2010 Information Security for South Africa最新文献

Towards an ethical analysis of the W3C Web services architecture model 对W3C Web服务体系结构模型进行道德分析

2010 Information Security for South Africa Pub Date : 2010-09-30 DOI: 10.1109/ISSA.2010.5588642

Valiya Gangadharan, L. Pretorius

{"title":"Towards an ethical analysis of the W3C Web services architecture model","authors":"Valiya Gangadharan, L. Pretorius","doi":"10.1109/ISSA.2010.5588642","DOIUrl":"https://doi.org/10.1109/ISSA.2010.5588642","url":null,"abstract":"This article explores the relevance of information ethics, the field that concerns itself with the study of ethical issues arising from the development and use of such technologies, for a specific information technology viz. Web services. In particular, the Web services architecture, as conceptualised by the W3C, is analysed using Floridi's theory of Information Ethics (IE). Firstly, it is shown that a technology such as Web services (acting as autonomous software agents and artificial agents with moral agency) should and could be subjected to a systematic ethical analysis that yields useful results. Secondly, the suitability and applicability of Floridi's ethical theory of IE is demonstrated by applying it to a complex system such as the Web services architecture. It is shown how the central notion of IE, viz. so-called levels of abstraction, supports major software systems design principles such as top-down design, structured analysis and design, and stepwise refinement and affords us the opportunity of interrogating the ethical behaviour of Web services. This result is of particular significance since it opens up opportunities for the systematic and appropriate ethical analysis of any software system and may provide a general approach to “ethics by design”.","PeriodicalId":423118,"journal":{"name":"2010 Information Security for South Africa","volume":"7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124699255","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Adding digital forensic readiness to the email trace header 将数字取证准备添加到电子邮件跟踪标头

2010 Information Security for South Africa Pub Date : 2010-09-30 DOI: 10.1109/ISSA.2010.5588258

F. R. V. Staden, H. Venter

{"title":"Adding digital forensic readiness to the email trace header","authors":"F. R. V. Staden, H. Venter","doi":"10.1109/ISSA.2010.5588258","DOIUrl":"https://doi.org/10.1109/ISSA.2010.5588258","url":null,"abstract":"The protection strategies proposed and implemented to protect users against spam, focus on specific areas that need to be protected e.g. Anti-Spam filters that protect the user's mailbox from bulk unsolicited email. Digital forensics is based on scientifically proven methods to collect and analyze digital information. Employing digital forensic techniques to gather and analyze email information provides a new dimension to the fight against spam. Adding digital forensic readiness to email will allow for the gathering of forensic information. The digital forensic information can be used to verify information contained in the trace header of an email. The authors propose augmentations to the receive header, that is part of the trace header, currently specified for SMTP to implement digital forensic readiness. Incorporating digital forensics, adds a level of integrity to the trace header information that can be used for other purposes e.g. creating a spam detection mechanism or tracing the origin of spam. Digital forensic information is added to the email envelope so there is no effect to the content of the email. Therefore, the content remains untouched. The authors examine the addition of digital forensic information and highlight the changes that will need to be implemented in the SMTP trace header. The authors propose the gap detection algorithm that is used to find gaps in the received-tokens of the received header. The information that is generated by the gap detection algorithm is also discussed. In conclusion, the addition of digital forensic readiness adds a level of integrity to the SMTP trace header that can be used to add a level of trust.","PeriodicalId":423118,"journal":{"name":"2010 Information Security for South Africa","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130011939","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 5

Broadband broadens scope for cyber crime in Africa 宽带扩大了非洲网络犯罪的范围

2010 Information Security for South Africa Pub Date : 2010-09-30 DOI: 10.1109/ISSA.2010.5588287

M. Grobler, J. V. Vuuren

引用次数: 14

Common challenges faced during the establishment of a CSIRT 建立CSIRT过程中面临的共同挑战

2010 Information Security for South Africa Pub Date : 2010-09-30 DOI: 10.1109/ISSA.2010.5588307

M. Grobler, H. Bryk

引用次数: 19

A framework for evaluating IT security investments in a banking environment 用于评估银行环境中IT安全投资的框架

