Digital Commons Network^™

Market Reactions To Publicly Announced Privacy And Security Breaches Suffered By Companies Listed On The United States Stock Exchanges: A Comparative Empirical Investigation, Adolfo S. Coronado

Open Access Theses & Dissertations

Using a sample of security and privacy breaches the present research examines the comparative announcement impact between the two types of events. The first part of the dissertation analyzes the impact of publicly announced security and privacy breaches on abnormal stock returns, the change in firm risk, and abnormal trading volume are measured. The second part of the dissertation analyzes differential impact between security and privacy breaches on abnormal stock returns, the change in firm risk, and abnormal trading volume are measured.

Using a sample of 114 security (65) and privacy (49) breaches on average, security breaches resulted in more …

On The Development Of A Digital Forensics Curriculum, Manghui Tu, Dianxiang Xu, Samsuddin Wira, Cristian Balan, Kyle Cronin

Journal of Digital Forensics, Security and Law

Computer Crime and computer related incidents continue their prevalence and frequency, resulting in losses approaching billions of dollars. To fight against these crimes and frauds, it is urgent to develop digital forensics education programs to train a suitable workforce that can effectively investigate computer crimes and incidents. There is presently no standard to guide the design of digital forensics curriculum for an academic program. In this research, previous work on digital forensics curriculum design and existing education programs are thoroughly investigated. Both digital forensics educators and practitioners were surveyed and results were analyzed to determine the industry and law enforcement …

A 2011 Investigation Into Remnant Data On Second Hand Memory Cards Sold In Australia, Patryk Szewczyk, Krishnun Sansurooah

Australian Digital Forensics Conference

The use of memory cards is widely used in numerous electronic devices including tablet computers, cameras, mobile phones and multimedia devices. Like a USB drive, memory cards are an inexpensive and portable persistent storage solution. Numerous manufactures are incorporating a memory card interface into their product, allowing for a large array of confidential data to be stored. This research aimed to determine the sensitivity, type and amount of data that remained on second hand memory cards post sale. In 2011, over an eight month period, 119 second hand memory cards were randomly purchased from eBay Australia. The findings from the …

A Secure Online Payment System, Shristi Pant

Theses and Dissertations--Computer Science

An online payment system allows a customer to make a payment to an online merchant or a service provider. Payment gateways, a channel between customers and payment processors, use various security tools to secure a customer’s payment information, usually debit or credit card information, during an online payment. However, the security provided by a payment gateway cannot completely protect a customer’s payment information when a merchant also has the ability to obtain the payment information in some form. Furthermore, not all merchants provide a secure payment environment to their customers and, despite having a standard payment policy, adhere to it. …

Developing A Forensic Continuous Audit Model, Grover S. Kearns, Katherine J. Barker, Stephen P. Danese

Journal of Digital Forensics, Security and Law

Despite increased attention to internal controls and risk assessment, traditional audit approaches do not seem to be highly effective in uncovering the majority of frauds. Less than 20 percent of all occupational frauds are uncovered by auditors. Forensic accounting has recognized the need for automated approaches to fraud analysis yet research has not examined the benefits of forensic continuous auditing as a method to detect and deter corporate fraud. The purpose of this paper is to show how such an approach is possible. A model is presented that supports the acceptance of forensic continuous auditing by auditors and management as …

Exploring Identity Management At Community Colleges In Texas With Open Access To College Computer Networks, Michael John Callahan

Walden Dissertations and Doctoral Studies

The study addressed the lack of identity management practices in Texas community colleges to identify guest users who access college computers. Guest user access is required by Texas law and is part of the state's mission to bridge the technology gap; however, improper identification methods leave the college vulnerable to liability issues. The purpose of this study was to eliminate or mitigate liabilities facing colleges by creating and using security policies to identify guest users. This study combined the theoretical concepts of Cameron's internal security management model with the external trust models of the Liberty Alliance and Microsoft's Passport software. …

An Analytical Study Of It Security Governance And Its Adoption On Australian Organisations, Tanveer A. Zia

Australian Information Security Management Conference

Contemporary organisations are at infancy stages of adopting IT governance processes in Australia. Organisations who have adopted these processes underestimate the security processes within the governance framework. If the security processes are designed, they are often flawed with operational level implementation. This study investigates IT security governance broadly and in Australian organisations specifically. The objective of this study is to bring the local organisations in alignment with international standards and frameworks in terms of integration of information security, IT audits, risks and control measures. A survey of selected organisations is completed and results are presented in this paper identifying the …

Masthead

Journal of Digital Forensics, Security and Law

No abstract provided.

