A risk simulation framework for information infrastructure protection

Information communication and technology (ICT) systems are almost ubiquitous in the modern world. It is hard to identify any industry, or for that matter any part of society, that is not in some way dependent on these systems and their continued secure operation. Therefore the security of information infrastructures, both on an organisational and societal level, is of critical importance. Information security risk assessment is an essential part of ensuring that these systems are appropriately protected and positioned to deal with a rapidly changing threat environment. The complexity of these systems and their inter-dependencies however, introduces a similar complexity to the information security risk assessment task. This complexity suggests that information security risk assessment cannot, optimally, be undertaken manually. Information security risk assessment for individual components of the information infrastructure can be aided by the use of a software tool, a type of simulation, which concentrates on modelling failure rather than normal operational simulation. Avoiding the modelling of the operational system will once again reduce the level of complexity of the assessment task. The use of such a tool provides the opportunity to reuse information in many different ways by developing a repository of relevant information to aid in both risk assessment and management and governance and compliance activities. Widespread use of such a tool allows the opportunity for the risk models developed for individual information infrastructure components to be connected in order to develop a model of information security exposures across the entire information infrastructure. In this thesis conceptual and practical aspects of risk and its underlying epistemology are analysed to produce a model suitable for application to information security risk assessment. Based on this work prototype software has been developed to explore these concepts for information security risk assessment. Initial work has been carried out to investigate the use of this software for information security compliance and governance activities. Finally, an initial concept for extending the use of this approach across an information infrastructure is presented.

Measuring the effect of motorcycle rider training on psychosocial influences for risk taking

Aim: Whilst motorcycle rider training is commonly incorporated into licensing programs in many developed nations, little empirical support has been found in previous research to prescribe it as an effective road safety countermeasure. It has been posited that the lack of effect of motorcycle rider training on crash reduction may, in part, be due to the predominant focus on skills-based training with little attention devoted to addressing attitudes and motives that influence subsequent risky riding. However, little past research has actually endeavoured to measure attitudinal and motivational factors as a function of rider training. Accordingly, this study was undertaken to assess the effect of a commercial motorcycle rider training program on psychosocial factors that have been shown to influence risk taking by motorcyclists. Method: Four hundred and thirty-eight motorcycle riders attending a competency-based licence training course in Brisbane, Australia, voluntarily participated in the study. A self-report questionnaire adapted from the Rider Risk Assessment Measure (RRAM) was administered to participants at the commencement of training, then again at the conclusion of training. Participants were informed of the independent nature of the research and that their responses would in no way effect their chance of obtaining a licence. To minimise potential demand characteristics, participants were instructed to seal completed questionnaires in envelopes and place them in a sealed box accessible only by the research team (i.e. not able to be viewed by instructors). Results: Significant reductions in the propensity for thrill seeking and intentions to engage in risky riding in the next 12 months were found at the end of training. In addition, a significant increase in attitudes to safety was found. Conclusions: These findings indicate that rider training may have a positive short-term influence on riders’ propensity for risk taking. However, such findings must be interpreted with caution in regard to the subsequent safety of riders as these factors may be subject to further influence once riders are licensed and actively engage with peers during on-road riding. This highlights a challenge for road safety education / training programs in regard to the adoption of safety practices and the need for behavioural follow-up over time to ascertain long-term effects. This study was the initial phase of an ongoing program of research into rider training and risk taking framed around Theory of Planned Behaviour concepts. A subsequent 12 month follow-up of the study participants has been undertaken with data analysis pending.

A review of system safety failure probability objectives for Unmanned Aircraft Systems

Unmanned Aircraft Systems (UAS) are one of a number of emerging aviation sectors. Such new aviation concepts present a significant challenge to National Aviation Authorities (NAAs) charged with ensuring the safety of their operation within the existing airspace system. There is significant heritage in the existing body of aviation safety regulations for Conventionally Piloted Aircraft (CPA). It can be argued that the promulgation of these regulations has delivered a level of safety tolerable to society, thus justifying the “default position” of applying these same standards, regulations and regulatory structures to emerging aviation concepts such as UAS. An example of this is the proposed “1309” regulation for UAS, which is based on the 1309 regulation for CPA. However, the absence of a pilot on-board an unmanned aircraft creates a fundamentally different risk paradigm to that of CPA. An appreciation of these differences is essential to the justification of the “default position” and in turn, to ensure the development of effective safety standards and regulations for UAS. This paper explores the suitability of the proposed “1309” regulation for UAS. A detailed review of the proposed regulation is provided and a number of key assumptions are identified and discussed. A high-level model characterising the expected number of third party fatalities on the ground is then used to determine the impact of these assumptions. The results clearly show that the “one size fits all” approach to the definition of 1309 regulations for UAS, which mandates equipment design and installation requirements independent of where the UAS is to be operated, will not lead to an effective management of the risks.

