Open Access. Powered by Scholars. Published by Universities.®
- Discipline
-
- Engineering (47)
- Computer Law (46)
- Law (46)
- Computer Engineering (45)
- Electrical and Computer Engineering (38)
-
- Forensic Science and Technology (37)
- Legal Studies (37)
- Social and Behavioral Sciences (37)
- Databases and Information Systems (8)
- OS and Networks (7)
- Digital Communications and Networking (5)
- Theory and Algorithms (4)
- Business (3)
- Graphics and Human Computer Interfaces (3)
- Data Storage Systems (2)
- Other Computer Sciences (2)
- Programming Languages and Compilers (2)
- Systems Architecture (2)
- Computer and Systems Architecture (1)
- Controls and Control Theory (1)
- Digital Circuits (1)
- E-Commerce (1)
- Health Information Technology (1)
- Management Information Systems (1)
- Mathematics (1)
- Medicine and Health Sciences (1)
- Numerical Analysis and Scientific Computing (1)
- Institution
- Keyword
-
- Security (7)
- Computer security (5)
- Information security (5)
- Privacy (5)
- Computer forensics (4)
-
- Computer networks--Security measures (4)
- Malware (4)
- Digital forensics (3)
- Information Security (3)
- RFID (3)
- Anomaly detection (2)
- Auditing (2)
- Chosen-ciphertext attack (2)
- Clustering (2)
- Cyber crime (2)
- Cyber resilience (2)
- Digital evidence (2)
- Disk analysis (2)
- Flow chart (2)
- Forensics (2)
- Governance (2)
- Hierarchical hypermedia (2)
- Honeypot (2)
- ISO/IEC 27001:2005 (2)
- Identity-Based Encryption (2)
- Information leakage (2)
- Information personalization (2)
- Information warfare (2)
- Malware (Computer software) (2)
- Mobile computing (2)
- Publication
-
- Journal of Digital Forensics, Security and Law (32)
- Research Collection School Of Computing and Information Systems (30)
- Australian Information Security Management Conference (19)
- Theses and Dissertations (17)
- Annual ADFSL Conference on Digital Forensics, Security and Law (14)
-
- International Cyber Resilience conference (10)
- Australian Information Warfare and Security Conference (7)
- Publications (3)
- All Faculty and Staff Scholarship (2)
- Computer Science Faculty Publications (2)
- Electrical & Computer Engineering and Computer Science Faculty Publications (2)
- All Faculty Scholarship for the College of the Sciences (1)
- Computer Science and Computer Engineering Undergraduate Honors Theses (1)
- Dissertations and Theses Collection (Open Access) (1)
- Electrical & Computer Engineering Faculty Publications (1)
- Honors Theses (1)
- Publications and Research (1)
- Research Collection School Of Accountancy (1)
- Theses: Doctorates and Masters (1)
- Publication Type
Articles 1 - 30 of 146
Full-Text Articles in Information Security
Analysis Of A Database Insider Threat Model, Andrea Samuel
Analysis Of A Database Insider Threat Model, Andrea Samuel
Computer Science and Computer Engineering Undergraduate Honors Theses
According to Silicon.com's CIO Insight - Beware the Insider Security Threat, insiders are bigger threats to corporate security than external threats such as denial of service attacks or malware. Statistics show that 70% of fraud is perpetrated by staff and that the main data security threat comes from poorly trained or disgruntled employees who are authorized to have access to data and file stores [4]. This research project focuses specifically on the problem of insider threat in relational database systems. The project involves simulating research conducted in Qussai Yaseen and Brajendra Panda's research paper, Predicting and Preventing Insider Threat in …
Dynamic Group Key Exchange Revisited, Guomin Yang, Chik How Tan
Dynamic Group Key Exchange Revisited, Guomin Yang, Chik How Tan
Research Collection School Of Computing and Information Systems
In a dynamic group key exchange protocol, besides the basic group setup protocol, there are also a join protocol and a leave protocol, which allow the membership of an existing group to be changed more efficiently than rerunning the group setup protocol. The join and leave protocols should ensure that the session key is updated upon every membership change so that the subsequent sessions are protected from leaving members (backward security) and the previous sessions are protected from joining members (forward security). In this paper, we present a new security model for dynamic group key exchange. Comparing to existing models, …
Revisiting Address Space Randomization, Zhi Wang, Renquan Cheng, Debin Gao
Revisiting Address Space Randomization, Zhi Wang, Renquan Cheng, Debin Gao
Research Collection School Of Computing and Information Systems
Address space randomization is believed to be a strong defense against memory error exploits. Many code and data objects in a potentially vulnerable program and the system could be randomized, including those on the stack and heap, base address of code, order of functions, PLT, GOT, etc. Randomizing these code and data objects is believed to be effective in obfuscating the addresses in memory to obscure locations of code and data objects. However, attacking techniques have advanced since the introduction of address space randomization. In particular, return-oriented programming has made attacks without injected code much more powerful than what they …
Time Cost Evaluation For Executing Rfid Authentication Protocols, Kevin Chiew, Yingjiu Li, Tieyan Li, Robert H. Deng, Manfred Aigner
