Insider threats: the major challenge to security risk management

Security risk management is by definition, a subjective and complex exercise and it takes time to perform properly. Human resources are fundamental assets for any organization, and as any other asset, they have inherent vulnerabilities that need to be handled, i.e. managed and assessed. However, the nature that characterize the human behavior and the organizational environment where they develop their work turn these task extremely difficult, hard to accomplish and prone to errors. Assuming security as a cost, organizations are usually focused on the efficiency of the security mechanisms implemented that enable them to protect against external attacks, disregarding the insider risks, which are much more difficult to assess. All these demands an interdisciplinary approach in order to combine technical solutions with psychology approaches in order to understand the organizational staff and detect any changes in their behaviors and characteristics. This paper intends to discuss some methodological challenges to evaluate the insider threats and its impacts, and integrate them in a security risk framework, that was defined according to the security standard ISO/IEC_JTC1, to support the security risk management process.

Design of a case-based reasoner for information security in military organizations

Information security is concerned with the protection of information, which can be stored, processed or transmitted within critical information systems of the organizations, against loss of confidentiality, integrity or availability. Protection measures to prevent these problems result through the implementation of controls at several dimensions: technical, administrative or physical. A vital objective for military organizations is to ensure superiority in contexts of information warfare and competitive intelligence. Therefore, the problem of information security in military organizations has been a topic of intensive work at both national and transnational levels, and extensive conceptual and standardization work is being produced. A current effort is therefore to develop automated decision support systems to assist military decision makers, at different levels in the command chain, to provide suitable control measures that can effectively deal with potential attacks and, at the same time, prevent, detect and contain vulnerabilities targeted at their information systems. The concept and processes of the Case-Based Reasoning (CBR) methodology outstandingly resembles classical military processes and doctrine, in particular the analysis of “lessons learned” and definition of “modes of action”. Therefore, the present paper addresses the modeling and design of a CBR system with two key objectives: to support an effective response in context of information security for military organizations; to allow for scenario planning and analysis for training and auditing processes.

Preschool education in Brazil: does public supply crowd out private enrollment?

Expanding access to preschool education is a particularly important policy issue in developing countries, where enrollment rates are generally much lower, and where private institutions constitute a much larger share of the formal preschool sector, than in developed countries. This paper examines if an expansion in the supply of public preschool crowds-out private enrollment using rich data for municipalities in Brazil from 2000 to 2006, where federal transfers to local governments change discontinuously with given population thresholds. Results from a regression-discontinuity design reveal that larger federal transfers lead to a significant expansion of local public preschool services, but show no evidence of crowding-out of private enrollment, nor of negative impacts on the quality of private providers. This finding is consistent with a theory in which households differ in willingness-to-pay for preschool services, and private suppliers optimally adjust prices in response to an expansion of lower-quality, free-of-charge public supply. In the context of the model, the absence of crowding-out effects of more public preschool providers can be rationalized by the existence of relatively large differences in willingness-to-pay for preschool services across different demand segments. Our theoretical and empirical findings therefore suggest that in developing country settings characterized by relatively high income inequality, an expansion in public preschool supply will likely significantly increase enrollment among the poorest segments of society, and need not have adverse effects on the quantity or quality of local private supply.

A inovação, as marcas próprias e o private label no setor do calçado em Portugal

O sector do calçado português apresenta excelentes indicadores económicos e um desempenho competitivo assinalável. Os últimos quatro anos foram particularmente fortes, tendo Portugal atingido o 11º lugar entre os 15 maiores exportadores mundiais, com o segundo preço mais elevado por par de sapato vendido, superado apenas pela Itália. O artigo analisa o tipo de inovação realizada pelas empresas consideradas inovadoras dentro do sector do calçado em Portugal, de acordo com o manual de Oslo, e analisa a evolução que as empresas fizeram ao passarem de um regime dominado pelo private label para o desenvolvimento de produtos, de coleções e de marcas próprias. A pesquisa foi de natureza qualitativa, envolvendo sete empresas com inovação, sendo realizado estudos de caso através de entrevistas semi-estruturadas, análise de documentos e visitas às empresas e aos seus processos produtivos e de criação. Os resultados obtidos na investigação evidenciam uma relação entre os indicadores económicos e de desempenho e a existência de determinadas categorias de inovação. Evidencia ainda a relação existente entre o regime de produção e os indicadores económicos das empresas.

ADSNARK: Nearly practical and privacy-preserving proofs on authenticated data

We study the problem of privacy-preserving proofs on authenticated data, where a party receives data from a trusted source and is requested to prove computations over the data to third parties in a correct and private way, i.e., the third party learns no information on the data but is still assured that the claimed proof is valid. Our work particularly focuses on the challenging requirement that the third party should be able to verify the validity with respect to the specific data authenticated by the source — even without having access to that source. This problem is motivated by various scenarios emerging from several application areas such as wearable computing, smart metering, or general business-to-business interactions. Furthermore, these applications also demand any meaningful solution to satisfy additional properties related to usability and scalability. In this paper, we formalize the above three-party model, discuss concrete application scenarios, and then we design, build, and evaluate ADSNARK, a nearly practical system for proving arbitrary computations over authenticated data in a privacy-preserving manner. ADSNARK improves significantly over state-of-the-art solutions for this model. For instance, compared to corresponding solutions based on Pinocchio (Oakland’13), ADSNARK achieves up to 25× improvement in proof-computation time and a 20× reduction in prover storage space.

