Secure portable execution and storage environments: A capability to improve security for remote working

Remote working is a practice that provides economic benefits to both the employing organisation and the individual. However, evidence suggests that organisations implementing remote working have limited appreciation of the security risks, particularly those impacting upon the confidentiality and integrity of information and also on the integrity and availability of the remote worker’s computing environment. Other research suggests that an organisation that does appreciate these risks may veto remote working, resulting in a loss of economic benefits. With the implementation of high speed broadband, remote working is forecast to grow and therefore it is appropriate that improved approaches to managing security risks are researched. This research explores the use of secure portable execution and storage environments (secure PESEs) to improve information security for the remote work categories of telework, and mobile and deployed working. This thesis with publication makes an original contribution to improving remote work information security through the development of a body of knowledge (consisting of design models and design instantiations) and the assertion of a nascent design theory. The research was conducted using design science research (DSR), a paradigm where the research philosophies are grounded in design and construction. Following an assessment of both the remote work information security issues and threats, and preparation of a set of functional requirements, a secure PESE concept was defined. The concept is represented by a set of attributes that encompass the security properties of preserving the confidentiality, integrity and availability of the computing environment and data. A computing environment that conforms to the concept is considered to be a secure PESE, the implementation of which consists of a highly portable device utilising secure storage and an up-loadable (on to a PC) secure execution environment. The secure storage and execution environment combine to address the information security risks in the remote work location. A research gap was identified as no existing ‘secure PESE like’ device fully conformed to the concept, enabling a research problem and objectives to be defined. Novel secure storage and execution environments were developed and used to construct a secure PESE suitable for commercial remote work and a high assurance secure PESE suitable for security critical remote work. The commercial secure PESE was trialled with an existing telework team looking to improve security and the high assurance secure PESE was trialled within an organisation that had previously vetoed remote working due to the sensitivity of the data it processed. An evaluation of the research findings found that the objectives had been satisfied. Using DSR evaluation frameworks it was determined that the body of knowledge had improved an area of study with sufficient evidence generated to assert a nascent design theory for secure PESEs. The thesis highlights the limitations of the research while opportunities for future work are also identified. This thesis presents ten published papers coupled with additional doctoral research (that was not published) which postulates the research argument that ‘secure PESEs can be used to manage information security risks within the remote work environment’

An examination of the Asus WL-HDD 2.5 as a nepenthes malware collector

The Linksys WRT54g has been used as a host for network forensics tools for instance Snort for a long period of time. Whilst large corporations are already utilising network forensic tools, this paper demonstrates that it is quite feasible for a non-security specialist to track and capture malicious network traffic. This paper introduces the Asus Wireless Hard disk as a replacement for the popular Linksys WRT54g. Firstly, the Linksys router will be introduced detailing some of the research that was undertaken on the device over the years amongst the security community. It then briefly discusses malicious software and the impact this may have for a home user. The paper then outlines the trivial steps in setting up Nepenthes 0.1.7 (a malware collector) for the Asus WL-HDD 2.5 according to the Nepenthes and tests the feasibility of running the malware collector on the selected device. The paper then concludes on discussing the limitations of the device when attempting to execute Nepenthes

Sixth Goddard Conference on Mass Storage Systems and Technologies Held in Cooperation with the Fifteenth IEEE Symposium on Mass Storage Systems

This document contains copies of those technical papers received in time for publication prior to the Sixth Goddard Conference on Mass Storage Systems and Technologies which is being held in cooperation with the Fifteenth IEEE Symposium on Mass Storage Systems at the University of Maryland-University College Inn and Conference Center March 23-26, 1998. As one of an ongoing series, this Conference continues to provide a forum for discussion of issues relevant to the management of large volumes of data. The Conference encourages all interested organizations to discuss long term mass storage requirements and experiences in fielding solutions. Emphasis is on current and future practical solutions addressing issues in data management, storage systems and media, data acquisition, long term retention of data, and data distribution. This year's discussion topics include architecture, tape optimization, new technology, performance, standards, site reports, vendor solutions. Tutorials will be available on shared file systems, file system backups, data mining, and the dynamics of obsolescence

