bluuebunny/crossref_metadata_2025 huggingface dataset:
E-Government and Denial of Service Attacks
Authors: Mitrokotsa Aikaterini , Douligeris Christos
Published: May 2011

The use of electronic technologies in government services has played a significant role in making citizens’ lives more convenient. Even though the transition to digital governance has great advantages for the quality of government services it may be accompanied with many security threats. One of the major threats and hardest security problems e-Government faces are the Denial of Service (DoS) attacks. DoS attacks have already taken some of the most popular e-government sites off-line for several hours causing enormous losses and repair costs. In this chapter, important incidents of DoS attacks and results from surveys that indicate the seriousness of the problem are presented. In order to limit the problem of DoS attacks in government organisations we also present a list of best practices that can be used to combat the problem together with a classification of attacks and defense mechanisms.
Secure Authentication Process for High Sensitive Data E-Services
Authors: Ardagna Claudio Agostino , Damiani Ernesto , Frati Fulvio , Reale Salvatore
Published: May 2011

The widespread diffusion of distributed services, providing access to resources through the Net, has stressed the need of secure ways to authenticate users. The heterogeneity of resources leads to different authentication mechanisms implementations often requiring multiple log-on actions also in intra-domain multi-services scenario. The article presents a roadmap on authentication mechanisms implemented at different levels of services’ software structure.
Ethics Of Data Mining
Authors: Cook Jack
Published: May 2011

Decision makers thirst for answers to questions. As more data is gathered, more questions are posed: Which customers are most likely to respond positively to a marketing campaign, product price change or new product offering? How will the competition react? Which loan applicants are most likely or least likely to default? The ability to raise questions, even those that currently cannot be answered, is a characteristic of a good decision maker. Decision makers no longer have the luxury of making decisions based on gut feeling or intuition. Decisions must be supported by data; otherwise decision makers can expect to be questioned by stockholders, reporters, or attorneys in a court of law. Data mining can support and often direct decision makers in ways that are often counterintuitive. Although data mining can provide considerable insight, there is an “inherent risk that what might be inferred may be private or ethically sensitive” (Fule & Roddick, 2004, p. 159).
Privacy-Dangers and Protections
Authors: Friedman William H.
Published: May 2011

It is no wonder that the average citizen is concerned about the difficulty of guarding one’s privacy. Now, your own cell phone can reveal your ever-changing whereabouts by means of “location technology” (Lagesse, 2003). Chips that receive coordinates from global positioning satellites now make it possible to locate persons, cars, merchandise, in short, whatever we value. Like most new technology, it is easy to see advantages as well as drawbacks. Some positives of location technology are that ambulances, police and fire services can reach victims more quickly; driving suggestions can be delivered in real time to motorists (thus helping to avoid traffic tie-ups and prevent getting lost); advertisers can inform potential customers of the existence of a nearby hotel, store or restaurant; stores utilizing RFID (see the KEY TERMS section for explanations of possibly unfamiliar terms) can trace merchandise movement to reduce waste, replenish inventory, and stem shoplifting. Some negatives are that nefarious agents can also use location technology to track their prey; location-tracking history can be subpoenaed by one’s legal adversaries; and it is inevitable that corporations and government will have an interest in conducting such monitoring (Griffin & Whitehead, 2001, 2002).
Privacy and Security in E-Learning
Authors: El-Khatib Khalil , Korba Larry , Xu Yuefei , Yee George
Published: May 2011

For a variety of advantages, universities and other organizations are resorting to e-learning to provide instruction on-line. While many advances have been made in the mechanics of providing on-line instruction, the needs for privacy and security have to-date been largely ignored. This paper examines privacy and security issues associated with e-learning. It presents the basic principles behind privacy practices and legislation. It investigates the more popular e-learning standards to determine their provisions and limitations for privacy and security. Privacy requirements for e-learning systems are explored with respect to the “Privacy Principles.” The capabilities of a number of existing privacy enhancing technologies, including methods for network privacy, policy-based privacy/security management, and trust systems, are reviewed and assessed.
Privacy-Preserving Data Mining
Authors: Thuraisingham Bhavani
Published: May 2011

This article first describes the privacy concerns that arise due to data mining, especially for national security applications. Then we discuss privacy-preserving data mining. In particular, we view the privacy problem as a form of inference problem and introduce the notion of privacy constraints. We also describe an approach for privacy constraint processing and discuss its relationship to privacy-preserving data mining. Then we give an overview of the developments on privacy-preserving data mining that attempt to maintain privacy and at the same time extract useful information from data mining. Finally, some directions for future research on privacy as related to data mining are given.
WLAN Security Management
Authors: Pulkkis Göran , Grahn Kaj J. , Karlsson Jonny
Published: May 2011

