Analysing usability and security issues in design and development of information systems

Recent technological advancements and the global economic challenges have meant that, individuals and businesses are constantly seeking new ways to exploit Information Systems (IS) and in manners that not only enhance user experiences and/or improve business processes and productivity, but also protect the individual‟s privacy and business assets for competitive advantage. Therefore, Information Systems need to be designed and developed to meet these challenges and/or other objectives. This thesis will delve primarily into the history of IS as a basis for establishing where the problem(s) lie or emanate from. It will focus on critically analysing existing Information Systems, and investigating the conflicting issues of usability and security, from an Information Systems Design and Development perspective by analysing various approaches. An in-depth review of literature and critical analysis of requirements necessary for the design and development of a usable and secure Information System will be carried out and will form the intellectual framework for this research. The premise therefore, is to look for a balanced approach or appropriate trade-off framework for designing usable-secure systems. The research will conclude with a discussion on how an envisaged conceptual framework or model can be developed based on certain influential factors, and how the framework can be experimentally evaluated, and to suggest areas for further improvement or future research

Composable Distributed Access Control and Integrity Policies for Query-Based Wireless Sensor Networks

An expected requirement of wireless sensor networks (WSN) is the support of a vast number of users while permitting limited access privileges. While WSN nodes have severe resource constraints, WSNs will need to restrict access to data, enforcing security policies to protect data within WSNs. To date, WSN security has largely been based on encryption and authentication schemes. WSN Authorization Specification Language (WASL) is specified and implemented using tools coded in JavaTM. WASL is a mechanism{independent policy language that can specify arbitrary, composable security policies. The construction, hybridization, and composition of well{known security models is demonstrated and shown to preserve security while providing for modifications to permit inter{network accesses with no more impact on the WSN nodes than any other policy update. Using WASL and a naive data compression scheme, a multi-level security policy for a 1000-node network requires 66 bytes of memory per node. This can reasonably be distributed throughout a WSN. The compilation of a variety of policy compositions are shown to be feasible using a notebook{class computer like that expected to be performing typical WSN management responsibilities