A method for securing online community service: A study of selected Western Australian councils

Since the Internet was made publicly accessible, it has become increasingly popular and its deployment has been broad and global thereby facilitating a range of available online services such as Electronic Mail (email), news or bulletins, Internet Relay Chat (IRC) and World Wide Web (WWW). Progressively, other online services such as telephony, video conference, video on demand, Interactive Television (ITV) and Geographic Information System (GIS) have been integrated with the Internet and become publicly available. Presently, Internet broadband communication services incorporating both wired and wireless network technologies has seen the emergence of the concept of a digital community which has been growing and expanding rapidly around the world. Internet and the ever expanding online services to the wider digital community has raised the issue of security of these services during usage. Most local councils throughout Western Australia have resorted to delivering online services such as library, online payments and email accessibility. The provision and usage of these services have inherent security risks. Consequently, this study investigated the concept of a secure digital community in the secure provision and usage of these online services in selected local councils in Western Australia (WA). After an extensive review of existing literature, information security frameworks were derived from the adaptation of various resources, such as the OSSTMM 2.2 Section C: Internet Technology Security benchmark which was used as the main template. In addition, this template was enhanced into a framework model by incorporating other benchmarks such as NIST, CIS, ISSAF as well as other sources of information. These included information security related books, related ICT network and security websites such as CERT, CheckPoint, Cisco, GFI, Juniper, MS, NESSUS and NMAP together with journals and personal interviews. The proposed information security frameworks were developed to enhance the level of security strength of the email and online web systems as well as to increase the level of confidence in the system security within the selected local councils in WA. All the investigative studies were based upon the available selected local councils’ data and the associated analyses of the results as obtained from the testing software. In addition, the interpretive multiple-case study principles were used during the investigation to achieve or fulfil the purpose of this study. The findings from this study were then abstracted for use in a framework and made available for use as a model for possible adaptation and implementation to other similarly structured councils or organisations. As a result, the study confirmed that the proposed information security frameworks have the capability and potential to improve the level of security strength. In addition, the level of satisfaction and confidence of council staff of the selected local councils in WA in the system security would also be increased due to the application of these frameworks. Although these information security frameworks may be recommended as practical and supporting tools for local councils, the findings from this study were specific only to the selected local councils used in this study. Further research using other councils, may be necessary in order for the information security frameworks to be adopted within a wider range of councils or organisations in WA or elsewhere

The Practice of Basic Informatics 2020

Version 2020/04/02Kyoto University provides courses on 'The Practice of Basic Informatics' as part of its Liberal Arts and Sciences Program. The course is taught at many schools and departments, and course contents vary to meet the requirements of these schools and departments. This textbook is made open to the students of all schools that teach these courses. As stated in Chapter 1, this book is written with the aim of building ICT skills for study at university, that is, ICT skills for academic activities. Some topics may not be taught in class. However, the book is written for self-study by students. We include many exercises in this textbook so that instructors can select some of them for their classes, to accompany their teaching plans. The courses are given at the computer laboratories of the university, and the contents of this textbook assume that Windows 10 and Microsoft Office 2016 are available in these laboratories. In Chapter 13, we include an introduction to computer programming; we chose Python as the programming language because on the one hand it is easy for beginners to learn, and on the other, it is widely used in academic research. To check the progress of students' self-study, we have attached assessment criteria (a 'rubric') of this course as an Appendix. Current ICT is a product of the endeavors of many people. The "Great Idea" columns are included to show appreciation for such work. Dr. Yumi Kitamura and Dr. Hirohisa Hioki wrote Chapters 4 and 13, respectively. The remaining chapters were written by Dr. Hajime Kita. In revision for 2018 edition and after, Dr. Hiroyuki Sakai has participated in the author group, and Dr. Donghui Lin has also joined for English edition 2019. The authors hope that this textbook helps you to improve your academic ICT skill set. The content included in this book is selected based on the reference course plan discussed in the course development team for informatics at the Institute for Liberal Arts and Sciences. In writing this textbook, we obtained advice and suggestions from staffs of the Network Section, Information Infrastructure Division, Department of Planning and Information Management Department, Kyoto University on Chapters 2 and 3, from Mr. Sosuke Suzuki, NTT Communications Corporation also on Chapter 3, Rumi Haratake, Machiko Sakurai and Taku Sakamoto of the User Support Division, Kyoto University Library on Chapter 4. Dr. Masako Okamoto of Center for the Promotion of Excellence in Higher Education, Kyoto University helped us in revision of 2018 Japanese Edition. The authors would like to express their sincere gratitude to the people who supported them

