The enterprise information security policy as a strategic business policy within the corporate strategic plan (extended abstract)

Information security has been recognized as a core requirement for corporate governance that is expected to facilitate not only the management of risks, but also as a corporate enabler that supports and contributes to the sustainability of organizational operations. In implementing information security, the enterprise information security policy is the set of principles and strategies that guide the course of action for the security activities and may be represented as a brief statement that defines program goals and sets information security and risk requirements. The enterprise information security policy (alternatively referred to as security policy in this paper) that represents the meta-policy of information security is an element of corporate ICT governance and is derived from the strategic requirements for risk management and corporate governance. Consistent alignment between the security policy and the other corporate business policies and strategies has to be maintained if information security is to be implemented according to evolving business objectives. This alignment may be facilitated by managing security policy alongside other corporate business policies within the strategic management cycle. There are however limitations in current approaches for developing and managing the security policy to facilitate consistent strategic alignment. This paper proposes a conceptual framework for security policy management by presenting propositions to positively affect security policy alignment with business policies and prescribing a security policy management approach that expounds on the propositions.

An examination of recent taxation amendments, corporate law reforms and Queensland legislative reforms affecting nonprofit organisations

There is a tax amendment bill which will be debated. The Government has promised to outline its plan for the reform of the taxation system sometime this year. The plans appear to go beyond the mere introduction of some sort of goods and services tax to reform of the whole taxation system including fiscal relations with the States. Not for profit organisations will find their taxation environment will change. Governments are reluctant to permit exemptions to a GST style arrangements. GST trade offs such as reduced income tax rates and abolishing indirect taxes are useless to nonprofit organisations, as many are already exempt from such imposts. Administrative changes to tax collections may also have an impact. If the government decides to make an individual PAYE taxpayer return optional in exchange for no or standard deductions, this may have an effect on fundraising. The FBT and salary packaging schemes that not for profit organisations use will be under intense scrutiny. A regionalisation of the ATO along the successful model of the ASC would see discrete areas such as not for profit exemptions being centralised in one regional office for the whole of Australia. For example the Tasmanian ASC Office has the responsibility for much work in respect of corporate charities and not for profit companies.

Designing a self-service technology to increase self-efficacy and maintain breastfeeding

Despite the significant health benefits attributed to breastfeeding, rates in countries, such as Australia, continue to remain static or to decline. Typically, the tangible support offered for women to support breastfeeding behaviours takes the form of face-to-face advice from health professionals, peer counselling via not-for-profit organizations such as the ABA, and provision of information through websites, pamphlets, and books. Prior research indicates that face-to-face support is more effective than telephone contact (Britton, McCormic, Renfrew, Wade, & King, 2009). Given the increasing costs associated with the provision of personalized face-to-face professional support and the need for some women to maximize privacy, discretion, and judgment-free consultations, there is a gap that could be filled by the use of m-technologies such as text messaging and other social media. The research team developed MumBubConnect; a two-way SMS system which combined the personalized aspects of face-to-face contact but maintained levels of privacy. The use of SMS was immediate, portable, and overcame many of the barriers associated with embarrassment. An Page 205 of 312 online survey of 130 breastfeeding mothers indicated that MumBubConnect facilitated the seeking of social support using m-technology, increased self-efficacy and maintained the desire behaviour.

Improving remote collaborative process modelling using embodiment in 3D virtual environments

Identifying, modelling and documenting business processes usually require the collaboration of many stakeholders that may be spread across companies in inter-organizational settings. While modern process modelling technologies are beginning to provide a number of features to support remote, they lack support for visual cues used in co-located collaboration. In this paper, we examine the importance of visual cues for collaboration tasks in collaborative process modelling. Based on this analysis, we present a prototype 3D virtual world process modelling tool that supports a number of visual cues to facilitate remote collaborative process model creation and validation. We then report on a preliminary analysis of the technology. In conclusion, we proceed to describe the future direction of our research with regards to the theoretical contributions expected from the evaluation of the tool.

Identity verification in conveyancing : the failure of current legislative and regulatory measures, and recommendations for change

"Defrauding land titles systems impacts upon us all. Those who deal in land include ordinary citizens, big business, small business, governments, not-for-profit organisation, deceased estates...Fraud here touches almost everybody." the thesis presented in this paper is that the current and disparate steps taken by jurisdictions to alleviate land fraud associated with identity-based crimes are inadequate. The centrepiece of the analysis is the consideration of two scenarios that have recently occurred. One is the typical scenario where a spouse forges the partner's signature to obtain a mortgage from a financial institution. The second is atypical. It involves a sophisticated overseas fraud duping many stakeholders involved in the conveyancing process. After outlining these scenarios, we will examine how identity verification requirements of the United Kingdom, Ontario, the Australian states, and New Zealand would have been applied to these two frauds. Our conclusion is that even though some jurisdictions may have prevented the frauds from occurring, the current requirements are inadequate. We use the lessons learnt to propose what we consider core principles for identity verification in land transactions.

