Information Security Commons^™

Digital Forensics Investigative Framework For Control Rooms In Critical Infrastructure, Brian Cusack, Amr Mahmoud

Australian Digital Forensics Conference

In this paper a cyber-forensic framework with a detailed guideline for protecting control systems is developed to improve the forensic capability for big data in critical infrastructures. The main objective of creating a cyber-forensic plan is to cover the essentials of monitoring, troubleshooting, data reconstruction, recovery, and the safety of classified information. The problem to be addressed in control rooms is the diversity and quantity of data, and for investigators, bringing together the different skill groups for managing data and device diversity. This research embraces establishing of a new digital forensic model for critical infrastructures that supports digital forensic investigators …

Consortium Blockchain-Based Sift: Outsourcing Encrypted Feature Extraction In The D2d Network, Xiaoqin Feng, Jianfeng Ma, Tao Feng, Yinbin Miao, Ximeng Liu

Research Collection School Of Computing and Information Systems

Privacy-preserving outsourcing algorithms for feature extraction not only reduce users' storage and computation overhead but also preserve the image privacy. However, the existing schemes still suffer from deficiencies induced by security, applications, efficiency and storage. To solve the problems, we implement a consortium chain-based outsourcing feature extraction scheme over encrypted images by using the smart contract, distributed autonomous corporation (DAC), sharding technique, and device to device (D2D) communication, which is secure, widely applied, highly efficient, and has less storage overhead. First, the effectiveness, security, and performance of our scheme are analyzed. Then, the efficiency and storage overhead of our scheme …

Can Ego Defense Mechanism Help Explain Is Security Dysfunctional Behavior, Abhijit Chaudhury, Debasish Mallick

Information Systems and Analytics Department Faculty Conference Proceedings

IS security behavior studies are becoming popular. To date, much of the research has been based on theories such as the Theory of Planned Behavior, Technology Adoption Model, Rational Choice theory and Theory of Reasoned Action. They view users as rational individuals making conscious utilitarian decisions when there is increasing evidence that security breaches are the result of human behavior such as carelessness, malicious intent, bad habits, and hostility. We propose the ego defense mechanism model, taken from the psychoanalytical world. This model makes no assumption of rationality and has been developed to help understand the roots of dysfunctional behavior …

Developing A Cyberterrorism Policy: Incorporating Individual Values, Osama Bassam J. Rabie

Theses and Dissertations

Preventing cyberterrorism is becoming a necessity for individuals, organizations, and governments. However, current policies focus on technical and managerial aspects without asking for experts and non-experts values and preferences for preventing cyberterrorism. This study employs value focused thinking and public value forum to bare strategic measures and alternatives for complex policy decisions for preventing cyberterrorism. The strategic measures and alternatives are per socio-technical process.

Security Vulnerabilities In Android Applications, Crischell Montealegre, Charles Rubia Njuguna, Muhammad Imran Malik, Peter Hannay, Ian Noel Mcateer

Australian Information Security Management Conference

Privacy-related vulnerabilities and risks are often embedded into applications during their development, with this action being either performed out of malice or out of negligence. Moreover, the majority of the mobile applications initiate connections to websites, other apps, or services outside of its scope causing significant compromise to the oblivious user. Therefore, mobile data encryption or related data-protection controls should be taken into account during the application development phase. This paper evaluates some standard apps and their associated threats using publicly available tools and demonstrates how an ignorant user or an organisation can fall prey to such apps.

