, and IT staff; this article describes observed information security practices and identifies several factors which appear to be particularly important in influencing information security behaviour. These factors include values associated with national and organisational culture and how they manifest in practice, and activities related to information security management.

Mining Negative Relevance Feedback for Information Filtering

It is a big challenge to clearly identify the boundary between positive and negative streams. Several attempts have used negative feedback to solve this challenge; however, there are two issues for using negative relevance feedback to improve the effectiveness of information filtering. The first one is how to select constructive negative samples in order to reduce the space of negative documents. The second issue is how to decide noisy extracted features that should be updated based on the selected negative samples. This paper proposes a pattern mining based approach to select some offenders from the negative documents, where an offender can be used to reduce the side effects of noisy features. It also classifies extracted features (i.e., terms) into three categories: positive specific terms, general terms, and negative specific terms. In this way, multiple revising strategies can be used to update extracted features. An iterative learning algorithm is also proposed to implement this approach on RCV1, and substantial experiments show that the proposed approach achieves encouraging performance.

Improving the Traversal of Large Hierarchical Process Repositories

Business Process Management (BPM) has increased in popularity and maturity in recent years. Large enterprises engage use process management approaches to model, manage and refine repositories of process models that detail the whole enterprise. These process models can run to the thousands in number, and may contain large hierarchies of tasks and control structures that become cumbersome to maintain. Tools are therefore needed to effectively traverse this process model space in an efficient manner, otherwise the repositories remain hard to use, and thus are lowered in their effectiveness. In this paper we analyse a range of BPM tools for their effectiveness in handling large process models. We establish that the present set of commercial tools is lacking in key areas regarding visualisation of, and interaction with, large process models. We then present six tool functionalities for the development of advanced business process visualisation and interaction, presenting a design for a tool that will exploit the latest advances in 2D and 3D computer graphics to enable fast and efficient search, traversal and modification of process models.

Designing the Future

While there have been improvements in Australian engineering education since the 1990s, there are still strong concerns that more progress needs to be made, particularly in the areas of developing graduate competencies and in outcomes-based curricula. This paper reports on the findings from a two-day ALTC-funded forum that sought to establish a shared understanding with the 3 stakeholders (students, academics and industry) about how to achieve a design-based engineering curriculum. This paper reports on the findings from the first day’s activities and reveals that there is a shared desire for design and project-based curricula that would encourage the development of the ‘three-dimensional’ graduate: one who has technical, personal and professional and systems-thinking/design-based competence.

Graduate Attribute Mapping With the Extended CDIO Framework

The CDIO (Conceive-Design-Implement-Operate) Initiative has been globally recognised as an enabler for engineering education reform. With the CDIO process, the CDIO Standards and the CDIO Syllabus, many scholarly contributions have been made around cultural change, curriculum reform and learning environments. In the Australasian region, reform is gaining significant momentum within the engineering education community, the profession, and higher education institutions. This paper presents the CDIO Syllabus cast into the Australian context by mapping it to the Engineers Australia Graduate Attributes, the Washington Accord Graduate Attributes and the Queensland University of Technology Graduate Capabilities. Furthermore, in recognition that many secondary schools and technical training institutions offer introductory engineering technology subjects, this paper presents an extended self-rating framework suited for recognising developing levels of proficiency at a preparatory level. A demonstrator mapping tool has been created to demonstrate the application of this extended graduate attribute mapping framework as a precursor to an integrated curriculum information model.

Addressing Challenges for Internationalisation and Mobility in Engineering Through CDIO Standards

There is a growing need for international transparency of engineering qualifications, and mechanisms to support and facilitate student mobility. In response, there are a number of global initiatives attempting to address these needs, particularly in Europe, North America and Australia. The Conceive-Design-Implement-Operate (CDIO) Initiative has a set of standards, competencies, and proficiency levels developed through a global community of practice. It is a well-structured framework in which best-practice internationalisation and student mobility can be embedded. However, the current 12 CDIO Standards do not address international qualifications or student mobility. Based on an environmental scan of global activities, the underpinning principles of best practice are identified and form the basis of the proposed 13th CDIO Standard — “Internationalization and Mobility”.