Navigational safety in port waters: Techniques for modeling collision risk

Navigational collisions are one of the major safety concerns for many seaports. Continuing growth of shipping traffic in number and sizes is likely to result in increased number of traffic movements, which consequently could result higher risk of collisions in these restricted waters. This continually increasing safety concern warrants a comprehensive technique for modeling collision risk in port waters, particularly for modeling the probability of collision events and the associated consequences (i.e., injuries and fatalities). A number of techniques have been utilized for modeling the risk qualitatively, semi-quantitatively and quantitatively. These traditional techniques mostly rely on historical collision data, often in conjunction with expert judgments. However, these techniques are hampered by several shortcomings, such as randomness and rarity of collision occurrence leading to obtaining insufficient number of collision counts for a sound statistical analysis, insufficiency in explaining collision causation, and reactive approach to safety. A promising alternative approach that overcomes these shortcomings is the navigational traffic conflict technique (NTCT), which uses traffic conflicts as an alternative to the collisions for modeling the probability of collision events quantitatively. This article explores the existing techniques for modeling collision risk in port waters. In particular, it identifies the advantages and limitations of the traditional techniques and highlights the potentials of the NTCT in overcoming the limitations. In view of the principles of the NTCT, a structured method for managing collision risk is proposed. This risk management method allows safety analysts to diagnose safety deficiencies in a proactive manner, which consequently has great potential for managing collision risk in a fast, reliable and efficient manner.

The development of ground impact models for the analysis of the risks associated with Unmanned Aircraft Operations over inhabited areas

With the emergence of Unmanned Aircraft Systems (UAS) there is a growing need for safety standards and regulatory frameworks to manage the risks associated with their operations. The primary driver for airworthiness regulations (i.e., those governing the design, manufacture, maintenance and operation of UAS) are the risks presented to people in the regions overflown by the aircraft. Models characterising the nature of these risks are needed to inform the development of airworthiness regulations. The output from these models should include measures of the collective, individual and societal risk. A brief review of these measures is provided. Based on the review, it was determined that the model of the operation of an UAS over inhabited areas must be capable of describing the distribution of possible impact locations, given a failure at a particular point in the flight plan. Existing models either do not take the impact distribution into consideration, or propose complex and computationally expensive methods for its calculation. A computationally efficient approach for estimating the boundary (and in turn area) of the impact distribution for fixed wing unmanned aircraft is proposed. A series of geometric templates that approximate the impact distributions are derived using an empirical analysis of the results obtained from a 6-Degree of Freedom (6DoF) simulation. The impact distributions can be aggregated to provide impact footprint distributions for a range of generic phases of flight and missions. The maximum impact footprint areas obtained from the geometric template are shown to have a relative error of typically less than 1% compared to the areas calculated using the computationally more expensive 6DoF simulation. Computation times for the geometric models are on the order of one second or less, using a standard desktop computer. Future work includes characterising the distribution of impact locations within the footprint boundaries.