Diseño de los sistemas de comunicación en plantas de exploración y producción de hidrocarburos

Las plantas industriales de exploración y producción de petróleo y gas disponen de numerosos sistemas de comunicación que permiten el correcto funcionamiento de los procesos que tienen lugar en ella así como la seguridad de la propia planta. Para el presente Proyecto Fin de Carrera se ha llevado a cabo el diseño del sistema de megafonía PAGA (Public Address and General Alarm) y del circuito cerrado de televisión (CCTV) en la unidad de procesos Hydrocrcaker encargada del craqueo de hidrógeno. Partiendo de los requisitos definidos por las especificaciones corporativas de los grupos petroleros para ambos sistemas, PAGA y CCTV, se han expuesto los principios teóricos sobre los que se fundamenta cada uno de ellos y las pautas a seguir para el diseño y demostración del buen funcionamiento a partir de software específico. Se ha empleado las siguientes herramientas software: EASE para la simulación acústica, PSpice para la simulación eléctrica de las etapas de amplificación en la megafonía; y JVSG para el diseño de CCTV. La sonorización tanto de las unidades como del resto de instalaciones interiores ha de garantizar la inteligibilidad de los mensajes transmitidos. La realización de una simulación acústica permite conocer cómo va a ser el comportamiento de la megafonía sin necesidad de instalar el sistema, lo cual es muy útil para este tipo de proyectos cuya ingeniería se realiza previamente a la construcción de la planta. Además se comprueba el correcto diseño de las etapas de amplificación basadas en líneas de alta impedancia o de tensión constante (100 V). El circuito cerrado de televisión (CCTV) garantiza la transmisión de señales visuales de todos los accesos a las instalaciones y unidades de la planta así como la visión en tiempo real del correcto funcionamiento de los procesos químicos llevados a cabo en la refinería. El sistema dispone de puestos de control remoto para el manejo y gestión de las cámaras desplegadas; y de un sistema de almacenamiento de las grabaciones en discos duros (RAID-5) a través de una red SAN (Storage Area Network). Se especifican las diferentes fases de un proyecto de ingeniería en el sector de E&P de hidrocarburos entre las que se destaca: propuesta y adquisición, reunión de arranque (KOM, Kick Off Meeting), estudio in situ (Site Survey), plan de proyecto, diseño y documentación, procedimientos de pruebas, instalación, puesta en marcha y aceptaciones del sistema. Se opta por utilizar terminología inglesa dado al ámbito global del sector. En la última parte del proyecto se presenta un presupuesto aproximado de los materiales empleados en el diseño de PAGA y CCTV. ABSTRACT. Integrated communications for Oil and Gas allows reducing risks, improving productivity, reducing costs, and countering threats to safety and security. Both PAGA system (Public Address and General Alarm) and Closed Circuit Television have been designed for this project in order to ensure a reliable security of an oil refinery. Based on the requirements defined by corporate specifications for both systems (PAGA and CCTV), theoretical principles have been presented as well as the guidelines for the design and demonstration of a reliable design. The following software has been used: EASE for acoustic simulation; PSpice for simulation of the megaphony amplification loops; and JVSG tool for CCTV design. Acoustic for both the units and the other indoor facilities must ensure intelligibility of the transmitted messages. An acoustic simulation allows us to know how will be the performance of the PAGA system without installing loudspeakers, which is very useful for this type of project whose engineering is performed prior to the construction of the plant. Furthermore, it has been verified the correct design of the amplifier stages based on high impedance lines or constant voltage (100 V). Closed circuit television (CCTV) ensures the transmission of visual signals of all access to facilities as well as real-time view of the proper functioning of chemical processes carried out at the refinery. The system has remote control stations for the handling and management of deployed cameras. It is also included a storage system of the recordings on hard drives (RAID - 5) through a SAN (Storage Area Network). Phases of an engineering project in Oil and Gas are defined in the current project. It includes: proposal and acquisition, kick-off meeting (KOM), Site Survey, project plan, design and documentation, testing procedures (SAT and FAT), installation, commissioning and acceptance of the systems. Finally, it has been presented an estimate budget of the materials used in the design of PAGA and CCTV

