Quality metrics for assessing security-critical computer programs

Existing secure software development principles tend to focus on coding vulnerabilities, such as buffer or integer overflows, that apply to individual program statements, or issues associated with the run-time environment, such as component isolation. Here we instead consider software security from the perspective of potential information flow through a program’s object-oriented module structure. In particular, we define a set of quantifiable "security metrics" which allow programmers to quickly and easily assess the overall security of a given source code program or object-oriented design. Although measuring quality attributes of object-oriented programs for properties such as maintainability and performance has been well-covered in the literature, metrics which measure the quality of information security have received little attention. Moreover, existing securityrelevant metrics assess a system either at a very high level, i.e., the whole system, or at a fine level of granularity, i.e., with respect to individual statements. These approaches make it hard and expensive to recognise a secure system from an early stage of development. Instead, our security metrics are based on well-established compositional properties of object-oriented programs (i.e., data encapsulation, cohesion, coupling, composition, extensibility, inheritance and design size), combined with data flow analysis principles that trace potential information flow between high- and low-security system variables. We first define a set of metrics to assess the security quality of a given object-oriented system based on its design artifacts, allowing defects to be detected at an early stage of development. We then extend these metrics to produce a second set applicable to object-oriented program source code. The resulting metrics make it easy to compare the relative security of functionallyequivalent system designs or source code programs so that, for instance, the security of two different revisions of the same system can be compared directly. This capability is further used to study the impact of specific refactoring rules on system security more generally, at both the design and code levels. By measuring the relative security of various programs refactored using different rules, we thus provide guidelines for the safe application of refactoring steps to security-critical programs. Finally, to make it easy and efficient to measure a system design or program’s security, we have also developed a stand-alone software tool which automatically analyses and measures the security of UML designs and Java program code. The tool’s capabilities are demonstrated by applying it to a number of security-critical system designs and Java programs. Notably, the validity of the metrics is demonstrated empirically through measurements that confirm our expectation that program security typically improves as bugs are fixed, but worsens as new functionality is added.

Strategic Management Practices in the Construction Industry : a Dynamic Capabilities View

This book is an empirical study of strategic management practices in the construction industry. It examines the dynamic capabilities paradigm within the context of the Indonesian construction industry. The characteristics of asset-capability combinations were found to be significant determinants of the competitive advantage of the Indonesian construction enterprises, and that such advantage sequentially contributes to organizational performance. In doing so, this study fills an important gap in the empirical literature and reinforces the dynamic capabilities framework’s recognition as a rigorous theory of strategic management. As the dynamic capabilities framework can work in the context of Indonesia, it suggests that the framework has potential applicability in other emerging and developing countries

Powering innovation through tax concessions : the changing research and development tax incentives

The changing R&D Tax Concession has been touted as the biggest reform to business innovation policy in over a decade. But, is it a changing tax for changing times? This paper addresses this question and further asks ‘what’s tax got to do with it?’. To answer this question, the paper argues that rather than substantive tax reform, the proposed measures simply alter the criteria and means by which companies become eligible for a Federal Government subsidy for qualifying R&D activity. It further argues that when considered as part of the broader innovation agenda, the R&D Tax Concession should be evaluated as a government spending program in the same way as any direct spending on innovation. When this is done, the tax regime is arguably only the administrative policy instrument by which the subsidy is delivered. However, it is proposed that this may not be best practice to distribute those funds fairly, efficiently, and without distortion, while at the same time maintaining adequate government control and accountability. Finally, in answering the question of ‘what’s tax got to do with it?’ the paper concludes that the answer is ‘very little’.

Options for the development of the New Zealand Law of Charities

The Australian Centre for Philanthropy and Nonprofit Studies was briefed to advise the Charities Commission of New Zealand on ways in which the law of charity might be developed. The substantive issue underpinning the brief is a need to enable charity law in New Zealand to continue to develop in accordance with the societal values of New Zealand. This is an options paper and as such it does not explain the current law, but is intended to generate constructive discussion. Four options are sketched, with important issues and implications for each. No recommendation is made to adopt a particular option; there are strengths and weaknesses, opportunities and threats with each of the four approaches canvassed.

