A cyber exercise post assessment framework: In Malaysia perspectives

Critical infrastructures are based on complex systems that provide vital services to the nation. The complexities of the interconnected networks, each managed by individual organisations, if not properly secured, could offer vulnerabilities that threaten other organisations’ systems that depend on their services. This thesis argues that the awareness of interdependencies among critical sectors needs to be increased. Managing and securing critical infrastructure is not isolated responsibility of a government or an individual organisation. There is a need for a strong collaboration among critical service providers of public and private organisations in protecting critical information infrastructure. Cyber exercises have been incorporated in national cyber security strategies as part of critical information infrastructure protection. However, organising a cyber exercise involved multi sectors is challenging due to the diversity of participants’ background, working environments and incidents response policies. How well the lessons learned from the cyber exercise and how it can be transferred to the participating organisations is still a looming question. In order to understand the implications of cyber exercises on what participants have learnt and how it benefits participants’ organisation, a Cyber Exercise Post Assessment (CEPA) framework was proposed in this research. The CEPA framework consists of two parts. The first part aims to investigate the lessons learnt by participants from a cyber exercise using the four levels of the Kirkpatrick Training Model to identify their perceptions on reaction, learning, behaviour and results of the exercise. The second part investigates the Organisation Cyber Resilience (OCR) of participating sectors. The framework was used to study the impact of the cyber exercise called X Maya in Malaysia. Data collected through interviews with X Maya 5 participants were coded and categorised based on four levels according to the Kirkpatrick Training Model, while online surveys distributed to ten Critical National Information Infrastructure (CNII) sectors participated in the exercise. The survey used the C-Suite Executive Checklist developed by World Economic Forum in 2012. To ensure the suitability of the tool used to investigate the OCR, a reliability test conducted on the survey items showed high internal consistency results. Finally, individual OCR scores were used to develop the OCR Maturity Model to provide the organisation cyber resilience perspectives of the ten CNII sectors.

Security protection for critical infrastructure

Understanding and managing information infrastructure (II) security risks is a priority to most organizations dealing with information technology and information warfare (IW) scenarios today (Libicki, 2000). Traditional security risk analysis (SRA) was well suited to these tasks within the paradigm of computer security, where the focus was on securing tangible items such as computing and communications equipment (NCS,1996; Cramer, 1998). With the growth of information interchange and reliance on information infrastructure, the ability to understand where vulnerabilities lie within an organization, regardless of size, has become extremely difficult (NIPC, 1996). To place a value on the information that is owned and used by an organization is virtually an impossible task. The suitability of risk analysis to assist in managing IW and information infrastructure-related security risks is unqualified, however studies have been undertaken to build frameworks and methodologies for modeling information warfare attacks (Molander, Riddile, & Wilson, 1996; Johnson, 1997; Hutchinson & Warren, 2001) which will assist greatly in applying risk analysis concepts and methodologies to the burgeoning information technology security paradigm, information warfare.

Critical supply chain systems and critical infrastructure protection

Secure management of Australia's commercial critical infrastructure presents ongoing challenges to both the owners of this infrastructure as well as to the government. It is currently managed through high-level information sharing via collaboration but does this situation suit the commercial sector? One of the issues facing Australia is that the majority of critical infrastructure resides under the control of the business sector and certain aspects such of the critical infrastructure such as supply chain management (SCM) systems are distributed across a number of entities. The paper focuses upon the security and risk issues associated with SCM systems within the realms of critical infrastructure protection.

A review of rationale for allocating costs and payments in producing and supplying public sector information

Presentation given by Dr John S Cook at the Queensland Spatial Conference 2008, Global Warming: What’s Happening in Paradise?, held at Holiday Inn, Surfers Paradise,Queensland from 17-19 July, 2008 This presentation provides some semblance of an information infrastructure that is aligned generally to problems of governance in complex organisations.

A review of rationale for allocating costs and payments in producing and supplying public sector information PART A of 2 Parts – Chapters 1, 2 and 3) 13 March 2011 version

This work reviews the rationale and processes for raising revenue and allocating funds to perform information intensive activities that are pertinent to the work of democratic government. ‘Government of the people, by the people, for the people’ expresses an idea that democratic government has no higher authority than the people who agree to be bound by its rules. Democracy depends on continually learning how to develop understandings and agreements that can sustain voting majorities on which democratic law making and collective action depends. The objective expressed in constitutional terms is to deliver ‘peace, order and good government’. Meeting this objective requires a collective intellectual authority that can understand what is possible; and a collective moral authority to understand what ought to happen in practice. Facts of life determine that a society needs to retain its collective competence despite a continual turnover of its membership as people die but life goes on. Retaining this ‘collective competence’ in matters of self-government depends on each new generation: • acquiring a collective knowledge of how to produce goods and services needed to sustain a society and its capacity for self-government; • Learning how to defend society diplomatically and militarily in relation to external forces to prevent overthrow of its self-governing capacity; and • Learning how to defend society against divisive internal forces to preserve the authority of representative legislatures, allow peaceful dispute resolution and maintain social cohesion.