Risk factors for atherosclerosis in students of a private university in São Paulo - Brazil

OBJECTIVE: To characterize the risk profile for atherosclerosis (AS) in adolescents and young adults of a private university in São Paulo. METHODS: Clinical, nutritional, and laboratory parameters were evaluated in 209 students of both genders aged 17 to 25 years. In addition to determination of the lipid profile, the association of its abnormal values with other risk factors for AS was also investigated. RESULTS: Increased levels of total cholesterol, LDL-C and triglycerides (TG) were observed in 9.1%, 7.6% and 16.3% of the students, respectively, and decreased levels of HDL-C in 8.6% of them. Prevalence of the remaining risk factors analyzed was elevated: sedentary life style (78.9%); high intake of total fat (77.5%); high cholesterol intake (35.9%); smoking, hypertension (15.8%) and obesity (7.2%). There was an association between elevated LDL-C and TG levels and sedentary life style and body mass index. CONCLUSION: The high prevalence of risk factors for AS in young individuals draws attention to the need for adopting preventive plans.

Do pré-escolar para o 1º ano do ensino básico: "A Voz da Criança"

Dissertação de mestrado em Educação da Infância (área de especialização em Supervisão e Pedagogia da Infância)

China and India’s Maritime Geostrategies:: Implications for International Maritime Security and Scenarios for 2030

Dissertação de Mestrado em Estratégia

Análisis crítico de la formación y capacitación del profesional de la seguridad en la Provincia de Córdoba en los últimos diez años. A critical analysis of the formation and training of the professional in the area of security in the province of Córdoba in the last 10 years.

El problema que abordaremos es la transformación y la toma de decisiones en los procesos de formación y capacitación de las instituciones de seguridad, específicamente, los motivos y fundamentos de los cambios en los planes de estudios, en relación a los contenidos curriculares de los institutos de formación de los profesionales en seguridad. Esto sobre la hipótesis de que las organizaciones educativas policiales y penitenciarias han llevado a cabo transformaciones en su organización y gestión curricular para adecuarse a las nuevas demandas sociales y políticas. El objetivo del presente proyecto es analizar críticamente los contenidos curriculares de los institutos de formación y capacitación de la Policía y Servicio Penitenciario de la Provincia de Córdoba. Abordaremos el análisis de los planes de dichas instituciones en los últimos 10 años, sus modificaciones y criterios utilizados para responder a los nuevos escenarios sociales. Se hará una exploración de la información y la documentación existente en los ámbitos oficiales. Asimismo, la investigación contará con la realización de entrevistas y encuestas a directivos, docentes, alumnos y demás actores claves, con la finalidad de recabar la opinión de los mismos respecto de las transformaciones en la educación policial y penitenciaria. A partir del proyecto de investigación se pretende construir conocimiento acerca de las políticas educativas en el área de seguridad especialmente sobre la formación y capacitación de recursos profesionales específicos, dentro del ámbito local. De tal modo, se pretende aportar elementos teóricos de análisis al modo en que se han instituido la oferta educativa y las transformaciones en los planes de estudios en las instituciones de formación profesional de la seguridad y cómo éstos han sido implementados a la luz de los nuevos escenarios políticos y sociales. Esto nos permitirá aportar al incipiente campo de los estudios sobre la seguridad, específicamente sobre la formación de los profesionales en seguridad, poniendo a diposición de los responsables gubernamentales e institucionales un estudio que explora y sistematiza las transformaciones y fundamentos de la politica de educación en el campo de la seguridad provincial. Este desarrollo investigativo nos permitirá inagurar la actividad de producción de conocimiento dentro del ámbito académico de la Licenciatura en Seguridad de la Universidad Nacional de Villa María a través del presente proyecto que describirá el proceso de formación y capacitación policial y penitenciaria y los cambios que con el transcurso del tiempo se han verificado.

Tourism education in Ireland : an analysis of the provision of third level tourism education in Ireland focusing on the needs of the public, private and voluntary sectors

Tourism education in Ireland has witnessed a transformation within the last four decades since CERT introduced the first fundamentals of training in the 1960’s. An analysis of the provision of tourism education in Ireland, focusing on the needs of the public, private and voluntary sectors was the main focus of this study and concentrates mainly on third level provision of tourism education within the island of Ireland. The study examines the role of tourism education in Ireland, establishing any current or emerging trends in third level tourism provision. It identifies and analyses the main stakeholders in the public, private and voluntary sectors and investigates if any requirements exist in the provision of third level education. The multi-faceted nature of the tourism industry has resulted in the provision of a diverse range of educational courses. As a result of this diversity, a question hangs over the status of tourism as a professional discipline within itself. Other issues identified through this study are the over provision of tourism courses and the current and future disparity within tourism education. The qualitative nature of the research involved questioning of major stakeholders and educators who influence tourism education provision and developing an overview of the current status of tourism education provision in Ireland identifying the present needs of each sector. Finally several strategies are suggested which may enhance third level tourism education in the future.

