Enterprise information security policy assessment : an extended framework for metrics development utilising the goal-question-metric approach

Effective enterprise information security policy management requires review and assessment activities to ensure information security policies are aligned with business goals and objectives. As security policy management involves the elements of policy development process and the security policy as output, the context for security policy assessment requires goal-based metrics for these two elements. However, the current security management assessment methods only provide checklist types of assessment that are predefined by industry best practices and do not allow for developing specific goal-based metrics. Utilizing theories drawn from literature, this paper proposes the Enterprise Information Security Policy Assessment approach that expands on the Goal-Question-Metric (GQM) approach. The proposed assessment approach is then applied in a case scenario example to illustrate a practical application. It is shown that the proposed framework addresses the requirement for developing assessment metrics and allows for the concurrent undertaking of process-based and product-based assessment. Recommendations for further research activities include the conduct of empirical research to validate the propositions and the practical application of the proposed assessment approach in case studies to provide opportunities to introduce further enhancements to the approach.

The enterprise information security policy as a strategic business policy within the corporate strategic plan (extended abstract)

Information security has been recognized as a core requirement for corporate governance that is expected to facilitate not only the management of risks, but also as a corporate enabler that supports and contributes to the sustainability of organizational operations. In implementing information security, the enterprise information security policy is the set of principles and strategies that guide the course of action for the security activities and may be represented as a brief statement that defines program goals and sets information security and risk requirements. The enterprise information security policy (alternatively referred to as security policy in this paper) that represents the meta-policy of information security is an element of corporate ICT governance and is derived from the strategic requirements for risk management and corporate governance. Consistent alignment between the security policy and the other corporate business policies and strategies has to be maintained if information security is to be implemented according to evolving business objectives. This alignment may be facilitated by managing security policy alongside other corporate business policies within the strategic management cycle. There are however limitations in current approaches for developing and managing the security policy to facilitate consistent strategic alignment. This paper proposes a conceptual framework for security policy management by presenting propositions to positively affect security policy alignment with business policies and prescribing a security policy management approach that expounds on the propositions.

Integrating information security policy management with corporate risk management for strategic alignment

Information security policy defines the governance and implementation strategy for information security in alignment with the corporate risk policy objectives and strategies. Research has established that alignment between corporate concerns may be enhanced when strategies are developed concurrently using the same development process as an integrative relationship is established. Utilizing the corporate risk management framework for security policy management establishes such an integrative relationship between information security and corporate risk management objectives and strategies. There is however limitation in the current literature on presenting a definitive approach that fully integrates security policy management with the corporate risk management framework. This paper presents an approach that adopts a conventional corporate risk management framework for security policy development and management to achieve alignment with the corporate risk policy. A case example is examined to illustrate the alignment achieved in each process step with a security policy structure being consequently derived in the process. It is shown that information security policy management outcomes become both integral drivers and major elements of the corporate-level risk management considerations. Further study should involve assessing the impact of the use of the proposed framework in enhancing alignment as perceived in this paper.

Cultural diversity, cultural networks and trade : international cultural policy debate

This article sketches some of the ways in which the language and concepts of cultural diversity are being taken up internationally. The debate has been driven in part by concerns about the treatment of cultural goods, services and knowledge in trade agreements. But it also involves larger questions about the role of the state, the role of non-state actors in domestic policy formation, and the shape and function of international policy communities comprising both state and non-state actors. The extent of the discussion of cultural diversity internationally is described through new formal and informal cultural networks and work towards an international instrument for cultural diversity to lay our ground rules for international trade, cultural exchange and policy principles to guide governmental responsibilities. The article concludes with analysis of some of these new networks, and investigates why Canada has been so prominent in these international efforts.

Security and the War on Terror

The terrorist attacks of 11 September 2001 marked a turning point in international politics, representing a new type of threat that could not easily be anticipated or prevented through state-based structures of security alone. Opening up interdisciplinary conversations between strategic, economic, ethical and legal approaches to global terrorism, this edited book recognises a fundamental issue: while major crises initially tend to reinforce old thinking and behavioural patterns, they also allow societies to challenge and overcome entrenched habits, thereby creating the foundations for a new and perhaps more peaceful future. This volume addresses the issues that are at stake in this dual process of political closure, and therefore rethinks how states can respond to terrorist threats. The contributors range from leading conceptual theorists to policy-oriented analysts, from senior academics to junior researchers. The book explores how terrorism has had a profound impact on how security is being understood and implemented, and uses a range of hitherto neglected sources of insight, such as those between political, economic, legal and ethical factors, to examine the nature and meaning of security in a rapidly changing world.

