560,305 research outputs found
An examination into the role of knowledge management and computer security in organizations
Organisations develop their computer security procedures based on external guidelines such as
ISO 17799 with very little provision to incorporate organisational knowledge in their security
procedures. While these external guidelines make recommendations as to how an organisation
should develop and implement best practices in computer security they often fail to provide a
mechanism that links the security process to the organisational knowledge. The result is that
often, security policies, procedures and controls are implemented that are neither strong nor
consistent with the organisation's objectives. This study has examined the role of Knowledge
Management in organisational Computer Security in 19 Australian SMEs. The study has
determined that although the role of knowledge management in organisational computer security
is currently limited, there appears to be evidence to argue that the application of knowledge
management systems to organisational computer security development and management
processes will considerably enhance performance and reduce costs.
The study supports that future research is warranted to focus on how existing computer security
standards and practices can be improved to allow for a stronger integration with organisational
knowledge through the application of knowledge management systems
Process of designing robust, dependable, safe and secure software for medical devices: Point of care testing device as a case study
This article has been made available through the Brunel Open Access Publishing Fund.Copyright © 2013 Sivanesan Tulasidas et al. This paper presents a holistic methodology for the design of medical device software, which encompasses of a new way of eliciting requirements, system design process, security design guideline, cloud architecture design, combinatorial testing process and agile project management. The paper uses point of care diagnostics as a case study where the software and hardware must be robust, reliable to provide accurate diagnosis of diseases. As software and software intensive systems are becoming increasingly complex, the impact of failures can lead to significant property damage, or damage to the environment. Within the medical diagnostic device software domain such failures can result in misdiagnosis leading to clinical complications and in some cases death. Software faults can arise due to the interaction among the software, the hardware, third party software and the operating environment. Unanticipated environmental changes and latent coding errors lead to operation faults despite of the fact that usually a significant effort has been expended in the design, verification and validation of the software system. It is becoming increasingly more apparent that one needs to adopt different approaches, which will guarantee that a complex software system meets all safety, security, and reliability requirements, in addition to complying with standards such as IEC 62304. There are many initiatives taken to develop safety and security critical systems, at different development phases and in different contexts, ranging from infrastructure design to device design. Different approaches are implemented to design error free software for safety critical systems. By adopting the strategies and processes presented in this paper one can overcome the challenges in developing error free software for medical devices (or safety critical systems).Brunel Open Access Publishing Fund
Model for cryptography protection of confidential information
УДК 004.056
Борсуковський Ю.В., Борсуковська В.Ю. Модель криптографічного захисту конфіденційної інформації
В даній статті проведено детальний аналіз вимог щодо формування моделі криптографічного захисту конфіденційної інформації. Розглянуто використання засобів криптографічного захисту інформації з метою реалізації організаційних та технічних заходів по запобіганню витокам конфіденційної інформації на об’єктах критичної інфраструктури. Сформульовані базові вимоги та рекомендації щодо структури та функціональних складових моделі захисту конфіденційної інформації. Формалізовані вимоги щодо створення, впровадження та експлуатації превентивних процедур управління багатоступінчатим захистом конфіденційної інформації. Наведено приклад використання моделі криптографічного захисту інформації для створення захищеної і прозорої в використанні бази аутентифікаційних даних користувача. Запропонована модель захисту дозволяє мати кілька ступенів програмного та апаратного захисту, що із однієї сторони спрощує їх використання при виконанні чинних політик безпеки і зменшує ймовірність дискредитації аутентифікаційних даних, а із іншої сторони підвищує ймовірність виявлення зловмисних дій третьої сторони за рахунок багатоступінчатої системи захисту. Враховано практичний досвід створення типових моделей захисту конфіденційної інформації для розробки, впровадження та управління сучасними політиками інформаційної безпеки щодо питань використання засобів криптографічного захисту конфіденційної інформації на підприємствах різних форми власності.UDC 004.056
Borsukovskyi Y., Borsukovska V. Model for Cryptography Protection of Confidential Information
