Integrating information security policy management with corporate risk management for strategic alignment

Information security policy defines the governance and implementation strategy for information security in alignment with the corporate risk policy objectives and strategies. Research has established that alignment between corporate concerns may be enhanced when strategies are developed concurrently using the same development process as an integrative relationship is established. Utilizing the corporate risk management framework for security policy management establishes such an integrative relationship between information security and corporate risk management objectives and strategies. There is however limitation in the current literature on presenting a definitive approach that fully integrates security policy management with the corporate risk management framework. This paper presents an approach that adopts a conventional corporate risk management framework for security policy development and management to achieve alignment with the corporate risk policy. A case example is examined to illustrate the alignment achieved in each process step with a security policy structure being consequently derived in the process. It is shown that information security policy management outcomes become both integral drivers and major elements of the corporate-level risk management considerations. Further study should involve assessing the impact of the use of the proposed framework in enhancing alignment as perceived in this paper.

Enterprise information security policy assessment : an extended framework for metrics development utilising the goal-question-metric approach

Effective enterprise information security policy management requires review and assessment activities to ensure information security policies are aligned with business goals and objectives. As security policy management involves the elements of policy development process and the security policy as output, the context for security policy assessment requires goal-based metrics for these two elements. However, the current security management assessment methods only provide checklist types of assessment that are predefined by industry best practices and do not allow for developing specific goal-based metrics. Utilizing theories drawn from literature, this paper proposes the Enterprise Information Security Policy Assessment approach that expands on the Goal-Question-Metric (GQM) approach. The proposed assessment approach is then applied in a case scenario example to illustrate a practical application. It is shown that the proposed framework addresses the requirement for developing assessment metrics and allows for the concurrent undertaking of process-based and product-based assessment. Recommendations for further research activities include the conduct of empirical research to validate the propositions and the practical application of the proposed assessment approach in case studies to provide opportunities to introduce further enhancements to the approach.

The enterprise information security policy as a strategic business policy within the corporate strategic plan (extended abstract)

Information security has been recognized as a core requirement for corporate governance that is expected to facilitate not only the management of risks, but also as a corporate enabler that supports and contributes to the sustainability of organizational operations. In implementing information security, the enterprise information security policy is the set of principles and strategies that guide the course of action for the security activities and may be represented as a brief statement that defines program goals and sets information security and risk requirements. The enterprise information security policy (alternatively referred to as security policy in this paper) that represents the meta-policy of information security is an element of corporate ICT governance and is derived from the strategic requirements for risk management and corporate governance. Consistent alignment between the security policy and the other corporate business policies and strategies has to be maintained if information security is to be implemented according to evolving business objectives. This alignment may be facilitated by managing security policy alongside other corporate business policies within the strategic management cycle. There are however limitations in current approaches for developing and managing the security policy to facilitate consistent strategic alignment. This paper proposes a conceptual framework for security policy management by presenting propositions to positively affect security policy alignment with business policies and prescribing a security policy management approach that expounds on the propositions.

Association rule mining activity : A general formalism

Mining association rules from a large collection of databases is based on two main tasks. One is generation of large itemsets; and the other is finding associations between the discovered large itemsets. Existing formalism for association rules are based on a single transaction database which is not sufficient to describe the association rules based on multiple database environment. In this paper, we give a general characterization of association rules and also give a framework for knowledge-based mining of multiple databases for association rules.

A Scalable Architecture for VoIP Conferencing

Real-Time services are traditionally supported on circuit switched network. However, there is a need to port these services on packet switched network. Architecture for audio conferencing application over the Internet in the light of ITU-T H.323 recommendations is considered. In a conference, considering packets only from a set of selected clients can reduce speech quality degradation because mixing packets from all clients can lead to lack of speech clarity. A distributed algorithm and architecture for selecting clients for mixing is suggested here based on a new quantifier of the voice activity called “Loudness Number” (LN). The proposed system distributes the computation load and reduces the load on client terminals. The highlights of this architecture are scalability, bandwidth saving and speech quality enhancement. Client selection for playing out tries to mimic a physical conference where the most vocal participants attract more attention. The contributions of the paper are expected to aid H.323 recommendations implementations for Multipoint Processors (MP). A working prototype based on the proposed architecture is already functional.

