Timing Attack Detection On Bacnet Via A Machine Learning Approach,
2015
Security Research Institute, Edith Cowan University
Timing Attack Detection On Bacnet Via A Machine Learning Approach, Michael N. Johnstone, Matthew Peacock, J I. Den Hartog
Australian Information Security Management Conference
Building Automation Systems (BAS), alternatively known as Building Management Systems (BMS), which centralise the management of building services, are often connected to corporate networks and are routinely accessed remotely for operational management and emergency purposes. The protocols used in BAS, in particular BACnet, were not designed with security as a primary requirement, thus the majority of systems operate with sub-standard or non-existent security implementations. As intrusion is thus likely easy to achieve, intrusion detection systems should be put in place to ensure they can be detected and mitigated. Existing intrusion detection systems typically deal only with known threats (signature-based approaches) …
Selection Of Penetration Testing Methodologies: A Comparison And Evaluation,
2015
Edith Cowan University
Selection Of Penetration Testing Methodologies: A Comparison And Evaluation, Aleatha Shanley, Michael N. Johnstone
Australian Information Security Management Conference
Cyber security is fast becoming a strategic priority across both governments and private organisations. With technology abundantly available, and the unbridled growth in the size and complexity of information systems, cyber criminals have a multitude of targets. Therefore, cyber security assessments are becoming common practice as concerns about information security grow. Penetration testing is one strategy used to mitigate the risk of cyber-attack. Penetration testers attempt to compromise systems using the same tools and techniques as malicious attackers thus attempting to identify vulnerabilities before an attack occurs. This research details a gap analysis of the theoretical vs. the practical classification …
Evaluating Policy Layer Security Controls For Value Realisation In Secure Systems,
2015
Auckland University of Technology
Evaluating Policy Layer Security Controls For Value Realisation In Secure Systems, Brian Cusack, Maher Al-Khazrajy
Australian Information Security Management Conference
A strategic question for any business is: What value do control frameworks give? The question concerns the costs associated with implementing and maintaining control frameworks compared with the benefits gained. Each control framework contains many controls that may or may not benefit a situation and this research is aimed at testing different selections and combinations of controls to forecast probable impacts on business outcomes. The scope of the research is limited to a representative set of security controls and the lesser question: What are the criteria for selecting the most effective and efficient security control configurations for best business value? …
Loyalty Cards And The Problem Of Captcha: 2nd Tier Security And Usability Issues For Senior Citizens,
2015
Security Research Institute, Edith Cowan University
Loyalty Cards And The Problem Of Captcha: 2nd Tier Security And Usability Issues For Senior Citizens, David M. Cook, Apoorv Kumar, Charwina Unmar-Satiah
Australian Information Security Management Conference
Information Security often works in antipathy to access and useability in communities of older citizens. Whilst security features are required to prevent the disclosure of information, some security tools have a deleterious effect upon users, resulting in insecure practices. Security becomes unfit for purpose where users prefer to abandon applications and online benefits in favour of non-digital authentication and verification requirements. For some, the ability to read letters and symbols from a distorted image is a decidedly more difficult task than for others, and the resulting level of security from CAPTCHA tests is not consistent from person to person. This …
A Hybrid Feature Selection For Network Intrusion Detection Systems: Central Points,
2015
University of New South Wales
A Hybrid Feature Selection For Network Intrusion Detection Systems: Central Points, Nour Moustafa, Jill Slay
Australian Information Warfare and Security Conference
Network intrusion detection systems are an active area of research to identify threats that face computer networks. Network packets comprise of high dimensions which require huge effort to be examined effectively. As these dimensions contain some irrelevant features, they cause a high False Alarm Rate (FAR). In this paper, we propose a hybrid method as a feature selection, based on the central points of attribute values and an Association Rule Mining algorithm to decrease the FAR. This algorithm is designed to be implemented in a short processing time, due to its dependency on the central points of feature values with …
Is The Internet The Main Medium Of Transmitting Terrorism?,
2015
Central Queensland University
Is The Internet The Main Medium Of Transmitting Terrorism?, Hatem El Zein
Australian Information Warfare and Security Conference
The influx of virtual media platforms has allowed extremists and terrorists to transmit their messages to wider audiences without passing through a gatekeeper or being a subject to editorial policies existed in traditional media outlets. Thus, extremists and terrorists exploit virtual media platforms to report their actions; propagate their ideologies and ultimately to boost their objectives, because these mediums enabled them to have control over time and space. As a result, some governments work to deprive extremists and terrorists from this 'oxygen' through monitoring the cyberspace to block the suspected virtual media platforms. The reactions of some governments to face …
Developing And Verifying A Set Of Principles For The Cyber Security Of The Critical Infrastructures Of Turkey,
2015
Franklin University
Developing And Verifying A Set Of Principles For The Cyber Security Of The Critical Infrastructures Of Turkey, Bilge Karabacak
All Faculty and Staff Scholarship
Critical infrastructures are vital assets for countries as a harm given to critical infrastructures may affect public order, economic welfare and/or national security. Today, cyber systems are extensively used to control and monitor critical infrastructures. Therefore, cyber threats have the potential to adversely affect the order of societies and countries. In this PhD study, the root causes of the susceptibility of the critical infrastructures of Turkey to the cyber threats are identified by analyzing the qualitative data with the grounded theory method. The extracted root causes are verified by two experts. The set of principles for the cyber security of …
Cyberspace: A Venue For Terrorism,
2015
Embry-Riddle Aeronautical University
Cyberspace: A Venue For Terrorism, David Bieda, Leila Halawi
Publications
This paper discusses how cyberspace has become a venue for terrorists groups for recruiting and proliferating propaganda and terrorism. Moreover, this study explores how the low cost Internet infrastructure and social media sites (such as Facebook, Twitter, and YouTube) have contributed to their networking and operations due to the convenience, in terms of availability, accessibility, message redundancy, ease of use, and the inability to censor content. Concepts such as cyber-weapons, cyber-attacks, cyber-war, and cyber-terrorism are presented and explored to assess how terrorist groups are exploiting cyberspace.
