Information Security Commons^™

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

A 3-D Stability Analysis Of Lee Harvey Oswald In The Backyard Photo, Srivamshi Pittala, Emily Whiting, Hany Farid

Journal of Digital Forensics, Security and Law

Fifty years have passed since the assassination of U.S. President Kennedy. Despite the long passage of time, it is still argued that the famous backyard photo of Oswald, holding the same type of rifle used to assassinate the President, is a fake. These claims include, among others, that Oswald’s pose in the photo is physically implausible. We describe a detailed 3-D stability analysis to determine if this claim is warranted.

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

The Hare And The Hortoise [Sic]: The Potential Versus The Reality Of Etp Implementation, Kyaw Kyaw Htat, Patricia A. H Williams, Vincent Mccauley

Research outputs 2014 to 2021

In a health system increasingly driven by cost constraints, there is a focus on improved electronic transfer of information to support healthcare delivery. One area of healthcare that has moved more quickly than others to achieve this is prescribing in the primary care environment. Whilst the move to electronic transfer of prescriptions has reduced transcription errors, the regulatory environment persists with handwritten signatures. This constraint, whilst addressed slowly with technology solutions, needs support from legislative change. The ultimate step is to have a secure mobile model, which would support the move to a fully-electronic, paperless transaction model.

Resilient And Trustworthy Dynamic Data-Driven Application Systems (Dddas) Services For Crisis Management Environments, Youakim Badr, Salim Hariti, Youssif Al-Nashif, Erik Blasch

Electrical & Computer Engineering Faculty Publications

Future crisis management systems needresilient and trustworthy infrastructures to quickly develop reliable applications and processes, andensure end-to-end security, trust, and privacy. Due to the multiplicity and diversity of involved actors, volumes of data, and heterogeneity of shared information;crisis management systems tend to be highly vulnerable and subjectto unforeseen incidents. As a result, the dependability of crisis management systems can be at risk. This paper presents a cloud-based resilient and trustworthy infrastructure (known as rDaaS) to quickly develop secure crisis management systems. The rDaaS integrates the Dynamic Data-Driven Application Systems (DDDAS) paradigm into a service-oriented architecture over cloud technology and provides …

Judging Dread: A Quantitative Investigation Of Affect, Psychometric Dread And Risk Consequence, Melvyn Griffiths

Theses: Doctorates and Masters

Risk is generally understood as a product of the likelihood and consequence of an event. However, the way in which estimations of consequences are formed is unclear due to the complexities of human perception. In particular, the influence of Affect, defined as positive or negative qualities subjectively assigned to stimuli, may skew risk consequence judgements. Thus a clearer understanding of the role of Affect in risk consequence estimations has significant implications for risk management, risk communication and policy formulation.

In the Psychometric tradition of risk perception, Affect has become almost synonymous with the concept of Dread, despite Dread being measured …

Secure Portable Execution And Storage Environments: A Capability To Improve Security For Remote Working, Peter James

Theses: Doctorates and Masters

Remote working is a practice that provides economic benefits to both the employing organisation and the individual. However, evidence suggests that organisations implementing remote working have limited appreciation of the security risks, particularly those impacting upon the confidentiality and integrity of information and also on the integrity and availability of the remote worker’s computing environment. Other research suggests that an organisation that does appreciate these risks may veto remote working, resulting in a loss of economic benefits. With the implementation of high speed broadband, remote working is forecast to grow and therefore it is appropriate that improved approaches to managing …

Intelligent Network Intrusion Detection Using An Evolutionary Computation Approach, Samaneh Rastegari

Theses: Doctorates and Masters

With the enormous growth of users' reliance on the Internet, the need for secure and reliable computer networks also increases. Availability of effective automatic tools for carrying out different types of network attacks raises the need for effective intrusion detection systems.

Generally, a comprehensive defence mechanism consists of three phases, namely, preparation, detection and reaction. In the preparation phase, network administrators aim to find and fix security vulnerabilities (e.g., insecure protocol and vulnerable computer systems or firewalls), that can be exploited to launch attacks. Although the preparation phase increases the level of security in a network, this will never completely …

A Secure Sharing Design For Multi-Tag Rfid Authentication Protocol, Ayad Al-Adhami, Marcel Ambroze, Colin Cristopher, Ingo Stengel, Martin Tomlinson

Australian Security and Intelligence Conference

No abstract provided.

