SELinux policy management framework for HIS

Health Information Systems (HIS) make extensive use of Information and Communication Technologies (ICT). The use of ICT aids in improving the quality and efficiency of healthcare services by making healthcare information available at the point of care (Goldstein, Groen, Ponkshe, and Wine, 2007). The increasing availability of healthcare data presents security and privacy issues which have not yet been fully addressed (Liu, Caelli, May, and Croll, 2008a). Healthcare organisations have to comply with the security and privacy requirements stated in laws, regulations and ethical standards, while managing healthcare information. Protecting the security and privacy of healthcare information is a very complex task (Liu, May, Caelli and Croll, 2008b). In order to simplify the complexity of providing security and privacy in HIS, appropriate information security services and mechanisms have to be implemented. Solutions at the application layer have already been implemented in HIS such as those existing in healthcare web services (Weaver et al., 2003). In addition, Discretionary Access Control (DAC) is the most commonly implemented access control model to restrict access to resources at the OS layer (Liu, Caelli, May, Croll and Henricksen, 2007a). Nevertheless, the combination of application security mechanisms and DAC at the OS layer has been stated to be insufficient in satisfying security requirements in computer systems (Loscocco et al., 1998). This thesis investigates the feasibility of implementing Security Enhanced Linux (SELinux) to enforce a Role-Based Access Control (RBAC) policy to help protect resources at the Operating System (OS) layer. SELinux provides Mandatory Access Control (MAC) mechanisms at the OS layer. These mechanisms can contain the damage from compromised applications and restrict access to resources according to the security policy implemented. The main contribution of this research is to provide a modern framework to implement and manage SELinux in HIS. The proposed framework introduces SELinux Profiles to restrict access permissions over the system resources to authorised users. The feasibility of using SELinux profiles in HIS was demonstrated through the creation of a prototype, which was submitted to various attack scenarios. The prototype was also subjected to testing during emergency scenarios, where changes to the security policies had to be made on the spot. Attack scenarios were based on vulnerabilities common at the application layer. SELinux demonstrated that it could effectively contain attacks at the application layer and provide adequate flexibility during emergency situations. However, even with the use of current tools, the development of SELinux policies can be very complex. Further research has to be made in order to simplify the management of SELinux policies and access permissions. In addition, SELinux related technologies, such as the Policy Management Server by Tresys Technologies, need to be researched in order to provide solutions at different layers of protection.

Indigenous livelihoods policy reference group: Research priorities identified from the first meeting, 28th April 2010

The CSIRO Indigenous Livelihoods Project sought to work with Indigenous communities, government and non-government stakeholders to bring together western science and Indigenous knowledge in order to understand the potential livelihood benefits of enterprises based on natural resource management. The research focus was to enhance livelihood opportunities for Indigenous communities derived from new enterprises and activities based on natural resource management in regional and remote Australia. Underpinning outcomes were: · Identification of effective policy and institutional arrangements required to establish and maintain sustainable livelihoods; · Improved systems understanding of factors that enhance or inhibit sustainable livelihoods based on natural resource management; · Tools and methods for measuring the livelihood benefits of natural resource management; · Education, training, employment and capacity building for Indigenous communities and researchers.

E-business adoption in construction : international review on impediments

The adoption of e-business by the Australian construction industry lags other service and product industries. It is assumed that slow adoption rate does not reflect the maturity of the technology but is due to adoption impediments peculiar to the nature of construction. This chapter examines impediments to the uptake of e-business nationally and internationally. A systematic and extensive literature search of impediments (also referred to as obstacles, impediments or hindrances) to adoption has been undertaken and the findings discussed in this chapter. This review included more that 200 documents and these have been published in a searchable database as part of a larger research initiative funded by the Cooperative Research Centre for Construction Innovation. The influence of levels of e-business maturity seen in other sectors such as retail, tourism and manufacturing was also captured and a number of major impediments were identified some including: privacy, trust, uncertainty of financial returns, lack of reliable measurement, fraud, lack of support and system maintenance. A total of 23 impediments were assessed in terms of impact to organisational type and size across reviewed documents. With this information it was possible to develop a reference framework for measuring maturity levels and readiness to uptake e-business in construction. Results have also shown that impediments to e-business adoption work differently according to organisational type and culture. Areas of training and people development need to be addressed. This would include a more sensitive approach to the nature of construction organisations, especially to those small and medium enterprises. Raising levels of awareness and creating trust for on-line collaboration are other aspects that need attention, which current studies confirm as lacking. An empirical study within construction, to validate these findings, forms the subsequent phase of this research.