Time Cost Evaluation For Executing Rfid Authentication Protocols, Kevin Chiew, Yingjiu Li, Tieyan Li, Robert H. Deng, Manfred Aigner
Research Collection School Of Computing and Information Systems
There are various reader/tag authentication protocols proposed for the security of RFID systems. Such a protocol normally contains several rounds of conversations between a tag and a reader and involves cryptographic operations at both reader and tag sides. Currently there is a lack of benchmarks that provide a fair comparison platform for (a) the time cost of cryptographic operations at the tag side and (b) the time cost of data exchange between a reader and a tag, making it impossible to evaluate the total time cost for executing a protocol. Based on our experiments implemented on IAIK UHF tag emulators …
Chosen-Ciphertext Secure Bidirectional Proxy Re-Encryption Schemes Without Pairings, Jian Weng, Huijie, Robert Deng, Shengli Liu, Kefei Chen
Chosen-Ciphertext Secure Bidirectional Proxy Re-Encryption Schemes Without Pairings, Jian Weng, Huijie, Robert Deng, Shengli Liu, Kefei Chen
Research Collection School Of Computing and Information Systems
Proxy re-encryption realizes delegation of decryption rights, enabling a proxy holding a re-encryption key to convert a ciphertext originally intended for Alice into an encryption of the same message for Bob. Proxy re-encryption is a very useful primitive, having many applications in distributed file systems, outsourced filtering of encrypted spam, access control over network storage, and so on. Lately, Weng et al. proposed the first unidirectional proxy re-encryption scheme without using bilinear pairs. However, Weng et al.'s construction does not possess collusion resilience, in the sense that a coalition of the proxy and the delegatee can recover the delegator's private …
A Multi-User Steganographic File System On Untrusted Shared Storage, Jin Han, Meng Pan, Debin Gao, Hwee Hwa Pang
A Multi-User Steganographic File System On Untrusted Shared Storage, Jin Han, Meng Pan, Debin Gao, Hwee Hwa Pang
Research Collection School Of Computing and Information Systems
Existing steganographic file systems enable a user to hide the existence of his secret data by claiming that they are (static) dummy data created during disk initialization. Such a claim is plausible if the adversary only sees the disk content at the point of attack. In a multi-user computing environment that employs untrusted shared storage, however, the adversary could have taken multiple snapshots of the disk content over time. Since the dummy data are static, the differences across snapshots thus disclose the locations of user data, and could even reveal the user passwords. In this paper, we introduce a Dummy-Relocatable …
Protecting And Restraining The Third Party In Rfid-Enabled 3pl Supply Chains, Shaoying Cai, Chunhua Su, Yingjiu Li, Robert H. Deng
Protecting And Restraining The Third Party In Rfid-Enabled 3pl Supply Chains, Shaoying Cai, Chunhua Su, Yingjiu Li, Robert H. Deng
Research Collection School Of Computing and Information Systems
“Symmetric secret”-based RFID systems are widely adopted in supply chains. In such RFID systems, a reader’s ability to identify a RFID tag relies on the possession of the tag’s secret which is usually only known by its owner. If a “symmetric secret”-based RFID system is deployed in third party logistics (3PL) supply chains, all the three parties (the sender of the goods, the receiver of the goods and the 3PL provider) should have a copy of those tags’ secrets to access the tags. In case the three parties in 3PL supply chain are not all honest, sharing the secrets among …
New Approaches To Mitigation Of Malicious Traffic In Voip Networks, Tobi Wulff, Ray Hunt
New Approaches To Mitigation Of Malicious Traffic In Voip Networks, Tobi Wulff, Ray Hunt
Australian Information Security Management Conference
Voice over IP (VoIP) telephony is becoming widespread in use, and is often integrated into computer networks. Because of this, malicious software threatens VoIP systems in the same way that traditional computer systems have been attacked by viruses, worms, and other automated agents. VoIP networks are a challenge to secure against such malware as much of the network intelligence is focused on the edge devices and access environment. This paper describes the design and implementation of a novel VoIP security architecture in which evaluation of, and mitigation against, malicious traffic is demonstrated by the use of virtual machines to emulate …
Australian Critical Infrastructure Protection: A Case Of Two Tales, Matthew Warren, Graeme Pye, William Hutchinson
Australian Critical Infrastructure Protection: A Case Of Two Tales, Matthew Warren, Graeme Pye, William Hutchinson
Australian Information Warfare and Security Conference
The protection of critical infrastructures and the choices made in terms of priorities and cost, all impact upon the planning, precautions and security aspects of protecting these important systems. Often the when choices made is difficult to assess at the time the decision is taken and it is only after an incident that the truth of the choices made become fully evident. The paper focuses on two recent examples of Australian Critical Infrastructure protection and the issues that related to those examples.
