Open Access. Powered by Scholars. Published by Universities.®

Information Security Commons™

Open Access. Powered by Scholars. Published by Universities.®

Australian Information Security Management Conference

Articles 61 - 90 of 224

Full-Text Articles in Information Security

Securing The Internet Of Things Infrastructure – Standards And Techniques, Zubair A. Baig Jan 2014

Securing The Internet Of Things Infrastructure – Standards And Techniques, Zubair A. Baig

Australian Information Security Management Conference

The Internet of Things (IoT) infrastructure is a conglomerate of electronic devices interconnected through the Internet, with the purpose of providing prompt and effective service to end-users. Applications running on an IoT infrastructure generally handle sensitive information such as a patient’s healthcare record, the position of a logistic vehicle, or the temperature readings obtained through wireless sensor nodes deployed in a bushland. The protection of such information from unlawful disclosure, tampering or modification, as well as the unscathed presence of IoT devices, in adversarial environments, is of prime concern. In this paper, a descriptive analysis of the security of standards …

Go to article

Mitigating Man-In-The-Middle Attacks On Smartphones – A Discussion Of Ssl Pinning And Dnssec, Veelasha Moonsamy, Lynn Batten Jan 2014

Mitigating Man-In-The-Middle Attacks On Smartphones – A Discussion Of Ssl Pinning And Dnssec, Veelasha Moonsamy, Lynn Batten

Australian Information Security Management Conference

Since their introduction, smartphones remain one of the most used handheld devices and this trend is predicted to continue in the coming years. Consequently, the number of attacks on smartphones is increasing exponentially; current market research shows that data traffic generated by smartphones will escalate by tenfold in 2019. Such an increase in traffic indicates that the smartphone industry will remain an attractive target for attackers. Whilst smartphone users are aware of the benefits of installing antivirus applications for malware evasion, they have limited knowledge on how to mitigate MiTM attacks. Furthermore, application developers do not always consider implementing appropriate …

Go to article

Cache-Timing Attack Against Aes Crypto System - Countermeasures Review, Yaseen H. Taha, Settana M. Abdulh, Naila A. Sadalla, Huwaida Elshoush Jan 2014

Cache-Timing Attack Against Aes Crypto System - Countermeasures Review, Yaseen H. Taha, Settana M. Abdulh, Naila A. Sadalla, Huwaida Elshoush

Australian Information Security Management Conference

Side channel attacks are based on side channel information, which is information that is leaked from encryption systems. Implementing side channel attacks is possible if and only if an attacker has access to a cryptosystem (victim) or can interact with cryptosystem remotely to compute time statistics of information that collected from targeted system. Cache timing attack is a special type of side channel attack. Here, timing information caused by cache effect is collected and analyzed by an attacker to guess sensitive information such as encryption key or plaintext. Cache timing attack against AES was known theoretically until Bernstein carry out …

Go to article

The Impact Of Social Constructivism On Erp Systems Security: A Critical Social Review, Kennedy Njenga Jan 2014

The Impact Of Social Constructivism On Erp Systems Security: A Critical Social Review, Kennedy Njenga

Australian Information Security Management Conference

Little is understood about the effects of social constructivism that shapes conflicting concerns regarding Enterprise Resource Planning (ERP) security and usability during implementation. This work looks at social constructivism as produced and reproduced by stakeholders in the ERP systems implementation phase. Social constructivism is characterised by the embedded trade-off for usability, espoused by end-user and security, espoused by developers. Social constructivism was conceptualised qualitatively from a selected case study. Critical Social Theory (CST) was used as the theoretical lens. Stakeholders concerned with ERP security aspects in the implementation phase were interviewed and data transcribed and interpreted. Hermeneutical interpretation was applied …

Go to article

12th Australian Information Security Management Conference, 2014, Edith Cowan University: Conference Details, Security Research Institute, Edith Cowan University Jan 2014

12th Australian Information Security Management Conference, 2014, Edith Cowan University: Conference Details, Security Research Institute, Edith Cowan University

Australian Information Security Management Conference

No abstract provided.