Risk-based approach to the management of on-site wastewater treatment facilities

Background On-site wastewater treatment system (OWTS) siting, design and management has traditionally been based on site specific conditions with little regard to the surrounding environment or the cumulative effect of other systems in the environment. The general approach has been to apply the same framework of standards and regulations to all sites equally, regardless of the sensitivity, or lack thereof, to the receiving environment. Consequently, this has led to the continuing poor performance and failure of on-site systems, resulting in environmental and public health consequences. As a result, there is increasing realisation that more scientifically robust evaluations in regard to site assessment and the underlying ground conditions are needed. Risk-based approaches to on-site system siting, design and management are considered the most appropriate means of improvement to the current standards and codes for on-site wastewater treatment systems. The Project Research in relation to this project was undertaken within the Gold Coast City Council region, the major focus being the semi-urban, rural residential and hinterland areas of the city that are not serviced by centralised treatment systems. The Gold Coast has over 15,000 on-site systems in use, with approximately 66% being common septic tank-subsurface dispersal systems. A recent study evaluating the performance of these systems within the Gold Coast area showed approximately 90% were not meeting the specified guidelines for effluent treatment and dispersal. The main focus of this research was to incorporate strong scientific knowledge into an integrated risk assessment process to allow suitable management practices to be set in place to mitigate the inherent risks. To achieve this, research was undertaken focusing on three main aspects involved with the performance and management of OWTS. Firstly, an investigation into the suitability of soil for providing appropriate effluent renovation was conducted. This involved detailed soil investigations, laboratory analysis and the use of multivariate statistical methods for analysing soil information. The outcomes of these investigations were developed into a framework for assessing soil suitability for effluent renovation. This formed the basis for the assessment of OWTS siting and design risks employed in the developed risk framework. Secondly, an assessment of the environmental and public health risks was performed specifically related the release of contaminants from OWTS. This involved detailed groundwater and surface water sampling and analysis to assess the current and potential risks of contamination throughout the Gold Coast region. Additionally, the assessment of public health risk incorporated the use of bacterial source tracking methods to identify the different sources of fecal contamination within monitored regions. Antibiotic resistance pattern analysis was utilised to determine the extent of human faecal contamination, with the outcomes utilised for providing a more indicative public health assessment. Finally, the outcomes of both the soil suitability assessment and ground and surface water monitoring was utilised for the development of the integrated risk framework. The research outcomes achieved through this project enabled the primary research aims and objects to be accomplished. This in turn would enable Gold Coast City Council to provide more appropriate assessment and management guidelines based on robust scientific knowledge which will ultimately ensure that the potential environmental and public health impacts resulting from on-site wastewater treatment is minimised. As part of the implementation of suitable management strategies, a critical point monitoring program (CPM) was formulated. This entailed the identification of the key critical parameters that contribute to the characterised risks at monitored locations within the study area. The CPM will allow more direct procedures to be implemented, targeting the specific hazards at sensitive areas throughout Gold Coast region.

Assessing Cardiovascular Risk in Regional Areas: The Healthy Hearts – Beyond City Limits Program

Background: Cardiovascular disease (CVD) is more prevalent in regional and remote Australia compared to metropolitan areas. The aim of Healthy Hearts was to determine age and sex specific CVD risk factor levels and the potential value of national risk clinics. Methods: Healthy Hearts was an observational research study conducted in four purposefully selected higher risk communities in regional Victoria, Australia. The main outcome measures were the proportion of participants with CVD risk factors with group comparisons to determine the adjusted likelihood of elevated risk factor levels. Trained personnel used a standardized protocol over four weeks per community to measure CVD risk factor levels, estimate absolute CVD risk and provide feedback and advice. Results: A total of 2125 self-selected participants were assessed (mean age 58 ± 15 years, 57% women). Overall, CVD risk factors were highly prevalent. More men than women had ≥ 2 modifiable CVD risk factors (76% vs. 68%, p < .001), pre-existing CVD (20 vs. 15%, p < .01) and a major ECG abnormality requiring follow-up (15% vs. 7%, p < .001) . Less men reported depressive symptoms compared to women (28% vs. 22%, p < .01). A higher proportion of women were obese (adjusted OR 1.36, 95% CI 1.13 to 1.63), and physically inactive (adjusted OR 1.32, 95% CI 1.07 to 1.63). Conclusions: High CVD risk factor levels were confirmed for regional Victoria. Close engagement with individuals and communities provides scope for the application of regional risk management clinics to reduce the burden of CVD risk in regional Australia.