Power of engineering : changing the perceptions of year 9 and 10 female school students towards an engineering career

BACKGROUND The engineering profession in Australia has failed to attract young women for the last decade or so despite all the effort that have gone into promoting engineering as a preferred career choice for girls. It is a missed opportunity for the profession to flourish as a heterogeneous team. Many traditional initiatives and programs have failed to make much impact or at best incremental improvement into attracting and retaining more women in the profession. The reasons why girls and young women in most parts of the world show little interest in engineering haven't changed, despite all the efforts to address them, the issue proposed here in this paper is with the perceptions of engineering in the community and the confidence to pursue it. This gender imbalance is detrimental for the engineering profession, and hence an action-based intervention strategy was devised by the Women in Engineering Qld Chapter of Engineers Australia in 2012 to change the perceptions of school girls by redesigning the engagement strategy and key messages. As a result, the “Power of Engineering Inc” (PoE) was established as a not-for-profit organisation, and is a collaborative effort between government, schools, universities, and industry. This paper examines a case study in changing the perceptions of year 9 and 10 school girls towards an engineering career. PURPOSE To evaluate and determine the effectiveness of an intervention in changing the perceptions of year 9 and 10 school girls about engineering career options, but specifically, “What were their perceptions of engineering before today and have those perceptions changed?” DESIGN/METHOD The inaugural Power of Engineering (PoE) event was held on International Women’s Day, Thursday 8 March 2012 and was attended by 131 high school female students (year 9 and 10) and their teachers. The key message of the day was “engineering gives you the power to change the world”. A questionnaire was conducted with the participating high school female students, collecting both quantitative and qualitative data. The survey instrument has not been validated. RESULTS The key to the success of the event was as a result of collaboration between all participants involved and the connection created between government, schools, universities and industry. Of the returned surveys (109 of 131), 91% of girls would now consider a career in engineering and 57% who had not considered engineering before the day would now consider a career in engineering. Data collected found significant numbers of negative and varying perceptions about engineering careers prior to the intervention. CONCLUSIONS The evidence in this research suggests that the intervention assisted in changing the perceptions of year 9 and 10 female school students towards engineering as a career option. Whether this intervention translates into actual career selection and study enrolment is to be determined. In saying this, the evidence suggests that there is a critical and urgent need for earlier interventions prior to students selecting their subjects for year 11 and 12. This intervention could also play its part in increasing the overall pool of students engaged in STEM education.

PartSS : An efficient partition-based filtering for edit distance constraints

This paper introduces PartSS, a new partition-based fil- tering for tasks performing string comparisons under edit distance constraints. PartSS offers improvements over the state-of-the-art method NGPP with the implementation of a new partitioning scheme and also improves filtering abil- ities by exploiting theoretical results on shifting and scaling ranges, thus accelerating the rate of calculating edit distance between strings. PartSS filtering has been implemented within two major tasks of data integration: similarity join and approximate membership extraction under edit distance constraints. The evaluation on an extensive range of real-world datasets demonstrates major gain in efficiency over NGPP and QGrams approaches.

How difficult are exams? A framework for assessing the complexity of introductory programming exams

Student performance on examinations is influenced by the level of difficulty of the questions. It seems reasonable to propose therefore that assessment of the difficulty of exam questions could be used to gauge the level of skills and knowledge expected at the end of a course. This paper reports the results of a study investigating the difficulty of exam questions using a subjective assessment of difficulty and a purpose-built exam question complexity classification scheme. The scheme, devised for exams in introductory programming courses, assesses the complexity of each question using six measures: external domain references, explicitness, linguistic complexity, conceptual complexity, length of code involved in the question and/or answer, and intellectual complexity (Bloom level). We apply the scheme to 20 introductory programming exam papers from five countries, and find substantial variation across the exams for all measures. Most exams include a mix of questions of low, medium, and high difficulty, although seven of the 20 have no questions of high difficulty. All of the complexity measures correlate with assessment of difficulty, indicating that the difficulty of an exam question relates to each of these more specific measures. We discuss the implications of these findings for the development of measures to assess learning standards in programming courses.

A qualitative think aloud study of the early Neo-Piagetian stages of reasoning in novice programmers

Recent research indicates that some of the difficulties faced by novice programmers are manifested very early in their learning. In this paper, we present data from think aloud studies that demonstrate the nature of those difficulties. In the think alouds, novices were required to complete short programming tasks which involved either hand executing ("tracing") a short piece of code, or writing a single sentence describing the purpose of the code. We interpret our think aloud data within a neo-Piagetian framework, demonstrating that some novices reason at the sensorimotor and preoperational stages, not at the higher concrete operational stage at which most instruction is implicitly targeted.

