Information Security Commons^™

Tags At War: A Review Of The United States Department Of Defence Rfid Tag Data Standard, Uros Urosevic, Christopher Bolan

Australian Information Warfare and Security Conference

The U.S. Department of Defence have mandated the use of RFID technology in their procurement and supply systems. To enable compatibility across civilian contractors and suppliers and military systems the US DOD RFTag Data Format 2.0 specification has been implemented. This paper outlines the features of this standard and the possible security implications of its adoption.

An Attitude And Perception Study Of Wireless Network Usage In Home Environments, Patryk Szewczyk

Theses : Honours

Research on the use of 802.11 wireless networking and wireless security has in the past focused predominantly on corporations who generally have access to resources specifically allocated to computer and network security. Research has also focused on identifying the flaws in wireless network security, and developing stronger and safer methods which may be incorporated. To date there has been a lack of research into determining what the individual at home perceives towards wireless security. As broadband Internet connections are now predominantly chosen, the amount of available bandwidth open to exploitation is significantly higher than the now becoming obsolete dialup connection. …

Computer Security: Investigating The Impact That Security Specific Education Has On Users’ Behaviour, Samuel David Jones

Theses : Honours

A lack in end-user awareness in computer security issues provides the rationale for this investigation. The research considers whether or not the provision of an educational package addressing computer security issues will improve awareness and transform behaviour of end-users in assessing and enacting appropriate responses in computer security situations. A group of twenty participants was studied in detail using a mixed methods research approach. The participants were drawn from a cross section of computer end-users, from elementary to advanced levels of computer literacy. Outcomes include a positive response to the provision of material, however human factors were found to be …

An Investigation Of Network Security Management Methods, Shamila Anuranga Ratnayake

Theses : Honours

Network Management (NM) is concerned with reducing complexity and managing cost. The traditional NM tools and techniques are based on the Open System Interconnection (OSI) NM model. However, several drawbacks have been identified when managing a network using traditional NM tools (Sarkar & Verma, 2001). Network security is a major issue when managing a network. Even though the technology assists to reduce security risks, unless properly managed, the security measures may not do the job as expected. The State Model (SM) diagram is a new method, which may assists in managing the network. This new method may provide functionality not …

Security Governance: Its Impact On Security Culture, K. Koh, A. B. Ruighaver, S. B. Maynard, A. Ahmad

Research outputs pre 2011

While there is an overwhelming amount of literature that recognises the need for organisations to create a security culture in order to effectively manage security, little is known about how to create a good security culture or even what constitutes a good security culture. In this paper, we report on one of two case studies performed to examine how security governance influences security culture and in particular, the sense of responsibility and ownership of security. The results indicate that although the structural and functional mechanisms in security governance are influencing factors, it is the extent of social participation that may …

Risk Management In Crm Security Management, Mahdi Seify

Research outputs pre 2011

In an increasing competitive world, marketing survival can be depended simply on timely new information on customers and market trend. One of the most important strategies in CRM (Customer Relationship Management) is to capture enough information from customers and using this information carefully [Ryals , Tinsley]. Of course security of this information is very important in CRM data management [Bryan]. Data management is a method for scheduling and controlling data saving, recovering and processing. This activity has been done continually or periodically[Bryan]. Security level of this information depends on the security policy of the organization. CRM security policy is the …

Understanding Transition Towards Information Security Culture Change, Leanne Ngo, Wanlei Zhou, Matthew Warren

Research outputs pre 2011

Transitioning towards an information security culture for organisations has not been adequately explored in the current security and management literature. Many authors have proposed how information security culture can be created, fostered and managed within organisations, but have failed to adequately address the transition process towards information security culture change, particularly for small medium enterprises (SMEs). This paper aims to (1) recapitulate key developments and trends within information security culture literature; (2) explore in detail the transition process towards organisational change; (3) adapt the transition process with respects to the key players involved in transition and propose a transition model …

Smart Card Authentication For Mobile Devices, Wayne Jansen, Serban Gavrila, Clément Séveillac

Research outputs pre 2011

While mobile handheld devices provide productivity benefits, they also pose new risks. User authentication is the best safeguard against the risk of unauthorized use and access to a device’s contents. This paper describes two novel types of smart card with unconventional form factors, designed to take advantage of common interfaces built into many current handheld devices.