Current article provides the detailed analysis of requirements for creation of model for cryptography protection of confidential information. Article defines the use of information cryptography protection tools in order to ensure the application of organizational and technical actions to prevent leakage of confidential information at critical infrastructure assets. It provides the basic requirements for the structure and functional elements of model for protection of confidential information. Formalize requirements on creation, implementation and exploitation of preventive procedure in management of multi-level protection of confidential information. The article includes example of use of model for cryptography protection of information for creation of secure and transparent in use the authenticating data base of user. The presented model of protection ensures to have a few levels of firewalls, that, on one hand, simplifies its use in execution of acting security policies and decrease the probability of discrediting of authenticating data, and, on other hand, increase the probability to detect the criminal actions of third party by means of multi-level protection system. It considers the practical experience in creation of standard models for protection of confidential information for development, implementation and management of modern policies on information security in part of use of cryptography protection tools for confidential information at enterprises of different forms of incorporation
ESPOON: Enforcing Security Policies In Outsourced Environments
Data outsourcing is a growing business model offering services to individuals
and enterprises for processing and storing a huge amount of data. It is not
only economical but also promises higher availability, scalability, and more
effective quality of service than in-house solutions. Despite all its benefits,
data outsourcing raises serious security concerns for preserving data
confidentiality. There are solutions for preserving confidentiality of data
while supporting search on the data stored in outsourced environments. However,
such solutions do not support access policies to regulate access to a
particular subset of the stored data.
For complex user management, large enterprises employ Role-Based Access
Controls (RBAC) models for making access decisions based on the role in which a
user is active in. However, RBAC models cannot be deployed in outsourced
environments as they rely on trusted infrastructure in order to regulate access
to the data. The deployment of RBAC models may reveal private information about
sensitive data they aim to protect. In this paper, we aim at filling this gap
by proposing \textbf{} for enforcing RBAC policies in
outsourced environments. enforces RBAC policies in an
encrypted manner where a curious service provider may learn a very limited
information about RBAC policies. We have implemented
and provided its performance evaluation showing a limited overhead, thus
confirming viability of our approach.Comment: The final version of this paper has been accepted for publication in
Elsevier Computers & Security 2013. arXiv admin note: text overlap with
arXiv:1306.482
Smart Asset Management for Electric Utilities: Big Data and Future
This paper discusses about future challenges in terms of big data and new
technologies. Utilities have been collecting data in large amounts but they are
hardly utilized because they are huge in amount and also there is uncertainty
associated with it. Condition monitoring of assets collects large amounts of
data during daily operations. The question arises "How to extract information
from large chunk of data?" The concept of "rich data and poor information" is
being challenged by big data analytics with advent of machine learning
techniques. Along with technological advancements like Internet of Things
(IoT), big data analytics will play an important role for electric utilities.
In this paper, challenges are answered by pathways and guidelines to make the
current asset management practices smarter for the future.Comment: 13 pages, 3 figures, Proceedings of 12th World Congress on
Engineering Asset Management (WCEAM) 201
Minimizing Competition? Entry-level Compensation in Japanese Firms
This is the first empirical study of the determinants of pay for entry-level jobs among Japanese firms. Pay data of 1,382 companies obtained from the Nikkei survey was matched with company size, performance, industry, and foreign ownership data from Toyo Keizai’s Japan Company Handbook. We found that unlike the results based on U.S. data, company size is not related to entry-level pay. Firm performance is positively related, but its effect is minimal. Industry membership and foreign ownership are positively related. We believe that these findings highlight the influence of the Japanese employment context and information sharing in Japan. Implications for research and practice are discussed
A trustworthy mobile agent infrastructure for network management
Despite several advantages inherent in mobile-agent-based approaches to network management as compared to traditional SNMP-based approaches, industry is reluctant to adopt the mobile agent paradigm as a replacement for the existing manager-agent model; the management community requires an evolutionary, rather than a revolutionary, use of mobile agents. Furthermore, security for distributed management is a major concern; agent-based management systems inherit the security risks of mobile agents. We have developed a Java-based mobile agent infrastructure for network management that enables the safe integration of mobile agents with the SNMP protocol. The security of the system has been evaluated under agent to agent-platform and agent to agent attacks and has proved trustworthy in the performance of network management tasks
- …