Barriers to e-business adoption in construction: international literature review

The adoption of e-business by the Australian construction industry lags other service and product industries. It is assumed that slow adoption rate does not reflect the maturity of the technology but is due to adoption barriers peculiar to the nature of construction. This paper examines impediments to the uptake of e-business nationally and internationally. A systematic and extensive literature search of barriers (also referred to as obstacles, impediments or hindrances) to adoption has been undertaken and the findings discussed in this paper. This review included more that 200 documents and these have been published in a searchable database as part of a larger research initiative funded by the Cooperative Research Centre for Construction Innovation. The influence of levels of e-business maturity seen in other sectors such as retail, tourism and manufacturing was also captured and a number of major barriers were identified some including: privacy, trust, uncertainty of financial returns, lack of reliable measurement, fraud, lack of support and system maintenance. A total of 23 barriers were assessed in terms of impact to organisational type and size across reviewed documents. With this information it was possible to develop a reference framework for measuring maturity levels and readiness to uptake e-business in construction. Results have also shown that barriers to e-business adoption work differently according to organisational type and culture. Areas of training and people development need to be addressed. This would include a more sensitive approach to the nature of construction organisations, especially to those small and medium enterprises. Raising levels of awareness and creating trust for on-line collaboration are other aspects that need attention, which current studies confirm as lacking. An empirical study within construction, to validate these findings, forms the subsequent phase of this research.

Conceptualisation and facilitation of SOA governance

As organisations strive to improve their capabilities in the areas of Service Management and Service-oriented Architectures (SOA), SOA Governance is becoming an increasingly important success factor. However, the concept of SOA Governance is complex and not well-understood, and the adoption of an adequate SOA Governance approach in an organisation can be difficult. Tools that support SOA Governance mostly have a technical bias and rarely address organisational aspects. In this paper, we contribute to the field by specifying a conceptual meta model for SOA Governance that integrates the structure of major IT and SOA Governance frameworks into one consolidated view. By presenting this conceptualisation and a corresponding prototypical implementation of a tool that supports SOA Governance maturity assessment, reference framework exploration and company-specific tailoring of SOA Governance, we provide insights into the first step of a Design Science research project, i.e. the development of an important IT artefact.

Complex events in business processes

Flow-oriented process modeling languages have a long tradition in the area of Business Process Management and are widely used for capturing activities with their behavioral and data dependencies. Individual events were introduced for triggering process instantiation and activities. However, real-world business cases drive the need for also covering complex event patterns as they are known in the field of Complex Event Processing. Therefore, this paper puts forward a catalog of requirements for handling complex events in process models, which can be used as reference framework for assessing process definition languages and systems. An assessment of BPEL and BPMN is provided.

An object oriented road asset information model

Preservation and enhancement of transportation infrastructure is critical to continuous economic development in Australia. Of particular importance are the road assets infrastructure, due to their high costs of setting up and their social and economic impact on the national economy. Continuous availability of road assets, however, is contingent upon their effective design, condition monitoring, maintenance, and renovation and upgrading. However, in order to achieve this data exchange, integration, and interoperability is required across municipal boundaries. On the other hand, there are no agreed reference frameworks that consistently describe road infrastructure assets. As a consequence, specifications and technical solutions being chosen to manage road assets do not provide adequate detail and quality of information to support asset lifecycle management processes and decisions taken are based on perception not reality. This paper presents a road asset information model, which works as reference framework to, link other kinds of information with asset information; integrate different data suppliers; and provide a foundation for service driven integrated information framework for community infrastructure and asset management.

Scenes, quarters and clusters: The formation and governance of creative places in urban China

This paper presents a PhD program examining the formation and governance patterns of the social and spatial concentration of creative people and creative businesses in cities. It develops a typology for creative places, adding the terms ‘scene’ and ‘quarter’ to ‘clusters’, to fill in the literature gap of partial emphasis on the ‘creative clusters’ model as an organising mechanism for regional and urban policy. The framework is then applied to China, specifically to Hangzhou, a second-tier city in central eastern China that is ambitious to become a ‘national cultural and creative industries centre’. Drawing on in-depth interviews with initiators, managers and creative professionals from three cases selected respectively for scene, quarter and cluster, together with extensive documentary analysis, the paper investigates the composition of actors, characteristics of the locality and the diversity of activities of the three places. The findings demonstrate a convergence of the three terms. Furthermore, in China, planning and government intervention is the key to the governance of creative places; spontaneous development processes exist, but these need a more tolerant environment, a greater diversity of cultural forms and more time to develop. Moreover, the main business development model is still real estate based: this model needs to incorporate more mature business models and an enhanced IP protection system. Finally, the business strategies need to be combined with a self-management model for the creative class, and a collaborative governance mechanism with other stakeholders such as government, real estate developers and education providers.