Non-Repudiation In Pure Mobile Ad Hoc Network, Yi-Chi Lin, Jill Slay

Research outputs pre 2011

Within the last decade, the use of wireless technologies has become more prevalent. Wireless networks have flexible architectures with data transferred via radio waves and can be divided into two categories; infrastructure-based wireless networks and mobile ad hoc network.

The mobile ad hoc network (MANET) is an autonomous system which can be dynamically built without pre-existing infrastructure or a trusted third party (TTP). Due to these infrastructure-less and self-organized characteristics, MANET encounters different problems from infrastructure-based wired network, such as key management, power shortage, and security issues. This paper will further divide MANETs into pure ad hoc networks which do …

Benchmarking E-Business Security: A Model And Framework, Graeme Pye, Matthew J. Warren

Research outputs pre 2011

The dynamic nature of threats and vulnerabilities within the E-business environment can impede online functionality, compromise organisational or customer information, contravene security implementations and thereby undermine online customer confidence. To negate these problems, E-business security has to become proactive, by reviewing and continuously improving security to strengthen E-business security measures and policies. This can be achieved through benchmarking the security measures and policies utilised within the E-business, against recognised information technology (IT) and information security (IS) security standards.

An Investigation Into The Paradox Of Organisational Flexibility Versus Security: A Research Project, Rosanna Fanciulli

Research outputs pre 2011

The trend towards utilising geographically and temporally dispersed personnel has grown quickly over the past decade; enabled by swift advances in computing, telecommunications, and networking technologies. The impact of these developments on corporate strategies and forms has manifested itself in a move to de-legitimise the rigid structure of a traditional bureaucracy and move towards one that is more flexible. These new technologies and organisational structures, however, also bring with them Information Security threats and risks. It is critical that managers become informed and equipped to deal with these issues. This paper presents an ongoing study designed to determine the major …

Architecture For Self-Estimation Of Security Level In Ad Hoc Network Nodes, Reijo Savola

Research outputs pre 2011

Inherent freedom due to a lack of central authority of self-organised mobile ad hoc networks introduces challenges to security and trust management. In these kinds of scenarios, the nodes themselves are naturally responsible for their own security – or they could trust certain known nodes, called “micro-operators”. We propose an architecture for security management in self-organising mobile ad hoc networks that is based on the nodes’ own responsibility and node-level security monitoring. The aim is to predict, as well as to monitor the security level concentrating on the principal effects contributing to it.

My Problem Or Our Problem? Exploring The Use Of Information Sharing As A Component Of A Holistic Approach To E-Security In Response To The Growth Of ‘Malicious Targeted Attacks’, Aaron Olding, Paul Turner

Research outputs pre 2011

There is now a growing recognition amongst e-security specialists that the e-security environment faced by organisations is changing rapidly. This environment now sees a situation where maliciously targeted attacks are conducted by ‘guns for hire’ (hackers) and/or criminal organisations (Illett 2005; Keiser 2005). As a consequence, conventional organisational approaches to e-security are becoming increasingly problematic and inadequate. There is a need to raise awareness of these issues amongst organisations and to contribute to the generation of effective integrated solutions that address this emerging e-security environment without sacrificing user privacy and/or breaching user trust. This paper considers the potential role of …

Detecting Rogue Access Points That Endanger The Maginot Line Of Wireless Authentication, Zhiqi Tao, A. B. Ruighaver

Research outputs pre 2011

The rapid growth in deployment of wireless networks in recent years may be an indication that many organizations believe that their system will be adequately secured by the implementation of enhanced encryption and authentication. However, in our view, the emphasis on cryptographic solutions in wireless security is repeating the history of the “Maginot Line”. Potential attackers of wireless networks currently will find many ways to get access to wireless networks to compromise the confidentiality of information without the need to crack the encryption. In this paper we analyze how rogue access points threaten the security of an organization’s wireless network …

Optimisation Of John The Ripper In A Clustered Linux Environment, Christian Frichot

Theses : Honours

To aid system administrators in enforcing strict password policies, the use of password cracking tools such as Cisilia (C.I.S.I.ar, 2003) and John the Ripper (Solar Designer, 2002), have been employed as software utilities to look for "weak" passwords. John the Ripper (JtR) attempts to crack the passwords by using a dictionary, brute-force or "other" mode of attack. The computational intensity of cracking passwords has led to the utilisation of parallel-processing environments to increase the speed of the password-cracking task. Parallel-processing environments can consist of either single systems with multiple processors, or a collection of separate computers working together as a …

