Access control : allocating resources to selfish agents

The ultimate goal of an authorisation system is to allocate each user the level of access they need to complete their job - no more and no less. This proves to be challenging in an organisational setting because on one hand employees need enough access to perform their tasks, while on the other hand more access will bring about an increasing risk of misuse - either intentionally, where an employee uses the access for personal benefit, or unintentionally through carelessness, losing the information or being socially engineered to give access to an adversary. With the goal of developing a more dynamic authorisation model, we have adopted a game theoretic framework to reason about the factors that may affect users’ likelihood to misuse a permission at the time of an access decision. Game theory provides a useful but previously ignored perspective in authorisation theory: the notion of the user as a self-interested player who selects among a range of possible actions depending on their pay-offs.

An approach to access control under uncertainty

In dynamic and uncertain environments such as healthcare, where the needs of security and information availability are difficult to balance, an access control approach based on a static policy will be suboptimal regardless of how comprehensive it is. The uncertainty stems from the unpredictability of users’ operational needs as well as their private incentives to misuse permissions. In Role Based Access Control (RBAC), a user’s legitimate access request may be denied because its need has not been anticipated by the security administrator. Alternatively, even when the policy is correctly specified an authorised user may accidentally or intentionally misuse the granted permission. This paper introduces a novel approach to access control under uncertainty and presents it in the context of RBAC. By taking insights from the field of economics, in particular the insurance literature, we propose a formal model where the value of resources are explicitly defined and an RBAC policy (entailing those predictable access needs) is only used as a reference point to determine the price each user has to pay for access, as opposed to representing hard and fast rules that are always rigidly applied.

Resisting contradictions : non-Indigenous pre-service teacher responses to critical Indigenous studies

The study examines non-Indigenous pre-service teacher responses to the authorisation of Indigenous knowledge perspectives in compulsory Indigenous studies with a primary focus on exploring the nature and effects of resistance. It draws on the philosophies of the Japanangka teaching and research paradigm (West, 2000), relationship theory (Graham, 1999), Indigenist methodologies and decolonisation approaches to examine this resistance. A Critical Indigenist Study was employed to investigate how non-Indigenous pre-service teachers managed their learning, and how they articulated shifts in resistance as they progressed through their studies. This study explains resistance to compulsory Indigenous and how it can be targeted by Indigenist Standpoint Pedagogy. The beginning transformations in pre-service teacher positioning in relation to Australian history, contemporary educational practice, and professional identity was also explored.

The status of Australian nurse practitioners : the second national census

Objectives. To profile Australian nurse practitioners and their practice in 2009 and compare results with a similar 2007 census. Methods. Self-administered questionnaire. Results. Atotal of 293 nurse practitioners responded (response rate 76.3%). The majority were female (n = 229, 81.2%); mean age was 47.3 years (s.d. = 8.1). As in 2007, emergency nurse practitioners represented the largest clinical specialty (n = 63, 30.3%). A majority practiced in a metropolitan area (n = 133, 64.3%); a decrease from 2007. Consistent with 2007, only 71.5% (n = 208) were employed as a nurse practitioner and 22.8% (n = 46) were awaiting approval for some or all of their clinical protocols. Demographic data, allocations of tasks, and patterns of practice remained consistent with 2007 results. ‘No Medicare provider number’ (n = 182, 91.0%), ‘no authority to prescribe using the Pharmaceutical Benefits Scheme’ (n = 182, 89.6%) and ‘lack of organisational support’ (n = 105, 52.2%) were reported as ‘limiting’ or ‘extremely limiting’ to practice. Conclusions. Our results demonstrate less than satisfactory uptake of the nurse practitioner role despite authorisation. Barriers constraining nurse practitioner practice reduced but remained unacceptably high. Adequate professional and political support is necessary to ensure the efficacy and sustainability of this clinical role.