Xmpp Architecture And Security Challenges In An Iot Ecosystem, Muhammad Imran Malik, Ian Noel Mcateer, Peter Hannay, Syed Naeem Firdous, Zubair Baig

Australian Information Security Management Conference

The elusive quest for technological advancements with the aim to make human life easier has led to the development of the Internet of Things (IoT). IoT technology holds the potential to revolutionise our daily life, but not before overcoming barriers of security and data protection. IoTs’ steered a new era of free information that transformed life in ways that one could not imagine a decade ago. Hence, humans have started considering IoTs as a pervasive technology. This digital transformation does not stop here as the new wave of IoT is not about people, rather it is about intelligent connected devices. …

The Relevance Of A Good Internal Control System In A Computerised Accounting Information System, Raymond Lutui, Tau’Aho ‘Ahokovi

Australian Information Security Management Conference

Advancements in information technology (IT) have enabled companies to use computers to carry out their activities that were previously performed manually. Accounting systems that were previously performed manually can now be performed with the help of computers. With all the advantages of computerized accounting software, business owners need to realize that problems do arise for a variety of reasons. Dependence on computers sometimes leads to bigger problems. This paper, therefore provide a detail information about the concept of internal control to its relevance in a computerised accounting information. This study also considers the trend between manual and computerised accounting system. …

An Investigation Into A Denial Of Service Attack On An Ethereum Network, Richard Greene, Michael N. Johnstone

Australian Information Security Management Conference

Apart from its much-publicised use in crypto-currency, blockchain technology is used in a wide range of application areas, from diamonds to wine. The most common application of this technology is in smart contracts in supply chain management, where assurance of delivery and provenance are important. One problem for an Ethereum consortium is the potential for disruption caused by a Denial-of-Service attack across the consortium nodes. Such an attack can be launched from a single source or multiple sources to amplify the effect. This paper investigates the impact of various Denial-of-Service attacks on an Ethereum Consortium deployed on the Azure Cloud …

Mobile Device Wardriving Tools’ Comparison: Nuku’Alofa As Case Study, Raymond Lutui, ‘Osai Tete’Imoana, George Maeakafa

Australian Information Security Management Conference

This paper describes the justification for a project to assess the security status of wireless networks usage in Nuku’alofa, the CBD of Tonga, By War Driving these suburbs, actual data was gathered to indicate the security status of wireless networks and provide an understanding of the users’ level of awareness and attitudes towards wireless security. This paper also takes the opportunity to compare the performance of the War driving tools that this study employed – GMoN, SWardriving, and Wi-Fi Scan. Wireless network communication remains a challenging and critical issue. This study takes an exploratory approach in which it allows the …

Securing The Internet Of Healthcare, Michael Mattioli, Scott J. Shackelford, Steve Myers, Austin Brady, Yvette Wang, Stephanie Wong

Articles by Maurer Faculty

Cybersecurity, including the security of information technology (IT), is a critical requirement in ensuring society trusts, and therefore can benefit from, modern technology. Problematically, though, rarely a day goes by without a news story related to how critical data has been exposed, exfiltrated, or otherwise inappropriately used or accessed as a result of supply chain vulnerabilities. From the Russian government's campaign to influence the 2016 U.S. presidential election to the September 2017 Equifax breach of more than 140-million Americans' credit reports, mitigating cyber risk has become a topic of conversation in boardrooms and the White House, on Wall Street and …

The New Writs Of Assistance, Ian Samuel

Articles by Maurer Faculty

The providers of network services (and the makers of network devices) know an enormous amount about our lives. Because they do, these network intermediaries are being asked with increasing frequency to assist the government in solving crimes or gathering intelligence. Given how much they know about us, if the government can secure the assistance of these intermediaries, it will enjoy a huge increase in its theoretical capacity for surveillance—the ability to learn, in principle, almost anything about anyone. That has the potential to create serious social harm, even assuming that the government continues to adhere to ordinary democratic norms and …

An Unstoppable Force And An Immoveable Object? Eu Data Protection Law And National Security, Fred H. Cate, Christopher Kuner, Orla Lynskey, Christopher Millard, Nora Ni Loideain, Dan Jerker B. Svantesson

Articles by Maurer Faculty

No abstract provided.

Expanding The Artificial Intelligence-Data Protection Debate, Fred H. Cate, Christopher Kuner, Orla Lynskey, Christopher Millard, Nora Ni Loideain, Dan Jerker B. Svantesson

Articles by Maurer Faculty

No abstract provided.