Urdu Text Steganography: Utilizing Isolated Letters, Aliya Tabassum Abbasi, Nuzhat Naqvi, Aihab Khan, Basheer Ahmad

Australian Information Security Management Conference

This paper presents an imperceptible and high capacity feature based approach which hides a secret message into Urdu text cover media by utilising all isolated letters. Existing techniques are less imperceptible and also not robust against steganalysis attacks and some of these schemes are failed to provide the better capacity rates. Previous lexical based and syntax based schemes are ineffective to provide the better capacity rate and image based approaches are not robust against format attacks. Moreover, Feature based approaches are more perceptible and thus, cannot resist against visual attacks. This paper proposes an improved algorithm that encompasses all isolated …

The Data Protection Credibility Crisis, Fred H. Cate, Christopher Kuner, Christopher Millard, Dan Jerker B. Svantesson, Orla Lynskey

Articles by Maurer Faculty

No abstract provided.

Analysis Of Password Cracking Methods & Applications, John A. Chester

Williams Honors College, Honors Research Projects

This project examines the nature of password cracking and modern applications. Several applications for different platforms are studied. Different methods of cracking are explained, including dictionary attack, brute force, and rainbow tables. Password cracking across different mediums is examined. Hashing and how it affects password cracking is discussed. An implementation of two hash-based password cracking algorithms is developed, along with experimental results of their efficiency.

Project Maelstrom: Forensic Analysis Of The Bittorrent-Powered Browser, Jason Farina, M-Tahar Kechadi, Mark Scanlon

Journal of Digital Forensics, Security and Law

In April 2015, BitTorrent Inc. released their distributed peer-to-peer powered browser, Project Maelstrom, into public beta. The browser facilitates a new alternative website distribution paradigm to the traditional HTTP-based, client-server model. This decentralised web is powered by each of the visitors accessing each Maelstrom hosted website. Each user shares their copy of the website;s source code and multimedia content with new visitors. As a result, a Maelstrom hosted website cannot be taken offline by law enforcement or any other parties. Due to this open distribution model, a number of interesting censorship, security and privacy considerations are raised. This paper explores …

Towards A Standardised Strategy To Collect And Distribute Application Software Artifacts, Thomas Laurenson, Stephen Macdonell, Hank Wolfe

Australian Digital Forensics Conference

Reference sets contain known content that are used to identify relevant or filter irrelevant content. Application profiles are a type of reference set that contain digital artifacts associated with application software. An application profile can be compared against a target data set to identify relevant evidence of application usage in a variety of investigation scenarios. The research objective is to design and implement a standardised strategy to collect and distribute application software artifacts using application profiles. An advanced technique for creating application profiles was designed using a formalised differential analysis strategy. The design was implemented in a live differential forensic …

Towards Dynamic Adaption Of User's Organisational Information Security Behaviour, Mutlaq Alotaibi, Steven Furnell, Nathan Clarke

Australian Information Security Management Conference

The weakest link in the field of information security that has been identified in the literature is the organisation’s employees. Information security policy compliance is one of the main challenges facing organisations today. Although implementing technical and procedural measures clearly helps to improve an organisation's information security, the human factor or the employees' compliance with these measures is the key to success. However, organisations are now having some issues regarding the extent of employee adherence to policy. The problem of employees being unaware or ignorant of their responsibilities in relation to information security is still an open issue. The proposed …

Timing Attack Detection On Bacnet Via A Machine Learning Approach, Michael N. Johnstone, Matthew Peacock, J I. Den Hartog

Australian Information Security Management Conference

Building Automation Systems (BAS), alternatively known as Building Management Systems (BMS), which centralise the management of building services, are often connected to corporate networks and are routinely accessed remotely for operational management and emergency purposes. The protocols used in BAS, in particular BACnet, were not designed with security as a primary requirement, thus the majority of systems operate with sub-standard or non-existent security implementations. As intrusion is thus likely easy to achieve, intrusion detection systems should be put in place to ensure they can be detected and mitigated. Existing intrusion detection systems typically deal only with known threats (signature-based approaches) …

Selection Of Penetration Testing Methodologies: A Comparison And Evaluation, Aleatha Shanley, Michael N. Johnstone