SELinux policy management framework for HIS

Health Information Systems (HIS) make extensive use of Information and Communication Technologies (ICT). The use of ICT aids in improving the quality and efficiency of healthcare services by making healthcare information available at the point of care (Goldstein, Groen, Ponkshe, and Wine, 2007). The increasing availability of healthcare data presents security and privacy issues which have not yet been fully addressed (Liu, Caelli, May, and Croll, 2008a). Healthcare organisations have to comply with the security and privacy requirements stated in laws, regulations and ethical standards, while managing healthcare information. Protecting the security and privacy of healthcare information is a very complex task (Liu, May, Caelli and Croll, 2008b). In order to simplify the complexity of providing security and privacy in HIS, appropriate information security services and mechanisms have to be implemented. Solutions at the application layer have already been implemented in HIS such as those existing in healthcare web services (Weaver et al., 2003). In addition, Discretionary Access Control (DAC) is the most commonly implemented access control model to restrict access to resources at the OS layer (Liu, Caelli, May, Croll and Henricksen, 2007a). Nevertheless, the combination of application security mechanisms and DAC at the OS layer has been stated to be insufficient in satisfying security requirements in computer systems (Loscocco et al., 1998). This thesis investigates the feasibility of implementing Security Enhanced Linux (SELinux) to enforce a Role-Based Access Control (RBAC) policy to help protect resources at the Operating System (OS) layer. SELinux provides Mandatory Access Control (MAC) mechanisms at the OS layer. These mechanisms can contain the damage from compromised applications and restrict access to resources according to the security policy implemented. The main contribution of this research is to provide a modern framework to implement and manage SELinux in HIS. The proposed framework introduces SELinux Profiles to restrict access permissions over the system resources to authorised users. The feasibility of using SELinux profiles in HIS was demonstrated through the creation of a prototype, which was submitted to various attack scenarios. The prototype was also subjected to testing during emergency scenarios, where changes to the security policies had to be made on the spot. Attack scenarios were based on vulnerabilities common at the application layer. SELinux demonstrated that it could effectively contain attacks at the application layer and provide adequate flexibility during emergency situations. However, even with the use of current tools, the development of SELinux policies can be very complex. Further research has to be made in order to simplify the management of SELinux policies and access permissions. In addition, SELinux related technologies, such as the Policy Management Server by Tresys Technologies, need to be researched in order to provide solutions at different layers of protection.

A Proposed Framework for Understanding Information Security Culture and Practices in the Saudi Context

An examination of Information Security (IS) and Information Security Management (ISM) research in Saudi Arabia has shown the need for more rigorous studies focusing on the implementation and adoption processes involved with IS culture and practices. Overall, there is a lack of academic and professional literature about ISM and more specifically IS culture in Saudi Arabia. Therefore, the overall aim of this paper is to identify issues and factors that assist the implementation and the adoption of IS culture and practices within the Saudi environment. The goal of this paper is to identify the important conditions for creating an information security culture in Saudi Arabian organizations. We plan to use this framework to investigate whether security culture has emerged into practices in Saudi Arabian organizations.

