Information security culture : a behaviour compliance conceptual framework

Understanding the complex dynamic and uncertain characteristics of organisational employees who perform authorised or unauthorised information security activities is deemed to be a very important and challenging task. This paper presents a conceptual framework for classifying and organising the characteristics of organisational subjects involved in these information security practices. Our framework expands the traditional Human Behaviour and the Social Environment perspectives used in social work by identifying how knowledge, skills and individual preferences work to influence individual and group practices with respect to information security management. The classification of concepts and characteristics in the framework arises from a review of recent literature and is underpinned by theoretical models that explain these concepts and characteristics. Further, based upon an exploratory study of three case organisations in Saudi Arabia involving extensive interviews with senior managers, department managers, IT managers, information security officers, and IT staff; this article describes observed information security practices and identifies several factors which appear to be particularly important in influencing information security behaviour. These factors include values associated with national and organisational culture and how they manifest in practice, and activities related to information security management.

Improving the Traversal of Large Hierarchical Process Repositories

Business Process Management (BPM) has increased in popularity and maturity in recent years. Large enterprises engage use process management approaches to model, manage and refine repositories of process models that detail the whole enterprise. These process models can run to the thousands in number, and may contain large hierarchies of tasks and control structures that become cumbersome to maintain. Tools are therefore needed to effectively traverse this process model space in an efficient manner, otherwise the repositories remain hard to use, and thus are lowered in their effectiveness. In this paper we analyse a range of BPM tools for their effectiveness in handling large process models. We establish that the present set of commercial tools is lacking in key areas regarding visualisation of, and interaction with, large process models. We then present six tool functionalities for the development of advanced business process visualisation and interaction, presenting a design for a tool that will exploit the latest advances in 2D and 3D computer graphics to enable fast and efficient search, traversal and modification of process models.

Context change archetypes : understanding the impact of context change on business processes

The emergence of Enterprise Resource Planning systems and Business Process Management have led to improvements in the design, implementation, and overall management of business processes. However, the typical focus of these initiatives has been on internal business operations, assuming a defined and stable context in which the processes are designed to operate. Yet, a lack of context-awareness for external change leads to processes and supporting information systems that are unable to react appropriately and timely enough to change. To increase the alignment of processes with environmental change, we propose a conceptual framework that facilitates the identification of context change. Based on a secondary data analysis of published case studies about process adaptation, we exemplify the framework and identify four general archetypes of context-awareness. The framework, in combination with the learning from the case analysis, provides a first understanding of what, where, how, and when processes are subjected to change.

An administrative model for UCON

UCON is an emerging access control framework that lacks an administration model. In this paper we define the problem of administration and propose a novel administrative model. At the core of this model is the concept of attribute, which is also the central component of UCON. In our model, attributes are created by the assertions of subjects, which ascribe properties/rights to other subjects or objects. Through such a treatment of attributes, administration capabilities can be delegated from one subject to another and as a consequence UCON is improved in three aspects. First, immutable attributes that are currently considered as external to the model can be incorporated and thereby treated as mutable at- tributes. Second, the current arbitrary categorisation of users (as modifiers of attributes), to system and administrator can be removed. Attributes and objects are only modifiable by those who possess administration capability over them. Third, the delegation of administration over objects and properties that is not currently expressible in UCON is made possible.

Evaluation of aerial remote sensing techniques for vegetation management in power line corridors

The following paper presents an evaluation of airborne sensors for use in vegetation management in powerline corridors. Three integral stages in the management process are addressed including, the detection of trees, relative positioning with respect to the nearest powerline and vegetation height estimation. Image data, including multi-spectral and high resolution, are analyzed along with LiDAR data captured from fixed wing aircraft. Ground truth data is then used to establish the accuracy and reliability of each sensor thus providing a quantitative comparison of sensor options. Tree detection was achieved through crown delineation using a Pulse-Coupled Neural Network (PCNN) and morphologic reconstruction applied to multi-spectral imagery. Through testing it was shown to achieve a detection rate of 96%, while the accuracy in segmenting groups of trees and single trees correctly was shown to be 75%. Relative positioning using LiDAR achieved a RMSE of 1.4m and 2.1m for cross track distance and along track position respectively, while Direct Georeferencing achieved RMSE of 3.1m in both instances. The estimation of pole and tree heights measured with LiDAR had a RMSE of 0.4m and 0.9m respectively, while Stereo Matching achieved 1.5m and 2.9m. Overall a small number of poles were missed with detection rates of 98% and 95% for LiDAR and Stereo Matching.

Correctness ensuring process configuration : an approach based on partner synthesis

A configurable process model describes a family of similar process models in a given domain. Such a model can be configured to obtain a specific process model that is subsequently used to handle individual cases, for instance, to process customer orders. Process configuration is notoriously difficult as there may be all kinds of interdependencies between configuration decisions.} In fact, an incorrect configuration may lead to behavioral issues such as deadlocks and livelocks. To address this problem, we present a novel verification approach inspired by the ``operating guidelines'' used for partner synthesis. We view the configuration process as an external service, and compute a characterization of all such services which meet particular requirements using the notion of configuration guideline. As a result, we can characterize all feasible configurations (i.\,e., configurations without behavioral problems) at design time, instead of repeatedly checking each individual configuration while configuring a process model.

Mitigating sandwich attacks against a secure key management scheme in wireless sensor networks for PCS/SCADA

Alzaid et al. proposed a forward & backward secure key management scheme in wireless sensor networks for Process Control Systems (PCSs) or Supervisory Control and Data Acquisition (SCADA) systems. The scheme, however, is still vulnerable to an attack called the sandwich attack that can be launched when the adversary captures two sensor nodes at times t1 and t2, and then reveals all the group keys used between times t1 and t2. In this paper, a fix to the scheme is proposed in order to limit the vulnerable time duration to an arbitrarily chosen time span while keeping the forward and backward secrecy of the scheme untouched. Then, the performance analysis for our proposal, Alzaid et al.’s scheme, and Nilsson et al.’s scheme is given.