The moment of exchange : risk, vulnerability, responsibility

Any cycle of production and exchange – be it economic, cultural or aesthetic – involves an element of risk. It involves uncertainty, unpredictability, and a potential for new insight and innovation (the boom) as well as blockages, crises and breakdown (the bust). In performance, the risks are plentiful – economic, political, social, physical and psychological. The risks people are willing to take depend on their position in the exchange (performer, producer, venue manager or spectator), and their aesthetic preferences. This paper considers the often uncertain, confronting or ‘risky’ moment of exchange between performer, spectator and culture in Live Art practices. Encompassing body art, autobiographical art, site-specific art and other sorts of performative intervention in the public sphere, Live Art eschews the artifice of theatre, breaking down barriers between art and life, artist and spectator, to speak back to the public sphere, and challenge assumptions about bodies, identities, memories, relationships and histories. In the process, Live Art frequently privileges an uncertain, confrontational or ‘risky’ mode of exchange between performer, spectator and culture, as a way of challenging power structures. This paper examines the moment of exchange in terms of risk, vulnerability, responsibility and ethics. Why the romance with ‘risky’ behaviours and exchanges? Who is really taking a risk? What risk? With whose permission (or lack thereof)? What potential does a ‘risky’ exchange hold to destabilise aesthetic, social or political norms? Where lies the fine line between subversive intervention in the public sphere and sheer self-indulgence? What are the social and ethical implications of a moment of exchange that puts bodies, beliefs or social boundaries at ‘risk’? In this paper, these questions are addressed with reference to historical and contemporary practices under the broadly defined banner of Live Art, from the early work of Abrovamic and Burden, through to contemporary Australian practitioners like Fiona McGregor.

Data-driven impostor selection for T-norm score normalisation and the background dataset in SVM-based speaker verification

A data-driven background dataset refinement technique was recently proposed for SVM based speaker verification. This method selects a refined SVM background dataset from a set of candidate impostor examples after individually ranking examples by their relevance. This paper extends this technique to the refinement of the T-norm dataset for SVM-based speaker verification. The independent refinement of the background and T-norm datasets provides a means of investigating the sensitivity of SVM-based speaker verification performance to the selection of each of these datasets. Using refined datasets provided improvements of 13% in min. DCF and 9% in EER over the full set of impostor examples on the 2006 SRE corpus with the majority of these gains due to refinement of the T-norm dataset. Similar trends were observed for the unseen data of the NIST 2008 SRE.

Scatter difference NAP for SVM speaker recognition

This paper presents Scatter Difference Nuisance Attribute Projection (SD-NAP) as an enhancement to NAP for SVM-based speaker verification. While standard NAP may inadvertently remove desirable speaker variability, SD-NAP explicitly de-emphasises this variability by incorporating a weighted version of the between-class scatter into the NAP optimisation criterion. Experimental evaluation of SD-NAP with a variety of SVM systems on the 2006 and 2008 NIST SRE corpora demonstrate that SD-NAP provides improved verification performance over standard NAP in most cases, particularly at the EER operating point.

Authentic assessment of work integrated learning

The paper examines how poster presentations can be used to authentically assess student learning during internships. While poster presentations are commonly used for assessment in the sciences, they are an innovative approach to assessment in the humanities. It is argued that posters are one way that universities can overcome the substantial challenges of assessing work integrated learning. The paper evaluates the use of poster presentations for assessment in two internship units at the Queensland University of Technology (QUT)]. The first is a unit in the Faculty of Business where students majoring in advertising, marketing and public relations are placed in a variety of organisations. The second unit is a law unit where students complete placements in government legal offices. The two units adopt different approaches to the poster assessment; the unit in the Faculty of Business is non-graded and the poster assessment task requires students to reflect on their learning during the internship. The law unit is graded and requires students to present on a research topic that relates to their internship. In both units the posters were presented during a poster showcase which was attended by students, workplace supervisors and members of faculty. The paper evaluates the benefits of poster presentations for students, workplace supervisors and faculty and concludes that posters can effectively and authentically assess various learning outcomes in internships in different disciplines.