Legislative and security requirements of audit material for evidentiary purpose

This research used the Queensland Police Service, Australia, as a major case study. Information on principles, techniques and processes used, and the reason for the recording, storing and release of audit information for evidentiary purposes is reported. It is shown that Law Enforcement Agencies have a two-fold interest in, and legal obligation pertaining to, audit trails. The first interest relates to the situation where audit trails are actually used by criminals in the commission of crime and the second to where audit trails are generated by the information systems used by the police themselves in support of the recording and investigation of crime. Eleven court cases involving Queensland Police Service audit trails used in evidence in Queensland courts were selected for further analysis. It is shown that, of the cases studied, none of the evidence presented was rejected or seriously challenged from a technical perspective. These results were further analysed and related to normal requirements for trusted maintenance of audit trail information in sensitive environments with discussion on the ability and/or willingness of courts to fully challenge, assess or value audit evidence presented. Managerial and technical frameworks for firstly what is considered as an environment where a computer system may be considered to be operating “properly” and, secondly, what aspects of education, training, qualifications, expertise and the like may be considered as appropriate for persons responsible within that environment, are both proposed. Analysis was undertaken to determine if audit and control of information in a high security environment, such as law enforcement, could be judged as having improved, or not, in the transition from manual to electronic processes. Information collection, control of processing and audit in manual processes used by the Queensland Police Service, Australia, in the period 1940 to 1980 was assessed against current electronic systems essentially introduced to policing in the decades of the 1980s and 1990s. Results show that electronic systems do provide for faster communications with centrally controlled and updated information readily available for use by large numbers of users who are connected across significant geographical locations. However, it is clearly evident that the price paid for this is a lack of ability and/or reluctance to provide improved audit and control processes. To compare the information systems audit and control arrangements of the Queensland Police Service with other government departments or agencies, an Australia wide survey was conducted. Results of the survey were contrasted with the particular results of a survey, conducted by the Australian Commonwealth Privacy Commission four years previous, to this survey which showed that security in relation to the recording of activity against access to information held on Australian government computer systems has been poor and a cause for concern. However, within this four year period there is evidence to suggest that government organisations are increasingly more inclined to generate audit trails. An attack on the overall security of audit trails in computer operating systems was initiated to further investigate findings reported in relation to the government systems survey. The survey showed that information systems audit trails in Microsoft Corporation's “Windows” operating system environments are relied on quite heavily. An audit of the security for audit trails generated, stored and managed in the Microsoft “Windows 2000” operating system environment was undertaken and compared and contrasted with similar such audit trail schemes in the “UNIX” and “Linux” operating systems. Strength of passwords and exploitation of any security problems in access control were targeted using software tools that are freely available in the public domain. Results showed that such security for the “Windows 2000” system is seriously flawed and the integrity of audit trails stored within these environments cannot be relied upon. An attempt to produce a framework and set of guidelines for use by expert witnesses in the information technology (IT) profession is proposed. This is achieved by examining the current rules and guidelines related to the provision of expert evidence in a court environment, by analysing the rationale for the separation of distinct disciplines and corresponding bodies of knowledge used by the Medical Profession and Forensic Science and then by analysing the bodies of knowledge within the discipline of IT itself. It is demonstrated that the accepted processes and procedures relevant to expert witnessing in a court environment are transferable to the IT sector. However, unlike some discipline areas, this analysis has clearly identified two distinct aspects of the matter which appear particularly relevant to IT. These two areas are; expertise gained through the application of IT to information needs in a particular public or private enterprise; and expertise gained through accepted and verifiable education, training and experience in fundamental IT products and system.

The Rise of the BASIC Group Within the International Climate Regime : The Challenge of Ensuring Equitable Mitigation Obligations

The chapter examines the current emission reduction obligations within the climate regime. It looks at the formation and rise of the BASIC negotiation group within the international climate COP negotiations and examines the role that BASIC nations are now playing shaping international mitigation policy.

Co-production of actions and activities at airport security screening

In this paper we will examine passenger actions and activities at the security screening points of Australian domestic and international airports. Our findings and analysis provide a more complete understanding of the current airport passenger security screening experience. Data in this paper is comprised of field studies conducted at two Australian airports, one domestic and one international. Video data was collected by cameras situated either side of the security screening point. A total of one hundred and ninety-six passengers were observed. Two methods of analysis are used. First, the activities of passengers are coded and analysed to reveal the common activities at domestic and international security regimes and between quiet and busy periods. Second, observation of passenger activities is used to reveal uncommon aspects. The results show that passengers do more at security screening that being passively scanned. Passengers queue, unpack the required items from their bags and from their pockets, walk through the metal-detector, re-pack and occasionally return to be re-screened. For each of these activities, passengers must understand the procedures at the security screening point and must co-ordinate various actions and objects in time and space. Through this coordination passengers are active participants in making the security checkpoint function – they are co-producers of the security screening process.

The rise and fall of the international law of maritime terrorism : the ghost of piracy is still hunting!

Maritime terrorism is a serious threat to global security. A major debate in this regard is the treating of acts of maritime terrorism as piracy by some scholars and a rejection of this view by others. Moreover, the international law of maritime terrorism suffers from fundamental definitional issues, much like the international law of terrorism. This article examines the current international law of maritime terrorism with a particular emphasis on the debate regarding the applicability of the international law of piracy in the case of maritime terrorism. It argues that the international law of piracy is not applicable in the enforcement and prosecution of maritime terrorists on the high seas. International treaties on terrorism and the post-September 11 developments relating to international laws on terrorism have created a workable international legal framework for combating maritime terrorism, despite some bottlenecks.

A policy model for access control using building information models

Building information models have created a paradigm shift in how buildings are built and managed by providing a dynamic repository for building data that is useful in many new operational scenarios. This change has also created an opportunity to use building information models as an integral part of security operations and especially as a tool to facilitate fine-grained access control to building spaces in smart buildings and critical infrastructure environments. In this paper, we identify the requirements for a security policy model for such an access control system and discuss why the existing policy models are not suitable for this application. We propose a new policy language extension to XACML, with BIM specific data types and functions based on the IFC specification, which we call BIM-XACML.