Influence Operations: Action And Attitude, William Hutchinson
Influence Operations: Action And Attitude, William Hutchinson
Australian Information Warfare and Security Conference
This paper investigates the relationships between attitudes, behaviour and influence. The major objective of influence operations is predominantly to exert soft power and in doing this there is an assumption that it will change attitudes. It is assumed that by changing attitudes favourable to the influencer that behaviours will be changed. However, this is a problematic assumption. Influence operations whose messages seem to contradict the real behaviour of the influencer tends to nullify the message; and, in fact, might reinforce the attitudes and behaviours of the foe and begin to alienate friends. Messages should be based on a credible reality; …
Threat Modelling With Stride And Uml, Michael N. Johnstone
Threat Modelling With Stride And Uml, Michael N. Johnstone
Australian Information Security Management Conference
Threat modelling as part of risk analysis is seen as an essential part of secure systems development. Microsoft’s Security Development Lifecycle (SDL) is a well-known software development method that places security at the forefront of product initiation, design and implementation. As part of SDL, threat modelling produces data flow diagrams (DFDs) as key artefacts and uses those diagrams as mappings with STRIDE to identify threats. This paper uses a standard case study to illustrate the effects of using an alternative process model (UML activity diagrams) with STRIDE and suggests that using a more modern process diagram can generate a more …
A Proposed Policy-Based Management Architecture For Wireless Clients Operating In A Heterogeneous Mobile Environment, Mayank Keshariya, Ray Hunt
A Proposed Policy-Based Management Architecture For Wireless Clients Operating In A Heterogeneous Mobile Environment, Mayank Keshariya, Ray Hunt
Australian Information Security Management Conference
The objective of this paper is to provide a managed always best connected service to mobile entities over underlying heterogeneous wireless and mobile platforms while maintaining negotiated security and quality of service (QoS). This paper proposes a new model and its architecture which is based upon Policy-based Management but provides a new framework based on layered-approach for the centralised management of mobile clients. In particular, we propose and implement a new model of a policy-managed mobile client and its architecture to support seamless handoff across multiple access networks. The proposed mobile client supports multi-domain authentication, authorisation and security based on …
Micro-Blogging In The Workplace, Chia Yao Lee, Matthew Warren
Micro-Blogging In The Workplace, Chia Yao Lee, Matthew Warren
Australian Information Security Management Conference
Micro-blogging services such as Twitter, Yammer, Plurk and Google Buzz have generated substantial interest among members of the business community in recent years. Many CEOs, managers and front-line employees have embraced micro-blogs as a tool for interacting with colleagues, employees, customers, suppliers and investors. Micro-blogs are considered a more informal channel than emails and official websites, and thus present a different set of challenges to businesses. As a positional paper, this paper uses a case study of a bogus Twitter account to emphasise security and ethical issues relating to (i) Trust, Accuracy and Authenticity of Information, (ii) Privacy and Confidentiality, …
A Novel Design And Implementation Of Dos-Resistant Authentication And Seamless Handoff Scheme For Enterprise Wlans, Isaac Lee, Ray Hunt
A Novel Design And Implementation Of Dos-Resistant Authentication And Seamless Handoff Scheme For Enterprise Wlans, Isaac Lee, Ray Hunt
Australian Information Security Management Conference
With the advance of wireless access technologies, the IEEE 802.11 wireless local area network (WLAN) has gained significant increase in popularity and deployment due to the substantially improved transmission rate and decreased deployment costs. However, this same widespread deployment makes WLANs an attractive target for network attacks. Several vulnerabilities have been identified and reported regarding the security of the current 802.11 standards. To address those security weaknesses, IEEE standard committees proposed the 802.11i amendment to enhance WLAN security. The 802.11i standard has demonstrated the capability of providing satisfactory mutual authentication, better data confidentiality, and key management support, however, the design …
An Information Security Governance Framework For Australian Primary Care Health Providers, Donald C. Mcdermid, Rachel J. Mahncke, Patricia A H Williams
An Information Security Governance Framework For Australian Primary Care Health Providers, Donald C. Mcdermid, Rachel J. Mahncke, Patricia A H Williams
Australian Information Security Management Conference
The competitive nature of business and society means that the protection of information, and governance of the information security function, is increasingly important. This paper introduces the notion of a governance framework for information security for health providers. It refines the idea of an IT Balanced Scorecard into a scorecard process for use in governing information security for primary care health providers, where IT and security skills may be limited. The approach amends and justifies the four main elements of the scorecard process. The existence of a governance framework specifically tailored for the needs of primary care practice is a …