Three essays on demand estimation

Dissertation Summary This thesis is composed of three essays on demand estimation. The first essay proposes an approach to estimate demand functions with loyalty, the second and third essays are building on existing demand estimation techniques in order to assess the behavior of economic entities in an antitrust framework. The first essay proposes a method to augment a demand function estimated on market level data with micro data purchase histories in order to improve the demand function fit. In a first step, a micro model is defined at the household level, where the dataset is available for a subset of households only. This allows the identification of state dependence, thereby distinguishing loyal and non-loyal households. In the second step, a market level demand function that accounts for state dependence is estimated on all markets. This is achieved through three modifications: the state dependence coefficients are incorporated and treated as data, the state variables are proxied through forward iteration and finally defining an extra moment condition is defined (the predicted share of loyal transitions must match the one observed in the micro data). I show on Monte Carlo simulated datasets that the model improves market share fit. I apply the model to data on yoghurt purchases in the US. The second essay (joint work with Alon Eizenberg and Michelle Sovinsky) aims at providing evidence of vertical restraints. Vertical restraints between upstream suppliers and downstream customers often raise anti-competitive concerns. While the extant empirical and theoretical literature focuses on static analyses of such arrangements, this paper empirically documents their effect in a dynamic environment. Our study focuses on the processor industry during the years 2002-2009 which saw an incumbent, dominant upstream supplier (Intel) attempting to maintain its dominant position versus a smaller contender (AMD). Using a unique combination of datasets, we apply both linear and nonlinear dynamic panel regression methods. The empirical evidence suggests a nuanced form of foreclosure: one targeted not at eliminating a rival, but rather at keeping the rival below a threshold of production. The third essay (joint work with Hwa Ryung Lee and Michelle Sovinsky) focuses on predatory advertising. Antitrust authorities typically try to establish exclusivity and the anticompetitiveness of loyalty rebates through pricing, but do not address the strategic use of advertising and, more generally, marketing campaigns. In this paper we focus on non-price anticompetitive behavior arising from marketing. We propose a Test of Advertising Predation (TAP) that can be used to detect non-price predatory behavior. The TAP test is based on a structural approach and allows us to disentangle the potential positive impact of a marketing program from the anticompetitive predatory effect. We apply the TAP test to the Intel case, but it can be used to guide antitrust authorities in future cases, as it provides a more general framework for testing for the anticompetitive use of marketing campaigns. We use the test to examine whether Intel's choice of processor marketing via PC firms is consistent with predatory behavior, and find evidence that the "Intel Inside" marketing campaign had predatory effects. Zusammenfassung der Dissertation Diese These besteht aus drei Essays über Nachfrage-Schätzung. Der erste Essay schlägt einen Ansatz zur Schätzung von Nachfragefunktionen mit Kundentreue vor, der zweite und der dritte Essays bauen auf bestehenden Nachfragefunktionen auf, um das Verhalten von Wirtschaftssubjekten in einem kartellrechtlichen Rahmen zu bewerten. Der erste Essay schlägt eine Methode vor, um eine Nachfragefunktion zu erweitern, die auf Marktebene mit Mikrodatenkaufgeschichten geschätzt wird, um die Nachfragefunktion zu verbessern. In einem ersten Schritt wird ein Mikromodell auf Haushaltsebene definiert, wobei der Datensatz nur für einen Teil der Haushalte verfügbar ist. Dies ermöglicht die Identifizierung der Zustandsabhängigkeit und unterscheidet dadurch loyale und nicht-loyale Haushalte. Im zweiten Schritt wird auf allen Märkten eine Nachfragefunktion auf Marktebene geschätzt, die die „state dependence“ berücksichtigt. Dies wird durch drei Modifikationen erreicht: Die Koeffizienten von Kundentreue werden als Daten integriert und behandelt, die Zustandsvariablen werden durch eine Vorwärtsiteration projiziert und schließlich eine zusätzliche „moment condition“ definiert wird (der vorhergesagte Anteil an loyalen Transitionen muss mit dem im Mikro beobachteten Daten übereinstimmen). Ich zeige mit Monte Carlo simulierten Datensätzen, dass Marktanteile besser prognostiziert werden. Ich verwende das Modell mit Datensätzen von Joghurtkäufen in den USA. Der zweite Essay (gemeinsame Arbeit mit Alon Eizenberg und Michelle Sovinsky) zielt darauf ab, Beweise für vertikale Beschränkungen zu liefern. Vertikale Beschränkungen zwischen vorgelagerten Anbietern und nachgelagerten Kunden sind oft wettbewerbswidrig. Während die vorliegende empirische und theoretische Literatur sich auf statische Analysen solcher Anordnungen konzentriert, dokumentiert diese Arbeit empirisch ihre Wirkung in einem dynamischen Umfeld. Unsere Studie konzentriert sich auf die Prozessorindustrie in den Jahren 2002-2009, in der ein etablierter, dominanter vorgelagerter Anbieter (Intel) versuchte, seine dominierende Position gegenüber einem kleineren Wettbewerber (AMD) beizubehalten. In einer einzigartigen Kombination von Datensätzen verwenden wir sowohl lineare als auch nichtlineare dynamische Regressionsmethoden. Die empirische Evidenz deutet auf eine nuancierte Form der Abschottung hin: Man zielt nicht darauf ab, einen Rivalen zu eliminieren, sondern den Rivalen unterhalb einer Produktionsschwelle zu halten. Der dritte Essay (gemeinsame Arbeit mit Hwa Ryung Lee und Michelle Sovinsky) konzentriert sich auf „predatory advertising“. Die Kartellbehörden versuchen in der Regel, durch die Preisgestaltung Exklusivität und Wettbewerbsfähigkeit von Treuerabatt zu etablieren, gehen aber nicht auf die strategische Verwendung von Werbung und generell auf Marketingkampagnen ein. In diesem Projekt konzentrieren wir uns auf nicht-Preis-wettbewerbswidriges Verhalten im Bereich des Marketings. Wir schlagen einen „Test of Advertising Predation“ (TAP) vor, der verwendet wird, um nicht-Preis Raub- Verhalten zu erkennen. Der TAP-Test basiert auf einem strukturellen Ansatz und ermöglicht es uns, die potenziellen positiven Auswirkungen eines Marketingprogramms von der wettbewerbswidrigen räuberischen Wirkung zu befreien. Wir wenden den TAP-Test auf den Intel-Fall an, das Vorgehen kann aber auch in Zukunft von Kartellbehörden eingesetzt werden, da es einen allgemeineren Rahmen für die Prüfung der wettbewerbswidrigen Nutzung von Marketingkampagnen bietet. Wir verwenden den Test, um zu untersuchen, ob Intel die Wahl des Prozessor-Marketings über PC-Firmen mittels räuberischen Verhalten durchführte, und finden Beweise dafür, dass die "Intel Inside" -Kampagne solche räuberische Auswirkungen hatte