Go to article

The Application Of An Agile Approach To It Security Risk Management For Smes, Damien Hutchinson, Chris Armitt, Dean Edwards-Lear Jan 2014

The Application Of An Agile Approach To It Security Risk Management For Smes, Damien Hutchinson, Chris Armitt, Dean Edwards-Lear

Australian Information Security Management Conference

This paper demonstrates the application of an agile risk management approach to perform asset-based risk analysis to meet the information security requirements of SMEs (Small and Medium-sized Enterprises). This approach is proposed as an alternative to traditional methods that are cumbersome, resource intensive and costly, often hindering their value and use by SMEs. The organisation being studied is an Aged Care Facility (ACF) with legal and ethical responsibilities. Within the business there is little knowledge regarding potential information technology threats that could impact on these responsibilities. The ACF maintains a system containing client personal and medical records, network communications, as …

Go to article

A Conceptual Model For Federated Authentication In The Cloud, Abdulwahid Al Abdulwahid, Nathan Clarke, Steven Furnell, Ingo Stengel Dec 2013

A Conceptual Model For Federated Authentication In The Cloud, Abdulwahid Al Abdulwahid, Nathan Clarke, Steven Furnell, Ingo Stengel

Australian Information Security Management Conference

Authentication is a key security control for any computing system, whether that is a PC, server, laptop, tablet or mobile phone. However, authentication is traditionally poorly served, with existing implementations falling foul of a variety of weaknesses. Passwords are poorly selected, reused and shared (to name but a few). Research has suggested novel approaches to authentication such as transparent authentication and cooperative and distributed authentication. However, these technologies merely focus upon individual platforms rather than providing a universal and federated authentication approach that can be used across technologies and services. The advent of cloud computing, its universal connectivity, scalability and …

Go to article

The Effectiveness Of Internet Activity Erasure Tools To Protect Privacy, Brian Cusack, Andrew Woodward, Scott Butson, Benjamin Leber Dec 2013

The Effectiveness Of Internet Activity Erasure Tools To Protect Privacy, Brian Cusack, Andrew Woodward, Scott Butson, Benjamin Leber

Australian Information Security Management Conference

When most people go to the trouble of getting erasure tools to remove data from their hard drives they expect the job is done correctly. Using erasure tools is a step to protect privacy by assuming the applied tools erase data rather than simply delete data that may be recovered using forensic tools. In this research we tested the performance of the delete function on three web browsers against the performance of eight erasure tools with alarming results. It was found that the erasure tools had almost the same capability to delete data as the web browsers delete function; and …

Go to article

Exchanging Demands: Weaknesses In Ssl Implementations For Mobile Platforms, Peter Hannay, Clinton Carpene, Craig Valli, Andrew Woodward, Mike Johnstone Dec 2013

Exchanging Demands: Weaknesses In Ssl Implementations For Mobile Platforms, Peter Hannay, Clinton Carpene, Craig Valli, Andrew Woodward, Mike Johnstone

Australian Information Security Management Conference

The ActiveSync protocol’s implementation on some embedded devices leaves clients vulnerable to unauthorised remote policy enforcement. This paper discusses a proof of concept attack against the implementation of ActiveSync in common Smart phones including Android devices and iOS devices. A two‐phase approach to exploiting the ActiveSync protocol is introduced. Phase 1 details the usage of a man‐in‐the‐middle attack to gain a vantage point over the client device, whilst Phase 2 involves spoofing the server‐side ActiveSync responses to initiate the unauthorised policy enforcement. These vulnerabilities are demonstrated by experiment, highlighting how the system can be exploited to perform a remote factory …

Go to article

A Simulation-Based Study Of Server Location Selection Rules In Manets Utilising Threshold Cryptography, Alastair Nisbet Dec 2013

A Simulation-Based Study Of Server Location Selection Rules In Manets Utilising Threshold Cryptography, Alastair Nisbet

