An agile IT security model for project risk assessment

There are two fundamental challenges in effectively performing security risk assessment in today's IT projects.The first is the project manager's need to know what IT security risks face the project before the project begins. At this stage IT security staff are unable to answer this question without first knowing the system requirements for the project which are yet to be defined. Second organisations that deal with a large project throughput each year find the current IT security risk assessment process to be tedious and expensive, especially when the same process has to be repeated for each individual project. This also makes it difficult for an organisation to prioritise which projects require more investment in IT security in order to fit within budget constraints. This paper presents a conceptual model that is based on an agile approach to alleviate these challenges. We do this by first analysing two online database resources of vulnerabilities by comparing them to each other, and then compare them to the agile criteria of the conceptual model which we define. The conceptual model is then presented and an example is given of how it can be applied to an actual project. We then briefly discuss what further work needs to be done to implement the conceptual model and validate it against an existing IT project.

Drugs, ships and containers : how anti-terrorism benefits shipping security

Using ships to transport illicit drugs is not new; nor is the practice of concealing them
in shipping containers decreasing – or is it? This article questions whether recent container security initiatives created to stop terrorism have also achieved a decrease in the use of containers for smuggling illicit drugs. Or, are these maritime security regimes creating a false sense of achievement, being too limited in scope to be truly useful in this secondary role? Logically, improved detection of illicit drugs in containers shipped by sea is more likely when port personnel are better trained, x-ray scanners installed, port fencing improved and official collaboration encouraged. However, since the number of containers being electronically screened and physically searched has only marginally improved, the question is, is it enough?

Contemporary security and strategy

This chapter raises the following main points:
• The study of security has experienced a series of debates around the nature of the threats to security.
• The early security scholars, as distinct from those who studied strategy and warfare, took a broad approach and argued that military and non-military means could achieve security.
• During the Cold War the study of security focused on the most pressing security issue of the day – the nuclear standoff between the two superpowers.
• In the post-Cold War era the broader approach to the study of security returned to the fore and included non-state actors and non-traditional sources of insecurity.

Regional security and regional conflict

This chapter raises the following main points:
• Regions are groupings of states that share either geographic proximity or have sufficient cultural/historic ties that bind them together.
• Regionalization occurs within a region as interdependence is developed among the regional states.
• The development of regionalism is dependent on the support of the regional great power(s), the extent of reciprocity that exists in the relations of the states in the region, and the level of strategic reassurance that exists among these states.
• Regionalization is not a lineal process, that is, it can increase or decrease.
• The pace of regionalism is different in each region but a basic pattern exists where economic integration precedes political and security integration.
• Regional threats to security can be divided into four categories. The first two comprise traditional military threats such as balance of power contests between regional powers and ‘grass fire’ conflicts between smaller powers or over more localized issues. The
third category includes, for example, intra-state conflicts for ethnic, religious, nationalist or ideological, issues. Finally, transnational threats such as environmental degradation or resource scarcity can also cause regional instability and conflict.

Does traditional security risk assessment have a future in information security?

The current information security standards still advocate the use of risk assessment in the prioritisation of security investments. However, prior research on the use of risk assessment methodologies in organisational security has shown that the use of the traditional monolithic risk assessment process described in the current risk management standard is simply not practical at the organisational level. This paper first examines the problems in performing a systematic risk assessment and then discusses the limitations of a traditional risk assessment. To address these limitations, this paper proposes splitting up the current monolithic risk assessment process. The result is an information security assessment framework that puts greater emphasis on situational awareness and allows for better decision making on the prioritization of security investments.

Critical infrastructure systems : security analysis and modelling approach

A system security analysis and system modelling framework tool is proposed adopting an associated conceptual methodology as the basis for assessing security and conceptually modelling a critical infrastructure system incident. The intent is to identify potential system security issues and gain operational insights that will contribute to improving system resilience, contingency planning, disaster recovery and ameliorating incident management responses for critical infrastructure system incidents. The aforementioned system security analysis and modelling framework is applied to an adverse critical infrastructure system incident case study. This paper reports on the practical application of the framework to a case study of an actual critical infrastructure system failure and the resultant incident implications for the system and the wider regional communities.

You say security, we say safety : speaking and talking ‘security’ in Kyrgyzstan

The Copenhagen School's notion of securitization is widely recognised as an important theoretical innovation in the conceptualisation of security, not least for its potential for including a range of actors and spatial scales beyond the state. However, its empirical utility remains more open to question due to a lack of reflexivity regarding local socio-cultural contexts, narrow focus on speech and inherently retrospective nature. Drawing on fieldwork conducted by the author in Kyrgyzstan between September 2005 and June 2006, this paper will examine the implications of these limitations for conducting empirical research on "security" logistically and methodologically. Centrally, the question of how “security” can be researched in the field will be discussed. Consideration will be given to the researcher’s role in talking “security” and how “security” can effectively be located and explicated through the creation of ethnomethodological “thick description”. Issues of contingency, multiple voices and power loci, and inter-cultural translation will be addressed. The paper will conclude with a consideration of how local knowledge can be used to inform our research and help find ways to bridge the divide between the field and theory.

Solar greenhouse technology for food security : a case study from Humla District, NW Nepal

Food security is a significant issue for many people who live in remote mountain areas around the world. Most of these people are also poor because of the lack of opportunity to earn cash. Malnutrition is common because the harsh climate restricts production and access to fresh food. Simple conventional greenhouses can provide some improvement of growing conditions, but the benefits are limited because of the high heat losses from these structures. Solar greenhouses, however, which are designed to store some of the heat generated within the structure can overcome these limitations. This article describes the experiences of a nongovernmental organization that has been introducing community and family-owned solar greenhouses into the remote villages of Humla, a mountainous district of northwest Nepal prone to food insecurity. The overall result has been positive. Family-owned greenhouses, which avoid the issues of community ownership and operation, have been more successful. A validated computer model based on the first solar greenhouse has been used to predict the thermal performance of a new family-sized design. Training and education are vital to the success of solar greenhouse technology in remote mountain areas.