Enterprise information security policy assessment : an extended framework for metrics development utilising the goal-question-metric approach

Effective enterprise information security policy management requires review and assessment activities to ensure information security policies are aligned with business goals and objectives. As security policy management involves the elements of policy development process and the security policy as output, the context for security policy assessment requires goal-based metrics for these two elements. However, the current security management assessment methods only provide checklist types of assessment that are predefined by industry best practices and do not allow for developing specific goal-based metrics. Utilizing theories drawn from literature, this paper proposes the Enterprise Information Security Policy Assessment approach that expands on the Goal-Question-Metric (GQM) approach. The proposed assessment approach is then applied in a case scenario example to illustrate a practical application. It is shown that the proposed framework addresses the requirement for developing assessment metrics and allows for the concurrent undertaking of process-based and product-based assessment. Recommendations for further research activities include the conduct of empirical research to validate the propositions and the practical application of the proposed assessment approach in case studies to provide opportunities to introduce further enhancements to the approach.

Morphological design control for large-scale city development : a new proposal

Whereas many good examples can be found of the study of urban morphology informing the design of new residential areas in Europe, it is much more difficult to find examples relating to other land uses and outside of Europe. This paper addresses a particular issue, the control and coordination of large and complex development schemes within cities, and, in doing so, considers commercial and mixed-use schemes outside of Europe. It is argued that urban morphology has much to offer for both the design of such development and its implementation over time. Firstly, lessons are drawn from the work of Krier and Rossi in Berlin, the form-based guidance developed in Chelmsford, UK, and the redesign and coordination of the Melrose Arch project in Johannesburg, SA. A recent development at Boggo Road in Brisbane, Australia, is then subjected to a more detailed examination. It is argued that the scheme has been unsatisfactory in terms of both design and implementation. An alternative framework based on historical morphological studies is proposed that would overcome these deficiencies. It is proposed that this points the way to a general approach that could be incorporated within the planning process internationally.

Development of distributed fuzzy systems with a runtime-adaptable mobile components framework

A distributed fuzzy system is a real-time fuzzy system in which the input, output and computation may be located on different networked computing nodes. The ability for a distributed software application, such as a distributed fuzzy system, to adapt to changes in the computing network at runtime can provide real-time performance improvement and fault-tolerance. This paper introduces an Adaptable Mobile Component Framework (AMCF) that provides a distributed dataflow-based platform with a fine-grained level of runtime reconfigurability. The execution location of small fragments (possibly as little as few machine-code instructions) of an AMCF application can be moved between different computing nodes at runtime. A case study is included that demonstrates the applicability of the AMCF to a distributed fuzzy system scenario involving multiple physical agents (such as autonomous robots). Using the AMCF, fuzzy systems can now be developed such that they can be distributed automatically across multiple computing nodes and are adaptable to runtime changes in the networked computing environment. This provides the opportunity to improve the performance of fuzzy systems deployed in scenarios where the computing environment is resource-constrained and volatile, such as multiple autonomous robots, smart environments and sensor networks.

Developing sustainable IT-related capabilities : instrument development and test

Research has established that firms' IT-related capabilities at a point in time explain IT-related performance differences across firms. IT resources, however, are dynamic, and evolve at an exponential rate. This means we need to understand how to sustain firms' existing capabilities to leverage opportunities offered by new IT resources. Wet suggests a higher-level resource that can sustain firms' existing IT-related capabilities. Second, we report on the development of a valid and reliable measurement instrument for measuring this higher-level resource in four stages, which includes expert feedback and a field test. The validated instrument would be useful in extending the IT business value studies to investigate how firms can sustain their IT-related capabilities. This effort will provide a deeper understanding of how firms can secure sustainable IT-related business value from their acquired IT resources.

