Quality metrics for assessing security-critical computer programs

Existing secure software development principles tend to focus on coding vulnerabilities, such as buffer or integer overflows, that apply to individual program statements, or issues associated with the run-time environment, such as component isolation. Here we instead consider software security from the perspective of potential information flow through a program’s object-oriented module structure. In particular, we define a set of quantifiable "security metrics" which allow programmers to quickly and easily assess the overall security of a given source code program or object-oriented design. Although measuring quality attributes of object-oriented programs for properties such as maintainability and performance has been well-covered in the literature, metrics which measure the quality of information security have received little attention. Moreover, existing securityrelevant metrics assess a system either at a very high level, i.e., the whole system, or at a fine level of granularity, i.e., with respect to individual statements. These approaches make it hard and expensive to recognise a secure system from an early stage of development. Instead, our security metrics are based on well-established compositional properties of object-oriented programs (i.e., data encapsulation, cohesion, coupling, composition, extensibility, inheritance and design size), combined with data flow analysis principles that trace potential information flow between high- and low-security system variables. We first define a set of metrics to assess the security quality of a given object-oriented system based on its design artifacts, allowing defects to be detected at an early stage of development. We then extend these metrics to produce a second set applicable to object-oriented program source code. The resulting metrics make it easy to compare the relative security of functionallyequivalent system designs or source code programs so that, for instance, the security of two different revisions of the same system can be compared directly. This capability is further used to study the impact of specific refactoring rules on system security more generally, at both the design and code levels. By measuring the relative security of various programs refactored using different rules, we thus provide guidelines for the safe application of refactoring steps to security-critical programs. Finally, to make it easy and efficient to measure a system design or program’s security, we have also developed a stand-alone software tool which automatically analyses and measures the security of UML designs and Java program code. The tool’s capabilities are demonstrated by applying it to a number of security-critical system designs and Java programs. Notably, the validity of the metrics is demonstrated empirically through measurements that confirm our expectation that program security typically improves as bugs are fixed, but worsens as new functionality is added.

Critical time scales for advection–diffusion–reaction processes

The concept of local accumulation time (LAT) was introduced by Berezhkovskii and coworkers in 2010–2011 to give a finite measure of the time required for the transient solution of a reaction–diffusion equation to approach the steady–state solution (Biophys J. 99, L59 (2010); Phys Rev E. 83, 051906 (2011)). Such a measure is referred to as a critical time. Here, we show that LAT is, in fact, identical to the concept of mean action time (MAT) that was first introduced by McNabb in 1991 (IMA J Appl Math. 47, 193 (1991)). Although McNabb’s initial argument was motivated by considering the mean particle lifetime (MPLT) for a linear death process, he applied the ideas to study diffusion. We extend the work of these authors by deriving expressions for the MAT for a general one–dimensional linear advection–diffusion–reaction problem. Using a combination of continuum and discrete approaches, we show that MAT and MPLT are equivalent for certain uniform–to-uniform transitions; these results provide a practical interpretation for MAT, by directly linking the stochastic microscopic processes to a meaningful macroscopic timescale. We find that for more general transitions, the equivalence between MAT and MPLT does not hold. Unlike other critical time definitions, we show that it is possible to evaluate the MAT without solving the underlying partial differential equation (pde). This makes MAT a simple and attractive quantity for practical situations. Finally, our work explores the accuracy of certain approximations derived using the MAT, showing that useful approximations for nonlinear kinetic processes can be obtained, again without treating the governing pde directly.

Legal education and the 'idealistic student': using Foucault to unpack the critical legal narrative

It appears that few of the students holding ‘socially idealistic’ goals upon entering law school actually maintain these upon graduation. The critical legal narrative, which explains and seeks to act upon this shift in the graduate’s ‘legal identity’, posits that these ideals are repressed through power relations that create passive receptacles into which professional ideologies can be deposited, in the interests of those advantaged by the social and legal status quo. Using the work of Michel Foucault, this paper unpacks the assumptions underpinning this narrative, particularly its arguments about ideology, power, and the subject. In doing so, it will argue this narrative provides an untenable basis for political action within legal education. By interrogating this narrative, this paper provides a new way of understanding the construction of the legal identity through legal education, and a new basis for political action within law school.

Corporate, risk, mining camps and knowledge/power

Australia is currently in the midst of a major resources boom. However the benefits from the boom are unevenly distributed, with state governments collecting billions in royalties, and mining companies billions in profits. The costs are borne mostly at a local level by regional communities on the frontier of the mining boom, surrounded by thousands of men housed in work camps. The escalating reliance on non–resident workers housed in camps carries significant risks for individual workers, host communities and the provision of human services and infrastructure. These include rising rates of fatigue–related death and injuries, rising levels of alcohol–fuelled violence, illegally erected and unregulated work camps, soaring housing costs and other costs of living, and stretched basic infrastructure undermining the sustainability of these towns. But these costs have generally escaped industry, government and academic scrutiny. This chapter directs a critical gaze at the hopelessly compromised industry–funded research vital to legitimating the resource sector’s self–serving knowledge claims that it is committed to social sustainability and corporate responsibility. The chapter divides into two parts. The first argues that post–industrial mining regimes mask and privatise these harms and risks, shifting them on to workers, families and communities. The second part links the privatisation of these risks with the political economy of privatised knowledge embedded in the approvals process for major resource sector projects.