Front Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Defining A Forensic Audit, G. S. Smith, D. L. Crumbley

Journal of Digital Forensics, Security and Law

Disclosures about new financial frauds and scandals are continually appearing in the press. As a consequence, the accounting profession's traditional methods of monitoring corporate financial activities are under intense scrutiny. At the same time, there is recognition that principles-based GAAP from the International Accounting Standards Board will become the recognized standard in the U.S. The authors argue that these two factors will change the practices used to fight corporate malfeasance as investigators adapt the techniques of accounting into a forensic audit engagement model.

Self-Reported Cyber Crime: An Analysis On The Effects Of Anonymity And Pre-Employment Integrity, Ibrahim Baggili, Marcus Rogers

Electrical & Computer Engineering and Computer Science Faculty Publications

A key issue facing today’s society is the increase in cyber crimes. Cyber crimes pose threats to nations, organizations and individuals across the globe. Much of the research in cyber crime has risen from computer science-centric programs, and little experimental research has been performed on the psychology of cyber crime. This has caused a knowledge gap in the study of cyber crime. To this end, this research focuses on understanding psychological concepts related to cyber crime. Through an experimental design, participants were randomly assigned to three groups with varying degrees of anonymity. After each treatment, participants were asked to self-report …

Continuous Fraud Detection In Enterprise Systems Through Audit Trail Analysis, Peter J. Best, Pall Rikhardsson, Mark Toleman

Journal of Digital Forensics, Security and Law

Enterprise systems, real time recording and real time reporting pose new and significant challenges to the accounting and auditing professions. This includes developing methods and tools for continuous assurance and fraud detection. In this paper we propose a methodology for continuous fraud detection that exploits security audit logs, changes in master records and accounting audit trails in enterprise systems. The steps in this process are: (1) threat monitoringsurveillance of security audit logs for ‘red flags’, (2) automated extraction and analysis of data from audit trails, and (3) using forensic investigation techniques to determine whether a fraud has actually occurred. We …

Visualisation Of Critical Infrastructure Failure, W D. Wilde, M J. Warren

Australian Information Warfare and Security Conference

The paper explores the complexity of critical infrastructure and critical infrastructure failure (CIF), real life examples are used to discuss the complexity involved. The paper then discusses what Visualisation is and how Visualisation can be applied to a security situation, in particular critical infrastructure. The paper concludes by discussing the future direction of the research.

Virtual Aesthetics And Ethical Communication: Towards Virtuous Reality Design, David Williams

All Theses

This thesis argues that ethics can and should be applied to Second Life avatar design and behavior. Second Life is a unique virtual reality due to its connection to the physical world primarily through financial devices. Users buy and sell virtual and physical goods over these networks; the avatar, it is argued, is the primary instrument for persuasion in these contexts. Avatars facilitate a virtual aesthetic that is primarily 'natural.' By creating aesthetic avatars, the developers of Second Life enable audiences to affectively associate with other 'residents.' Not only is the avatar designed for aesthetic appeal, but it enables users …

Data Mining Techniques For Fraud Detection, Rekha Bhowmik

Annual ADFSL Conference on Digital Forensics, Security and Law

The paper presents application of data mining techniques to fraud analysis. We present some classification and prediction data mining techniques which we consider important to handle fraud detection. There exist a number of data mining algorithms and we present statistics-based algorithm, decision tree-based algorithm and rule-based algorithm. We present Bayesian classification model to detect fraud in automobile insurance. Naïve Bayesian visualization is selected to analyze and interpret the classifier predictions. We illustrate how ROC curves can be deployed for model assessment in order to provide a more intuitive analysis of the models.