Constructing the ideal victim in the United States of America's annual trafficking in persons reports

Human trafficking as a global phenomenon continues to elude accurate quantitative measure, and remains a controversial policy domain significantly influenced by anecdotal evidence. Drawing on the policy analysis framework of Bacchi (1999; 2007) the problem representation of trafficking through narratives can be considered a direct antecedent of contemporary anti-human trafficking policy. This article explores the construction of human trafficking within the Trafficking in Persons Reports, published annually by the United States of America’s Department of State. An examination of the victim and offender narratives contained within the reports published between 2001 and 2012 demonstrates that human trafficking is predominantly represented as a crime committed by ideal offenders against idealized victims, consistent with Christie’s (1986) landmark criteria of ideal victimization. This representation of an ideal prototype has the potential to inform policy that diverts focus from the causative role of global socioeconomic injustice towards criminal justice policies targeting individual offenders.

Why do policy decision-makers opt for command and control environmental regulation? An economic analysis with special reference to Sri Lanka

This chapter examines why policy decision-makers opt for command and control environmental regulation despite the availability of a plethora of market-based instruments which are more efficient and cost-effective. Interestingly, Sri Lanka has adopted a wholly command and control system, during both the pre and post liberalisation economic policies. This chapter first examines the merits and demerits of command and control and market-based approaches and then looks at Sri Lanka’s extensive environmental regulatory framework. The chapter then examines the likely reasons as to why the country has gone down the path of inflexible regulatory measures and has become entrenched in them. The various hypotheses are discussed and empirical evidence is provided. The chapter also discusses the consequences of an environmentally slack economy and policy implications stemming from adopting a wholly regulatory approach. The chapter concludes with a discussion of the main results.

A framework for assessing social policy inclusion proposals

This document outlines a framework that could be used by government agencies in assessing policy interventions aimed at achieving social outcomes from government construction contracts. The framework represents a rational interpretation of the information gathered during the multi-outcomes construction policies project. The multi-outcomes project focused on the costs and benefits of using public construction contracts to promote the achievement of training and employment and public art objectives. The origin of the policy framework in a cost-benefit appraisal of current policy interventions is evidenced by its emphasis on sensitivity to policy commitment and project circumstances (especially project size and scope).The quantitative and qualitative analysis conducted in the multi-outcomes project highlighted, first, that in the absence of strong industry commitment to policy objectives, policy interventions typically result in high levels of avoidance activity, substantial administrative costs and very few benefits. Thus, for policy action on, for example, training or local employment to be successful compliance issues must be adequately addressed. Currently it appears that pre-qualification schemes (similar to the Priority Access Scheme) and schemes that rely on measuring, for example, the training investments of contractors within particular projects do not achieve high levels of compliance and involve significant administrative costs. Thus, an alternative is suggested in the policy framework developed here: a levy on each public construction project – set as a proportion of the total project costs. Although a full evaluation of this policy alternative was beyond the scope of the multi-outcomes construction policies project, it appears to offer the potential to minimize the transaction costs on contractors whilst enabling the creation of a training agency dedicated to improving the supply of skilled construction labour. A recommendation is thus made that this policy alternative be fully researched and evaluated. As noted above, the outcomes of the multi-outcomes research project also highlighted the need for sensitivity to project circumstances in the development and implementation of polices for public construction projects. Ideally a policy framework would have the flexibility to respond to circumstances where contractors share a commitment to the policy objectives and are able to identify measurable social outcomes from the particular government projects they are involved in. This would involve a project-by-project negotiation of goals and performance measures. It is likely to only be practical for large, longer term projects.

Setting hospital infection control policy : a decision-making framework incorporating health economics and healthcare epidemiology