Ophthalmic engineering:the development of novel instrumentation to further research in the field

The principle theme of this thesis is the advancement and expansion of ophthalmic research via the collaboration between professional Engineers and professional Optometrists. The aim has been to develop new and novel approaches and solutions to contemporary problems in the field. The work is sub divided into three areas of investigation; 1) High technology systems, 2) Modification of current systems to increase functionality, and 3) Development of smaller more portable and cost effective systems. High Technology Systems: A novel high speed Optical Coherence Tomography (OCT) system with integrated simultaneous high speed photography was developed achieving better operational speed than is currently available commercially. The mechanical design of the system featured a novel 8 axis alignment system. A full set of capture, analysis, and post processing software was developed providing custom analysis systems for ophthalmic OCT imaging, expanding the current capabilities of the technology. A large clinical trial was undertaken to test the dynamics of contact lens edge interaction with the cornea in-vivo. The interaction between lens edge design, lens base curvature, post insertion times and edge positions was investigated. A novel method for correction of optical distortion when assessing lens indentation was also demonstrated. Modification of Current Systems: A commercial autorefractor, the WAM-5500, was modified with the addition of extra hardware and a custom software and firmware solution to produce a system that was capable of measuring dynamic accommodative response to various stimuli in real time. A novel software package to control the data capture process was developed allowing real time monitoring of data by the practitioner, adding considerable functionality of the instrument further to the standard system. The device was used to assess the accommodative response differences between subjects who had worn UV blocking contact lens for 5 years, verses a control group that had not worn UV blocking lenses. While the standard static measurement of accommodation showed no differences between the two groups, it was determined that the UV blocking group did show better accommodative rise and fall times (faster), thus demonstrating the benefits of the modification of this commercially available instrumentation. Portable and Cost effective Systems: A new instrument was developed to expand the capability of the now defunct Keeler Tearscope. A device was developed that provided a similar capability in allowing observation of the reflected mires from the tear film surface, but with the added advantage of being able to record the observations. The device was tested comparatively with the tearscope and other tear film break-up techniques, demonstrating its potential. In Conclusion: This work has successfully demonstrated the advantages of interdisciplinary research between engineering and ophthalmic research has provided new and novel instrumented solutions as well as having added to the sum of scientific understanding in the ophthalmic field

Accelerated neuromorphic cybernetics

Accelerated mixed-signal neuromorphic hardware refers to electronic systems that emulate electrophysiological aspects of biological nervous systems in analog voltages and currents in an accelerated manner. While the functional spectrum of these systems already includes many observed neuronal capabilities, such as learning or classification, some areas remain largely unexplored. In particular, this concerns cybernetic scenarios in which nervous systems engage in closed interaction with their bodies and environments. Since the control of behavior and movement in animals is both the purpose and the cause of the development of nervous systems, such processes are, however, of essential importance in nature. Besides the design of neuromorphic circuit- and system components, the main focus of this work is therefore the construction and analysis of accelerated neuromorphic agents that are integrated into cybernetic chains of action. These agents are, on the one hand, an accelerated mechanical robot, on the other hand, an accelerated virtual insect. In both cases, the sensory organs and actuators of their artificial bodies are derived from the neurophysiology of the biological prototypes and are reproduced as faithfully as possible. In addition, each of the two biomimetic organisms is subjected to evolutionary optimization, which illustrates the advantages of accelerated neuromorphic nervous systems through significant time savings