A Deception Based Framework For The Application Of Deceptive Countermeasures In 802.11b Wireless Networks, Suen Yek

Theses : Honours

The advance of 802.11 b wireless networking has been beset by inherent and in-built security problems. Network security tools that are freely available may intercept network transmissions readily and stealthily, making organisations highly vulnerable to attack. Therefore, it is incumbent upon defending organisations to take initiative and implement proactive defences against common network attacks. Deception is an essential element of effective security that has been widely used in networks to understand attack methods and intrusions. However, little thought has been given to the type and the effectiveness of the deception. Deceptions deployed in nature, the military and in cyberspace were …

Protecting The Infrastructure: 3rd Australian Information Warfare & Security Conference 2002, William Hutchinson (Ed.)

Research outputs pre 2011

The conference is hosted by the We-B Centre (working with a-business) in the School of Management Information System, the School of Computer & Information Sciences at Edith Cowan University. This year's conference is being held at the Sheraton Perth Hotel in Adelaide Terrace, Perth. Papers for this conference have been written by a wide range of academics and industry specialists. We have attracted participation from both national and international authors and organisations.

The papers cover many topics, all within the field of information warfare and its applications, now and into the future.

The papers have been grouped into six streams: …

Working For Excellence In The E-Conomy: 2nd International We-B Conference, Sue Stoney (Ed.)

Research outputs pre 2011

Welcome to Perth, Western Australia, and to the 2nd International We-B Conference 2001 "working for excellence in the e-conomy" hosted by the We-B Centre, School of Management Information Systems at Edith Cowan University.

This is an international conference for academics and industry specialists in e-business, e-government and related fields. The conference has drawn participants from national and international organisations.

All submitted papers were subjected to an anonymous peer review process managed by the Conference Committee.

The Development And Use Of The Secure Electronic Transaction (Set) Protocol On The Internet, Damon James Whyte

Theses : Honours

While still in its infancy, Electronic Commerce is growing at an exponential rate each year (Walson, 1997. p.53). Although few doubt that such growth will only continue in years to come, many people still have serious reservations about the levels of security offered by currently available applications for conducting such trade. This thesis identifies some of the key areas of concern regarding Electronic Commerce on the lnternet, and looks at the ways in which the Secure Electronic Transaction (SET) model, proposed by Mastercard and Visa, succeeds or fails in addressing these concerns. It identifies and describes the key dements and …

Review Of Personal Identification Systems, J. M. Cross

Research outputs pre 2011

The growth of the use of biometric personal identification systems has been relatively steady over the last 20 years. The expected biometric revolution which was forecast since the mid 1970's has not yet occurred. The main factor for lower than expected growth has been the cost and user acceptance of the systems. During the last few years, however, a new generation of more reliable, less expensive and better designed biometric devices have come onto the market. This combined with the anticipated expansion of new reliable, user friendly inexpensive systems provides a signal that the revolution is about to begin. This …

Development Of A Classification System For Computer Viruses In The Ibm Pc Environment Using The Dos Operating System, Hugh R. Browne

Theses : Honours

The threat to computers worldwide from computer viruses is increasing as new viruses and variants proliferate. Availability of virus construction tools to facilitate 'customised' virus production and wider use of more sophisticated means of evading detection, such as encryption, polymorphic transformation and memory resident 'stealth' techniques increase this problem. Some viruses employ methods to guard against their own eradication from an infected computer, whilst other viruses adopt measures to prevent disassembly of the virus for examination and analysis. Growth in computer numbers and connectivity provide a growing pool of candidate hosts for infection. Standardised and flexible systems for classification and …

An Investigation Of Ibm Pc Computer Viruses Infection Rates And Types In A Western Australian Environment, Boon Guan Lee

Theses : Honours

In recent years computer viruses have become increasingly significant as a form of computer abuse. By virtue of their reproductive capability, computer viruses can have cumulative and potentially catastrophic effects to the many people who use those affected computers. There is a growing concern in the computing community about these forms of electronic vandalism. This concern arises from the possible damage to stored information on which the work depends and the ensuing disruption of the work-place. Although the vandalism or purposeful abuse by introducing computer viruses to computer systems was originally mainly an American experience, research reports published by the …