Contractual relationships for better stewardship of privatised critical infrastructures

Governments increasingly rely on forms of privatisation to provide critical public infrastructure yet when those infrastructures fail to meet community expectations government bears the political and economic risks, being held accountable by the public as steward for those infrastructures. Reconfiguration of the contractual relationships may achieve better stewardship. Many of the forms of privatization rely on Agency theory prescriptions, conceptualizing organisations and individuals as motivated solely by self-interest. Stewardship theory (Van Slyke 2007) has developed as a complement to Agency theory offering the possibility of contractual relationships which maximize stewardship outcome. Stewardship theory asserts that pro-stewardship factors cause the agent/steward to act in the interests of the principal. This research has interrogated the literature finding that of the pro-stewardship factors, sense of responsibility is pre-eminent and has a significant link to the agent acting as a steward. The research has explored how important it is that the steward feel sense of responsibility and the actions that sense of responsibility. Case studies of privatized core elements of urban water systems infrastructure were explored. Data has been gathered primarily from archival sources and individual interviews of government and private sector executives key to those systems. This paper reports the findings as to the extent of stewardship, how important it is that the steward acts in the interests of the principal, even to the steward’s detriment and the importance of the steward feeling a sense of responsibility. The actions which increase that sense of responsibility will be assembled to position the research to better proceed with the analysis of the data as to these actions.

International students using online information resources to learn : complex experience and learning needs

This paper reports the findings of a qualitative study which investigated 25 international students’ use of online information resources for study purposes at two Australian universities. Using an expanded critical incident approach, the study viewed international students through an information literacy lens, as information-using learners. The findings are presented in two complementary parts: as a word picture that describes their whole experience of using online information resources to learn; and as a tabulated set of critical findings that summarises their associated information literacy learning needs. The word picture shows international students’ resource use as a complex interplay of eight inter-related elements: students; information-learning environment; interactions (with online resources); strengths-challenges; learning-help; affective responses; reflective responses; cultural-linguistic dimensions. In using online resources, the international students experience an array of strengths and challenges, and an apparent information literacy imbalance between their more developed information skills and less developed critical information use. The critical findings about information literacy needs provide a framework for developing an inclusive informed learning approach that responds to international students’ complex information using experiences and needs. While the study is situated in Australia, the findings are of potential interest to educators, information professionals and researchers worldwide who seek to support learning in culturally diverse higher education contexts.

Children's Literature Digital Resource (CLDR)

Children’s Literature Digital Resources incorporates primary texts published from white settlement to 1945, including children’s and young adult fiction, poetry, short stories, and picture books. This collection is supported by selected secondary material. The objective is to provide a centralised access point for information about Australian children's literature and writers and a growing body of full-text primary resources. Four key aims are: * To establish an important digital facility for research, teaching, and information provision around Australian children’s literature; * To provide access to a wide range of high-quality full-text data, both primary and secondary resources; * To provide access to essential library and research information infrastructure and facilities for established and emerging researchers in the fields of Humanities and Education; To enable research while preserving important heritage material. The collection contains texts digitised for AustLit through cooperation with various Australian libraries. The collection includes children’s and young adult fiction, poetry, picture books, short stories, and critical articles relating to relevant primary texts. Authors of primary sources include Irene Cheyne, E. W. Cole, Richard Rowe, Lillian M. Pyke, and Dorothy Wall. Secondary sources include critical works by Clare Bradford, Heather Scutter, Kerry White, Sharyn Pearce, and Marcie Muir. These full-text materials are keyword searchable (both within individual texts and across the CLDR corpus) and can be downloaded for research purposes. As well as digitising primary and secondary material, the project locates and provides pathways to existing online resources or internet publications to enhance AustLit's Children's Literature subset. These resources include both primary and secondary texts.

Study of a geo-multicast framework for efficient message dissemination at unmanned level crossings

Collisions among trains and cars at road/rail level crossings (LXs) can have severe consequences such as high level of fatalities, injuries and significant financial losses. As communication and positioning technologies have significantly advanced, implementing vehicular ad hoc networks (VANETs) in the vicinity of unmanned LXs, generally LXs without barriers, is seen as an efficient and effective approach to mitigate or even eliminate collisions without imposing huge infrastructure costs. VANETs necessitate unique communication strategies, in which routing protocols take a prominent part in their scalability and overall performance, through finding optimised routes quickly and with low bandwidth overheads. This article studies a novel geo-multicast framework that incorporates a set of models for communication, message flow and geo-determination of endangered vehicles with a reliable receiver-based geo-multicast protocol to support cooperative level crossings (CLXs), which provide collision warnings to the endangered motorists facing road/rail LXs without barriers. This framework is designed and studied as part of a $5.5 m Government and industry funded project, entitled 'Intelligent-Transport-Systems to improve safety at road/rail crossings'. Combined simulation and experimental studies of the proposed geo-multicast framework have demonstrated promising outcomes as cooperative awareness messages provide actionable critical information to endangered drivers who are identified by CLXs.