A Value Sensitive Design Approach To Adolescent Mobile Online Safety, Arup Kumar Ghosh

Electronic Theses and Dissertations

With the rise of adolescent smartphone use, concerns about teen online safety are also on the rise. A number of parental control apps are available for mobile devices, but adoption of these apps has been markedly low. To better understand these apps, their users, and design opportunities in the space of mobile online safety for adolescents, we have conducted four studies informed by the principles of Value Sensitive Design (VSD). In Study 1 (Chapter 2), we conducted a web-based survey of 215 parents and their teens (ages 13-17) using two separate logistic regression models (parent and teen) to examine the …

Determining Vulnerability Using Attach Graphs: An Expansion Of The Current Fair Model, Beth M. Anderson

EWU Masters Thesis Collection

Factor Analysis of Information Risk (FAIR) provides a framework for measuring and understanding factors that contribute to information risk. One such factor is FAIR Vulnerability; the probability that an event involving a threat will result in a loss. An asset is vulnerable if a threat actor’s Threat Capability is higher than the Resistance Strength of the asset. In FAIR scenarios, Resistance Strength is currently estimated for entire assets, oversimplifying assets containing individual systems and the surrounding environment. This research explores enhancing estimations of FAIR Vulnerability by modeling interactions between threat actors and assets through attack graphs. By breaking down the …

Cybersecurity And The New Era Of Space Activities, David P. Fidler

Articles by Maurer Faculty

No abstract provided.

Software Safety And Security Risk Mitigation In Cyber-Physical Systems, Miklos Biro, Atif Mashkoor, Johannes Sametinger, Remzi Seker

Publications

Cyber-physical systems (CPSs) offer many opportunities but pose many challenges--especially regarding functional safety, cybersecurity, and their interplay, as well as the systems' impact on society. Consequently, new methods and techniques are needed for CPS development and assurance. This article [and issue] aims to address some of these challenges.

Determinants Of Personal Information Protection Activities In South Korea, Pilku Kang

MPA/MPP/MPFM Capstone Projects

The purpose of this paper is to investigate how people’s awareness and ways to obtain relevant materials of personal information have influenced individual’s information privacy protection activities. This study uses the data of a 2016 survey on information security published by Korea Information and Security Agency.

The dependent variables of this study are preventive measures for the security of a Personal Computer (PC) and preventive measures against personal information breach. I classify independent variables into four types. They are internet users’ perception about information privacy, such as awareness of the importance of protecting one’s personal information, and awareness of information …

Automatic Log Parser To Support Forensic Analysis, Hudan Studiawan, Ferdous Sohel, Christian Payne

Australian Digital Forensics Conference

Event log parsing is a process to split and label each field in a log entry. Existing approaches commonly use regular expressions or parsing rules to extract the fields. However, such techniques are time-consuming as a forensic investigator needs to define a new rule for each log file type. In this paper, we present a tool, namely nerlogparser, to parse the log entries automatically, where log parsing is modeled as a named entity recognition problem. We use a deep machine learning technique, specifically the bidirectional long short-term memory networks, as the underlying architecture for this purpose. Unlike existing tools, nerlogparser …

Detection Techniques In Operational Technology Infrastructure, Glenn Murray, Matthew Peacock, Priya Rabadia, Paresh Kerai

Australian Information Security Management Conference

In previous decades, cyber-attacks have not been considered a threat to critical infrastructure. However, as the Information Technology (IT) and Operational Technology (OT) domains converge, the vulnerability of OT infrastructure is being exploited. Nation-states, cyber criminals and hacktivists are moving to benefit from economic and political gains. The OT network, i.e. Industrial Control System (ICS) is referred to within OT infrastructure as Supervisory Control and Data Acquisition (SCADA). SCADA systems were introduced primarily to optimise the data transfer within OT network infrastructure. The introduction of SCADA can be traced back to the 1960’s, a time where cyber-attacks were not considered. …