Information Leakage Through Online Social Networking: Opening The Doorway For Advanced Persistence Threats, Nurul Nuha Abdul Molok, Shanton Chang, Atif Ahmad
Information Leakage Through Online Social Networking: Opening The Doorway For Advanced Persistence Threats, Nurul Nuha Abdul Molok, Shanton Chang, Atif Ahmad
Australian Information Security Management Conference
The explosion of online social networking (OSN) in recent years has caused damages to organisations due to leakage of information by their employees. Employees’ social networking behaviour, whether accidental or intentional, provides an opportunity for advanced persistent threats (APT) attackers to realise their social engineering techniques and undetectable zero-day exploits. APT attackers use a spear-phishing method that targeted on key employees of victim organisations through social media in order to conduct reconnaissance and theft of confidential proprietary information. This conceptual paper posits OSN as the most challenging channel of information leakage and provides an explanation about the underlying factors of …
Yet Another Symbian Vulnerability Update, Nizam Uddin Bhuiyan
Yet Another Symbian Vulnerability Update, Nizam Uddin Bhuiyan
Australian Information Security Management Conference
The more the mobile devices are approaching to advance their security, the numbers of vulnerabilities are also becoming more astonishing. The number of mobile phones including smart phones is rising vertically, and so has the amount of malware activity. This report documents the latest threats in Symbian mobile industry and analyses the consequence. In addition, it will suggest the possible solution that may help individuals to protect their device & ultimately maintain the privacy.
Development And Evaluation Of A Secure Web Gateway Using Existing Icap Open Source Tools, Michael Pearce, Ray Hunt
Development And Evaluation Of A Secure Web Gateway Using Existing Icap Open Source Tools, Michael Pearce, Ray Hunt
Australian Information Security Management Conference
This work in progress paper discusses the development and evaluation of an open source secure web gateway. The proof of concept system uses a combination of open source software (including the Greasyspoon ICAP Server, Squid HTTP proxy, and Clam Antivirus) to perform the various security tasks that range from simple (such as passive content insertion) to more advanced (such as active content alteration) by modules installed on the server. After discussing the makeup of the proof of concept system we discuss our evaluation methodology for both effectiveness and performance. The effectiveness was tested using comparative analysis of groups of self-browsing …
Success Of Agile Environment In Complex Projects, Abbass Ghanbary, Julian Day
Success Of Agile Environment In Complex Projects, Abbass Ghanbary, Julian Day
Australian Information Warfare and Security Conference
This paper discusses the impact of agile methodology in complex and modular interrelated projects based on the authors’ practical experience and observations. With the advancement of Web technologies and complex computer systems, business applications are able to transcend boundaries in order to fully meet business requirements and comply with the legislation, policies and procedures. The success of software development as well as software deployment of these complex applications is dependent upon the employed methodology and project management. This is so because employed methodology plays an important position in capturing and modeling of business requirements and project management helps to ensure …
An Analytical Study Of It Security Governance And Its Adoption On Australian Organisations, Tanveer A. Zia
An Analytical Study Of It Security Governance And Its Adoption On Australian Organisations, Tanveer A. Zia
Australian Information Security Management Conference
Contemporary organisations are at infancy stages of adopting IT governance processes in Australia. Organisations who have adopted these processes underestimate the security processes within the governance framework. If the security processes are designed, they are often flawed with operational level implementation. This study investigates IT security governance broadly and in Australian organisations specifically. The objective of this study is to bring the local organisations in alignment with international standards and frameworks in terms of integration of information security, IT audits, risks and control measures. A survey of selected organisations is completed and results are presented in this paper identifying the …
Security Information Supplied By Australian Internet Service Providers, Patryk Szewczyk
Security Information Supplied By Australian Internet Service Providers, Patryk Szewczyk
Australian Information Security Management Conference
Results from previous studies indicate that numerous Internet Service Providers within Australia either have inadequately trained staff, or refuse to provide security support to end-users. This paper examines the security information supplied by Internet Service Providers on their website. Specifically content relating to securing; a wireless network, an ADSL router, and a Microsoft Windows based workstation. A further examination looked at the accuracy, currency, and accessibility of information provided. Results indicate that the information supplied by Internet Service Providers is either inadequate or may in fact further deter the end-user from appropriately securing their computer and networking devices.
