Information security management : a case study of an information security culture

This thesis argues that in order to establish a sound information security culture it is necessary to look at organisation's information security systems in a socio- technical context. The motivation for this research stems from the continuing concern of ineffective information security in organisations, leading to potentially significant monetary losses. It is important to address both technical and non- technical aspects when dealing with information security management. Culture has been identified as an underlying determinant of individuals' behaviour and this extends to information security culture, particularly in developing countries. This research investigates information security culture in the Saudi Arabia context. The theoretical foundation for the study is based on organisational and national culture theories. A conceptual framework for this study was constructed based on Peterson and Smith's (1997) model of national culture. This framework guides the study of national, organisational and technological values and their relationships to the development of information security culture. Further, the study seeks to better understand how these values might affect the development and deployment of an organisation's information security culture. Drawing on evidence from three exploratory case studies, an emergent conceptual framework was developed from the traditional human behaviour and the social environment perspectives used in social work, This framework contributes to in- formation security management by identifying behaviours related to four modes of information security practice. These modes provide a sound basis that can be used to evaluate individual organisational members' behaviour and the adequacy of ex- isting security measures. The results confirm the plausibility of the four modes of practice. Furthermore, a final framework was developed by integrating the four modes framework into the research framework. The outcomes of the three case stud- ies demonstrate that some of the national, organisational and technological values have clear impacts on the development and deployment of organisations' informa- tion security culture. This research, by providing an understanding the in uence of national, organi- sational and technological values on individuals' information security behaviour, contributes to building a theory of information security culture development within an organisational context. The research reports on the development of an inte- grated information security culture model that highlights recommendations for developing an information security culture. The research framework, introduced by this research, is put forward as a robust starting point for further related work in this area.

Secure data aggregation in wireless sensor networks

A Wireless Sensor Network (WSN) is a set of sensors that are integrated with a physical environment. These sensors are small in size, and capable of sensing physical phenomena and processing them. They communicate in a multihop manner, due to a short radio range, to form an Ad Hoc network capable of reporting network activities to a data collection sink. Recent advances in WSNs have led to several new promising applications, including habitat monitoring, military target tracking, natural disaster relief, and health monitoring. The current version of sensor node, such as MICA2, uses a 16 bit, 8 MHz Texas Instruments MSP430 micro-controller with only 10 KB RAM, 128 KB program space, 512 KB external ash memory to store measurement data, and is powered by two AA batteries. Due to these unique specifications and a lack of tamper-resistant hardware, devising security protocols for WSNs is complex. Previous studies show that data transmission consumes much more energy than computation. Data aggregation can greatly help to reduce this consumption by eliminating redundant data. However, aggregators are under the threat of various types of attacks. Among them, node compromise is usually considered as one of the most challenging for the security of WSNs. In a node compromise attack, an adversary physically tampers with a node in order to extract the cryptographic secrets. This attack can be very harmful depending on the security architecture of the network. For example, when an aggregator node is compromised, it is easy for the adversary to change the aggregation result and inject false data into the WSN. The contributions of this thesis to the area of secure data aggregation are manifold. We firstly define the security for data aggregation in WSNs. In contrast with existing secure data aggregation definitions, the proposed definition covers the unique characteristics that WSNs have. Secondly, we analyze the relationship between security services and adversarial models considered in existing secure data aggregation in order to provide a general framework of required security services. Thirdly, we analyze existing cryptographic-based and reputationbased secure data aggregation schemes. This analysis covers security services provided by these schemes and their robustness against attacks. Fourthly, we propose a robust reputationbased secure data aggregation scheme for WSNs. This scheme minimizes the use of heavy cryptographic mechanisms. The security advantages provided by this scheme are realized by integrating aggregation functionalities with: (i) a reputation system, (ii) an estimation theory, and (iii) a change detection mechanism. We have shown that this addition helps defend against most of the security attacks discussed in this thesis, including the On-Off attack. Finally, we propose a secure key management scheme in order to distribute essential pairwise and group keys among the sensor nodes. The design idea of the proposed scheme is the combination between Lamport's reverse hash chain as well as the usual hash chain to provide both past and future key secrecy. The proposal avoids the delivery of the whole value of a new group key for group key update; instead only the half of the value is transmitted from the network manager to the sensor nodes. This way, the compromise of a pairwise key alone does not lead to the compromise of the group key. The new pairwise key in our scheme is determined by Diffie-Hellman based key agreement.