Analysis and development of a scoring system for repair and upgrade of products

As part of the implementation of the EU action plan for the Circular Economy, the European Commission has carried out a study for the analysis and development of a possible scoring system to inform about the ability to repair and upgrade products. The overall aims of the study, described in the present report, are: 1) To develop a general approach for the assessment of the ability to repare/upgrade energy related products (ErP); 2) To test the feasibility and types of results derived using the general approach on three specific product groups (Laptops, Vacuum Cleaners and Washing Machines). Building on the experience gained by CEN-CENELEC-JTC10 during the development of prEN 45554, a general framework has been proposed that provides technical guidance for the identification of most relevant aspects and priority parts for products on the market, as well as for scoring and aggregating different aspects of repair and upgrade. A limited number of technical parameters have been selected which cover design characteristics and relevant operational aspects related to the repair/upgrade of products. Purely economic parameters are out of the scope of this study but they are addressed indirectly by the selected parameters since these can have an influence on the cost of repair/upgrade operations. The assessment of products has been simplified by focusing, when relevant, on priority parts, to be defined on a product group basis taking into account aspects such as the frequency of failure/upgrade, the functional importance of parts, as well as qualitative information. The assessment framework is composed of: a) Pass/fail criteria that products have to fulfil in order to be considered as reparable/upgradable, and thus eligible for being assessed through the scoring criteria; b) Scoring criteria, to rate the extent to which products are reparable or upgradable. Scores can be aggregated and reported in different types of indices, which could be more or less suitable based on the final application of the scoring system. However, it was recognised that background information used for their quantification should be also provided for transparency reasons. In order to understand specific aspects and needs for different types/groups of products, the general framework has been theoretically applied to three illustrative product groups: laptops, vacuum cleaners and washing machines. The assessment has been kept practical by focusing on key parameters for the analysed product groups. This scoring system could serve as a technical reference for potential use in policy-making (e.g. Ecodesign, Energy Label, GPP, Ecolabel), for the design of a new label, or as public guidance document (for designers and consumer testing organisations). However, the study itself does not propose or pre-empt any future policy decision. Moreover, the scoring system may need to be revised periodically, in the logic of continuous methodological improvement and adaptation to changing market conditions. The applicability of the system should be also supported by future investigation aiming at: - The analysis of how consumers can understand different types of information related to the repair/upgrade of products; - The analysis of the performance of real products on the market to understand how parameters, rating and weighting of the scoring system should be adjusted, and how frequently they should be updated over time. Finally, it has also to be observed that different aspects should be evaluated in a preliminary phase to understand which are the best material efficiency strategies to implement for a specific product (e.g. similar levels of benefits could be achieved either designing more reliable products that last longer, or that can be repaired/upgraded more easily). Durability of a product is relevant as long as a product has actually an extended service life. Reliability, reparability and upgradability are all durability aspects targeted to extending the service lifetime of products and tightly linked to each other. Also in the cases in which reliability could have higher importance, reparability and upgradability can be still complementary to extend the lifetime of products.JRC.B.5-Circular Economy and Industrial Leadershi

Introductory Computer Forensics

INTERPOL (International Police) built cybercrime programs to keep up with emerging cyber threats, and aims to coordinate and assist international operations for ?ghting crimes involving computers. Although signi?cant international efforts are being made in dealing with cybercrime and cyber-terrorism, ?nding effective, cooperative, and collaborative ways to deal with complicated cases that span multiple jurisdictions has proven dif?cult in practic