Slid pairs in the initialisation of the A5/1 stream cipher

A5/1 is a shift register based stream cipher which uses a majority clocking rule to update its registers. It is designed to provide privacy for the GSM system. In this paper, we analyse the initialisation process of A5/1. We demonstrate a sliding property of the A5/1 cipher, where every valid internal state is also a legitimate loaded state and multiple key-IV pairs produce phase shifted keystream sequences. We describe a possible ciphertext only attack based on this property.

A conceptual model for reflecting on expected learning vs. demonstrated student performance

Educators are faced with many challenging questions in designing an effective curriculum. What prerequisite knowledge do students have before commencing a new subject? At what level of mastery? What is the spread of capabilities between bare-passing students vs. the top performing group? How does the intended learning specification compare to student performance at the end of a subject? In this paper we present a conceptual model that helps in answering some of these questions. It has the following main capabilities: capturing the learning specification in terms of syllabus topics and outcomes; capturing mastery levels to model progression; capturing the minimal vs. aspirational learning design; capturing confidence and reliability metrics for each of these mappings; and finally, comparing and reflecting on the learning specification against actual student performance. We present a web-based implementation of the model, and validate it by mapping the final exams from four programming subjects against the ACM/IEEE CS2013 topics and outcomes, using Bloom's Taxonomy as the mastery scale. We then import the itemised exam grades from 632 students across the four subjects and compare the demonstrated student performance against the expected learning for each of these. Key contributions of this work are the validated conceptual model for capturing and comparing expected learning vs. demonstrated performance, and a web-based implementation of this model, which is made freely available online as a community resource.

Towards a secure human-and-computer mutual authentication protocol

We blend research from human-computer interface (HCI) design with computational based crypto- graphic provable security. We explore the notion of practice-oriented provable security (POPS), moving the focus to a higher level of abstraction (POPS+) for use in providing provable security for security ceremonies involving humans. In doing so we high- light some challenges and paradigm shifts required to achieve meaningful provable security for a protocol which includes a human. We move the focus of security ceremonies from being protocols in their context of use, to the protocols being cryptographic building blocks in a higher level protocol (the security cere- mony), which POPS can be applied to. In order to illustrate the need for our approach, we analyse both a protocol proven secure in theory, and a similar proto- col implemented by a �nancial institution, from both HCI and cryptographic perspectives.

Open Access Books

Although digital technology has, in theory, made it possible for many more people to access content at no extra cost, fewer people than ever before are able to read the books written by university-based researchers. This article looks, very briefly, at the role that open access licenses might play in reviving the scholarly monograph: a specialised area of academic publishing that has seen sales decline by more than 90% over the past three decades. It also introduces a new approach to funding open-access scholarly books being pioneered by the not-for-profit social enterprise Knowledge Unlatched.

Working with refugee survivors of torture and trauma : an opportunity for vicarious posttraumatic growth

Clinical work with people who have survived trauma carries a risk of vicarious traumatisation for the service provider, but also the potential for vicarious posttraumatic growth. Despite growing interest in this area, the effects of working with survivors of refugee-related trauma have remained relatively unexplored. The aim of the current study was to examine the lived experiences of people working on a daily basis with survivors of torture and trauma who had sought refuge in Australia. Seventeen clinical, administrative, and managerial staff from a not-for-profit organisation participated in a semi-structured interview that was later analysed using interpretive phenomenological analysis. Analysis of the data demonstrated that the entire sample reported symptoms of vicarious trauma (e.g., strong emotional reactions, intrusive images, shattering of existing beliefs) as well as vicarious posttraumatic growth (e.g., forming new relationships, increased self-understanding, greater appreciation of life). Moreover, effortful meaning making processes appeared to facilitate such positive changes. Reduction in the risks associated with this work, enhancement of clinician well-being, and improvement of therapeutic outcomes is a shared responsibility of the organisation and clinician. Without negating the distress of trauma work, clinicians are encouraged to more deeply consider the unique positive outcomes that supporting survivors can provide.

Linking scientific evidence and decision making : A case study of hand hygiene interventions

We consider how data from scientific research should be used for decision making in health services. Whether a hand hygiene intervention to reduce risk of nosocomial infection should be widely adopted is the case study. Improving hand hygiene has been described as the most important measure to prevent nosocomial infection. 1 Transmission of microorganisms is reduced, and fewer infections arise, which leads to a reduction in mortality2 and cost savings.3 Implementing a hand hygiene program is itself costly, so the extra investment should be tested for cost-effectiveness.4,5 The first part of our commentary is about cost-effectiveness models and how they inform decision making for health services. The second part is about how data on the effectiveness of hand hygiene programs arising from scientific studies are used, and 2 points are made: the threshold for statistical inference of .05 used to judge effectiveness studies is not important for decision making,6,7 and potentially valuable evidence about effectiveness might be excluded by decision makers because it is deemed low quality.8 The ideas put forward will help researchers and health services decision makers to appraise scientific evidence in a more powerful way.