Modelling Denial of Service Attacks on JFK with Meadow's Cost-Based Framework

We present the first detailed application of Meadows’s cost-based modelling framework to the analysis of JFK, an Internet key agreement protocol. The analysis identifies two denial of service attacks against the protocol that are possible when an attacker is willing to reveal the source IP address. The first attack was identified through direct application of a cost-based modelling framework, while the second was only identified after considering coordinated attackers. Finally, we demonstrate how the inclusion of client puzzles in the protocol can improve denial of service resistance against both identified attacks.

Critical success factors for positioning Australian business talent in the global knowledge economy : a current research agenda

"Globalisation‟ and the "global knowledge economy‟ have become some of the most common "buzzwords‟ in Australian business, economic, and social sectors in the past decade. Further, knowledge service exports are a growing sector for Australia that utilise complex technical and creative capacities, increasingly rely on virtual work innovations, require new socio-technical systems to establish and maintain effective client relationships in global contexts; and – along with other innovations in the electronic age – may require novel coping abilities on the part of both managers and their employees to achieve desired outcomes (Bandura, 2002). Accordingly, this paper overviews such trends. The paper also includes a research agenda which is a "work-in-progress‟ with a major global company, Shell (Australia); it highlights both the objectives and proposed methodology of the study; it also outlines anticipated key benefits arising from the research.

Collaboration and Engagement Throughout The Supply Chain : The Role of Government

Collaboration is acknowledged as a key to continued growth in the Australian construction industry. Government, as a major industry client, has an important role to play with respect to fostering collaboration and ensuring the global competitiveness of the industry. The paper draws upon data collected for the Construction 2020 study and aims to demonstrate that government can a) help to break down the adversarial situation that currently exists between clients, project managers and subcontractors; and b) allow the supply chain to collaborate more effectively in terms of satisfying the relational and financial needs of all parties. Government can also provide a clear set of guidelines (backed up by a functional dispute resolution system) that will promote confidence with respect to forging relationships. Thus, the paper will discuss the way in which public policy can be more closely aligned with actual industry needs in order to promote greater collaboration.

A comparative analysis of major ERP lifecycle implementation, management and support issues in Queensland Government

This paper reports on a study of ERP lifecycle major issues from the perspectives of individuals with substantial and diverse involvement with SAP Financials in Queensland Government. A survey was conducted of 117 ERP system project participants in five closely related state government agencies. A modified Delphi technique identified, rationalized and weighed perceived major issues in ongoing ERP life cycle implementation, management and support. The five agencies each implemented SAP Financials simultaneously using a common implementation partner. The three survey rounds of the Delphi technique, together with coding and synthesizing procedures, resulted in a set of 10 major issue categories with 38 sub-issues. Relative scores of issue importance are compared across government agencies, roles (client vs implementation partner) and organizational levels (strategic, technical and operational). Study findings confirm the importance of this finer partitioning of the data, and distinctions identified reflect the circumstances of ERP lifecycle implementation, management and support among the stakeholder groups. The study findings should also be of interest to stakeholders who seek to better understand the issues surrounding ERP systems and to better realise the benefits of ERP.

Developing a vision for an nD modelling tool

The design of a building is a complicated process, having to formulate diverse components through unique tasks involving different personalities and organisations in order to satisfy multi-faceted client requirements. To do this successfully, the project team must encapsulate an integrated design that accommodates various social, economic and legislative factors. Therefore, in this era of increasing global competition integrated design has been increasingly recognised as a solution to deliver value to clients.----- The ‘From 3D to nD modelling’ project at the University of Salford aims to support integrated design; to enable and equip the design and construction industry with a tool that allows users to create, share, contemplate and apply knowledge from multiple perspectives of user requirements (accessibility, maintainability, sustainability, acoustics, crime, energy simulation, scheduling, costing etc.). Thus taking the concept of 3-dimensional computer modelling of the built environment to an almost infinite number of dimensions, to cope with whole-life construction and asset management issues in the design of modern buildings. This paper reports on the development of a vision for how integrated environments that will allow nD-enabled construction and asset management to be undertaken. The project is funded by a four-year platform grant from the Engineering and Physical Sciences Research Council (EPSRC) in the UK; thus awarded to a multi-disciplinary research team, to enable flexibility in the research strategy and to produce leading innovation. This paper reports on the development of a business process and IT vision for how integrated environments will allow nD-enabled construction and asset management to be undertaken. It further develops many of the key issues of a future vision arising from previous CIB W78 conferences.