LDLR and PCSK9 Are Associated with the Presence of Antiphospholipid Antibodies and the Development of Thrombosis in aPLA Carriers

Introduction The identification of the genetic risk factors that could discriminate non-thrombotic from thrombotic antiphospholipid antibodies (aPLA) carriers will improve prognosis of these patients. Several human studies have shown the presence of aPLAs associated with atherosclerotic plaque, which is a known risk factor for thrombosis. Hence, in order to determine the implication of atherosclerosis in the risk of developing thrombosis in aPLA positive patients, we performed a genetic association study with 3 candidate genes, APOH, LDLR and PCSK9. Material & Methods For genetic association study we analyzed 190 aPLA carriers -100 with non-thrombotic events and 90 with thrombotic events-and 557 healthy controls. Analyses were performed by chi(2) test and were corrected by false discovery rate. To evaluate the functional implication of the newly established susceptibility loci, we performed expression analyses in 86 aPLA carrier individuals (43 with thrombotic manifestations and 43 without it) and in 45 healthy controls. Results Our results revealed significant associations after correction in SNPs located in LDLR gene with aPLA carriers and thrombotic aPLA carriers, when compared with healthy controls. The most significant association in LDLR gene was found between SNP rs129083082 and aPLA carriers in recessive model (adjusted P-value = 2.55 x 10(-3); OR = 2.18; 95% CI = 1.49-3.21). Furthermore, our work detected significant allelic association after correction between thrombotic aPLA carriers and healthy controls in SNP rs562556 located in PCSK9 gene (adjusted P-value = 1.03 x 10(-2); OR = 1.60; 95% CI = 1.24-2.06). Expression level study showed significantly decreased expression level of LDLR gene in aPLA carriers (P-value < 0.0001; 95% CI 0.16-2.10; SE 0.38-1.27) in comparison to the control group. Discussion Our work has identified LDLR gene as a new susceptibility gene associated with the development of thrombosis in aPLA carriers, describing for the first time the deregulation of LDLR expression in individuals with aPLAs. Besides, thrombotic aPLA carriers also showed significant association with PCSK9 gene, a regulator of LDLR plasma levels. These results highlight the importance of atherosclerotic processes in the development of thrombosis in patients with aPLA.

Silicon: the promising material for phontonic integrated circuits platform

The development of optical network demands integrated arid multiple functionality modules to lowing cost and acquire highly reliability. Among the various contender materials to be photonic integrated circuits platform, silicon exhibits dominant characteristics and is the most promising platform materials. The paper compares the characteristics of some candidate materials with silicon and reviews recent progress in silicon based photonic integration technology. Tile challenges to silicon for optical integration for optical networking application arc also indicated.

Engineering emergence for cluster configuration

Distributed applications are being deployed on ever-increasing scale and with ever-increasing functionality. Due to the accompanying increase in behavioural complexity, self-management abilities, such as self-healing, have become core requirements. A key challenge is the smooth embedding of such functionality into our systems. Natural distributed systems such as ant colonies have evolved highly efficient behaviour. These emergent systems achieve high scalability through the use of low complexity communication strategies and are highly robust through large-scale replication of simple, anonymous entities. Ways to engineer this fundamentally non-deterministic behaviour for use in distributed applications are being explored. An emergent, dynamic, cluster management scheme, which forms part of a hierarchical resource management architecture, is presented. Natural biological systems, which embed self-healing behaviour at several levels, have influenced the architecture. The resulting system is a simple, lightweight and highly robust platform on which cluster-based autonomic applications can be deployed.

Towards policy-based self-configuration of embedded systems

This paper describes work towards the deployment of flexible self-management into real-time embedded systems. A challenging project which focuses specifically on the development of a dynamic, adaptive automotive middleware is described, and the specific self-management requirements of this project are discussed. These requirements have been identified through the refinement of a wide-ranging set of use cases requiring context-sensitive behaviours. A sample of these use-cases is presented to illustrate the extent of the demands for self-management. The strategy that has been adopted to achieve self-management, based on the use of policies is presented. The embedded and real-time nature of the target system brings the constraints that dynamic adaptation capabilities must not require changes to the run-time code (except during hot update of complete binary modules), adaptation decisions must have low latency, and because the target platforms are resource-constrained the self-management mechanism have low resource requirements (especially in terms of processing and memory). Policy-based computing is thus and ideal candidate for achieving the self-management because the policy itself is loaded at run-time and can be replaced or changed in the future in the same way that a data file is loaded. Policies represent a relatively low complexity and low risk means of achieving self-management, with low run-time costs. Policies can be stored internally in ROM (such as default policies) as well as externally to the system. The architecture of a designed-for-purpose powerful yet lightweight policy library is described. A suitable evaluation platform, supporting the whole life-cycle of feasibility analysis, concept evaluation, development, rigorous testing and behavioural validation has been devised and is described.