Australian Information Security Management Conference

Cyber security is fast becoming a strategic priority across both governments and private organisations. With technology abundantly available, and the unbridled growth in the size and complexity of information systems, cyber criminals have a multitude of targets. Therefore, cyber security assessments are becoming common practice as concerns about information security grow. Penetration testing is one strategy used to mitigate the risk of cyber-attack. Penetration testers attempt to compromise systems using the same tools and techniques as malicious attackers thus attempting to identify vulnerabilities before an attack occurs. This research details a gap analysis of the theoretical vs. the practical classification …

Evaluating Policy Layer Security Controls For Value Realisation In Secure Systems, Brian Cusack, Maher Al-Khazrajy

Australian Information Security Management Conference

A strategic question for any business is: What value do control frameworks give? The question concerns the costs associated with implementing and maintaining control frameworks compared with the benefits gained. Each control framework contains many controls that may or may not benefit a situation and this research is aimed at testing different selections and combinations of controls to forecast probable impacts on business outcomes. The scope of the research is limited to a representative set of security controls and the lesser question: What are the criteria for selecting the most effective and efficient security control configurations for best business value? …

Loyalty Cards And The Problem Of Captcha: 2nd Tier Security And Usability Issues For Senior Citizens, David M. Cook, Apoorv Kumar, Charwina Unmar-Satiah

Australian Information Security Management Conference

Information Security often works in antipathy to access and useability in communities of older citizens. Whilst security features are required to prevent the disclosure of information, some security tools have a deleterious effect upon users, resulting in insecure practices. Security becomes unfit for purpose where users prefer to abandon applications and online benefits in favour of non-digital authentication and verification requirements. For some, the ability to read letters and symbols from a distorted image is a decidedly more difficult task than for others, and the resulting level of security from CAPTCHA tests is not consistent from person to person. This …

A Hybrid Feature Selection For Network Intrusion Detection Systems: Central Points, Nour Moustafa, Jill Slay

Australian Information Warfare and Security Conference

Network intrusion detection systems are an active area of research to identify threats that face computer networks. Network packets comprise of high dimensions which require huge effort to be examined effectively. As these dimensions contain some irrelevant features, they cause a high False Alarm Rate (FAR). In this paper, we propose a hybrid method as a feature selection, based on the central points of attribute values and an Association Rule Mining algorithm to decrease the FAR. This algorithm is designed to be implemented in a short processing time, due to its dependency on the central points of feature values with …

Is The Internet The Main Medium Of Transmitting Terrorism?, Hatem El Zein

Australian Information Warfare and Security Conference

The influx of virtual media platforms has allowed extremists and terrorists to transmit their messages to wider audiences without passing through a gatekeeper or being a subject to editorial policies existed in traditional media outlets. Thus, extremists and terrorists exploit virtual media platforms to report their actions; propagate their ideologies and ultimately to boost their objectives, because these mediums enabled them to have control over time and space. As a result, some governments work to deprive extremists and terrorists from this 'oxygen' through monitoring the cyberspace to block the suspected virtual media platforms. The reactions of some governments to face …

Developing And Verifying A Set Of Principles For The Cyber Security Of The Critical Infrastructures Of Turkey, Bilge Karabacak

All Faculty and Staff Scholarship

Critical infrastructures are vital assets for countries as a harm given to critical infrastructures may affect public order, economic welfare and/or national security. Today, cyber systems are extensively used to control and monitor critical infrastructures. Therefore, cyber threats have the potential to adversely affect the order of societies and countries. In this PhD study, the root causes of the susceptibility of the critical infrastructures of Turkey to the cyber threats are identified by analyzing the qualitative data with the grounded theory method. The extracted root causes are verified by two experts. The set of principles for the cyber security of …

Framing The Question, "Who Governs The Internet?", Robert J. Domanski

Publications and Research

There remains a widespread perception among both the public and elements of academia that the Internet is “ungovernable”. However, this idea, as well as the notion that the Internet has become some type of cyber-libertarian utopia, is wholly inaccurate. Governments may certainly encounter tremendous difficulty in attempting to regulate the Internet, but numerous types of authority have nevertheless become pervasive. So who, then, governs the Internet? This book will contend that the Internet is, in fact, being governed, that it is being governed by specific and identifiable networks of policy actors, and that an argument can be made as to …

Integrating Security Into The Undergraduate Software Engineering Curriculum, Robert Evans

UNF Graduate Theses and Dissertations

This research included a thorough examination of the existing software assurance or what is commonly called software security knowledge, methodologies and what information security technologies is currently being recommended by the information technology community. Finally it is demonstrated how this security knowledge could be incorporated into the curriculum for undergraduate software engineering.