A framework for fully decentralised cycle stealing

Ordinary desktop computers continue to obtain ever more resources – in-creased processing power, memory, network speed and bandwidth – yet these resources spend much of their time underutilised. Cycle stealing frameworks harness these resources so they can be used for high-performance computing. Traditionally cycle stealing systems have used client-server based architectures which place significant limits on their ability to scale and the range of applica-tions they can support. By applying a fully decentralised network model to cycle stealing the limits of centralised models can be overcome. Using decentralised networks in this manner presents some difficulties which have not been encountered in their previous uses. Generally decentralised ap-plications do not require any significant fault tolerance guarantees. High-performance computing on the other hand requires very stringent guarantees to ensure correct results are obtained. Unfortunately mechanisms developed for traditional high-performance computing cannot be simply translated because of their reliance on a reliable storage mechanism. In the highly dynamic world of P2P computing this reliable storage is not available. As part of this research a fault tolerance system has been created which provides considerable reliability without the need for a persistent storage. As well as increased scalability, fully decentralised networks offer the ability for volunteers to communicate directly. This ability provides the possibility of supporting applications whose tasks require direct, message passing style communication. Previous cycle stealing systems have only supported embarrassingly parallel applications and applications with limited forms of communication so a new programming model has been developed which can support this style of communication within a cycle stealing context. In this thesis I present a fully decentralised cycle stealing framework. The framework addresses the problems of providing a reliable fault tolerance sys-tem and supporting direct communication between parallel tasks. The thesis includes a programming model for developing cycle stealing applications with direct inter-process communication and methods for optimising object locality on decentralised networks.

IT professionals' experience of ethics and its implications for IT education

This study investigates variation in IT professionals' experience of ethics with a view to enhancing their formation and support. This is explored through an examination of the experience of IT, IT professional ethics and IT professional ethics education. The study's principal contribution is the empirical study and description of IT professionals' experience of ethics. The empirical phase is preceded by a review of conceptions of IT and followed by an application of the findings to IT education. The study's empirical findings are based on 30 semi-structured interviews with IT professionals who represent a wide demographic, experience and IT sub-discipline range. Their experience of ethics is depicted as five citizenships: Citizenship of my world, Citizenship of the corporate world, Citizenship of a shared world, Citizenship of the client's world and Citizenship of the wider world. These signify an expanding awareness, which progressively accords rights to others and defines responsibility in terms of others. The empirical findings inform a Model of Ethical IT. This maps an IT professional space increasingly oriented towards others. Such a model provides a conceptual tool, available to prompt discussion and reflection, and which may be employed in pursuing formation aimed at experiential change. Its usefulness for the education of IT professionals with respect to ethics is explored. The research approach employed in this study is phenomenography. This method seeks to elicit and represent variation of experience. It understands experience as a relationship between a subject (IT professionals) and an object (ethics), and describes this relationship in terms of its foci and boundaries. The study's findings culminate in three observations, that change is indicated in the formation and support of IT professionals in: 1. IT professionals' experience of their discipline, moving towards a focus on information users; 2. IT professionals' experience of professional ethics, moving towards the adoption of other-centred attitudes; and 3. IT professionals' experience of professional development, moving towards an emphasis on a change in lived experience. Based on these results, employers, educators and professional bodies may want to evaluate how they approach professional formation and support, if they aim to promote a comprehensive awareness of ethics in IT professionals.