The Economics Of Developing Security Embedded Software, Craig S. Wright, Tanveer A. Zia
The Economics Of Developing Security Embedded Software, Craig S. Wright, Tanveer A. Zia
Australian Information Security Management Conference
Market models for software vulnerabilities have been disparaged in the past citing how these do little to lower the risk of insecure software. In this paper we argue that the market models proposed are flawed and not the concept of a market itself. A well-defined software risk derivative market would improve the information exchange for both the software user and vendor removing the often touted imperfect information state that is said to believe the software industry. In this way, users could have a rational means of accurately judging software risks and costs and as such the vendor could optimally apply …
Anomaly Detection Over User Profiles For Intrusion Detection, Grant Pannell, Helen Ashman
Anomaly Detection Over User Profiles For Intrusion Detection, Grant Pannell, Helen Ashman
Australian Information Security Management Conference
Intrusion detection systems (IDS) have often been used to analyse network traffic to help network administrators quickly identify and respond to intrusions. These detection systems generally operate over the entire network, identifying “anomalies” atypical of the network’s normal collective user activities. We show that anomaly detection could also be host-based so that the normal usage patterns of an individual user could be profiled. This enables the detection of masquerading intruders by comparing a learned user profile against the current session’s profile. A prototype behavioural IDS applies the concept of anomaly detection to user behaviour and compares the effects of using …
Information Security Risk Assessment: Towards A Business Practice Perspective, Piya Shedden, Wally Smith, Atif Ahmad
Information Security Risk Assessment: Towards A Business Practice Perspective, Piya Shedden, Wally Smith, Atif Ahmad
Australian Information Security Management Conference
Information security risk assessments (ISRAs) are of great importance for organisations. Current ISRA methods identify an organisation’s security risks and provide a measured, analysed security risk profile of critical information assets in order to build plans to treat risk. However, despite prevalent use in organisations today, current methods adopt a limited view of information assets during risk identification. In the context of day-to-day activities, people copy, print and discuss information, leading to the ‘leakage’ of information assets. Employees will create and use unofficial assets as part of their day-to-day routines. Furthermore, employees will also possess important knowledge on how to …
Organisational Learning And Incident Response: Promoting Effective Learning Through The Incident Response Process, Piya Shedden, Atif Ahmad, A B. Ruighaver
Organisational Learning And Incident Response: Promoting Effective Learning Through The Incident Response Process, Piya Shedden, Atif Ahmad, A B. Ruighaver
Australian Information Security Management Conference
Effective response to information security incidents is a critical function of modern organisations. However, recent studies have indicated that organisations have adopted a narrow and technical view of incident response (IR), focusing on the immediate concern of detection and subsequent corrective actions. Although some reflection on the IR process may be involved, it is typically limited to technical issues and does not leverage opportunities to learn about the organisational security threat environment and to adapt incident response capabilities. Given the science of incident response is rooted in practice, it is not surprising that the same criticisms can be applied to …
Information Security Disclosure: A Victorian Case Study, Ian Rosewall, Matthew Warren
Information Security Disclosure: A Victorian Case Study, Ian Rosewall, Matthew Warren
Australian Information Security Management Conference
This paper will focus upon the impact of Generation Y and their attitudes to security. The paper will be based around discussing the findings of a recent report by the Office of Police Integrity (OPI) on “Information Security and the Victoria Police State Surveillance Unit”. Issues that will be discussed include the context of Generation Y and how they contribute to the case study, their attitudes, or their perceived attitudes to security of information. A discussion of the OPI report itself, and the issues that have arisen. A brief overview of the key findings within this report and the implications …
The Complexity Of Security Studies In Nfc Payment System, Marc Pasquet, Sylvie Gerbaix
The Complexity Of Security Studies In Nfc Payment System, Marc Pasquet, Sylvie Gerbaix
Australian Information Security Management Conference
If we compare the security problem of a face-to-face contactless card payment process with a mobile phone NFC payment process, we may easily consider that the latter is far more difficult to study. Indeed, the more partners from different organizations involved in the process there are, the more complex the studies are and, accordingly, its protection. As well as the current solutions applied to studying the electronic payment security chain (Common Criteria, ISO 27005, etc), the James Reason model has pointed out the specific risks implied by the interaction between the different links in a complex chain. His theory has …