Australian Information Security Management Conference

Truly Ad Hoc wireless networks where a spontaneous formation of a network occurs and there is no prior knowledge of nodes to each other present significant security challenges, especially as entirely online configuration of nodes with encryption keys must be performed. Utilising threshold cryptography in this type of MANET can greatly increase the security by requiring servers to collaborate to form a single Certificate Authority (CA). In this type of CA responsibility for certificate services is shared between a threshold of servers, greatly increasing security and making attack against the CA considerably more difficult. Choosing which nodes to take on …

Go to article

Information Security Management: Factors That Influence Security Investments In Smes, Zhi Xian Ng, Atif Ahmad, Sean B. Maynard Dec 2013

Information Security Management: Factors That Influence Security Investments In Smes, Zhi Xian Ng, Atif Ahmad, Sean B. Maynard

Australian Information Security Management Conference

In the modern information economy, the security of information is critically important to organizations. Information‐security risk assessments (ISRAs) allow organizations to identify key information assets and security risks so security expenditure can be directed cost‐effectively. Unfortunately conducting ISRAs requires special expertise and tends to be complex and costly for small to medium sized organizations (SMEs). Therefore, it remains unclear in practice, and unknown in literature, how SMEs address information security imperatives without the benefit of an ISRA process. This research makes a contribution to theory in security management by identifying the factors that influence key decision-makers in SMEs to address …

Go to article

A Comparison Of Information Security Curricula In China And The Usa, Huaying Chen, Sean B. Maynard, Atif Ahmad Dec 2013

A Comparison Of Information Security Curricula In China And The Usa, Huaying Chen, Sean B. Maynard, Atif Ahmad

Australian Information Security Management Conference

Information Security (InfoSec) education varies in its content, focus and level of technicality across the world. In this paper we investigate the differences between graduate InfoSec programs in top universities in China and in the United States of America (USA). In China, curriculum emphasises Telecommunication, Computer Science and InfoSec Technology, whilst in the USA in addition to Computer Science and InfoSec Technology the curriculum also emphasises Enterprise‐level Security Strategy and Policy, InfoSec Management, and Cyber Law. The differences are significant and will have a profound impact on both the perceptions and capabilities of future generations of information security professionals on …

Go to article

Determining What Characteristics Constitute A Darknet, Symon Aked, Christopher Bolan, Murray Brand Dec 2013

Determining What Characteristics Constitute A Darknet, Symon Aked, Christopher Bolan, Murray Brand

Australian Information Security Management Conference

Privacy on the Internet has always been a concern, but monitoring of content by both private corporations and Government departments has pushed people to search for ways to communicate over the Internet in a more secure manner. This has given rise to the creations of Darknets, which are networks that operate “inside” the Internet, and allow anonymous participation via a de‐centralised, encrypted, peer‐to‐peer network topology. This research investigates some sources of known Internet content monitoring, and how they provided the template for the creation of a system to avoid such surveillance. It then highlights how communications on the Clearnet is …

Go to article

Privacy And Legal Issues In Cloud Computing - The Smme Position In South Africa, Mathias Mujinga Dec 2013

Privacy And Legal Issues In Cloud Computing - The Smme Position In South Africa, Mathias Mujinga

Australian Information Security Management Conference

Cloud computing (CC) brings substantial benefits to organizations and their clients. Information technology (IT) users in developing countries, especially those in underdeveloped communities, are gaining easy and cost‐effective access to a variety of services, from entertainment to banking. South Africa has outlined a national e‐strategy that aims to improve those communities, by providing frameworks for access to information and communications technology (ICT). The products and services of small‐, medium and micro‐sized enterprises (SMME) are now reaching a wider audience through the use of technology. CC can go a long way to help government realize the national e‐strategy. There are numerous …

Go to article

A 2013 Study Of Wireless Network Security In New Zealand: Are We There Yet?, Alastair Nisbet Dec 2013

A 2013 Study Of Wireless Network Security In New Zealand: Are We There Yet?, Alastair Nisbet