Too young to drink but old enough to drive under the influence : a study of underage offenders as seen in substance abuse treatment in Texas

Driving under the influence (DUI) is a major road safety problem. Historically, alcohol has been assumed to play a larger role in crashes and DUI education programs have reflected this assumption, although recent evidence suggests that younger drivers are becoming more likely to drive drugged than to drive drunk. This is a study of 7096 Texas clients under age 21 who were admitted to state-funded treatment programs between 1997 and 2007 with a past-year DUI arrest, DUI probation, or DUI referral. Data were obtained from the State’s administrative dataset. Multivariate logistic regressions models were used to understand the differences between those minors entering treatment as a DUI as compared to a non-DUI as well as the risks for completing treatment and for being abstinent in the month prior to follow-up. A major finding was that over time, the primary problem for underage DUI drivers changed from alcohol to marijuana. Being abstinent in the month prior to discharge, having a primary problem with alcohol rather than another drug, and having more family involved were the strongest predictors of treatment completion. Living in a household where the client was exposed to alcohol abuse or drug use, having been in residential treatment, and having more drug and alcohol and family problems were the strongest predictors of not being abstinent at follow-up. As a result, there is a need to direct more attention towards meeting the needs of the young DUI population through programs that address drug as well as alcohol consumption problems.

Protocol engineering for protection against denial-of-service attacks

Denial-of-service attacks (DoS) and distributed denial-of-service attacks (DDoS) attempt to temporarily disrupt users or computer resources to cause service un- availability to legitimate users in the internetworking system. The most common type of DoS attack occurs when adversaries °ood a large amount of bogus data to interfere or disrupt the service on the server. The attack can be either a single-source attack, which originates at only one host, or a multi-source attack, in which multiple hosts coordinate to °ood a large number of packets to the server. Cryptographic mechanisms in authentication schemes are an example ap- proach to help the server to validate malicious tra±c. Since authentication in key establishment protocols requires the veri¯er to spend some resources before successfully detecting the bogus messages, adversaries might be able to exploit this °aw to mount an attack to overwhelm the server resources. The attacker is able to perform this kind of attack because many key establishment protocols incorporate strong authentication at the beginning phase before they can iden- tify the attacks. This is an example of DoS threats in most key establishment protocols because they have been implemented to support con¯dentiality and data integrity, but do not carefully consider other security objectives, such as availability. The main objective of this research is to design denial-of-service resistant mechanisms in key establishment protocols. In particular, we focus on the design of cryptographic protocols related to key establishment protocols that implement client puzzles to protect the server against resource exhaustion attacks. Another objective is to extend formal analysis techniques to include DoS- resistance. Basically, the formal analysis approach is used not only to analyse and verify the security of a cryptographic scheme carefully but also to help in the design stage of new protocols with a high level of security guarantee. In this research, we focus on an analysis technique of Meadows' cost-based framework, and we implement DoS-resistant model using Coloured Petri Nets. Meadows' cost-based framework is directly proposed to assess denial-of-service vulnerabil- ities in the cryptographic protocols using mathematical proof, while Coloured Petri Nets is used to model and verify the communication protocols using inter- active simulations. In addition, Coloured Petri Nets are able to help the protocol designer to clarify and reduce some inconsistency of the protocol speci¯cation. Therefore, the second objective of this research is to explore vulnerabilities in existing DoS-resistant protocols, as well as extend a formal analysis approach to our new framework for improving DoS-resistance and evaluating the performance of the new proposed mechanism. In summary, the speci¯c outcomes of this research include following results; 1. A taxonomy of denial-of-service resistant strategies and techniques used in key establishment protocols; 2. A critical analysis of existing DoS-resistant key exchange and key estab- lishment protocols; 3. An implementation of Meadows's cost-based framework using Coloured Petri Nets for modelling and evaluating DoS-resistant protocols; and 4. A development of new e±cient and practical DoS-resistant mechanisms to improve the resistance to denial-of-service attacks in key establishment protocols.