Development and pilot test of a peer-support based Cardiac-Diabetes Self-Management program : a study protocol

Background: People with cardiac disease and type 2 diabetes have higher hospital readmission rates (22%)compared to those without diabetes (6%). Self-management is an effective approach to achieve better health outcomes; however there is a lack of specifically designed programs for patients with these dual conditions. This project aims to extend the development and pilot test of a Cardiac-Diabetes Self-Management Program incorporating user-friendly technologies and the preparation of lay personnel to provide follow-up support. Methods/Design: A randomised controlled trial will be used to explore the feasibility and acceptability of the Cardiac-Diabetes Self-Management Program incorporating DVD case studies and trained peers to provide follow-up support by telephone and text-messaging. A total of 30 cardiac patients with type 2 diabetes will be randomised, either to the usual care group, or to the intervention group. Participants in the intervention group will received the Cardiac-Diabetes Self-Management Program in addition to their usual care. The intervention consists of three faceto- face sessions as well as telephone and text-messaging follow up. The face-to-face sessions will be provided by a trained Research Nurse, commencing in the Coronary Care Unit, and continuing after discharge by trained peers. Peers will follow up patients for up to one month after discharge using text messages and telephone support. Data collection will be conducted at baseline (Time 1) and at one month (Time 2). The primary outcomes include self-efficacy, self-care behaviour and knowledge, measured by well established reliable tools. Discussion: This paper presents the study protocol of a randomised controlled trial to pilot evaluates a Cardiac- Diabetes Self-Management program, and the feasibility of incorporating peers in the follow-ups. Results of this study will provide directions for using such mode in delivering a self-management program for patients with both cardiac condition and diabetes. Furthermore, it will provide valuable information of refinement of the intervention program.

Using user-friendly telecommunications to improve cardiac and diabetes self-management programme : a pilot study

Previous studies exploring the incidence and readmission rates of cardiac patients admitted to a coronary care unit (CCU) with type 2 diabetes [1] have been undertaken by the first author. Interviews of these patients regarding their experiences in managing their everyday conditions [2] provided the basis for developing the initial cardiac–diabetes self-management programme (CDSMP) [3]. Findings from each of these previous studies highlighted the complexity of self-management for patients with both conditions and contributed to the creation of a new self-management programme, the CDSMP, based on Bandura’s (2004) self-efficacy theory [4]. From patient and staff feedback received for the CDSMP [3], it became evident that further revision of the programme was needed to improve self-management levels of patients and possibility of incorporating methods of information technology (IT). Little is known about the applicability of different methods of technology for delivering self-management programmes for patients with chronic diseases such as those with type 2 diabetes and cardiac conditions. Although there is some evidence supporting the benefits and the great potential of using IT in supporting self-management programmes, it is not strong, and further research on the use of IT in such programmes is recommended [5–7]. Therefore, this study was designed to pilot test feasibility of the CDSMP incorporating telephone and text-messaging as follow-up approaches.

Children’s food and activity patterns following a six-month child weight management program

Objective To describe the impact of a parent-led, family focused child weight management program on the food intake and activity patterns of pre-pubertal children. Methods n assessor-blinded, randomized controlled trial involving 111 (64% female) overweight, pre-pubertal children 6 to 9 years of age randomly assigned to parenting-skills training plus intensive lifestyle education, parenting-skills training alone, or a 12-month wait-listed control. Study outcomes were assessed at baseline, 6 months, and 12 months. This paper presents data on food intake assessed via a validated 54-item parent completed dietary questionnaire and activity behaviours assessed via a parent-report 20-item activity questionnaire. Results Intake of energy-dense nutrient poor foods was lower in both intervention groups at 6 months (mean difference, P+DA -1.5 serves [CI -2.0;-1.0]; P -1.0 serves [-2.0;-0.5]) and 12 months (mean difference P+DA -1.0 serves [CI -2.0;-0.5]; P -1.0 serves [-1.5; 0.0]) compared to baseline. Intake of vegetables, fruit, breads and cereals, meat and alternatives and dairy foods remained unchanged. Regardless of study group there were significant reductions over time in the reported time spent engaged in small screen activities and an increase in the time reported spent in active play. Conclusion Child weight management intervention that promotes food intake in line with national dietary guidelines achieves a reduction in children’s intake of energy dense, nutrient poor foods. This was achieved without compromising intake of nutrient-rich food and changes in were maintained even once the intervention ceased.

Supply chain sustainability : a relationship management approach moderated by culture and commitment

This research explores the nature of relationship management on construction projects in Australia and examines the effects of culture, by means of Schwarz’s value survey, on relationships under different contract strategies. The research was based on the view that the development of a sustainable supply chain depends on the transfer of knowledge and capabilities from the larger players in the supply chain through collaboration brought about by relationship management. The research adopted a triangulated approach in which quantitative data were collected by questionnaire, interviews were conducted to explore and enrich the quantitative data and case studies were undertaken in order to illustrate and validate the findings. The aim was to investigate how values and attitudes enhance or reduce the incorporation of the supply chain into the project. From the research it was found that the degree of match and mismatch between values and contract strategy impacts commitment and the engagement and empowerment of the supply chain.