ACE research vignette 005 : success or failure - what makes the difference in managing new product development?

This series of research vignettes is aimed at sharing current and interesting findings from our team of international Entrepreneurship researchers. In this vignette, Dr Henri Burgers considers some of the factors that can make a difference in managing new product development.

Development of a good practice guide to safeguard student learning engagement

This paper reports on the development of a good practice guide that will offer the higher education sector a framework for safeguarding student learning engagement. The good practice guide and framework are underpinned by a set of principles initially identified as themes in the social justice literature which were refined following the consolidation of data collected from eight selected “good practice” Australasian universities and feedback gathered at various forums and presentations. The good practice guide will provide the sector with examples of institutional wide efforts which respond to national priorities for student retention and will also provide exemplars of institutional practices for each principle to facilitate the uptake of sector-wide good practice. Participants will be provided with the opportunity to discuss the social justice principles, the draft good practice guide and identify the practical applications of the guide within individual institutions.

Getting stuck in together : improving work integrated learning from an Australian institution and faculty perspective

According to a recent report Australian higher education is not in crisis. However, we could be doing it better. The report Mapping Australian Higher Education (Norton, 2012) highlights comparative weaknesses such as levels f student engagement; interactions between students and academic staff; and academic staff preferences for research over teaching. The report points out that despite these concerns most graduates continue to get good, well-paid jobs, student satisfaction is improving, and levels of public confidence in Australian higher education are high. It also stresses that ‘the promise of higher education is that it provides adaptable cognitive skills, not that it always provides the job specific skills graduates will need in their future employment’ (Norton, 2012, p.58). This is worth keeping in mind as we contribute to the significant growth in curriculum initiatives aimed at preparing graduates for the world of work. Work Integrated Learning (WIL) is not a new concept but there is increased pressure on higher education globally to address graduate employability skills. The sector is under pressure in an increasingly competitive environment to demonstrate the relevance of courses, accountability and effective use of public funds (Peach & Gamble, 2011). In the Australian context this also means responding to the skills shortage in areas such as engineering, health, construction and business (DEEWR, 2010). This paper provides a brief overview of collaborative efforts over several years to improve the activity of WIL at the Queensland University of Technology (QUT). These efforts have resulted in changes to curriculum, pedagogy, systems and processes, and the initiation of local, regional, national, and international networks. The willingness of students, staff, and industry partners to ‘get stuck in’ and try new approaches in these different contexts can be understood as a form of boundary spanning. That is, the development of the capability to mediate between different forms of expertise and the demands of different contexts in order to nurture student learning and improve the outcomes of higher education through WIL (Peach, Cates, Ilg, Jones, Lechleiter, 2011).

XBRL : the future of financial reporting and a catalyst for capital market development

There has never been a better time to strengthen financial reporting in Fiji. With increased interest shown by prospective companies in capital market participation, the pressing problems in the public sector reporting and accountability and global emphasis on the increasing need to strengthen the corporate governance structure, this is perhaps the opportune time to consider the potential of XBRL.

Development issues for the creative economy in Malaysia

Cultural tourism and creative industries have intersecting policy agendas and economic interdependencies. Most studies of the creative industries have focused on western countries. Cultural tourism is rarely included. However the arrival of the creative economy and its movement through developing countries has changed the relationship. Supporters of the creative economy now see fit to include tourism. This thesis addresses the development of the creative economy in Malaysia. The thesis conducted case studies on animation and museum sectors in Malaysia. These two case studies provide information on the development of creative economy in Malaysia. The study found that a top-down cultural management approach is being practised but that Malaysia is now influenced by new ideas concerning innovation and technical creativity. The study examined whether or not technical innovation by itself is enough. The reference points here are the Multimedia Super Corridor in Cyberjaya and other similar projects in the region. The museum case study was situated in Malacca. It showed that museums needed to adapt new media and new experiences to remain relevant in today’s world. In applying a case study approach, the thesis made use of interviews with key stakeholders, as well consulting numerous policy documents and web sites. Both case studies imitated similar products and services in the market but added local characteristics. This research project contributes significantly to the existing body of knowledge in the field of creative economy within the context of developing countries. Finally the thesis makes recommendations for Malaysia to better position itself in the regional economy while retaining its distinctive cultural identity.