E-portfolios : developing nurse practitioner competence and capability

Objective: This paper aims to integrate nurse practitioner literature on competence and capability with post graduate and nursing literature on e‑portfolios in order to demonstrate the potential merits of e‑portfolios in nurse practitioner education for competence and capability development. Primary Argument In the Nurse Practitioner Standards Project, competence and capability were proposed as key criteria to assess candidates in nurse practitioner educational courses. Portfolios have traditionally been used to demonstrate competence in nursing and are integral to nursing education as well. An examination of the portfolio and electronic portfolio literature in postgraduate nursing education and professional practice indicates that these portfolios fall under two main structures, each with different purposes: 1) A spinal column structure, with evidence and reflective pieces aligned to competency standards or course objectives, for the purposes of meeting prescribed competencies, professional development planning and showcasing evidence for authorisation or potential employers; and 2) A cake mix structure, which consists of a reflective narrative tying evidence together, which enables a greater focus on personal learning journeys, reflection and the development of personal qualities. Finally, evidence from the general nursing literature suggests the complexity of e‑portfolios in assessment and evaluation can be overcome by using qualitative research methods. Conclusion: To meet the competence and capability needs of nurse practitioners, portfolios could be used, for competence and showcasing and for learning and capability. Further research would be useful to refine and explore the use of e‑portfolios to meet the needs of NP candidates and their educators, clinical mentors, authorisation personal and employers. The current evidence on nurse practitioner education, competence, capability and e‑portfolios points to the integration of the use of an e‑portfolio into current nurse practitioner curriculum models to meet the unique needs of nurse practitioner candidates.

Parental responsibility and removal of life sustaining treatment : Re Baby D

The case of Re Baby D (No. 2) has been described as a “landmark decision” as to whether parents themselves can authorise medical staff to withdraw life-sustaining treatment from their child or are required to seek the permission of a court or tribunal. The reasons for the decision that the removal of an endotracheal tube from the airway of Baby D was to treat “a bodily malfunction or disease” and therefore could be authorised by the parents will be explored.

Delegation framework for federated systems

It is not uncommon for enterprises today to be faced with the demand to integrate and incor- porate many different and possibly heterogeneous systems which are generally independently designed and developed, to allow seamless access. In effect, the integration of these systems results in one large whole system that must be able, at the same time, to maintain the local autonomy and to continue working as an independent entity. This problem has introduced a new distributed architecture called federated systems. The most challenging issue in federated systems is to find answers for the question of how to efficiently cooperate while preserving their autonomous characteristic, especially the security autonomy. This thesis intends to address this issue. The thesis reviews the evolution of the concept of federated systems and discusses the organisational characteristics as well as remaining security issues with the existing approaches. The thesis examines how delegation can be used as means to achieve better security, especially authorisation while maintaining autonomy for the participating member of the federation. A delegation taxonomy is proposed as one of the main contributions. The major contribution of this thesis is to study and design a mechanism to support dele- gation within and between multiple security domains with constraint management capability. A novel delegation framework is proposed including two modules: Delegation Constraint Man- agement module and Policy Management module. The first module is designed to effectively create, track and manage delegation constraints, especially for delegation processes which require re-delegation (indirect delegation). The first module employs two algorithms to trace the root authority of a delegation constraint chain and to prevent the potential conflict when creating a delegation constraint chain if necessary. The first module is designed for conflict prevention not conflict resolution. The second module is designed to support the first module via the policy comparison capability. The major function of this module is to provide the delegation framework the capability to compare policies and constraints (written under the format of a policy). The module is an extension of Lin et al.'s work on policy filtering and policy analysis. Throughout the thesis, some case studies are used as examples to illustrate the discussed concepts. These two modules are designed to capture one of the most important aspects of the delegation process: the relationships between the delegation transactions and the involved constraints, which are not very well addressed by the existing approaches. This contribution is significant because the relationships provide information to keep track and en- force the involved delegation constraints and, therefore, play a vital role in maintaining and enforcing security for transactions across multiple security domains.

iiNet’s Hollywood ending : what does its court victory mean for copyright law?

In what is being billed as iiNet versus Hollywood, the Australian internet service provider has come out an apparent winner after the High Court dismissed a copyright infringement case brought by industry movie studios. The case was a final appeal by the industry in its attempts to crack down on internet users infringing copyright by using BitTorrent to download movies.

Private equity bidders : barbarians or best friends

The deal value of private equity merger and takeover activity has achieved unprecedented growth in the last couple of years, in Australia and globally. Private equity deals are not a new feature of the market; however, such deals have been subject to increased academic, professional and policy interest. This study examines the particular features of 15 major deals involving listed company "targets" and provides evidence – based on a comparison with a benchmark sample – to demonstrate the role that private equity plays in the market for corporate control. The objective of this study was to assess the friendliness of private equity bids. Based on the indicia compiled, lower bid premiums, the presence of break fees and the intention to retain senior management are compellingly different for private equity bids than for the comparative sample of bids. Using these several characteristics of "friendliness", the authors show that private equity deals are generally friendly in nature, consistent with industry rhetoric, but perhaps inconsistent with the popular belief that private equity bidders are the "barbarians at the gate".