Web Mashups in the Supply Chain

Many supply chains include multiple parties with the goods exchanged several times from the time of their production until they are sold. The liability issues that arise from goods changing hands several times along the way, as well as the exporting and importing regulations that have to be considered, add considerable complexity to the system. Furthermore weather, traffic, and market fluctuations make supply chains less reliable. Many of these issues in supply chain management could be solved or their adverse effects lessened by having information more readily shared among parties. Using Web 2.0 technologies such as a Service-Oriented Architecture, web mashups, blogs, wikis, and social networking sites could be used to facilitate sharing information between parties in a supply chain. This paper focuses on analyzing the potential use of web mashups by enterprises in the supply chain industry. Web mashups, the supply chain, and the security implications of using web mashups in the supply chain are analyzed to determine if it would be worthwhile to use web mashups in the supply chain industry

Advances in Intelligent Vehicle Control

This book is a printed edition of the Special Issue Advances in Intelligent Vehicle Control that was published in the journal Sensors. It presents a collection of eleven papers that covers a range of topics, such as the development of intelligent control algorithms for active safety systems, smart sensors, and intelligent and efficient driving. The contributions presented in these papers can serve as useful tools for researchers who are interested in new vehicle technology and in the improvement of vehicle control systems

ACCESSIBLE ACCESS CONTROL: A VISUALIZATION SYSTEM FOR ACCESS CONTROL POLICY MANAGEMENT

Attacks on computers today present in many different forms, causing malfunction of operating systems, information leakage and loss of business and public trust. Access control is a technique that stands as the last line of protection restricting the access of users or processes to resources on computers. Throughout the years, many access control models have been implemented to accommodate security requirements under different circumstances. However, the learning of access control models and the management of access control policies are still challenging given its abstract nature, the lack of an environment for practice, and the intricacy of fulfilling complex security goals. These problems seriously reduce the usability of access control models. In this dissertation, we present a set of pedagogical systems that facilitates the teaching and studying of access control models and a visualization system that aids the authoring and analysis of access control policies. These systems are designed to tackle the usability problems in two steps. First, the pedagogical systems were designed for new learners to overcome the obstacles of learning access control and the lack of practicing environment at the very beginning. Contrary to the traditional lecture and in-paper homework method, the tool allows users to write/import a policy file, follow the visual steps to understand the concepts and access mechanisms of a model and conduct self-evaluation through Quiz and Query modules. Each of the four systems is specifically designed for a model of the Domain Type Enforcement, Multi-level Security, Role-based Access Control, or UNIX permissions. Through these systems, users are able to take an active role in exploring the effect of a policy with a safe and intact underlying operating systems. Second, writing and evaluating the effect of a policy could also be challenging and tedious even for security professionals when there are thousands of lines of rules. We believe that writing an access control policy should not include the complexity of learning a new language, and managing the policies should never be manual when automatic examination could take the place. In the aspect of policy writing, the visualization system kept the least number of key elements for specifying a rule: user, object, and action. They describe the active entity who takes the action, the file or directory which the action is applied to, and the type of accesses allowed, respectively. Because of its simple form without requiring the learning of a programming-like language, we hope that specifying policies using our language could be accomplished effortlessly not only by security professionals but also by anyone who is interested in access control. Moreover, policies can often be left unexamined when deployed. This is similar to releasing program which was untested and could lead to dangerous results. Therefore, the visualization system provides ways to explore and analyze access control policies to help confirm the effect of the policies. Through interactive textual and graphical illustrations, users could specify the accesses to check, and be notified when problems exist