Examining The Security Awareness, Information Privacy, And The Security Behaviors Of Home Computer Users,
2015
Nova Southeastern University
Examining The Security Awareness, Information Privacy, And The Security Behaviors Of Home Computer Users, Keith Edwards
CCAC Theses and Dissertations
Attacks on computer systems continue to be a problem. The majority of the attacks target home computer users. To help mitigate the attacks some companies provide security awareness training to their employees. However, not all people work for a company that provides security awareness training and typically, home computer users do not have the incentive to take security awareness training on their own. Research in security awareness and security behavior has produced conflicting results. Therefore, it is not clear, how security aware home computer users are or to what extent security awareness affects the security behavior of home computer users. …
Virtue Ethics: Examining Influences On The Ethical Commitment Of Information System Workers In Trusted Positions,
2015
Nova Southeastern University
Virtue Ethics: Examining Influences On The Ethical Commitment Of Information System Workers In Trusted Positions, John Max Gray
CCAC Theses and Dissertations
Despite an abundance of research on the problem of insider threats, only limited success has been achieved in preventing trusted insiders from committing security violations. Virtue ethics may be an approach that can be utilized to address this issue. Human factors such as moral considerations impact Information System (IS) design, use, and security; consequently they affect the security posture and culture of an organization. Virtue ethics based concepts have the potential to influence and align the moral values and behavior of information systems workers with those of an organization in order to provide increased protection of IS assets. An individual’s …
A Survey Of Botnet Detection Techniques By Command And Control Infrastructure,
2015
Norwich University
A Survey Of Botnet Detection Techniques By Command And Control Infrastructure, Thomas S. Hyslip, Jason M. Pittman
Journal of Digital Forensics, Security and Law
Botnets have evolved to become one of the most serious threats to the Internet and there is substantial research on both botnets and botnet detection techniques. This survey reviewed the history of botnets and botnet detection techniques. The survey showed traditional botnet detection techniques rely on passive techniques, primarily honeypots, and that honeypots are not effective at detecting peer-to-peer and other decentralized botnets. Furthermore, the detection techniques aimed at decentralized and peer-to-peer botnets focus on detecting communications between the infected bots. Recent research has shown hierarchical clustering of flow data and machine learning are effective techniques for detecting botnet peer-to-peer …
Data Loss Prevention Management And Control: Inside Activity Incident Monitoring, Identification, And Tracking In Healthcare Enterprise Environments,
2015
Purdue University Calumet
Data Loss Prevention Management And Control: Inside Activity Incident Monitoring, Identification, And Tracking In Healthcare Enterprise Environments, Manghui Tu, Kimberly Spoa-Harty, Liangliang Xiao
Journal of Digital Forensics, Security and Law
As healthcare data are pushed online, consumers have raised big concerns on the breach of their personal information. Law and regulations have placed businesses and public organizations under obligations to take actions to prevent data breach. Among various threats, insider threats have been identified to be a major threat on data loss. Thus, effective mechanisms to control insider threats on data loss are urgently needed. The objective of this research is to address data loss prevention challenges in healthcare enterprise environment. First, a novel approach is provided to model internal threat, specifically inside activities. With inside activities modeling, data …
To License Or Not To License Reexamined: An Updated Report On State Statutes Regarding Private Investigators And Digital Examiners,
2015
Roger Williams University
To License Or Not To License Reexamined: An Updated Report On State Statutes Regarding Private Investigators And Digital Examiners, Thomas Lonardo, Alan Rea, Doug White
Journal of Digital Forensics, Security and Law
In this update to the 2012 year's study, the authors examine statutes that regulate, license, and enforce investigative functions in each US state. As before, the authors find that very few state statutes explicitly differentiate between Private Investigators and Digital Examiners. There is a small trend in which some states are changing definitions or moving to exempt DE from PI licensing requirements. However, we look at some additional information in terms of practicing attorney exemptions that may cloud the licensing waters.