Revising the scope of the copyright "Safe Harbour Scheme"

Submission to the Australian Government Attorney General’s Department consultation paper on Revising the Scope of the Copyright ‘Safe Harbour Scheme’

Evaluating the success of large-scale, integrated information systems through the lens of IS-impact and IS-support

This study proceeds from a central interest in the importance of systematically evaluating operational large-scale integrated information systems (IS) in organisations. The study is conducted within the IS-Impact Research Track at Queensland University of Technology (QUT). The goal of the IS-Impact Track is, "to develop the most widely employed model for benchmarking information systems in organizations for the joint benefit of both research and practice" (Gable et al, 2009). The track espouses programmatic research having the principles of incrementalism, tenacity, holism and generalisability through replication and extension research strategies. Track efforts have yielded the bicameral IS-Impact measurement model; the ‘impact’ half includes Organisational-Impact and Individual-Impact dimensions; the ‘quality’ half includes System-Quality and Information-Quality dimensions. Akin to Gregor’s (2006) analytic theory, the ISImpact model is conceptualised as a formative, multidimensional index and is defined as "a measure at a point in time, of the stream of net benefits from the IS, to date and anticipated, as perceived by all key-user-groups" (Gable et al., 2008, p: 381). The study adopts the IS-Impact model (Gable, et al., 2008) as its core theory base. Prior work within the IS-Impact track has been consciously constrained to Financial IS for their homogeneity. This study adopts a context-extension strategy (Berthon et al., 2002) with the aim "to further validate and extend the IS-Impact measurement model in a new context - i.e. a different IS - Human Resources (HR)". The overarching research question is: "How can the impacts of large-scale integrated HR applications be effectively and efficiently benchmarked?" This managerial question (Cooper & Emory, 1995) decomposes into two more specific research questions – In the new HR context: (RQ1): "Is the IS-Impact model complete?" (RQ2): "Is the ISImpact model valid as a 1st-order formative, 2nd-order formative multidimensional construct?" The study adhered to the two-phase approach of Gable et al. (2008) to hypothesise and validate a measurement model. The initial ‘exploratory phase’ employed a zero base qualitative approach to re-instantiating the IS-Impact model in the HR context. The subsequent ‘confirmatory phase’ sought to validate the resultant hypothesised measurement model against newly gathered quantitative data. The unit of analysis for the study is the application, ‘ALESCO’, an integrated large-scale HR application implemented at Queensland University of Technology (QUT), a large Australian university (with approximately 40,000 students and 5000 staff). Target respondents of both study phases were ALESCO key-user-groups: strategic users, management users, operational users and technical users, who directly use ALESCO or its outputs. An open-ended, qualitative survey was employed in the exploratory phase, with the objective of exploring the completeness and applicability of the IS-Impact model’s dimensions and measures in the new context, and to conceptualise any resultant model changes to be operationalised in the confirmatory phase. Responses from 134 ALESCO users to the main survey question, "What do you consider have been the impacts of the ALESCO (HR) system in your division/department since its implementation?" were decomposed into 425 ‘impact citations.’ Citation mapping using a deductive (top-down) content analysis approach instantiated all dimensions and measures of the IS-Impact model, evidencing its content validity in the new context. Seeking to probe additional (perhaps negative) impacts; the survey included the additional open question "In your opinion, what can be done better to improve the ALESCO (HR) system?" Responses to this question decomposed into a further 107 citations which in the main did not map to IS-Impact, but rather coalesced around the concept of IS-Support. Deductively drawing from relevant literature, and working inductively from the unmapped citations, the new ‘IS-Support’ construct, including the four formative dimensions (i) training, (ii) documentation, (iii) assistance, and (iv) authorisation (each having reflective measures), was defined as: "a measure at a point in time, of the support, the [HR] information system key-user groups receive to increase their capabilities in utilising the system." Thus, a further goal of the study became validation of the IS-Support construct, suggesting the research question (RQ3): "Is IS-Support valid as a 1st-order reflective, 2nd-order formative multidimensional construct?" With the aim of validating IS-Impact within its nomological net (identification through structural relations), as in prior work, Satisfaction was hypothesised as its immediate consequence. The IS-Support construct having derived from a question intended to probe IS-Impacts, too was hypothesised as antecedent to Satisfaction, thereby suggesting the research question (RQ4): "What is the relative contribution of IS-Impact and IS-Support to Satisfaction?" With the goal of testing the above research questions, IS-Impact, IS-Support and Satisfaction were operationalised in a quantitative survey instrument. Partial least squares (PLS) structural equation modelling employing 221 valid responses largely evidenced the validity of the commencing IS-Impact model in the HR context. ISSupport too was validated as operationalised (including 11 reflective measures of its 4 formative dimensions). IS-Support alone explained 36% of Satisfaction; IS-Impact alone 70%; in combination both explaining 71% with virtually all influence of ISSupport subsumed by IS-Impact. Key study contributions to research include: (1) validation of IS-Impact in the HR context, (2) validation of a newly conceptualised IS-Support construct as important antecedent of Satisfaction, and (3) validation of the redundancy of IS-Support when gauging IS-Impact. The study also makes valuable contributions to practice, the research track and the sponsoring organisation.