Development of a 3D culture system to study the skeletal metastasis of prostate cancer

In the cancer research field, most in vitro studies still rely on two-dimensional (2D) cultures. However, the trend is rapidly shifting towards using a three-dimensional (3D) culture system. This is because 3D models better recapitulate the microenvironment of cells, and therefore, yield cellular and molecular responses that more accurately describe the pathophysiology of cancer. By adopting technology platforms established by the tissue engineering discipline, it is now possible to grow cancer cells in extracellular matrix (ECM)-like environments and dictate the biophysical and biochemical properties of the matrix. In addition, 3D models can be modified to recapitulate different stages of cancer progression for instance from the initial development of tumor to metastasis. Inevitably, to recapitulate a heterotypic condition, comprising more than one cell type, it requires a more complex 3D model. To date, 3D models that are available for studying the prostate cancer (CaP)-bone interactions are still lacking. Therefore, the aim of this study is to establish a co-culture model that allows investigation of direct and indirect CaP-bone interactions. Prior to that, 3D polyethylene glycol (PEG)-based hydrogel cultures for CaP cells were first developed and growth conditions were optimised. Characterization of the 3D hydrogel cultures show that LNCaP cells form a multicellular mass that resembles avascular tumor. In comparison to 2D cultures, besides the difference in cell morphology, the response of LNCaP cells to the androgen analogue (R1881) stimulation is different compared to the cells in 2D cultures. This discrepancy between 2D and 3D cultures is likely associated with the cell-cell contact, density and ligand-receptor interactions. Following the 3D monoculture study, a 3D direct co-culture model of CaP cells and the human tissue engineered bone (hTEBC) construct was developed. Interactions between the CaP cells and human osteoblasts (hOBs) resulted in elevation of Matrix Metalloproteinase 9 (MMP9) for PC-3 cells and Prostate Specific Antigen (PSA) for LNCaP cells. To further investigate the paracrine interaction of CaP cells and (hOBs), a 3D indirect co-culture model was developed, where LNCaP cells embedded within PEG hydrogels were co-cultured with hTEBC. It was found that the cellular changes observed reflect the early event of CaP colonizing the bone site. In the absence of androgens, interestingly, up-regulation of PSA and other kallikreins is also detected in the co-culture compared to the LNCaP monoculture. This non androgenic stimulation could be triggered by the soluble factors secreted by the hOB such as Interleukin-6. There are also decrease in alkaline phosphatase (ALP) activity and down-regulation of genes of the hOB when co-cultured with LNCaP cells that have not been previously described. These genes include transforming growth factor β1 (TGFβ1), osteocalcin and Vimentin. However, no changes to epithelial markers (e.g E-cadherin, Cytokeratin 8) were observed in both cell types from the co-culture. Some of these intriguing changes observed in the co-cultures that had not been previously described have enriched the basic knowledge of the CaP cell-bone interaction. From this study, we have shown evidence of the feasibility and versatility of our established 3D models. These models can be adapted to test various hypotheses for studies pertaining to underlying mechanisms of bone metastasis and could provide a vehicle for anticancer drug screening purposes in the future.