An investigation into system security requirements and implementation in an Application Service Provider (ASP) environment

Although the ASP model has been around for over a decade, it has not achieved the expected high level of market uptake. This research project examines the past and present state of ASP adoption and identifies security as a primary factor influencing the uptake of the model. The early chapters of this document examine the ASP model and ASP security in particular. Specifically, the literature and technology review chapter analyses ASP literature, security technologies and best practices with respect to system security in general. Based on this investigation, a prototype to illustrate the range and types of technologies that encompass a security framework was developed and is described in detail. The latter chapters of this document evaluate the practical implementation of system security in an ASP environment. Finally, this document outlines the research outputs, including the conclusions drawn and recommendations with respect to system security in an ASP environment. The primary research output is the recommendation that by following best practices with respect to security, an ASP application can provide the same level of security one would expect from any other n-tier client-server application. In addition, a security evaluation matrix, which could be used to evaluate not only the security of ASP applications but the security of any n-tier application, was developed by the author. This thesis shows that perceptions with regard to fears of inadequate security of ASP solutions and solution data are misguided. Finally, based on the research conducted, the author recommends that ASP solutions should be developed and deployed on tried, tested and trusted infrastructure. Existing Application Programming Interfaces (APIs) should be used where possible and security best practices should be adhered to where feasible.

Georgia: National Security Concept Versus National Security

საქართველოს ეროვნული უსაფრთხოების კონცეფციის განახლებული ვერსიის გამოჩენა შესაძლებლობას იძლევა საიმისოდ, რომ გადავხედოთ საქართველოს ოფიციალურ შეხედულებას უსაფრთხოების შესახებ და შევაფასოთ ქვეყნის დამოკიდებულება საშინაო თუ საგარეო უსაფრთხოების გარემოსადმი;სტატია, პირველ რიგში, განიხილავს საქართველოს ეროვნული უსაფრთხოების დაგეგმვის გარემოებებს. შემდეგ ჩამოთვლილია კონცეფიციის პოზიტიური ასპექტები. ანალიზის ძირითადი ნაწილი მოიცავს ხუთ პრობლემატურ საკითხს. პირველი არის შიდა არასტაბილურობის შესაძლებლობა, რომლის შესახებ კონცეფციაში არაფერია ნათქვამი. მეორე საკითხი ეხება გლობალიზაციისა და ურთიერთდამოკიდებულების უსაფრთხოების ასპექტებს. მესამე საკითხი მოიცავს სამხრეთ კავკასიის რეგიონში არსებულ საფრთხეებს, კერძოდ კი, მთიანი ყარაბახის კონფლიქტს და არასტაბილურ მდგომარეობას ჩრდილოეთ კავკასიაში. მეოთხე საკითხი არის რუსეთისგან მომავალი საფრთხე. ბოლოს, განხილულია საქართველოს დასავლური ორიენტაცია.

Teaching Basic Life Support to Students of Public and Private High Schools

Background:Despite being recommended as a compulsory part of the school curriculum, the teaching of basic life support (BLS) has yet to be implemented in high schools in most countries.Objectives:To compare prior knowledge and degree of immediate and delayed learning between students of one public and one private high school after these students received BLS training.Methods:Thirty students from each school initially answered a questionnaire on cardiopulmonary resuscitation (CPR) and use of the automated external defibrillator (AED). They then received theoretical-practical BLS training, after which they were given two theory assessments: one immediately after the course and the other six months later.Results:The overall success rates in the prior, immediate, and delayed assessments were significantly different between groups, with better performance shown overall by private school students than by public school students: 42% ± 14% vs. 30.2% ± 12.2%, p = 0.001; 86% ± 7.8% vs. 62.4% ± 19.6%, p < 0.001; and 65% ± 12.4% vs. 45.6% ± 16%, p < 0.001, respectively. The total odds ratio of the questions showed that the private school students performed the best on all three assessments, respectively: 1.66 (CI95% 1.26-2.18), p < 0.001; 3.56 (CI95% 2.57-4.93), p < 0.001; and 2.21 (CI95% 1.69-2.89), p < 0.001.Conclusions:Before training, most students had insufficient knowledge about CPR and AED; after BLS training a significant immediate and delayed improvement in learning was observed in students, especially in private school students.

Klimawandel, Wetterextreme und private Schadensprävention : Entwicklung, Überprüfung und praktische Anwendbarkeit der Theorie privater proaktiver Wetterextrem-Vorsorge

Climate change, adaptation, adaptive capacity, natural disasters, natural hazards, flood preparedness, self-protective behavior, protection motivation, damage mitigation, self-efficacy, risk perception