The preferences of private equity investors in selecting target acquisitions : an international investigation

This study investigates the characteristics and attributes that private equity investors prefer when selecting target acquisitions. These characteristics are examined against a matched sample of firms subject to corporate acquisitions via tender/merger offer during 2000-2009, across seven countries: Australia, Canada, the United Kingdom, the USA, France, Germany and Sweden. We show that firm-specific characteristics are more influential in target selection than external or institutional variables. In particular, private equity targets exhibit lower stock volatility and long-term growth prospects, are larger, and have greater abnormal operating income relative to tender/merger offer target firms. Further, private equity bidders exhibit 'home bias', implying that familiarity motivates target selection. Institutional factors remain largely insignificant across all tests.

Joint ventures and the Competition and Consumer Act

The purpose of this chapter is to analyse the way in which joint venture agreements can fall within the competition provisions of the Competition and Consumer Act 2010, and the circumstances in which authorisation may be available for joint venture collaborations.

Classification—Content Regulation and Convergent Media

On 24 March 2011, Attorney-General Robert McClelland referred the National Classification Scheme to the ALRC and asked it to conduct widespread public consultation across the community and industry. The review considered issues including: existing Commonwealth, State and Territory classification laws the current classification categories contained in the Classification Act, Code and Guidelines the rapid pace of technological change the need to improve classification information available to the community the effect of media on children and the desirability of a strong content and distribution industry in Australia. During the inquiry, the ALRC conducted face-to-face consultations with stakeholders, hosted two online discussion forums, and commissioned pilot community and reference group forums into community attitudes to higher level media content. The ALRC published two consultation documents—an Issues Paper and a Discussion Paper—and invited submissions from the public. The Final Report was tabled in Parliament on 1 March 2012. Recommendations: The report makes 57 recommendations for reform. The net effect of the recommendations would be the establishment of a new National Classification Scheme that: applies consistent rules to content that are sufficiently flexible to be adaptive to technological change; places a regulatory focus on restricting access to adult content, helping to promote cyber-safety and protect children from inappropriate content across media platforms; retains the Classification Board as an independent classification decision maker with an essential role in setting benchmarks; promotes industry co-regulation, encouraging greater industry content classification, with government regulation more directly focused on content of higher community concern; provides for pragmatic regulatory oversight, to meet community expectations and safeguard community standards; reduces the overall regulatory burden on media content industries while ensuring that content obligations are focused on what Australians most expect to be classified; and harmonises classification laws across Australia, for the benefit of consumers and content providers.

Privacy-aware workflow management

Information security policies play an important role in achieving information security. Confidentiality, Integrity, and Availability are classic information security goals attained by enforcing appropriate security policies. Workflow Management Systems (WfMSs) also benefit from inclusion of these policies to maintain the security of business-critical data. However, in typical WfMSs these policies are designed to enforce the organisation’s security requirements but do not consider those of other stakeholders. Privacy is an important security requirement that concerns the subject of data held by an organisation. WfMSs often process sensitive data about individuals and institutions who demand that their data is properly protected, but WfMSs fail to recognise and enforce privacy policies. In this paper, we illustrate existing WfMS privacy weaknesses and introduce WfMS extensions required to enforce data privacy. We have implemented these extensions in the YAWL system and present a case scenario to demonstrate how it can enforce a subject’s privacy policy.