Australian Information Security Management Conference

This research examines the current level of security in wireless networks in New Zealand. A comprehensive wardrive covering the length of the country was made in January 2013 to ensure accurate comparisons from two previous wardrives as well as comparisons between the four main cities and the suburbs can be made. With 16 years since the introduction of the original IEEE 802.11 wireless standard having passed, an examination is made of the current state of wireless security of networks throughout New Zealand and the Auckland suburbs, and where possible compares these results with similar studies undertaken in 2004 and 2011. …

Go to article

Usability And Security Support Offered Through Adsl Router User Manuals, Patryk Szewczyk Dec 2013

Usability And Security Support Offered Through Adsl Router User Manuals, Patryk Szewczyk

Australian Information Security Management Conference

ADSL routers are often used as either the target or the means for cyber crime. Many ADSL router threats could be mitigated through the effective use of inbuilt security controls and firmware updates available from vendors. Unfortunately, end‐users typically lack the technical expertise to correctly configure and secure the device. Subsequently, end‐users are reliant on well documented procedures provided by vendors in their user manuals and quick start guides. This study investigates the usability and security recommendations and encouragements put forth by vendors in their user manuals. The study demonstrates that user manual usability does not conform to ideal technical …

Go to article

Automated Detection Of Vehicles With Machine Learning, Michael N. Johnstone, Andrew Woodward Jan 2013

Automated Detection Of Vehicles With Machine Learning, Michael N. Johnstone, Andrew Woodward

Australian Information Security Management Conference

Considering the significant volume of data generated by sensor systems and network hardware which is required to be analysed and intepreted by security analysts, the potential for human error is significant. This error can lead to consequent harm for some systems in the event of an adverse event not being detected. In this paper we compare two machine learning algorithms that can assist in supporting the security function effectively and present results that can be used to select the best algorithm for a specific domain. It is suggested that a naive Bayesian classiifer (NBC) and an artificial neural network (ANN) …

Go to article

Experimenting With Anomaly Detection By Mining Large-Scale Information Networks, A. Taleb-Bendiab Dec 2012

Experimenting With Anomaly Detection By Mining Large-Scale Information Networks, A. Taleb-Bendiab

Australian Information Security Management Conference

Social networks have formed the basis of many studies into large networks analysis. Whilst much is already known regarding efficient algorithms for large networks analysis, data mining, knowledge diffusion, anomaly detection, viral marketing, to mention. More recent research is focussing on new classes of efficient approximate algorithms that can scale to billion nodes and edges. To this end, this paper presents an extension of an algorithm developed originally to analyse large scale-free autonomic networks called the Global Observer Model. In this paper, the algorithm is studied in the context of monitoring large-scale information networks. Hence, taking into account the size …

Go to article

A Proposed Formula For Comparing Kill Password Effectiveness In Single Password Rfid Systems, Christopher Bolan Dec 2012

A Proposed Formula For Comparing Kill Password Effectiveness In Single Password Rfid Systems, Christopher Bolan

Australian Information Security Management Conference

The Electronic Product Code standard for RFID systems plays a significant role in worldwide RFID implementations. A feature of the RFID standards has been the RFID Kill command which allows for the "permanent" destruction of an RFID tag through the issuing of a simple command. Whilst the inclusion of this command may be vital for user privacy it also opens up significant avenues for attack. Whilst such attacks may be well documented there has been little to no discussion of the efficacy of the differing mitigation approaches taken. A simple formula to calculate the full timing of such an attack …

Go to article

Harms: Hierarchical Attack Representation Models For Network Security Analysis, Jin Hong, Dong-Seong Kim Dec 2012

Harms: Hierarchical Attack Representation Models For Network Security Analysis, Jin Hong, Dong-Seong Kim

