Open Access. Powered by Scholars. Published by Universities.®

Physical Sciences and Mathematics Commons

Open Access. Powered by Scholars. Published by Universities.®

Australian Digital Forensics Conference

2008

Security

Articles 1 - 2 of 2

Full-Text Articles in Physical Sciences and Mathematics

Issues Common To Australian Critical Infrastructure Providers Scada Networks Discovered Through Computer And Network Vulnerability Analysis, Craig Valli Mar 2008

Issues Common To Australian Critical Infrastructure Providers Scada Networks Discovered Through Computer And Network Vulnerability Analysis, Craig Valli

Australian Digital Forensics Conference

This paper reports on generic issues discovered as a result of conducting computer and network vulnerability assessments (CNVA) on Australian critical infrastructure providers. Generic issues discovered included policy, governance, IT specific such as segregation, patching and updating. Physical security was also lacking in some cases. Another issue was that previous security audits had failed to identify any of these issues. Of major concern is that despite education and awareness programs, and a body of knowledge referring to these issues, they are still occurring. It may be necessary for the federal government to force organisations to undergo computer and network vulnerability …


Virtual Environments Support Insider Security Violations, Iain Swanson, Patricia A.H. Williams Mar 2008

Virtual Environments Support Insider Security Violations, Iain Swanson, Patricia A.H. Williams

Australian Digital Forensics Conference

This paper describes an investigation into how an employee using a virtual environment can circumvent any or all of the security, policies and procedures within an organization. The paper discusses the fundamental issues that organizations must address to be able to detect such an attack. Attacks of this nature may be malicious with intent to cause disruption by flooding the network or disabling specific equipment, or non-malicious by quietly gathering critical information such as user names and passwords or a colleague’s internet banking details. Identification of potential residual evidence following an attack is presented. Such evidence may be used to …