Risk mitigation decisions for it security

Enterprises must manage their information risk as part of their larger operational risk management program. Managers must choose how to control for such information risk. This article defines the flow risk reduction problem and presents a formal model using a workflow framework. Three different control placement methods are introduced to solve the problem, and a comparative analysis is presented using a robust test set of 162 simulations. One year of simulated attacks is used to validate the quality of the solutions. We find that the math programming control placement method yields substantial improvements in terms of risk reduction and risk reduction on investment when compared to heuristics that would typically be used by managers to solve the problem. The contribution of this research is to provide managers with methods to substantially reduce information and security risks, while obtaining significantly better returns on their security investments. By using a workflow approach to control placement, which guides the manager to examine the entire infrastructure in a holistic manner, this research is unique in that it enables information risk to be examined strategically. © 2014 ACM

Caution versus conference referral: a comparison of police diversion in reducing re-contact by first-time Indigenous juvenile offenders in South Australia

This report compares the effectiveness of formal police cautioning and family conferencing in reducing re-contact with the criminal justice system by first-time Indigenous juvenile offenders. Introduction The over-representation of Indigenous young people in the criminal justice system remains a significant social justice and public policy issue in Australia. It has been suggested that an increased use of effective police diversion can reduce Indigenous over-representation. Diversion can be defined as the practice of diverting young people from entering or continuing into the formal criminal justice system and commonly involves pre-court processes and programs. Two of the most frequently used methods of diversion in South Australia are formal police cautioning and family conferencing. While a number of studies have investigated the effectiveness of diversion in reducing re-offending by Indigenous juveniles, only Cunningham (2007) and Allard et al. (2009) have investigated the effectiveness of formal police cautioning and family conferencing in reducing re-offending by first-time Indigenous juvenile offenders (F-TIJOs). However, these two studies report conflicting findings and contain notable methodological limitations, including: (i) short follow-up periods, (ii) failure to track re-offending into adulthood, (iii) small sample sizes, (iv) failure to examine more than two recidivism outcomes, and (v) risks of bias due to failure to control for significant predictors of re-offending and failure to analyse data on intention to treat. The current study aimed to compare the effectiveness of two methods of diversion; cautioning and referral to conferencing, in reducing re-contact by F-TIJOs using methods to overcome the limitations of previous research. To address these methodological limitations the current study (i) employed a follow-up period of 24 months for each offender regardless of whether this period extended into the adult justice system, (ii) analysed four recidivism outcomes, (iii) analysed data on intention to treat, and (iv) employed propensity score matching to control for significant predictors of re-offending. The following research question was examined: (1) Did the proportion of F-TIJOs who re-contacted with police within 24 months differ between those who received a formal police caution and those who received a referral to a family conference? For those who re-contacted within 24 months, the following research questions were also examined: (2) Did the frequency of re-contact differ between F-TIJOs who received a formal police caution and those who received a referral to a family conference?, (3) Did the seriousness of first re-contact differ between F-TIJOs who received a formal police caution and those who received a referral to a family conference?, and (4) Did time to re-contact differ between F-TIJOs who received a formal police caution and those who received a referral to a family conference

Safety in maritime oil sector: Content analysis of machinery space fire hazards

An in-depth study of the practice within the maritime oil industry was undertaken to ascertain safety issues in seafaring vessels. It was more concentrated on the type of accidents that occur in machine spaces of seafaring vessels in this industry. The main focus of the research was streamlined to fire in machinery spaces. The literature review later concentrated on two of such incidences, they are oil spill and fire events. An investigation was done to assess those factors which actually contribute or are in association to fire outbreak. A content analysis methodology was used to investigate the associative relationships to fire outbreak with the aid of NVivo 9.0 software. The investigation focused on 15 key in-depth reports on machinery space incidences which were uploaded into the software. The results indicate that leakages on hot surfaces were the major causes of fire hazards in seafaring vessels. The results from using this methodology also highlighted two more fire hazards that were not so apparent in previous studies. They are generator fire and compressors fire. The results supported other studies about leakages on hot surfaces as a major contributor, but also clearly show that there are other hazardous factors of fire in machinery spaces that require further investigation

An Approach to Select Cost-Effective Risk Countermeasures Exemplified in CORAS

Risk is unavoidable in business and risk management is needed amongst others to set up good security policies. Once the risks are evaluated, the next step is to decide how they should be treated. This involves managers making decisions on proper countermeasures to be implemented to mitigate the risks. The countermeasure expenditure, together with its ability to mitigate risks, is factors that affect the selection. While many approaches have been proposed to perform risk analysis, there has been less focus on delivering the prescriptive and specific information that managers require to select cost-effective countermeasures. This paper proposes a generic approach to integrate the cost assessment into risk analysis to aid such decision making. The approach makes use of a risk model which has been annotated with potential countermeasures, estimates for their cost and effect. A calculus is then employed to reason about this model in order to support decision in terms of decision diagrams. We exemplify the instantiation of the generic approach in the CORAS method for security risk analysis.Comment: 33 page

Understanding and profiling user requirements to support the conceptual design of an integrated land monitoring system

Acquiring and organizing knowledge and information elements can be essential not only to understand, but also to eliminate, reduce and control complexity and uncertainty. An integration of tools from different disciplines could systematically help in the construction of an agreed framework for problem formulation, above all when the situation is "new". An application was de-veloped in relation to an industrial project, in order to propose profiles of the potential users of an innovative system and of their requirements, and to for-mally develop models that can orient analysis, decision and action. Some ele-ments and results of this integrated application of "soft" and "hard" decision aid tools are here proposed as steps of an organizational learning cycle, which is a basic element of each innovation proces

mHealth Research Applied to Regulated and Unregulated Behavioral Health Sciences

Behavioral scientists are developing new methods and frameworks that leverage mobile health technologies to optimize individual level behavior change. Pervasive sensors and mobile apps allow researchers to passively observe human behaviors “in the wild” 24/7 which supports delivery of personalized interventions in the real-world environment. This is all possible because these technologies contain an incredible array of sensors that allow applications to constantly record user location and can contextualize current environmental conditions through barometers, thermometers, and ambient light sensors and can also capture audio and video of the user and their surroundings through multiple integrated high-definition cameras and microphones. These tools are a game changer in behavioral health research and, not surprisingly, introduce new ethical, regulatory/legal and social implications described in this article