Relationship management implementation in the Australian construction industry from the contractor's perspective

Many studies carried out in relation to construction procurement methods reveal evidence of a need to change of culture and attitude in the construction industry. This culture change would transition from traditional adversarial relationships to cooperative and collaborative relationships. Relational contracting approaches, such as partnering and relationship management, are business strategies whereby client, commercial participants’ and stakeholders’ objectives are aligned for mutual benefit. The efficacy of relationship management in the client and contractor groups is proven and well documented. However, the industry has a slow implementation of relational contracting down the value chain. This paper reports the findings of an empirical study which examined the practices and prerequisites for relationship management implementation success and for supply chain engagement to develop. Questionnaire survey, interviews and case studies were conducted with Australian contracting organisations in this study. The study reveals that the adaption of relational contracting approach in the supply chain is found to be limited and contractors still prefer to keep suppliers and subcontractors at arm’s length. Findings also show that the degree of match and mismatch between organizational structuring and organizational process is found to have an impact on staff’s commitment level and performance effectiveness.

Post-disaster housing reconstruction : challenges for community participation

The extant literature suggests that community participation is an important ingredient for the successful delivery of post-disaster housing reconstruction projects. Even though policy-makers, international funding bodies and non-governmental organisations broadly appreciate the value of community participation, post-disaster reconstruction practices systematically fail to follow, or align with, existing policy statements. Research into past experiences has led many authors to argue that post-disaster reconstruction is the least successful physically visible arena of international cooperation. Why is the principle of community participation not evident in the veracity of reconstructions already carried out on the ground? This paper discusses and develops the concepts of, and challenges to, community participation and the subsequent negative and positive effects on post-disaster reconstruction projects outcomes.

Power through influence : the evolution of arts management in Australia

The purpose of this paper is to frame effective models of arts management for Australia in the nineties and beyond based on an analysis of historical practices. The evolutionary process of government subvention of the arts through non-profit arts organisations provides a clear statement of the role of power and influence. In particular the ascendancy of arts organisations and their management constitute a background against which to study other non-profit corporations.

Business Process Management (BPM) education in Australia : a critical review based on content analysis

Business Process Management (BPM) is a top priority in organisations and is rapidly proliferating as an emerging discipline in practice. However, the current studies show lack of appropriate BPM skilled professionals in the field and a dearth of opportunities to develop BPM expertise. This paper analyses the gap between available BPM-related education in Australia and required BPM capabilities. BPM courses offered by Australian universities and training institutions have been critically analysed and mapped against leading BPM capability frameworks to determine how well current BPM education and training offerings in Australia actually address the core capabilities required for BPM professionals. The outcomes reported here can be used by Australian universities and training institutions to better align and position their training materials to the BPM required capabilities. It could also be beneficial to individuals looking for a systematic and in-depth understanding of BPM capabilities and trainings.

A comparative analysis of business analysis (BA) and business process management (BPM) capabilities

Many initiatives to improve Business processes are emerging. The essential roles and contributions of Business Analyst (BA) and Business Process Management (BPM) professionals to such initiatives have been recognized in literature and practice. The roles and responsibilities of a BA or BPM practitioner typically require different skill-sets; however these differences are often vague. This vagueness creates much confusion in practice and academia. While both the BA and BPM communities have made attempts to describe their domains through capability defining empirical research and developments of Bodies of knowledge, there has not yet been any attempt to identify the commonality of skills required and points of uniqueness between the two professions. This study aims to address this gap and presents the findings of a detailed content mapping exercise (using NVivo as a qualitative data analysis tool) of the International Institution of Business Analysis (IIBA®) Guide to the Business Analysis Body of Knowledge (BABOK® Guide) against core BPM competency and capability frameworks.

Using reputation management in participatory sensing for data classification

Participatory sensing enables collection, processing, dissemination and analysis of environmental sensory data by ordinary citizens, through mobile devices. Researchers have recognized the potential of participatory sensing and attempted applying it to many areas. However, participants may submit low quality, misleading, inaccurate, or even malicious data. Therefore, finding a way to improve the data quality has become a significant issue. This study proposes using reputation management to classify the gathered data and provide useful information for campaign organizers and data analysts to facilitate their decisions.

Sustainable assessment for large science classes : non-multiple choice, randomised assignments through a Learning Management System

This paper reports on the development of a tool that generates randomised, non-multiple choice assessment within the BlackBoard Learning Management System interface. An accepted weakness of multiple-choice assessment is that it cannot elicit learning outcomes from upper levels of Biggs’ SOLO taxonomy. However, written assessment items require extensive resources for marking, and are susceptible to copying as well as marking inconsistencies for large classes. This project developed an assessment tool which is valid, reliable and sustainable and that addresses the issues identified above. The tool provides each student with an assignment assessing the same learning outcomes, but containing different questions, with responses in the form of words or numbers. Practice questions are available, enabling students to obtain feedback on their approach before submitting their assignment. Thus, the tool incorporates automatic marking (essential for large classes), randomised tasks to each student (reducing copying), the capacity to give credit for working (feedback on the application of theory), and the capacity to target higher order learning outcomes by requiring students to derive their answers rather than choosing them. Results and feedback from students are presented, along with technical implementation details.