Australian Information Security Management Conference

Attack models can be used to assess network security. Purely graph based attack representation models (e.g., attack graphs) have a state-space explosion problem. Purely tree-based models (e.g., attack trees) cannot capture the path information explicitly. Moreover, the complex relationship between the host and the vulnerability information in attack models create difficulty in adjusting to changes in the network, which is impractical for modern large and dynamic network systems. To deal with these issues, we propose hierarchical attack representation models (HARMs). The main idea is to use two-layer hierarchy to separate the network topology information (in the upper layer) from the …

Go to article

An Information Security Awareness Capability Model (Isacm), Robert Poepjes, Michael Lane Dec 2012

An Information Security Awareness Capability Model (Isacm), Robert Poepjes, Michael Lane

Australian Information Security Management Conference

A lack of information security awareness within some parts of society as well as some organisations continues to exist today. Whilst we have emerged from the threats of late 1990s of viruses such as Code Red and Melissa, through to the phishing emails of the mid 2000’s and the financial damage some such as the Nigerian scam caused, we continue to react poorly to new threats such as demanding money via SMS with a promise of death to those who won’t pay. So is this lack of awareness translating into problems within the workforce? There is often a lack of …

Go to article

Human-Readable Real-Time Classifications Of Malicious Executables, Anselm Teh, Arran Stewart Dec 2012

Human-Readable Real-Time Classifications Of Malicious Executables, Anselm Teh, Arran Stewart

Australian Information Security Management Conference

Shafiq et al. (2009a) propose a non–signature-based technique for detecting malware which applies data mining techniques to features extracted from executable files. Their technique has a high level of accuracy, a low false positive rate, and a speed on par with commercial anti-virus products. One portion of their technique uses a multi-layer perceptron as a classifier, which provides little insight into the reasons for classification. Our experience is that network security analysts prefer tools which provide human-comprehensible reasons for a classification, rather than operating as “black boxes”. We therefore build on the results of Shafiq et al. by demonstrating a …

Go to article

Implementing A Secure Academic Grid System - A Malaysian Case, Mohd Samsu Sajat, Suhaidi Hassan, Adi Affandi Ahmad, Ali Yusny Daud, Amran Ahmad Dec 2012

Implementing A Secure Academic Grid System - A Malaysian Case, Mohd Samsu Sajat, Suhaidi Hassan, Adi Affandi Ahmad, Ali Yusny Daud, Amran Ahmad

Australian Information Security Management Conference

Computational grids have become very popular in the recent times due to their capabilities and flexibility in handling large computationally intensive jobs. When it comes to the implementation of practical grid systems, security plays a major role due to the confidentiality of the information handled and the nature of the resources employed. Also due to the complex nature of the grid operations, grid systems face unique security threats compared to other distributed systems. This paper describes how to implement a secure grid system with special emphasis on the steps to be followed in obtaining, implementing and testing PKI certificates.

Go to article

Web-Based Risk Analysis For Home Users, R. T. Magaya, N. L. Clarke Dec 2012

Web-Based Risk Analysis For Home Users, R. T. Magaya, N. L. Clarke

Australian Information Security Management Conference

The advancement of the Internet has provided access to a wide variety of online services such as banking, e-commerce, social networking and entertainment. The wide availability and popularity of the Internet has also led to the rise in risks and threats to users, as criminals have taken an increasingly active role in abusing innocent users. Current risk analysis tools, techniques and methods available do not cater for home users but are tailored for large organisations. The tools require expertise to use them and they are expensive to purchase. What is available for home users are generic information portals that provide …

Go to article

An Investigation Into The Wi-Fi Protected Setup Pin Of The Linksys Wrt160n V2, Symon Aked, Christopher Bolan, Murray Brand Dec 2012

An Investigation Into The Wi-Fi Protected Setup Pin Of The Linksys Wrt160n V2, Symon Aked, Christopher Bolan, Murray Brand

Australian Information Security Management Conference

Wi-Fi Protected Setup (WPS) is a method of allowing a consumer to set up a secure wireless network in a user friendly way. However, in December 2011 it was discovered that a brute force attack exists that reduces the WPS key space from 108 to 104+103. This resulted in a proof of concept tool that was able to search all possible combinations of PINs within a few days.This research presents a methodology to test wireless devices to determine their susceptibility to the external registrar PIN authentication design vulnerability. A number of devices were audited, and the Linksys WRT160N v2 router …

