Pendekatan konstruktif dalam inovasi pengajaran dan pembelajaran Bahasa Melayu di Kolej Vokasional

Pendekatan konstruktif adalah pendekatan pengajaran dan pembelajaran yang berpusatkan pelajar manakala inovasi pengajaran pula dikaitkan dengan kaedah pengajaran yang terbaru demi mengukuhkan pemahaman pelajar. Pembelajaran berasaskan pendekatan konstruktif merupakan elemen yang penting dan perlu difahami oleh guru-guru bagi memantapkan proses pengajaran dan pembelajaran sesuai dengan peredaran masa dan menjayakan proses tranformasi pendidikan negara. Objektif kajian ini dijalankan untuk mengenal pasti pemahaman guru-guru bahasa Melayu berkaitan inovasi, mengenal pasti perbezaan yang wujud antara guru lelaki dan guru perempuan dalam mengamalkan inovasi, pengkaji juga melihat adakah wujud perbezaan antara guru baru dan guru yang sudah berpengalaman dalam aspek mengaplikasikan inovasi serta mengenal pasti kekangan-kekangan yang dialami oleh para guru untuk mengaplikasikan inovasi di sekolah. Seramai 63 orang guru bahasa Melayu dari lapan buah kolej vokasional telah dipilih sebagai responden dalam kajian ini. Data dianalisis menggunakan perisian Winsteps 3.69.1.11 dengan pendekatan Model Pengukuran Rasch. Hasil analisis menunjukkan bahawa guru�guru bahasa Melayu memahami kepentingan inovasi dalam pengajaran dan pembelajaran. Hasil kajian juga menunjukkan guru-guru perempuan lebih banyak menerapkan unsur inovasi dalam pengajaran berbanding guru lelaki. Walaupun begitu, aspek pengalaman tidak menunjukkan perbezaan dari segi pengamalan inovasi sama ada guru baru ataupun guru yang sudah berpengalaman. Pengkaji juga mengenal pasti beberapa kekangan yang dialami oleh guru-guru untuk mengamalkan inovasi ini. Sebagai langkah untuk menangani masalah berkenaan, beberapa cadangan telah dikemukakan oleh pengkaji bagi memastikan guru-guru dapat merealisasikan proses pengajaran berkesan dengan penerapan inovasi mengikut model pendekatan konstruktif. Pengkaji berharap, kajian ini dapat dijadikan sebagai satu panduan kepada pelaksana kurikulum bagi memastikan budaya inovasi sentiasa menjadi amalan dalam kalangan guru demi mengangkat profesionalisme guru di Malaysia

Mobile commerce (mCommerce) security. An appraisal of current issues and trends

Millions of data capable mobile devices are currently in use around the world enabled by the growing acceptance of Internet over wireless networks. However, security mechanisms still remain nascent. Security plays a crucial role in facilitating the level of trust users place on mobile devices and applications. To effectively diffuse the mobile devices in the marketplace, sufficient levels of trust has to be established in the underlying security of mobile devices and applications. This paper is an appraisal of recent issues and emerging trends regarding mobile security, within the context of conducting mobile commerce via mobile networks by individual consumers and businesses.<br /

Mobile Identity, Credential, and Access Management Framework

Organizations today gather unprecedented quantities of data from their operations. This data is coming from transactions made by a person or from a connected system/application. From personal devices to industry including government, the internet has become the primary means of modern communication, further increasing the need for a method to track and secure these devices. Protecting the integrity of connected devices collecting data is critical to ensure the trustworthiness of the system. An organization must not only know the identity of the users on their networks and have the capability of tracing the actions performed by a user but they must trust the system providing them with this knowledge. This increase in the pace of usage of personal devices along with a lack of trust in the internet has driven demand for trusted digital identities. As the world becomes increasingly mobile with the number of smart phone users growing annually and the mobile web flourishing, it is critical to implement strong security on mobile devices. To manage the vast number of devices and feel confident that a machine’s identity is verifiable, companies need to deploy digital credentialing systems with a strong root of trust. As passwords are not a secure method of authentication, mobile devices and other forms of IoT require a means of two-factor authentication that meets NIST standards. Traditionally, this has been done with Public Key Infrastructure (PKI) through the use of a smart card. Blockchain technologies combined with PKI can be utilized in such a way as to provide an identity and access management solution for the internet of things (IoT). Improvements to the security of Radio Frequency Identification (RFID) technology and various implementations of blockchain make viable options for managing the identity and access of IoT devices. When PKI first began over two decades ago, it required the use of a smart card with a set of credentials known as the personal identity verification (PIV) card. The PIV card (something you have) along with a personal identification number (PIN) (something you know) were used to implement two-factor authentication. Over time the use of the PIV cards has proven challenging as mobile devices lack the integrated smart card readers found in laptop and desktop computers. Near Field Communication (NFC) capability in most smart phones and mobile devices provides a mechanism to allow a PIV card to be read by a mobile device. In addition, the existing PKI system must be updated to meet the demands of a mobile focused internet. Blockchain technology is the key to modernizing PKI. Together, blockchain-based PKI and NFC will provide an IoT solution that will allow industry, government, and individuals a foundation of trust in the world wide web that is lacking today