As with the previous research studies (Lonardo et al., 2008, 2009, 2012) the authors contacted all state regulatory agencies …
On The Network Performance Of Digital Evidence Acquisition Of Small Scale Devices Over Public Networks,
2015
Stockholm University
On The Network Performance Of Digital Evidence Acquisition Of Small Scale Devices Over Public Networks, Irvin Homem, Spyridon Dosis
Journal of Digital Forensics, Security and Law
While cybercrime proliferates – becoming more complex and surreptitious on the Internet – the tools and techniques used in performing digital investigations are still largely lagging behind, effectively slowing down law enforcement agencies at large. Real-time remote acquisition of digital evidence over the Internet is still an elusive ideal in the combat against cybercrime. In this paper we briefly describe the architecture of a comprehensive proactive digital investigation system that is termed as the Live Evidence Information Aggregator (LEIA). This system aims at collecting digital evidence from potentially any device in real time over the Internet. Particular focus is made …
A 3-D Stability Analysis Of Lee Harvey Oswald In The Backyard Photo,
2015
Dartmouth College
A 3-D Stability Analysis Of Lee Harvey Oswald In The Backyard Photo, Srivamshi Pittala, Emily Whiting, Hany Farid
Journal of Digital Forensics, Security and Law
Fifty years have passed since the assassination of U.S. President Kennedy. Despite the long passage of time, it is still argued that the famous backyard photo of Oswald, holding the same type of rifle used to assassinate the President, is a fake. These claims include, among others, that Oswald’s pose in the photo is physically implausible. We describe a detailed 3-D stability analysis to determine if this claim is warranted.
Computer Forensic Projects For Accountants,
2015
University of South Florida, St. Petersburg
Computer Forensic Projects For Accountants, Grover S. Kearns
Journal of Digital Forensics, Security and Law
Digital attacks on organizations are becoming more common and more sophisticated. Firms are interested in providing data security and having an effective means to respond to attacks. Accountants possess important investigative and analytical skills that serve to uncover fraud in forensic investigations. Some accounting students take courses in forensic accounting but few colleges offer a course in computer forensics for accountants. Educators wishing to develop such a course may find developing the curriculum daunting. A major element of such a course is the use of forensic software. This paper argues the importance of computer forensics to accounting students and offers …
Identification And Exploitation Of Inadvertent Spectral Artifacts In Digital Audio,
2015
The MITRE Corporation
Identification And Exploitation Of Inadvertent Spectral Artifacts In Digital Audio, N. C. Donnangelo, W. S. Kuklinski, R. Szabo, R. A. Coury, G. R. Hamshar
Journal of Digital Forensics, Security and Law
We show that modulation products from local oscillators in a variety of commercial camcorders are coupled into the recorded audio track, creating narrow band time invariant spectral features. These spectral features, left largely intact by transcoding, compression and other forms of audiovisual post processing, can encode characteristics of specific camcorders used to capture the audio files, including the make and model. Using data sets both downloaded from YouTube and collected under controlled laboratory conditions we demonstrate an average probability of detection (Pd) approaching 0.95 for identification of a specific camcorder in a population of thousands of similar recordings, with a …
Table Of Contents,
2015
Embry-Riddle Aeronautical University
Table Of Contents
Journal of Digital Forensics, Security and Law
No abstract provided.
Factors Influencing Digital Forensic Investigations: Empirical Evaluation Of 12 Years Of Dubai Police Cases,
2015
University of Central Lancashire
Factors Influencing Digital Forensic Investigations: Empirical Evaluation Of 12 Years Of Dubai Police Cases, Ibtesam Alawadhi, Janet C. Read, Andrew Marrington, Virginia N. L. Franqueira
Journal of Digital Forensics, Security and Law
In Digital Forensics, the number of person-hours spent on investigation is a key factor which needs to be kept to a minimum whilst also paying close attention to the authenticity of the evidence. The literature describes challenges behind increasing person-hours and identifies several factors which contribute to this phenomenon. This paper reviews these factors and demonstrates that they do not wholly account for increases in investigation time. Using real case records from the Dubai Police, an extensive study explains the contribution of other factors to the increase in person-hours. We conclude this work by emphasizing on several factors affecting the …
Tracking And Taxonomy Of Cyberlocker Link Sharers Based On Behavior Analysis,
2015
The University of Hong Kong
Tracking And Taxonomy Of Cyberlocker Link Sharers Based On Behavior Analysis, Xiao-Xi Fan, Kam-Pui Chow
Journal of Digital Forensics, Security and Law
The growing popularity of cyberlocker service has led to significant impact on the Internet that it is considered as one of the biggest contributors to the global Internet traffic estimated to be illegally traded content. Due to the anonymity property of cyberlocker, it is difficult for investigators to track user identity directly on cyberlocker site. In order to find the potential relationships between cyberlocker users, we propose a framework to collect cyberlocker related data from public forums where cyberlocker users usually distribute cyberlocker links for others to download and identity information can be gathered easily. Different kinds of sharing behaviors …