Keywords: Data Mining, Decision Tree, Bayesian Network, ROC …

Comparing Information Assurance Awareness Training For End-Users: A Content Analysis Examination Of Air Force And Defense Information Systems Agency User Training Modules, John W. Frugé

Theses and Dissertations

Today, the threats to information security and assurance are great. While there are many avenues for IT professionals to safeguard against these threats, many times these defenses prove useless against typical system users. Mandated by laws and regulations, all government agencies and most private companies have established information assurance (IA) awareness programs, most of which include user training. Much has been given in the existing literature to laying out the guidance for the roles and responsibilities of IT professionals and higher level managers, but less is specified for "everyday" users of information systems. This thesis attempts to determine the content …

Dealing With The Malicious Insider, Andy Jones, Carl Colwill

Australian Information Security Management Conference

This paper looks at a number of issues relating to the malicious insider and the nature of motivation, loyalty and the type of attacks that occur. The paper also examines the changing environmental, social, cultural and business issues that have resulted in an increased exposure to the insider threat. The paper then discusses a range of measures that can be taken to reduce both the likelihood of an attack and the impact that such an attack may have. These measures should be driven by focused and effective risk management processes.

Data Mining Techniques In Fraud Detection, Rekha Bhowmik

Journal of Digital Forensics, Security and Law

The paper presents application of data mining techniques to fraud analysis. We present some classification and prediction data mining techniques which we consider important to handle fraud detection. There exist a number of data mining algorithms and we present statistics-based algorithm, decision treebased algorithm and rule-based algorithm. We present Bayesian classification model to detect fraud in automobile insurance. Naïve Bayesian visualization is selected to analyze and interpret the classifier predictions. We illustrate how ROC curves can be deployed for model assessment in order to provide a more intuitive analysis of the models.

The Phantasm Of Atm Withdrawal, Nattakant Utakrit

Australian Information Security Management Conference

Despite the stringent legislation and increased enforcement aimed at combating financial crime, fraud using cash machines remains a public concern. The problem of ATM fraud is happening on a global scale and the ramifications have been felt in Australia. This paper highlights the stratagems of financial crime, in particular of ATM fraud. The abuse of ATMs with intelligent methods used by perpetrators will be discussed. At the same time, the paper will present some global cases of ATM fraud. Finally this paper will illustrate countermeasures and security methods, such as biometrics and premises protections of banks, financial institutions and customers, …

Security Issues Within Virtual Worlds Such As Second Life, Chia Yao Lee, Matthew Warren

Australian Information Security Management Conference

The advancement in Internet and bandwidth has resulted in a number of new applications to be developed. An area of advancement has been in the development of virtual worlds, where people can interact together via virtual characters. Virtual World systems have been so complex that virtual lives can be lived, including all aspect of life such as education, commerce, social activities etc. Not surprisingly, the problems that exist in the real world such as theft, fraud, vandalism and terrorism, also exist in the virtual worlds. The more developed these virtual worlds become the greater the breaches of security will be …

Users' Perspectives And Attitudes Towards Web Application Security, Leonard Ticualu

Theses : Honours

The Internet has become an integral part of the society in many parts of the world. However, as the Internet becoming more important and useful, the problems with Web security have also increased. More people today have experienced Web security threats such as viruses, spyware, keyloggers, and phishing; and a not insignificant number have encountered financial fraud because of the online activities they conducted. This research investigated the security concerns and level of awareness of users in regards to the use of web applications, by identifying users' concerns of web applications, examining the relationship of users' technical knowledge and users' …

Development Of A Malicious Insider Composite Vulnerability Assessment Methodology, William H. King

Theses and Dissertations

Trusted employees pose a major threat to information systems. Despite advances in prevention, detection, and response techniques, the number of malicious insider incidents and their associated costs have yet to decline. There are very few vulnerability and impact models capable of providing information owners with the ability to comprehensively assess the effectiveness an organization's malicious insider mitigation strategies. This research uses a multi-dimensional approach: content analysis, attack tree framework, and an intent driven taxonomy model are used to develop a malicious insider Decision Support System (DSS) tool. The DSS tool's utility and applicability is demonstrated using a notional example. This …

Paper Session Iv: Development And Delivery Of Coursework - The Legal/Regulatory/Policy Environment Of Cyberforensics, John W. Bagby, John C. Ruhnka

Annual ADFSL Conference on Digital Forensics, Security and Law

This paper describes a cyber-forensics course that integrates important public policy and legal issues as well as relevant forensic techniques. Cyber-forensics refers to the amalgam of multi-disciplinary activities involved in the identification, gathering, handling, custody, use and security of electronic files and records, involving expertise from the forensic domain, and which produces evidence useful in the proof of facts for both commercial and legal activities. The legal and regulatory environment in which electronic discovery takes place is of critical importance to cyber-forensics experts because the legal process imposes both constraints and opportunities for the effective use of evidence gathered through …