Protecting the protectors : legal liabilities from the use of Web 2.0 for Australian disaster response

The traditional model for information dissemination in disaster response is unidirectional from official channels to the public. However recent crises in the US, such as Hurricane Katrina and the Californian Bushfires show that civilians are now turning to Web 2.0 technologies as a means of sharing disaster related information. These technologies present enormous potential benefits to disaster response authorities that cannot be overlooked. In Australia, the Victorian Bushfires Royal Commission has recently recommended that Australian disaster response authorities utilize information technologies to improve the dissemination of disaster related, bushfire information. However, whilst the use of these technologies has many positive attributes, potential legal liabilities for disaster response authorities arise. This paper identifies some potential legal liabilities arising from the use of Web 2.0 technologies in disaster response situations thereby enhancing crisis related information sharing by highlighting legal concerns that need to be addressed.

A rights management approach to securing data distribution in coalitions

As network capacity has increased over the past decade, individuals and organisations have found it increasingly appealing to make use of remote services in the form of service-oriented architectures and cloud computing services. Data processed by remote services, however, is no longer under the direct control of the individual or organisation that provided the data, leaving data owners at risk of data theft or misuse. This paper describes a model by which data owners can control the distribution and use of their data throughout a dynamic coalition of service providers using digital rights management technology. Our model allows a data owner to establish the trustworthiness of every member of a coalition employed to process data, and to communicate a machine-enforceable usage policy to every such member.

How Novices Model Business Processes

In this paper, we examine the design of business process diagrams in contexts where novice analysts only have basic design tools such as paper and pencils available, and little to no understanding of formalized modeling approaches. Based on a quasi-experimental study with 89 BPM students, we identify five distinct process design archetypes ranging from textual to hybrid, and graphical representation forms. We also examine the quality of the designs and identify which representation formats enable an analyst to articulate business rules, states, events, activities, temporal and geospatial information in a process model. We found that the quality of the process designs decreases with the increased use of graphics and that hybrid designs featuring appropriate text labels and abstract graphical forms are well-suited to describe business processes. Our research has implications for practical process design work in industry as well as for academic curricula on process design.

Values, wellness and the social sciences curriculum

Recent initiatives in values education in Australia emphasise the importance of the process of valuing and general methodologies that foster this in the classroom. Although a range of strategies are available, this chapter argues that inquiry-based approaches in the Social Sciences play a significant role in linking valuing processes with decision making skills. Collectively, these approaches prompt the development of reasoning and self awareness which also impact on student wellness. This chapter proposes some curriculum approaches to foreground values education in the Australian Social Sciences classroom. It argues that valuing is an important life skill that can be cultivated in the classroom through specific valuing strategies. It contends that the development of the capacity to make informed value choices is a critical factor in promoting wellness and resilience in students and in preparing them for the decision making skills required for effective participation in society.

Managing process model collections with AProMoRe

As organizations reach higher levels of Business Process Management maturity, they tend to collect numerous business process models. Such models may be linked with each other or mutually overlap, supersede one another and evolve over time. Moreover, they may be represented at different abstraction levels depending on the target audience and modeling purpose, and may be available in multiple languages (e.g. due to company mergers). Thus, it is common that organizations struggle with keeping track of their process models. This demonstration introduces AProMoRe (Advanced Process Model Repository) which aims to facilitate the management of (large) process model collections.

Transnational business masculinities : media representations of gender and management in global mining corporations

This paper examines Australian media representations of the male managers of two global mining corporations, Rio Tinto and BHP Billiton. These organizations are transnational (or multinational) corporations with assets and/or operations across national boundaries (Dunning and Lundan, 2008), and indeed their respective Chief Executive Officers, Tom Albanese and Marius Kloppers are two of the most economically (and arguably politically) powerful in the world overseeing 37 000 and 39 000 employees internationally. With a 2008 profit of US$15.962 billion and assets of US$ 75.889 Billion BHP Billiton is the world's largest mining company. In terms of its profits and assets Rio Tinto ranks fourth in the world, but with operations in six countries (mainly Canada and Australia) and a 2008 profit of US$10.3 billion it is also emblematic of the transnational in that its ‘budget is larger than that of all but a few nations’ (Giddens, 2003, p. 62).

Sustainable urban infrastructure management : integration of urban computer modelling

Purpose - This paper seeks to examine the complex relationships between urban planning, infrastructure management, sustainable urban development, and to illustrate why there is an urgent need for local governments to develop a robust planning support system which integrates with advance urban computer modelling tools to facilitate better infrastructure management and improve knowledge sharing between the community, urban planners, engineers and decision makers. Design/methodology/approach - The methods used in this paper includes literature review and practical project case observations. Originality/value - This paper provides an insight of how the Brisbane's planning support system established by Brisbane City Council has significantly improved the effectiveness of urban planning, infrastructure management and community engagement through better knowledge management processes. Practical implications - This paper presents a practical framework for setting up a functional planning support system within local government. The integration of the Brisbane Urban Growth model, Virtual Brisbane and the Brisbane Economic Activity Monitoring (BEAM) database have proven initially successful to provide a dynamic platform to assist elected officials, planners and engineers to understand the limitations of the local environment, its urban systems and the planning implications on a city. With the Brisbane's planning support system, planners and decision makers are able to provide better planning outcomes, policy and infrastructure that adequately address the local needs and achieve sustainable spatial forms.