Building procurement methods

A plethora of methods for procuring building projects are available to meet the needs of clients. Deciding what method to use for a given project is a difficult and challenging task as a client’s objectives and priorities need to marry with the selected method so as to improve the likelihood of the project being procured successfully. The decision as to what procurement system to use should be made as early as possible and underpinned by the client’s business case for the project. The risks and how they can potentially affect the client’s business should also be considered. In this report, the need for client’s to develop a procurement strategy, which outlines the key means by which the objectives of the project are to be achieved is emphasised. Once a client has established a business case for a project, appointed a principal advisor, determined their requirements and brief, then consideration as to which procurement method to be adopted should be made. An understanding of the characteristics of various procurement options is required before a recommendation can be made to a client. Procurement systems can be categorised as traditional, design and construct, management and collaborative. The characteristics of these systems along with the procurement methods commonly used are described. The main advantages and disadvantages, and circumstances under which a system could be considered applicable for a given project are also identified.

Electronic tendering: an industry perspective

The construction industry is categorised as being an information-intensive industry and described as one of the most important industries in any developed country, facing a period of rapid and unparalleled change (Industry Science Resources 1999) (Love P.E.D., Tucker S.N. et al. 1996). Project communications are becoming increasingly complex, with a growing need and fundamental drive to collaborate electronically at project level and beyond (Olesen K. and Myers M.D. 1999; Thorpe T. and Mead S. 2001; CITE 2003). Yet, the industry is also identified as having a considerable lack of knowledge and awareness about innovative information and communication technology (ICT) and web-based communication processes, systems and solutions which may prove beneficial in the procurement, delivery and life cycle of projects (NSW Government 1998; Kajewski S. and Weippert A. 2000). The Internet has debatably revolutionised the way in which information is stored, exchanged and viewed, opening new avenues for business, which only a decade ago were deemed almost inconceivable (DCITA 1998; IIB 2002). In an attempt to put these ‘new avenues of business’ into perspective, this report provides an overall ‘snapshot’ of current public and private construction industry sector opportunities and practices in the implementation and application of web-based ICT tools, systems and processes (e-Uptake). Research found that even with a reserved uptake, the construction industry and its participating organisations are making concerted efforts (fortunately with positive results) in taking up innovative forms of doing business via the internet, including e-Tendering (making it possible to manage the entire tender letting process electronically and online) (Anumba C.J. and Ruikar K. 2002; ITCBP 2003). Furthermore, Government (often a key client within the construction industry),and with its increased tendency to transact its business electronically, undoubtedly has an effect on how various private industry consultants, contractors, suppliers, etc. do business (Murray M. 2003) – by offering a wide range of (current and anticipated) e-facilities / services, including e-Tendering (Ecommerce 2002). Overall, doing business electronically is found to have a profound impact on the way today’s construction businesses operate - streamlining existing processes, with the growth in innovative tools, such as e-Tender, offering the construction industry new responsibilities and opportunities for all parties involved (ITCBP 2003). It is therefore important that these opportunities should be accessible to as many construction industry businesses as possible (The Construction Confederation 2001). Historically, there is a considerable exchange of information between various parties during a tendering process, where accuracy and efficiency of documentation is critical. Traditionally this process is either paper-based (involving large volumes of supporting tender documentation), or via a number of stand-alone, non-compatible computer systems, usually costly to both the client and contractor. As such, having a standard electronic exchange format that allows all parties involved in an electronic tender process to access one system only via the Internet, saves both time and money, eliminates transcription errors and increases speed of bid analysis (The Construction Confederation 2001). Supporting this research project’s aims and objectives, researchers