A Comparison Of Cloud Computing Database Security Algorithms, Joseph A. Hoeppner

UNF Graduate Theses and Dissertations

The cloud database is a relatively new type of distributed database that allows companies and individuals to purchase computing time and memory from a vendor. This allows a user to only pay for the resources they use, which saves them both time and money. While the cloud in general can solve problems that have previously been too costly or time-intensive, it also opens the door to new security problems because of its distributed nature. Several approaches have been proposed to increase the security of cloud databases, though each seems to fall short in one area or another.

This thesis presents …

Identification And Exploitation Of Inadvertent Spectral Artifacts In Digital Audio, N. C. Donnangelo, W. S. Kuklinski, R. Szabo, R. A. Coury, G. R. Hamshar

Journal of Digital Forensics, Security and Law

We show that modulation products from local oscillators in a variety of commercial camcorders are coupled into the recorded audio track, creating narrow band time invariant spectral features. These spectral features, left largely intact by transcoding, compression and other forms of audiovisual post processing, can encode characteristics of specific camcorders used to capture the audio files, including the make and model. Using data sets both downloaded from YouTube and collected under controlled laboratory conditions we demonstrate an average probability of detection (Pd) approaching 0.95 for identification of a specific camcorder in a population of thousands of similar recordings, with a …

Computer Forensic Projects For Accountants, Grover S. Kearns

Journal of Digital Forensics, Security and Law

Digital attacks on organizations are becoming more common and more sophisticated. Firms are interested in providing data security and having an effective means to respond to attacks. Accountants possess important investigative and analytical skills that serve to uncover fraud in forensic investigations. Some accounting students take courses in forensic accounting but few colleges offer a course in computer forensics for accountants. Educators wishing to develop such a course may find developing the curriculum daunting. A major element of such a course is the use of forensic software. This paper argues the importance of computer forensics to accounting students and offers …

Data Loss Prevention Management And Control: Inside Activity Incident Monitoring, Identification, And Tracking In Healthcare Enterprise Environments, Manghui Tu, Kimberly Spoa-Harty, Liangliang Xiao

Journal of Digital Forensics, Security and Law

As healthcare data are pushed online, consumers have raised big concerns on the breach of their personal information. Law and regulations have placed businesses and public organizations under obligations to take actions to prevent data breach. Among various threats, insider threats have been identified to be a major threat on data loss. Thus, effective mechanisms to control insider threats on data loss are urgently needed. The objective of this research is to address data loss prevention challenges in healthcare enterprise environment. First, a novel approach is provided to model internal threat, specifically inside activities. With inside activities modeling, data …

Rules Of Professional Responsibility In Digital Forensics: A Comparative Analysis, Filipo Sharevski

Journal of Digital Forensics, Security and Law

The consolidation of the rules of professional responsibility as recommended by the Committee on Identifying the Needs of Forensic Sciences Community (2009) accents the establishment of an uniform code of ethics emphasizing the importance of enforceability in strengthening the role the forensic science plays within the criminal justice system. Equally pertinent for the domain of digital forensics, this imperative entails a research commitment in comparing and contrasting the respective codes of ethics to illustrate their “variety, specificity and enforceability” in order to inform the discussion on the regulative aspects of the digital forensic discipline. Accordingly, this paper reviews the professional …

On The Network Performance Of Digital Evidence Acquisition Of Small Scale Devices Over Public Networks, Irvin Homem, Spyridon Dosis

Journal of Digital Forensics, Security and Law

While cybercrime proliferates – becoming more complex and surreptitious on the Internet – the tools and techniques used in performing digital investigations are still largely lagging behind, effectively slowing down law enforcement agencies at large. Real-time remote acquisition of digital evidence over the Internet is still an elusive ideal in the combat against cybercrime. In this paper we briefly describe the architecture of a comprehensive proactive digital investigation system that is termed as the Live Evidence Information Aggregator (LEIA). This system aims at collecting digital evidence from potentially any device in real time over the Internet. Particular focus is made …