2010 Information Security for South Africa Pub Date : 2010-09-30 DOI: 10.1109/ISSA.2010.5588343

E. Smith, H. Kruger

{"title":"A framework for evaluating IT security investments in a banking environment","authors":"E. Smith, H. Kruger","doi":"10.1109/ISSA.2010.5588343","DOIUrl":"https://doi.org/10.1109/ISSA.2010.5588343","url":null,"abstract":"The amount of effort that can be expended on information security depends on funds available and management decisions. Organisations therefore have to prepare an annual budget for the maintenance and improvement of their information security systems. Two of the key issues that confront IT management, when dealing with IT security investments, are how to spend the IT security budget most effectively, and how to make the case for an increase in funds to maintain and further enhance information security. The aim of this paper is to present a quantitative framework as an alternative way of analysing IT security investments in a banking environment in order to address the two issues mentioned above. A two step framework is proposed. The first step utilizes a cluster analysis (CA) technique and the second step employs a linear programming technique called data envelopment analysis (DEA). The purpose of the clustering step is to ensure that evaluations are carried out in groups of homogenous bank branches while the purpose of the DEA model is to determine which of the branches make efficient use of the IT security resources available to them. Following a brief discussion of the proposed framework and techniques used, an illustrative example, based on a well known South African financial institution, is presented.","PeriodicalId":423118,"journal":{"name":"2010 Information Security for South Africa","volume":"71 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126248892","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 4

Deep packet inspection — Fear of the unknown 深度包检测-对未知的恐惧

2010 Information Security for South Africa Pub Date : 2010-09-30 DOI: 10.1109/ISSA.2010.5588278

R. Goss, R. Botha

引用次数: 6

Mobile security from an information warfare perspective 从信息战的角度看移动安全

2010 Information Security for South Africa Pub Date : 2010-09-30 DOI: 10.1109/ISSA.2010.5588339

B. V. Niekerk, M. Maharaj

引用次数: 10

Considering web services security policy compatibility 考虑web服务安全策略兼容性

2010 Information Security for South Africa Pub Date : 2010-09-30 DOI: 10.1109/ISSA.2010.5588269

Tristan Lavarack, M. Coetzee

{"title":"Considering web services security policy compatibility","authors":"Tristan Lavarack, M. Coetzee","doi":"10.1109/ISSA.2010.5588269","DOIUrl":"https://doi.org/10.1109/ISSA.2010.5588269","url":null,"abstract":"For most organizations supporting business-to-business (B2B) web services interactions, security is a growing concern. Web services providers and consumers document their primary and alternative security policy requirements and capabilities in security policy files, defined by WS-Policy, WS-SecurityPolicy and WS-Security syntax. To secure message exchanges to the satisfaction of all parties, the security requirements of both web services providers and consumers need to be satisfied. This paper investigates how mutually agreed-upon security policies can be created. An analysis of the policy intersection algorithm highlights its deficiencies for finding mutually compatible policies. The interrelated effect that security policy assertion choices have on each other is identified as an important aspect not yet considered. Over and above security policy assertions, other influence on security policy choices, which may affect the security level supported by the organization, is identified. A proposal is made on how the assertions of two security policies should be considered, in order to create a secure, mutually agreed-upon security policy that will satisfy the requirements of both parties.","PeriodicalId":423118,"journal":{"name":"2010 Information Security for South Africa","volume":"299 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132850064","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 10

Agent-based host enumeration and vulnerability scanning using dynamic topology information 基于代理的主机枚举和使用动态拓扑信息的漏洞扫描

2010 Information Security for South Africa Pub Date : 2010-09-30 DOI: 10.1109/ISSA.2010.5588317

Ziyad S. Al-Salloum, S. Wolthusen

引用次数: 5

The management of security in Cloud computing 云计算中的安全管理

2010 Information Security for South Africa Pub Date : 2010-09-30 DOI: 10.1109/ISSA.2010.5588290

Ramgovind S, Eloff Mm, Smith E

引用次数: 513