A symposium of reviews of public criminology? : by Ian Loader and Richard Sparks (Oxford : Key Ideas in Criminology, Routledge, 2010, 196pp.) with contributions from Nils Christie, Elliott Currie, Helena Kennedy, Gloria Laycock, Rod Morgan, Joe Sim, Jacqueline Tombs and Reece Walters

Public or Civic Criminology : A Critique of Loader and Sparks

Accuracy of rate estimation using relaxed-clock models with a critical focus on the early metazoan radiation

In recent years, a number of phylogenetic methods have been developed for estimating molecular rates and divergence dates under models that relax the molecular clock constraint by allowing rate change throughout the tree. These methods are being used with increasing frequency, but there have been few studies into their accuracy. We tested the accuracy of several relaxed-clock methods (penalized likelihood and Bayesian inference using various models of rate change) using nucleotide sequences simulated on a nine-taxon tree. When the sequences evolved with a constant rate, the methods were able to infer rates accurately, but estimates were more precise when a molecular clock was assumed. When the sequences evolved under a model of autocorrelated rate change, rates were accurately estimated using penalized likelihood and by Bayesian inference using lognormal and exponential models of rate change, while other models did not perform as well. When the sequences evolved under a model of uncorrelated rate change, only Bayesian inference using an exponential rate model performed well. Collectively, the results provide a strong recommendation for using the exponential model of rate change if a conservative approach to divergence time estimation is required. A case study is presented in which we use a simulation-based approach to examine the hypothesis of elevated rates in the Cambrian period, and it is found that these high rate estimates might be an artifact of the rate estimation method. If this bias is present, then the ages of metazoan divergences would be systematically underestimated. The results of this study have implications for studies of molecular rates and divergence dates.

Embedded criminology and knowledges of resistance

This chapter explores the changing intellectual landscapes and market-led research within academic institutions as the rise of 'embedded criminology' and argues for knowledges of resistance.

Job satisfaction and intention to leave among critical care nurses in Saudi Arabia

Aim The purpose of this study was to examine the relationship between registered nurses’ (RN) job satisfaction and their intention to leave critical care nursing in Saudi Arabia. Background Many studies have identified critical care areas as stressful work environments for nurses and have identified factors contributing to job satisfaction and staff retention. However, very little research has examined these relationships in the Saudi context. Design and Methods This study utilised an exploratory, cross-sectional survey design to examine the relationship between RN job satisfaction and intention to leave at King Abdul-Aziz University Hospital, Saudi Arabia. Respondents completed a self-administered survey including demographic items and validated measures of job satisfaction and intention to leave. A convenience sample of 182 RNs working in critical care areas during the data collection period were included. Results Regression analysis predicting RN intention to leave found that demographic variables including age, parental status and length of ICU experience, and three of the job satisfaction subscales including perceived workload, professional support and pay and prospects for promotion, were significantly associated with the outcome variable. Conclusion This study adds to the existing literature on the relationship between job satisfaction and intention to leave critical care areas among RNs working in Saudi Arabia. These findings point to the need for management and policy interventions targeting nurses’ workloads, professional support and pay and promotion in order to improve nurse retention.

Re-examining the evidence in radiation dermatitis management literature : an overview and a critical appraisal of systematic reviews

Purpose: To provide an overview and a critical appraisal of systematic reviews (SRs) of published interventions for the prevention/management of radiation dermatitis. Methods and Materials: We searched Medline, CINAHL, Embase, and the Cochrane Library. We also manually searched through individual reference lists of potentially eligible articles and a number of key journals in the topic area. Two authors screened all potential articles and included eligible SRs. Two authors critically appraised and extracted key findings from the included reviews using AMSTAR (the measurement tool for “assessment of multiple systematic reviews”). Results: Of 1837 potential titles, 6 SRs were included. A number of interventions have been reported to be potentially beneficial for managing radiation dermatitis. Interventions evaluated in these reviews included skin care advice, steroidal/nonsteroidal topical agents, systemic therapies, modes of radiation delivery, and dressings. However, all the included SRs reported that there is insufficient evidence supporting any single effective intervention. The methodological quality of the included studies varied, and methodological shortfalls in these reviews might create biases to the overall results or recommendations for clinical practice. Conclusions: An up-to-date high-quality SR in the prevention/management of radiation dermatitis is needed to guide practice and direction for future research. We recommend that clinicians or guideline developers critically evaluate the information of SRs in their decision making.

Against Marginality: Arguments for a Public Criminology

Despite its accumulated theoretical and empirical heft, the discipline of criminology has had distressingly little impact on the course of public policy toward crime and criminal justice. This article addresses the sources of that troubling marginality, with special emphasis on the powerful disincentives to greater public impact that operate within the discipline itself and the research universities that mainly house it—including the pressure to publish ever more narrow research in peer-reviewed journals at the expense of efforts at synthesis and dissemination that could serve to educate a broader public. Achieving a greater voice in the world outside the discipline will require a concerted move toward a more explicitly public criminology, and seeing to it that the work of such a criminology is more reliably supported and rewarded within the universities and the profession as a whole.