set to determine today’s construction industry ‘current state-of-play’ in relation to e-Tendering opportunities. The report also provides brief introductions to several Australian and International e-Tender systems identified during this investigation. e-Tendering, in its simplest form, is described as the electronic publishing, communicating, accessing, receiving and submitting of all tender related information and documentation via the internet, thereby replacing the traditional paper-based tender processes, and achieving a more efficient and effective business process for all parties involved (NT Governement 2000; NT Government 2000; NSW Department of Commerce 2003; NSW Government 2003). Although most of the e-Tender websites investigated at the time, maintain their tendering processes and capabilities are ‘electronic’, research shows these ‘eTendering’ systems vary from being reasonably advanced to more ‘basic’ electronic tender notification and archiving services for various industry sectors. Research also indicates an e-Tender system should have a number of basic features and capabilities, including: • All tender documentation to be distributed via a secure web-based tender system – thereby avoiding the need for collating paperwork and couriers. • The client/purchaser should be able to upload a notice and/or invitation to tender onto the system. • Notification is sent out electronically (usually via email) for suppliers to download the information and return their responses electronically (online). • During the tender period, updates and queries are exchanged through the same e-Tender system. • The client/purchaser should only be able to access the tenders after the deadline has passed. • All tender related information is held in a central database, which should be easily searchable and fully audited, with all activities recorded. • It is essential that tender documents are not read or submitted by unauthorised parties. • Users of the e-Tender system are to be properly identified and registered via controlled access. In simple terms, security has to be as good as if not better than a manual tender process. Data is to be encrypted and users authenticated by means such as digital signatures, electronic certificates or smartcards. • All parties must be assured that no 'undetected' alterations can be made to any tender. • The tenderer should be able to amend the bid right up to the deadline – whilst the client/purchaser cannot obtain access until the submission deadline has passed. • The e-Tender system may also include features such as a database of service providers with spreadsheet-based pricing schedules, which can make it easier for a potential tenderer to electronically prepare and analyse a tender. Research indicates the efficiency of an e-Tender process is well supported internationally, with a significant number, yet similar, e-Tender benefits identified during this investigation. Both construction industry and Government participants generally agree that the implementation of an automated e-Tendering process or system enhances the overall quality, timeliness and cost-effectiveness of a tender process, and provides a more streamlined method of receiving, managing, and submitting tender documents than the traditional paper-based process. On the other hand, whilst there are undoubtedly many more barriers challenging the successful implementation and adoption of an e-Tendering system or process, researchers have also identified a range of challenges and perceptions that seem to hinder the uptake of this innovative approach to tendering electronically. A central concern seems to be that of security - when industry organisations have to use the Internet for electronic information transfer. As a result, when it comes to e-Tendering, industry participants insist these innovative tendering systems are developed to ensure the utmost security and integrity. Finally, if Australian organisations continue to explore the competitive ‘dynamics’ of the construction industry, without realising the current and future, trends and benefits of adopting innovative processes, such as e-Tendering, it will limit their globalising opportunities to expand into overseas markets and allow the continuation of international firms successfully entering local markets. As such, researchers believe increased knowledge, awareness and successful implementation of innovative systems and processes raises great expectations regarding their contribution towards ‘stimulating’ the globalisation of electronic procurement activities, and improving overall business and project performances throughout the construction industry sectors and overall marketplace (NSW Government 2002; Harty C. 2003; Murray M. 2003; Pietroforte R. 2003). Achieving the successful integration of an innovative e-Tender solution with an existing / traditional process can be a complex, and if not done correctly, could lead to failure (Bourn J. 2002).