A hierarchical evolutionary algorithmic design (HEAD) system for generating and evolving building design models

This thesis develops a detailed conceptual design method and a system software architecture defined with a parametric and generative evolutionary design system to support an integrated interdisciplinary building design approach. The research recognises the need to shift design efforts toward the earliest phases of the design process to support crucial design decisions that have a substantial cost implication on the overall project budget. The overall motivation of the research is to improve the quality of designs produced at the author's employer, the General Directorate of Major Works (GDMW) of the Saudi Arabian Armed Forces. GDMW produces many buildings that have standard requirements, across a wide range of environmental and social circumstances. A rapid means of customising designs for local circumstances would have significant benefits. The research considers the use of evolutionary genetic algorithms in the design process and the ability to generate and assess a wider range of potential design solutions than a human could manage. This wider ranging assessment, during the early stages of the design process, means that the generated solutions will be more appropriate for the defined design problem. The research work proposes a design method and system that promotes a collaborative relationship between human creativity and the computer capability. The tectonic design approach is adopted as a process oriented design that values the process of design as much as the product. The aim is to connect the evolutionary systems to performance assessment applications, which are used as prioritised fitness functions. This will produce design solutions that respond to their environmental and function requirements. This integrated, interdisciplinary approach to design will produce solutions through a design process that considers and balances the requirements of all aspects of the design. Since this thesis covers a wide area of research material, 'methodological pluralism' approach was used, incorporating both prescriptive and descriptive research methods. Multiple models of research were combined and the overall research was undertaken following three main stages, conceptualisation, developmental and evaluation. The first two stages lay the foundations for the specification of the proposed system where key aspects of the system that have not previously been proven in the literature, were implemented to test the feasibility of the system. As a result of combining the existing knowledge in the area with the newlyverified key aspects of the proposed system, this research can form the base for a future software development project. The evaluation stage, which includes building the prototype system to test and evaluate the system performance based on the criteria defined in the earlier stage, is not within the scope this thesis. The research results in a conceptual design method and a proposed system software architecture. The proposed system is called the 'Hierarchical Evolutionary Algorithmic Design (HEAD) System'. The HEAD system has shown to be feasible through the initial illustrative paper-based simulation. The HEAD system consists of the two main components - 'Design Schema' and the 'Synthesis Algorithms'. The HEAD system reflects the major research contribution in the way it is conceptualised, while secondary contributions are achieved within the system components. The design schema provides constraints on the generation of designs, thus enabling the designer to create a wide range of potential designs that can then be analysed for desirable characteristics. The design schema supports the digital representation of the human creativity of designers into a dynamic design framework that can be encoded and then executed through the use of evolutionary genetic algorithms. The design schema incorporates 2D and 3D geometry and graph theory for space layout planning and building formation using the Lowest Common Design Denominator (LCDD) of a parameterised 2D module and a 3D structural module. This provides a bridge between the standard adjacency requirements and the evolutionary system. The use of graphs as an input to the evolutionary algorithm supports the introduction of constraints in a way that is not supported by standard evolutionary techniques. The process of design synthesis is guided as a higher level description of the building that supports geometrical constraints. The Synthesis Algorithms component analyses designs at four levels, 'Room', 'Layout', 'Building' and 'Optimisation'. At each level multiple fitness functions are embedded into the genetic algorithm to target the specific requirements of the relevant decomposed part of the design problem. Decomposing the design problem to allow for the design requirements of each level to be dealt with separately and then reassembling them in a bottom up approach reduces the generation of non-viable solutions through constraining the options available at the next higher level. The iterative approach, in exploring the range of design solutions through modification of the design schema as the understanding of the design problem improves, assists in identifying conflicts in the design requirements. Additionally, the hierarchical set-up allows the embedding of multiple fitness functions into the genetic algorithm, each relevant to a specific level. This supports an integrated multi-level, multi-disciplinary approach. The HEAD system promotes a collaborative relationship between human creativity and the computer capability. The design schema component, as the input to the procedural algorithms, enables the encoding of certain aspects of the designer's subjective creativity. By focusing on finding solutions for the relevant sub-problems at the appropriate levels of detail, the hierarchical nature of the system assist in the design decision-making process.