Determining The Level Of Network Security Awareness Of Utc Students Living On Campus, Alma Cemerlic

Honors Theses

While information technology divisions in various schools often conduct surveys on general computer use, almost no studies have been done that directly targeted the level of Internet security awareness among college students. The National Cyber Security Alliance (NCSA), a not-for-profit, public-private partnership focused on increasing online security awareness, in collaboration with the Government and the Internet industry, organized a number of different projects designed to promote "safe online practices" among college students. However, since research has not been done to investigate the relationship between students' demographics and their Internet security awareness, it is not possible to tell how effective these …

Designing A Data Warehouse For Cyber Crimes, Il-Yeol Song, John D. Maguire, Ki Jung Lee, Namyoun Choi, Xiaohua Hu, Peter Chen

Journal of Digital Forensics, Security and Law

One of the greatest challenges facing modern society is the rising tide of cyber crimes. These crimes, since they rarely fit the model of conventional crimes, are difficult to investigate, hard to analyze, and difficult to prosecute. Collecting data in a unified framework is a mandatory step that will assist the investigator in sorting through the mountains of data. In this paper, we explore designing a dimensional model for a data warehouse that can be used in analyzing cyber crime data. We also present some interesting queries and the types of cyber crime analyses that can be performed based on …

A Curriculum For Teaching Information Technology Investigative Techniques For Auditors, Grover S. Kearns

Journal of Digital Forensics, Security and Law

Recent prosecutions of highly publicized white-collar crimes combined with public outrage have resulted in heightened regulation of financial reporting and greater emphasis on systems of internal control. Because both white-collar and cybercrimes are usually perpetrated through computers, internal and external auditors’ knowledge of information technology (IT) is now more vital than ever. However, preserving digital evidence and investigative techniques, which can be essential to fraud examinations, are not skills frequently taught in accounting programs and instruction in the use of computer assisted auditing tools and techniques – applications that might uncover fraudulent activity – is limited. Only a few university-level …

Development And Delivery Of Coursework: The Legal/Regulatory/Policy Environment Of Cyberforensics, John W. Bagby, John C. Ruhnka

Journal of Digital Forensics, Security and Law

This paper describes a cyber-forensics course that integrates important public policy and legal issues as well as relevant forensic techniques. Cyber-forensics refers to the amalgam of multi-disciplinary activities involved in the identification, gathering, handling, custody, use and security of electronic files and records, involving expertise from the forensic domain, and which produces evidence useful in the proof of facts for both commercial and legal activities. The legal and regulatory environment in which electronic discovery takes place is of critical importance to cyber-forensics experts because the legal process imposes both constraints and opportunities for the effective use of evidence gathered through …

Computer Forensics Field Triage Process Model, Marcus K. Rogers, James Goldman, Rick Mislan, Timothy Wedge, Steve Debrota

Journal of Digital Forensics, Security and Law

With the proliferation of digital based evidence, the need for the timely identification, analysis and interpretation of digital evidence is becoming more crucial. In many investigations critical information is required while at the scene or within a short period of time - measured in hours as opposed to days. The traditional cyber forensics approach of seizing a system(s)/media, transporting it to the lab, making a forensic image(s), and then searching the entire system for potential evidence, is no longer appropriate in some circumstances. In cases such as child abductions, pedophiles, missing or exploited persons, time is of the essence. In …

Efficient Generation Of Social Network Data From Computer-Mediated Communication Logs, Jason Wei Sung Yee

Theses and Dissertations

The insider threat poses a significant risk to any network or information system. A general definition of the insider threat is an authorized user performing unauthorized actions, a broad definition with no specifications on severity or action. While limited research has been able to classify and detect insider threats, it is generally understood that insider attacks are planned, and that there is a time period in which the organization's leadership can intervene and prevent the attack. Previous studies have shown that the person's behavior will generally change, and it is possible that social network analysis could be used to observe …

Enemy At The Gate: Threats To Information Security, Michael E. Whitman

Faculty Articles

A firm can build more effective security strategies by identifying and ranking the severity of potential threats to its IS efforts.