Rigour versus Relevance Revisited : Evidence from IS Conference Reviewing Practice

A commonly held belief in the IS discipline is that rigour and relevance are contrary to each other and that addressing both is virtually impossible. It is also believed widely that the editorial practices of our premier conferences and journals over-emphasise rigour on the cost of relevance. However, while these two topics have been filled with numerous subjective discussions, more solid evidence into the true relationship between rigour and relevance and the impact of conference editors on this relationship is still outstanding. This paper contributes to this debate by deriving empirical evidence from a comprehensive and detailed analysis of the characteristics of the submissions and the reviewing practices of three recent IS conferences. It provides first insights into the actual relationship between rigour and relevance and into the role conference chairs play in balancing rigour and relevance. Besides the outcomes that the current set of evaluation criteria does not provide a straight forward proxy for relevance to practitioners, the paper offers two main contributions. First, empirical insights are provided that rigour and relevance do in fact not have to be mutually exclusive. Second, the editorial practices at conferences are skewed towards rigorous papers rather than relevant papers.

Augmenting web service discovery by cognitive semantics and abduction

We argue that web service discovery technology should help the user navigate a complex problem space by providing suggestions for services which they may not be able to formulate themselves as (s)he lacks the epistemic resources to do so. Free text documents in service environments provide an untapped source of information for augmenting the epistemic state of the user and hence their ability to search effectively for services. A quantitative approach to semantic knowledge representation is adopted in the form of semantic space models computed from these free text documents. Knowledge of the user’s agenda is promoted by associational inferences computed from the semantic space. The inferences are suggestive and aim to promote human abductive reasoning to guide the user from fuzzy search goals into a better understanding of the problem space surrounding the given agenda. Experimental results are discussed based on a complex and realistic planning activity.

Organizational rhetoric in the prospectuses of elite private schools : unpacking strategies of persuasion

Schools have seldom been examined by scholars in studies of organizational sites. Yet schools and the educational context in which they operate, offer potentially important insights into how organizations use rhetoric in their communications to persuade audiences and leverage advantage in the marketplace. This study, which utilises rhetorical analysis to examine the persuasive, yet ambiguous strategies used in 65 school prospectuses in Australia, revealed six strategies consistently used by schools to leverage competitive advantage and persuade internal and external audiences: identification, juxtapositioning, bolstering or self-promotion, partial reporting, selfexpansion and reframing or reversal. As well as illustrating how schools operate in the context of marketisation and privatization discourses in 21st century education, the organizational theory and methods utilised for the research demonstrates how rhetorical strategies draw on, as well as reproduce, socio-political and cultural discourses around economic and social privilege.

Conceptualisation and facilitation of SOA governance

As organisations strive to improve their capabilities in the areas of Service Management and Service-oriented Architectures (SOA), SOA Governance is becoming an increasingly important success factor. However, the concept of SOA Governance is complex and not well-understood, and the adoption of an adequate SOA Governance approach in an organisation can be difficult. Tools that support SOA Governance mostly have a technical bias and rarely address organisational aspects. In this paper, we contribute to the field by specifying a conceptual meta model for SOA Governance that integrates the structure of major IT and SOA Governance frameworks into one consolidated view. By presenting this conceptualisation and a corresponding prototypical implementation of a tool that supports SOA Governance maturity assessment, reference framework exploration and company-specific tailoring of SOA Governance, we provide insights into the first step of a Design Science research project, i.e. the development of an important IT artefact.

Empirical evaluation of a service analysis and design methodology

Service-orientation has gained widespread acceptance and is increasingly being employed as a paradigm for structuring both business and IT architectures. An earlier study of extant service analysis and design methodologies discovered a need for holistic approaches that equally account for both business and software services, which motivated the design of a new, consolidated service analysis and design methodology. A challenge in design-oriented research is to evaluate the utility of the newly created artefacts (here: the methodology), as they are often intended to become part of complex socio-technical systems. Therefore, after presenting a brief overview of the consolidated methodology, the paper discusses possible approaches for the “evaluate” phase of this design-science research process and presents the results of an empirical evaluation conducted in an Action Research study at one of Australia’s largest financial services providers.