Disease Diplomacy

In the age of air travel and globalized trade, pathogens that once took months or even years to spread beyond their regions of origin can now circumnavigate the globe in a matter of hours. Amid growing concerns about such epidemics as Ebola, SARS, MERS, and H1N1, disease diplomacy has emerged as a key foreign and security policy concern as countries work to collectively strengthen the global systems of disease surveillance and control. The revision of the International Health Regulations (IHR), eventually adopted by the World Health Organization’s member states in 2005, was the foremost manifestation of this novel diplomacy. The new regulations heralded a profound shift in international norms surrounding global health security, significantly expanding what is expected of states in the face of public health emergencies and requiring them to improve their capacity to detect and contain outbreaks. Drawing on Martha Finnemore and Kathryn Sikkink’s "norm life cycle" framework and based on extensive documentary analysis and key informant interviews, Disease Diplomacy traces the emergence of these new norms of global health security, the extent to which they have been internalized by states, and the political and technical constraints governments confront in attempting to comply with their new international obligations. The authors also examine in detail the background, drafting, adoption, and implementation of the IHR while arguing that the very existence of these regulations reveals an important new understanding: that infectious disease outbreaks and their management are critical to national and international security. The book will be of great interest to academic researchers, postgraduate students, and advanced undergraduates in the fields of global public health, international relations, and public policy, as well as health professionals, diplomats, and practitioners with a professional interest in global health security.

Intrusion detection techniques in wireless local area networks

This research investigates wireless intrusion detection techniques for detecting attacks on IEEE 802.11i Robust Secure Networks (RSNs). Despite using a variety of comprehensive preventative security measures, the RSNs remain vulnerable to a number of attacks. Failure of preventative measures to address all RSN vulnerabilities dictates the need for a comprehensive monitoring capability to detect all attacks on RSNs and also to proactively address potential security vulnerabilities by detecting security policy violations in the WLAN. This research proposes novel wireless intrusion detection techniques to address these monitoring requirements and also studies correlation of the generated alarms across wireless intrusion detection system (WIDS) sensors and the detection techniques themselves for greater reliability and robustness. The specific outcomes of this research are: A comprehensive review of the outstanding vulnerabilities and attacks in IEEE 802.11i RSNs. A comprehensive review of the wireless intrusion detection techniques currently available for detecting attacks on RSNs. Identification of the drawbacks and limitations of the currently available wireless intrusion detection techniques in detecting attacks on RSNs. Development of three novel wireless intrusion detection techniques for detecting RSN attacks and security policy violations in RSNs. Development of algorithms for each novel intrusion detection technique to correlate alarms across distributed sensors of a WIDS. Development of an algorithm for automatic attack scenario detection using cross detection technique correlation. Development of an algorithm to automatically assign priority to the detected attack scenario using cross detection technique correlation.

Minority activism : trends informing political participation across Australian communities

In the late 1990’s, intense and vigorous debate surrounded the impact of minority communities on Australia’s mainstream society. The rise of far-right populism took the stage with the introduction to the political landscape of Pauline Hanson and her One Nation party, whilst John Howard’s Liberal-National Coalition Government took the fore on debate over immigration issues corresponding with an influx of irregular arrivals. In 2001, following the September 11 terrorist attacks in the United States of America and subsequent attacks on western targets globally, many of these issues continued to be debated through the security posturing that followed. In recent years, much effort has been afforded to countering the threat of terrorism from home grown assailants. The Government has introduced stringent legislative responses whilst researchers have studied social movements and trends within Australian communities, particularly with respect to minorities. In 2008, the Scanlon Foundation, in association with Monash University and various government entities, released its findings into its survey approach to mapping social cohesion in Australia. It identified a number of spheres of exploration which it believed were essential to measuring cohesiveness of Australian communities generally including, economic, political and socio-cultural factors (Markus and Dharmalingam, 2008). This doctoral project report will explore the political sphere as identified in the Mapping Social Cohesion project and apply it to identified minority ethnic communities. The Scanlon Foundation project identified political participation as one of a number of true indicators of social cohesion. This project acknowledges that democracy in Australia is represented predominantly by two political entities representing a vast majority of constituents under a compulsory voting regime. This essay will identify the levels of political activism achieved by minority ethnic communities and access to democratic participation within the Australian political structure. It will define a ten year period from 1999 to 2009, identifying trends and issues within minority communities that have proactively and reactively promoted engagement in achieving a political voice, framed within a mainstream-dominated political system. It will research social movements and other influential factors over that period to enrich existing knowledge in relation to political participation rates across Australian communities.