Performance issues in optical burst/packet switching

The final publication is available at Springer via http://dx.doi.org/10.1007/978-3-642-01524-3_8This chapter summarises the activities on optical packet switching (OPS) and optical burst switching (OBS) carried out by the COST 291 partners in the last 4 years. It consists of an introduction, five sections with contributions on five different specific topics, and a final section dedicated to the conclusions. Each section contains an introductive state-of-the-art description of the specific topic and at least one contribution on that topic. The conclusions give some points on the current situation of the OPS/OBS paradigms

Radar Testbed Characterization for Evaluation of Modulated Scatterer Concepts

The following research explores the concepts of communication-embedded radar with an emphasis on radar operation and modulated scatterer concepts. Once firmly established the concept of communication via radar backscatter could be used in a variety of fields including, mass data collection, SAR calibration, and military communication. A radar testbed was developed and charactersized to enable experimental evaluation of communication via modulated scatterer concepts. The radar operates with a 1.84-GHz center frequency and 75-MHz bandwidth (later upgraded to a 235-MHz bandwidth). A dual-channel arbitrary waveform generator is loaded with used-defined complex baseband signals for frequency upconversion for transmission via a 22 dBi parabolic reflector antenna. Backscattered signals are received and frequency downconverted on four identical channels, each fed by a dipole antenna. A 4-channel data acquisition system digitizes and records the output video signal at 1-GSa/s per channel for signal analysis. The primary means of evaluating the radar testbed were loopback and freespace setups. The loopback setup consisted of a cabled inserted between transmitter and receiver to provide a controlled propagation environment. In this setup results were shown to be desirable, and easily explained by theory. Linear FM (chirp) waveforms were used which enabled pulse compression to reduce the peak signal power while preserving range resolution. After pulse compression via matched filter routines, amplitude, phase, and resolution were characterized and found to agree with theory. In extending the tests to freespace, it was seen that near targets could be seen and resolved coherently across the 4 channels. A prototype modulated scatterer constructed by a senior design group was further tested to evaluate the prototype's viability. This scatterer impresses a bit sequency on the radar wavefrom by modulating the scatterer's termination impedance between an open and short circuit at a rate determined by the bit sequence to be communicated (similar to frequency-shift keying). Connected via a cabled-loopback configuration, the prototype was shown to impress a bit sequence onto the backscatter of the transmit chirp and, through processing, the bit stream associated with the modulated scatterer was decoded successfully. Followon testing will evaluate freespace operation and techniques for decoding information from multiple devices in the field of view. This radar testbed will be used to experiementally evaluate various modulated scatterer concepts as well as other radar-related waveform and signal processing concepts in the future

Structural basis of the membrane intramolecular transacylase reaction responsible for lyso-form lipoprotein synthesis

Abstract: Lipoproteins serve diverse functions in the bacterial cell and some are essential for survival. Some lipoproteins are adjuvants eliciting responses from the innate immune system of the host. The growing list of membrane enzymes responsible for lipoprotein synthesis includes the recently discovered lipoprotein intramolecular transacylase, Lit. Lit creates a lipoprotein that is less immunogenic, possibly enabling the bacteria to gain a foothold in the host by stealth. Here, we report the crystal structure of the Lit enzyme from Bacillus cereus and describe its mechanism of action. Lit consists of four transmembrane helices with an extracellular cap. Conserved residues map to the cap-membrane interface. They include two catalytic histidines that function to effect unimolecular transacylation. The reaction involves acyl transfer from the sn-2 position of the glyceryl moiety to the amino group on the N-terminal cysteine of the substrate via an 8-membered ring intermediate. Transacylation takes place in a confined aromatic residue-rich environment that likely evolved to bring distant moieties on the substrate into proximity and proper orientation for catalysis