Final Report

This project aims to assess the extent of economic sustainability of working in international markets by Australian construction design-related firms. This investigation also identified barriers and success factors firms experience, which ultimately increases or reduces their exposure to financial risk. This study explored new research territory by developing a detailed understanding of the way three successful firms have maintained their longevity in various international markets. The firms are not considered to be large firms by international standards. The manner in which the firms achieve long term sustainability, deal with problems and barriers in international markets and develop successful strategies rely upon being adaptable to different markets and changes within markets. A model was developed based upon a critical analysis of the literature. An adaptive performance framework for sustainability was developed which had three key areas; internationalisation process, market knowledge and design management. The sustainable business model is underpinned by the management of non-economic factors, which include social, cultural and intellectual capital. The ultimate aim of any firm and the ultimate indicator of success is financial capital. Firms typically develop their own highly sophisticated financial measures themselves however have only an implicit understanding of other softer and less tangible factors that impact upon sustainability. Adaptive performance is the firm’s continual adaptivity of business practices to respond to and thereby achieve client satisfaction by a combination of self, market and project needs assessment.

Long term sustainability in exporting creativity

This project aims to assess the extent of economic sustainability of working in international markets by Australian construction design-related firms. This investigation also identified barriers and success factors firms experience, which ultimately increases or reduces their exposure to financial risk. This study explored new research territory by developing a detailed understanding of the way three successful firms have maintained their longevity in various international markets. The firms are not considered to be large firms by international standards. The manner in which the firms achieve long term sustainability, deal with problems and barriers in international markets and develop successful strategies rely upon being adaptable to different markets and changes within markets. A model was developed based upon a critical analysis of the literature. An adaptive performance framework for sustainability was developed which had three key areas; internationalisation process, market knowledge and design management. The sustainable business model is underpinned by the management of non-economic factors, which include social, cultural and intellectual capital. The ultimate aim of any firm and the ultimate indicator of success is financial capital. Firms typically develop their own highly sophisticated financial measures themselves however have only an implicit understanding of other softer and less tangible factors that impact upon sustainability. Adaptive performance is the firm’s continual adaptivity of business practices to respond to and thereby achieve client satisfaction by a combination of self, market and project needs assessment.

Final report implementation of relational management

Construction teams and construction organisations have their own distinctive cultures. There also exists an infrastructure, both social and contractual, which ensures that these projects within which the teams operate are completed successfully. It is these issues which this research has addressed. The project was instigated by Queensland Department of Main Roads, Public Works and John Holland Group in order to address how they might better implement relationship management (RM) on their construction projects. The project was devised initially in order to facilitate a change in culture which would allow the project to be run in a relational manner and would lead to effective performance in terms of the KPIs that the organisations set for themselves, described as business better than usual. This report describes the project, its outcomes and deliverable and indicates the changes that were made to the project during the research process. Hence, the initial premise of the project and the problem to investigate was the implementation of relational contracting: • throughout a range of projects; • with a focus on client body staff. The additions that were made to the project, and documented in the variations to the project, included two major additional areas of study: • client management and stakeholder management; • a live case study of an alliancing project. The context within which the research was undertaken is important. The research was driven by main roads with their desire to improve their operations by focusing on the relationship between the major project participants (however, stakeholder and client organisation management became an obvious issue as the research progressed, hence the variations). The context was initially focussed on main roads, public works and John Holland group organisations but it became clear very quickly that this was in fact an industry-wide issue and not an issue specific solely to the project participants. Hence, the context within which this research took place can be described as below: The deliverables from the project are a toolkit for determining RM needs in an organisation, a monograph describing the practical implementation of RM and the outline for a RM CPD and Masters course

Report a review of the concepts and definitions of the various forms of relational contracting

Partnering has been defined in many ways. It can be considered as an individual project mechanism or can be considered as a long term strategy. Alliancing is normally assumed to be a long term business strategy linking together client, contractor and supply chain. Relational contracting goes further than this and brings in the whole philosophy of the value chain and the linking of the interdependent parts within the construction project as a key business objective. This document aims to review existing definitions of these three concepts and present and overview of the current state of-the-art in terms of their use and implementation. The document should be useful for all of those project team members looking to sharpen their understanding of the various concepts and will also provide a platform for debating the current state of the definitions and implementations being used in Main Roads and Public Works Departments.