A data mining driven risk profiling method for road asset management

Road surface skid resistance has been shown to have a strong relationship to road crash risk, however, applying the current method of using investigatory levels to identify crash prone roads is problematic as they may fail in identifying risky roads outside of the norm. The proposed method analyses a complex and formerly impenetrable volume of data from roads and crashes using data mining. This method rapidly identifies roads with elevated crash-rate, potentially due to skid resistance deficit, for investigation. A hypothetical skid resistance/crash risk curve is developed for each road segment, driven by the model deployed in a novel regression tree extrapolation method. The method potentially solves the problem of missing skid resistance values which occurs during network-wide crash analysis, and allows risk assessment of the major proportion of roads without skid resistance values.

Validating a novel, low cost, automated malnutrition screening system as a predictor of nutritional risk in the Oncology Day Care Unit

Background Cancer-related malnutrition is associated with increased morbidity, poorer tolerance of treatment, decreased quality of life, increased hospital admissions, and increased health care costs (Isenring et al., 2013). This study’s aim was to determine whether a novel, automated screening system was a useful tool for nutrition screening when compared against a full nutrition assessment using the Patient-Generated Subjective Global Assessment (PG-SGA) tool. Methods A single site, observational, cross-sectional study was conducted in an outpatient oncology day care unit within a Queensland tertiary facility, with three hundred outpatients (51.7% male, mean age 58.6 ± 13.3 years). Eligibility criteria: ≥18 years, receiving anticancer treatment, able to provide written consent. Patients completed the Malnutrition Screening Tool (MST). Nutritional status was assessed using the PG-SGA. Data for the automated screening system was extracted from the pharmacy software program Charm. This included body mass index (BMI) and weight records dating back up to six months. Results The prevalence of malnutrition was 17%. Any weight loss over three to six weeks prior to the most recent weight record as identified by the automated screening system relative to malnutrition resulted in 56.52% sensitivity, 35.43% specificity, 13.68% positive predictive value, 81.82% negative predictive value. MST score 2 or greater was a stronger predictor of nutritional risk relative to PG-SGA classified malnutrition (70.59% sensitivity, 69.48% specificity, 32.14% positive predictive value, 92.02% negative predictive value). Conclusions Both the automated screening system and the MST fell short of the accepted professional standard for sensitivity (80%) or specificity (60%) when compared to the PG-SGA. However, although the MST remains a better predictor of malnutrition in this setting, uptake of this tool in the Oncology Day Care Unit remains challenging.

A comparative analysis of risk stratification tools for emergency department patients with chest pain

Background: Appropriate disposition of emergency department (ED) patients with chest pain is dependent on clinical evaluation of risk. A number of chest pain risk stratification tools have been proposed. The aim of this study was to compare the predictive performance for major adverse cardiac events (MACE) using risk assessment tools from the National Heart Foundation of Australia (HFA), the Goldman risk score and the Thrombolysis in Myocardial Infarction risk score (TIMI RS). Methods: This prospective observational study evaluated ED patients aged ≥30 years with non-traumatic chest pain for which no definitive non-ischemic cause was found. Data collected included demographic and clinical information, investigation findings and occurrence of MACE by 30 days. The outcome of interest was the comparative predictive performance of the risk tools for MACE at 30 days, as analyzed by receiver operator curves (ROC). Results: Two hundred eighty-one patients were studied; the rate of MACE was 14.1%. Area under the curve (AUC) of the HFA, TIMI RS and Goldman tools for the endpoint of MACE was 0.54, 0.71 and 0.67, respectively, with the difference between the tools in predictive ability for MACE being highly significant [chi2 (3) = 67.21, N = 276, p < 0.0001]. Conclusion: The TIMI RS and Goldman tools performed better than the HFA in this undifferentiated ED chest pain population, but selection of cutoffs balancing sensitivity and specificity was problematic. There is an urgent need for validated risk stratification tools specific for the ED chest pain population.

An early assessment of silicone hydrogel safety : pearls and pitfalls, and current status

The contact lens industry has evolved and now provides many choices, including continuous wear, overnight orthokeratology, frequent-replacement lenses, daily-disposable lenses, and many alternatives in systems of care and maintenance. Epidemiologic studies to date have shown that how a lens is worn, particularly if worn overnight, can increase the risk of microbial keratitis. However, the risk of silicone hydrogel contact lenses worn on a continuous-wear basis has been evaluated only recently. This article summarizes the recent research data on extended-wear silicone hydrogel lenses and discusses the challenges of early evaluations of silicone hydrogel lens safety. Finally, the relevance of this information is discussed to practitioners and contact lens wearers making choices about the risks and benefits of different products and how they are used.