Security validation of smartcard: MCOS

The National Fuel subsidy system planning in Malaysia should it persist would have elevated the Multi-purpose of MyKad. Malaysian government is planning for a new MyID system that can retrieve governmental related documents when dealing with 760 governments and agencies nationwide (The Star, 2010). This move will leverage the existing infrastructure of MyKad. The wider usage of MyKad may raise public concern regarding its security. Thus, there is a need for assessing the security of MyKad by an independent third party.This paper will first discuss vulnerability of smartcard by using the attack potential model (CCDB, 2008), and then the appropriateness of the current methods and tools to test the security of smartcard will be investigated.The study concludes that there is no yet a standard of security testing tool imposed on smartcard in Malaysia.The study promotes the developing of security testing tool for MyKad

RSA Keys Quality in a Real-world Organizational Certificate Dataset: a Practical Outlook

This research investigates the intricacies of X.509 certificates within a comprehensive corporate infrastructure. Spanning over two decades, the examined enterprise has heavily depended on its internal certificate authority and Public Key Infrastructure (PKI) to uphold its data and systems security. With the broad application of these certificates, from personal identification on smart cards to device and workstation authentication via Trusted Platform Modules (TPM), our study seeks to address a pertinent question on how prevalent are weak RSA keys within such a vast internal certificate repository. Previous research focused primarily on key sets publicly accessible from TLS and SSH servers or PGP key repositories. On the contrary, our investigation provides insights into the private domain of an enterprise, introducing new dimensions to this problem. Among our considerations are the trustworthiness of hardware and software solutions in generating keys and the consequential implications of identified vulnerabilities on organizational risk management. The obtained results can contribute to enhancing security strategies in enterprises

SMART CARD CONCEPT OF TWO-FACTOR USER AUTHENTICATION AND DATA ENCRYPTION WITHIN A WINDOWS DOMAIN

Smart cards play an important role in information, financial and mobile industry. In information industry, smart cards are used as safety element within variety of services such as data protection, user identification or providing secure communication over insecure communication environment. In this paper, network infrastructure is created, consisting of server, switch, desktop computer, laptop and router that is assigned by the ISP. Using a blank smart card and reader assigned by Financijska agencija – FINA (eng. Financial agency) and using ActiveClient software, we demonstrate user authentication within domain, data encryption by using Encryption File System (EFS) and connection to internal network over Virtual Private Network (VPN)

SECURING CLOUD COMPUTING SERVICES USING STRONG USER AUTHENTICATION WITH LOCAL CERTIFICATION AUTHORITY

Cloud computing technology provides services, computing, and storage for users over internet. This new technology allows companies to reduce hardware and software investments, users can collaborate easily with others everywhere in the world. However, security is a serious concern for cloud users. Strong user authentication is required for cloud computing in order to restrict illegal access to cloud services. In this regard, this paper proposes a strong user authentication based on digital certificates for cloud computing, users are authenticated using private public key infrastructure (PKI). The proposed method provides identity control, mutual authentication, session key establishment between the users and the cloud server. Moreover, our approach doesn’t require any investment in subscription or purchasing commercial certificates for an enterprise with worldwide branches