Background: Reducing rates of healthcare acquired infection has been identified by the Australian Commission on Safety and Quality in Health Care as a national priority. One of the goals is the prevention of central venous catheter-related bloodstream infection (CR-BSI). At least 3,500 cases of CR-BSI occur annually in Australian hospitals, resulting in unnecessary deaths and costs to the healthcare system between $25.7 and $95.3 million. Two approaches to preventing these infections have been proposed: use of antimicrobial catheters (A-CVCs); or a catheter care and management ‘bundle’. Given finite healthcare budgets, decisions about the optimal infection control policy require consideration of the effectiveness and value for money of each approach. Objectives: The aim of this research is to use a rational economic framework to inform efficient infection control policy relating to the prevention of CR-BSI in the intensive care unit. It addresses three questions relating to decision-making in this area: 1. Is additional investment in activities aimed at preventing CR-BSI an efficient use of healthcare resources? 2. What is the optimal infection control strategy from amongst the two major approaches that have been proposed to prevent CR-BSI? 3. What uncertainty is there in this decision and can a research agenda to improve decision-making in this area be identified? Methods: A decision analytic model-based economic evaluation was undertaken to identify an efficient approach to preventing CR-BSI in Queensland Health intensive care units. A Markov model was developed in conjunction with a panel of clinical experts which described the epidemiology and prognosis of CR-BSI. The model was parameterised using data systematically identified from the published literature and extracted from routine databases. The quality of data used in the model and its validity to clinical experts and sensitivity to modelling assumptions was assessed. Two separate economic evaluations were conducted. The first evaluation compared all commercially available A-CVCs alongside uncoated catheters to identify which was cost-effective for routine use. The uncertainty in this decision was estimated along with the value of collecting further information to inform the decision. The second evaluation compared the use of A-CVCs to a catheter care bundle. We were unable to estimate the cost of the bundle because it is unclear what the full resource requirements are for its implementation, and what the value of these would be in an Australian context. As such we undertook a threshold analysis to identify the cost and effectiveness thresholds at which a hypothetical bundle would dominate the use of A-CVCs under various clinical scenarios. Results: In the first evaluation of A-CVCs, the findings from the baseline analysis, in which uncertainty is not considered, show that the use of any of the four A-CVCs will result in health gains accompanied by cost-savings. The MR catheters dominate the baseline analysis generating 1.64 QALYs and cost-savings of $130,289 per 1.000 catheters. With uncertainty, and based on current information, the MR catheters remain the optimal decision and return the highest average net monetary benefits ($948 per catheter) relative to all other catheter types. This conclusion was robust to all scenarios tested, however, the probability of error in this conclusion is high, 62% in the baseline scenario. Using a value of $40,000 per QALY, the expected value of perfect information associated with this decision is $7.3 million. An analysis of the expected value of perfect information for individual parameters suggests that it may be worthwhile for future research to focus on providing better estimates of the mortality attributable to CR-BSI and the effectiveness of both SPC and CH/SSD (int/ext) catheters. In the second evaluation of the catheter care bundle relative to A-CVCs, the results which do not consider uncertainty indicate that a bundle must achieve a relative risk of CR-BSI of at least 0.45 to be cost-effective relative to MR catheters. If the bundle can reduce rates of infection from 2.5% to effectively zero, it is cost-effective relative to MR catheters if national implementation costs are less than $2.6 million ($56,610 per ICU). If the bundle can achieve a relative risk of 0.34 (comparable to that reported in the literature) it is cost-effective, relative to MR catheters, if costs over an 18 month period are below $613,795 nationally ($13,343 per ICU). Once uncertainty in the decision is considered, the cost threshold for the bundle increases to $2.2 million. Therefore, if each of the 46 Level III ICUs could implement an 18 month catheter care bundle for less than $47,826 each, this approach would be cost effective relative to A-CVCs. However, the uncertainty is substantial and the probability of error in concluding that the bundle is the cost-effective approach at a cost of $2.2 million is 89%. Conclusions: This work highlights that infection control to prevent CR-BSI is an efficient use of healthcare resources in the Australian context. If there is no further investment in infection control, an opportunity cost is incurred, which is the potential for a more efficient healthcare system. Minocycline/rifampicin catheters are the optimal choice of antimicrobial catheter for routine use in Australian Level III ICUs, however, if a catheter care bundle implemented in Australia was as effective as those used in the large studies in the United States it would be preferred over the catheters if it was able to be implemented for less than $47,826 per Level III ICU. Uncertainty is very high in this decision and arises from multiple sources. There are likely greater costs to this uncertainty for A-CVCs, which may carry hidden costs, than there are for a catheter care bundle, which is more likely to provide indirect benefits to clinical practice and patient safety. Research into the mortality attributable to CR-BSI, the effectiveness of SPC and CH/SSD (int/ext) catheters and the cost and effectiveness of a catheter care bundle in Australia should be prioritised to reduce uncertainty in this decision. This thesis provides the economic evidence to inform one area of infection control, but there are many other infection control decisions for which information about the cost-effectiveness of competing interventions does not exist. This work highlights some of the challenges and benefits to generating and using economic evidence for infection control decision-making and provides support for commissioning more research into the cost-effectiveness of infection control.

Redefining excellence : a strategic policy framework for community engagement and higher education

This report provides a current overview and analysis of the role of universities in local community development in the State of Victoria. Drawing on successful programs of community engagement in Victoria, Australia, Europe, Africa, and North America, the report proposes policy strategies for fostering community development for Victorian Higher Education through effective community engagement programs.