Go to article

Exposing Potential Privacy Issues With Ipv6 Address Construction, Clinton Carpene, Andrew Woodward Dec 2012

Exposing Potential Privacy Issues With Ipv6 Address Construction, Clinton Carpene, Andrew Woodward

Australian Information Security Management Conference

The usage of 128 bit addresses with hexadecimal representation in IPv6 poses significant potential privacy issues. This paper discusses the means of allocating IPv6 addresses, along with the implications each method may have upon privacy in different usage scenarios. The division of address space amongst the global registries in a hierarchal fashion can provide geographical information about the location of an address, and its originating device. Many IPv6 address configuration methods are available, including DHCPv6, SLAAC (with or without privacy extensions), and Manual assignment. These assignment techniques are dissected to expose the identifying characteristics of each technique. It is seen …

Go to article

Does The Android Permission System Provide Adequate Information Privacy Protection For End-Users Of Mobile Apps?, Michael Lane Dec 2012

Does The Android Permission System Provide Adequate Information Privacy Protection For End-Users Of Mobile Apps?, Michael Lane

Australian Information Security Management Conference

This paper investigates the Android permission system and its adequacy in alerting end-users of potential information privacy risks in an app. When an end-user seeks to install an app, they are presented with the required permissions and make a supposedly informed decision as to whether to install that app based on the permissions presented. The results from an analysis of ten popular apps indicate a number of permissions that pose potential information privacy risks of which most end-users are likely to be unaware. The Android permission system is complex and difficult for end-users to comprehend and effectively evaluate the potential …

Go to article

The Mobile Execution Environment: A Secure And Non-Intrusive Approach To Implement A Bring You Own Device Policy For Laptops, Peter James, Don Griffiths Dec 2012

The Mobile Execution Environment: A Secure And Non-Intrusive Approach To Implement A Bring You Own Device Policy For Laptops, Peter James, Don Griffiths

Australian Information Security Management Conference

Bring Your Own Device (BYOD) has become an established business practice, however the practice can increase an organisation’s information security risks. The implementation of a BYOD policy for laptops must consider how the information security risks can be mitigated or managed. The selection of an appropriate secure laptop software configuration is an important part of the information security risk mitigation/management strategy. This paper considers how a secure laptop software configuration, the Mobile Execution Environment (MEE) can be used to minimise risks when a BYOD policy for laptops is implemented. In this paper the security and business risks associated with the …

Go to article

Territorial Behavior And The Economics Of Botnets, Craig S. Wright Dec 2012

Territorial Behavior And The Economics Of Botnets, Craig S. Wright

Australian Information Security Management Conference

This paper looks at the economics associated with botnets. This research can be used to calculate territorial sizes for online criminal networks. Looking at the types of systems we can compare the time required to maintain the botnet against the benefits received. In doing this it will be possible to formulate economic defence strategies that reduce the benefits received through the control of the botnet. We look at the decision to be territorial or not from the perspective of the criminal bot-herder. This is extended to an analysis of territorial size. The criminal running a botnet seeks to maximize profit. …

Go to article

A Survey Of Computer And Network Security Support From Computer Retailers To Consumers In Australia, Patryk Szewczyk Jan 2012

A Survey Of Computer And Network Security Support From Computer Retailers To Consumers In Australia, Patryk Szewczyk

Australian Information Security Management Conference

Previously undertaken research suggests that novice end-users rely on computer retailers for security advice and support during and after a sale has occurred. This paper documents the survey results of computer and network security support provided to consumers by retailers in Perth, Western Australia between 2011 and 2012. The conducted survey shows that in the majority of cases, computers retailers were favourable in providing support and recommendations. However, these views were found to be flawed, confusing and do little to ensure that end-users are not victimized by cyber crime.

Go to article

First Prev Next Last