A security payment model for financial payment using mykad

The Malaysian Government has created smart national identity card named MyKad for every citizen aged 12 and above since September, 2001. In the following year, the National Registration Department of Malaysia (JPN) has embedded the latest application of MyKad, which is known as Public Key Infrastructure (PKI). It allows secure electronic transactions over the Internet. The electronic transactions include online submission of tax returns, secure email and e-commerce. In parallel with the emergence of e-commerce payment system, a new MyKad Payment Model (MPM) is proposed in order to introduce to the public another function of MyKad that is not only for identification purposes, but also in e-commerce transactions. However, to make this payment model accepted by the public, the focus should be made on two issues; trust/security issue and performance issue. A system with security technique named Arbitrary Random Security Algorithm (ARSA) and a one-to-one multithreading model need to be developed in order to accelerate the authentication response time of MPM. ARSA will automatically change its security algorithm based on times and attacks. If there is no attack or intrusion detected, MPM will wait for the scheduled switching within 30 minutes. However, if attack or intrusion is detected in less than 30 minutes, ARSA will automatically change the security algorithm to a new one. The evaluation of the MPM performance is measured with HP LoadRunner testing tools from which it is found that the response time of MPM with multithreading is better compared to the single thread model and credit card authorisation system. Moreover, the development of ARSA makes this model more secure and safer for the customers

Using quantum key distribution for cryptographic purposes: a survey

The appealing feature of quantum key distribution (QKD), from a cryptographic viewpoint, is the ability to prove the information-theoretic security (ITS) of the established keys. As a key establishment primitive, QKD however does not provide a standalone security service in its own: the secret keys established by QKD are in general then used by a subsequent cryptographic applications for which the requirements, the context of use and the security properties can vary. It is therefore important, in the perspective of integrating QKD in security infrastructures, to analyze how QKD can be combined with other cryptographic primitives. The purpose of this survey article, which is mostly centered on European research results, is to contribute to such an analysis. We first review and compare the properties of the existing key establishment techniques, QKD being one of them. We then study more specifically two generic scenarios related to the practical use of QKD in cryptographic infrastructures: 1) using QKD as a key renewal technique for a symmetric cipher over a point-to-point link; 2) using QKD in a network containing many users with the objective of offering any-to-any key establishment service. We discuss the constraints as well as the potential interest of using QKD in these contexts. We finally give an overview of challenges relative to the development of QKD technology that also constitute potential avenues for cryptographic research.Comment: Revised version of the SECOQC White Paper. Published in the special issue on QKD of TCS, Theoretical Computer Science (2014), pp. 62-8

Securing Multi-Application Smart Cards by Security-by-Contract

La tecnología de Java Card ha evolucionado hasta el punto de permitir la ejecución de servidores y clientes Web en una tarjeta inteligente. Sin embargo, desarrollos concretos de tarjetas inteligentes multiaplicación no son aún muy corrientes dado el modelo de negocio de descarga asíncrona y actualización de aplicaciones por diferentes partes que requiere que el control de las interacciones entre las aplicaciones sea hecho después de la expedición de la tarjeta. Los modelos y técnicas de seguridad actuales no soportan dicho tipo de evolución en la tartjeta. Un enfoque prometedor para resolver este problema parece ser la idea de Seguridad-mediante-Contrato (SxC). SxC es un entorno en el que se hace obligatorio que cualquier modificación de una aplicación tras la expedición de la tarjeta traiga consigo una especificación de su comportamiento en lo que concierne a seguridad, llamado contrato. Este se debe ajustar a la política de seguridad de la tarjeta multiaplicación. A causa de los recursos limitados de estos dispositivos, el enfoque de SxC puede ser aplicado a diferentes niveles de abstracción, según un jerarquía de modelos la cual proporciona beneficios en términos de complejidad computacional o expresividad del lenguaje. El nivel de más detalle (mayor expresividad) requiere algoritmos demasiado complejos para ser ejecutados en la tarjeta, por lo que es necesario enviar datos de forma privada a una tercera parte de confianza que será la responsable de realizar la comparación del contrato y la política de la tarjeta (proceso llamado Comparación Contrato-Política) con objeto de decidir si la modificación se ajusta a la política de seguridad o no; es decir, si el cambio es aceptable según el comportamiento esperado por la tarjeta y expresado en su política. El propósito del proyecto es desarrollar un sistema el cual resuelva el problema de externalizar el proceso de Comparación Contrato-Política a una entidad externa para tarjetas inteligentes multiaplicación de Java. Este sistema debe garantizar una comunicación segura entre la tarjeta y alguna tercera parte de confianza sobre un medio inseguro. La comunicación tiene que ser segura en términos de autenticación, integridad y confidencialidad. Lograr este objetivo requiere resolver problemas tales como la gestión de identidades y claves y el uso de funciones criptográficas para hacer segura la comunicación de datos privados almacenados en la tarjeta inteligente. Es por ello que los objetivos del proyecto son: Diseñar un sistema que resuelva el problema, implementar un prototipo que demuestre la validez del sistema y validar el prototipo y valorar su idoneidad en cuestión de espacio