Study protocol of the YOU CALL - WE CALL TRIAL: Impact of a multimodal support intervention after a "mild" stroke

Background More than 60% of new strokes each year are "mild" in severity and this proportion is expected to rise in the years to come. Within our current health care system those with "mild" stroke are typically discharged home within days, without further referral to health or rehabilitation services other than advice to see their family physician. Those with mild stroke often have limited access to support from health professionals with stroke-specific knowledge who would typically provide critical information on topics such as secondary stroke prevention, community reintegration, medication counselling and problem solving with regard to specific concerns that arise. Isolation and lack of knowledge may lead to a worsening of health problems including stroke recurrence and unnecessary and costly health care utilization. The purpose of this study is to assess the effectiveness, for individuals who experience a first "mild" stroke, of a sustainable, low cost, multimodal support intervention (comprising information, education and telephone support) - "WE CALL" compared to a passive intervention (providing the name and phone number of a resource person available if they feel the need to) - "YOU CALL", on two primary outcomes: unplanned-use of health services for negative events and quality of life. Method/Design We will recruit 384 adults who meet inclusion criteria for a first mild stroke across six Canadian sites. Baseline measures will be taken within the first month after stroke onset. Participants will be stratified according to comorbidity level and randomised to one of two groups: YOU CALL or WE CALL. Both interventions will be offered over a six months period. Primary outcomes include unplanned use of heath services for negative event (frequency calendar) and quality of life (EQ-5D and Quality of Life Index). Secondary outcomes include participation level (LIFE-H), depression (Beck Depression Inventory II) and use of health services for health promotion or prevention (frequency calendar). Blind assessors will gather data at mid-intervention, end of intervention and one year follow up. Discussion If effective, this multimodal intervention could be delivered in both urban and rural environments. For example, existing infrastructure such as regional stroke centers and existing secondary stroke prevention clinics, make this intervention, if effective, deliverable and sustainable.

Shipping information pipeline: initial design principles

This paper presents a design science approach to solving persistent problems in the international shipping eco system by creating the missing common information infrastructures. Specifically, this paper reports on an ongoing dialogue between stakeholders in the shipping industry and information systems researchers engaged in the design and development of a prototype for an innovative IT-artifact called Shipping Information Pipeline which is a kind of “an internet” for shipping information. The instrumental aim is to enable information seamlessly to cross the organizational boundaries and national borders within international shipping which is a rather complex domain. The intellectual objective is to generate and evaluate the efficacy and effectiveness of design principles for inter-organizational information infrastructures in the international shipping domain that can have positive impacts on global trade and local economies.

Tracking smart grid hackers

The next-generation smart grid will rely highly on telecommunications infrastructure for data transfer between various systems. Anywhere we have data transfer in a system is a potential security threat. When we consider the possibility of smart grid data being at the heart of our critical systems infrastructure it is imperative that we do all we can to ensure the confidentiality, availability and integrity of the data. A discussion on security itself is outside the scope of this paper, but if we assume the network to be as secure as possible we must consider what we can do to detect when that security fails, or when the attacks comes from the inside of the network. One way to do this is to setup a hacker-trap, or honeypot. A honeypot is a device or service on a network which appears legitimate, but is in-fact a trap setup to catch breech attempts. This paper identifies the different types of honeypot and describes where each may be used. The authors have setup a test honeypot system which has been live for some time. The test system has been setup to emulate a device on a utility network. The system has had many hits, which are described in detail by the authors. Finally, the authors discuss how larger-scale systems in utilities may benefit from honeypot placement.

Architectural information

Through a study of architectural information as a complex system, a theoretical model relating critical information elements and project knowledge is proposed. The Project Specific Information model articulates distinct information integrities (intellectual, contextual, structural and spatial) that support the knowledge-based decision-making processes controlling information quality in architectural projects.

Achieving effective biosurveillance with the Nationwide Health Information Network

The federal government is currently developing the Nationwide Health Information Network (NHIN). Described as a “network of networks,” the NHIN seeks to provide a nationwide, interoperable health information infrastructure that will securely connect consumers with those involved in health care. As part of the national health information technology (HIT) agenda, the NHIN aims to improve individual and population health by enabling health information to follow the consumer, be available for clinical decision-making, and support important public health measures such as biosurveillance. While the NHIN promises to improve clinical care to individuals and to reduce U.S. health care system costs overall, this electronic environment presents novel challenges for protecting individually identifiable health information. A major barrier to achieving public trust in the NHIN is the development of, and adherence to, a consistent and coordinated approach to privacy and security of health information. This paper will analyze the policy framework for electronic health information exchange with the NHIN. This exercise will demonstrate that the current policy is an effective framework for achieving effective biosurveillance with the NHIN. ^