A method for risk analysis across governance systems : a great barrier reef case study

Healthy governance systems are key to delivering sound environmental management outcomes from global to local scales. There are, however, surprisingly few risk assessment methods that can pinpoint those domains and sub-domains within governance systems that are most likely to influence good environmental outcomes at any particular scale, or those if absent or dysfunctional, most likely to prevent effective environmental management. This paper proposes a new risk assessment method for analysing governance systems. This method is then tested through its preliminary application to a significant real-world context: governance as it relates to the health of Australia's Great Barrier Reef (GBR). The GBR exists at a supra-regional scale along most of the north eastern coast of Australia. Brodie et al (2012 Mar. Pollut. Bull. 65 81-100) have recently reviewed the state and trend of the health of the GBR, finding that overall trends remain of significant concern. At the same time, official international concern over the governance of the reef has recently been signalled globally by the International Union for the Conservation of Nature (IUCN). These environmental and political contexts make the GBR an ideal candidate for use in testing and reviewing the application of improved tools for governance risk assessment. © 2013 IOP Publishing Ltd.

Conflicting notions of risk : the chasm of conflict between institutions and the public

The trust and credibility gap between institutional regulators and the public is based on fundamental social and cultural differences related to power and authority. It is also associated with the 'distance' of a bureaucracies from those whom they serve. The nature of public concern about risk may be investigated by considering specific cognitive decision making 'rules' such as 'familiarity' of a hazard or 'voluntariness' of exposure. A more complete appreciation of the 'how' and 'why' of public response to danger from industrial hazards can be gained by appreciating these 'rules' within the broader context of mis-communication between 'elite' regulators and a highly diverse public. If the results of risk assessments are expressed in technical terms alone, it is unlikely that any real communication will occur. Further, if issues related to the 'remote' nature of much institutional decision making are not addressed, closure of the 'gap' may be difficult to bring about.

Methodology for developing real-time motorway traffic risk identification models using individual-vehicle data

Most of existing motorway traffic safety studies using disaggregate traffic flow data aim at developing models for identifying real-time traffic risks by comparing pre-crash and non-crash conditions. One of serious shortcomings in those studies is that non-crash conditions are arbitrarily selected and hence, not representative, i.e. selected non-crash data might not be the right data comparable with pre-crash data; the non-crash/pre-crash ratio is arbitrarily decided and neglects the abundance of non-crash over pre-crash conditions; etc. Here, we present a methodology for developing a real-time MotorwaY Traffic Risk Identification Model (MyTRIM) using individual vehicle data, meteorological data, and crash data. Non-crash data are clustered into groups called traffic regimes. Thereafter, pre-crash data are classified into regimes to match with relevant non-crash data. Among totally eight traffic regimes obtained, four highly risky regimes were identified; three regime-based Risk Identification Models (RIM) with sufficient pre-crash data were developed. MyTRIM memorizes the latest risk evolution identified by RIM to predict near future risks. Traffic practitioners can decide MyTRIM’s memory size based on the trade-off between detection and false alarm rates. Decreasing the memory size from 5 to 1 precipitates the increase of detection rate from 65.0% to 100.0% and of false alarm rate from 0.21% to 3.68%. Moreover, critical factors in differentiating pre-crash and non-crash conditions are recognized and usable for developing preventive measures. MyTRIM can be used by practitioners in real-time as an independent tool to make online decision or integrated with existing traffic management systems.

Risk mitigation of post-earthquake fire in urban buildings

Post-earthquake fire (PEF) is considered one of the most high risk and complicated problems affecting buildings in urban areas and can cause even more damage than the earthquake itself. However, most standards and codes ignore the implications of PEF and so buildings are not normally designed with PEF in mind. What is needed is for PEF factors to be routinely scrutinized and codified as part of the design process. A systematic application is presented as a means of mitigating the risk of PEF in urban buildings. This covers both existing buildings, in terms of retrofit solutions, and those yet to be designed, where a PEF factor is proposed. To ensure the mitigation strategy meets the defined criteria, a minimum time is defined – the safety guaranteed time target – where the safety of the inhabitants in a building is guaranteed.