In a wired local-area network (LAN), the network ports and cables are mostly contained inside a building. Therefore, a hacker must defeat physical security measures, such as security personnel, identity cards, and door locks, to be able to physically access the LAN. However, the penetration capability of electromagnetic waves exposes the data-transmission medium of a wireless LAN (WLAN) to potential intruders (Potter & Fleck, 2003).
Architectures for Advanced Cryptographic Systems
Authors: Bertoni Guido , Guajardo Jorge , Paar Christof
Published: May 2011

In the last 20-30 years, the world of modern cryptography has been largely dominated by traditional systems such as the Data Encryption Standard and the RSA algorithm. Such systems have provided a secure way for storing and transmitting information and they are nowadays incorporated in many network protocols and secure storage media. More recently, the increasing advance of crypto-analytical techniques and tools and the emergence of new applications, for example wireless communications and mobile computing, have stimulated the research and development of innovative cryptographic algorithms. These newer systems require a more detailed and sophisticated mathematical formalization and operations, which are not normally supported by general-purpose processors. For example, many basic operations required to implement recently proposed cryptographic algorithms, such as the Advanced Encryption Standard or Elliptic Curve Cryptosystems, are based on arithmetic in finite fields (or Galois fields). This chapter is, thus, intended to give an overview of such developments in modern cryptography. In particular, it aims at giving the reader a comprehensive understanding of innovative cryptosystems, their basic structure, alternative existing hardware architectures to implement them, and their performance requirements and characterizations. Emphasis will be made throughout on two important cases: the Advanced Encryption Standard and Elliptic Curve Cryptosystems.
Security Laboratory Design and Implementation
Authors: Knight Linda V. , Labruyere Jean-Philippe P.
Published: May 2011

Security laboratories provide controlled environments that simulate enterprises’ infrastructures. Such laboratories allow technical professionals to test the effectiveness of different hardware, software, and network configurations in warding off attacks, as well as to experiment with and learn about various security devices, tools, and attack methods in a controlled manner that insures benign consequences. These laboratories typically include an extensive and sometimes complex networking environment.
Invisibility and the Ethics of Digitalization
Authors: van der Velden Maja
Published: May 2011

The diversity of knowledge is crucial for finding credible and sustainable alternatives for living together. Yet, a preoccupation with content and connectivity obscures the role of information technology by making invisible different ways of knowing and other logics and experiences. How do we deal with diversity and difference in information technology? In this chapter, two cases are explored in which dealing with difference is a particular political and ethical concern. The designs of Indymedia, an Internet-based alternative media network, and TAMI, an Aboriginal database, are informed by the confrontations over different ways of knowing. They translate difference without sacrificing diversity, providing clues for building credible and sustainable design alternatives that will not hurt others.
A Methodology for Developing Trusted Information Systems
Authors: Fugini Maria Grazia , Plebani Pierluigi
Published: May 2011

In building cooperative distributed information systems, a methodology for analysis, design and implementation of security requirements of involved data and processes is essential for obtaining mutual trust between cooperating organizations. Moreover, when the information system is built as a cooperative set of e-services, security is related to the type of data, to the sensitivity context of the cooperative processes and to the security characteristics of the communication paradigms. This paper presents a methodology to build a trusted cooperative environment, where data sensitivity parameters and security requirements of processes are taken into account. The phases are illustrated and a reference example is presented in a cooperative information system and e-applications. An architecture for trusted exchange of data in cooperative information system is proposed. The requirements analysis phase is presented in detail.
Digital Signature-Based Image Authentication
Authors: Lou Der-Chyuan , Liu Jiang-Lung , Li Chang-Tsun
Published: May 2011

This chapter is intended to disseminate the concept of digital signature-based image authentication. Capabilities of digital signature-based image authentication and its superiority over watermarking-based approaches are described first. Subsequently, general models of this technique — strict authentication and non-strict authentication are introduced. Specific schemes of the two general models are also reviewed and compared. Finally, based on the review, design issues faced by the researchers and developers are outlined.
Current Network Security Systems
Authors: Pulkkis Göran , Grahn Kaj , Astrom Peik
Published: May 2011

Network security is defined as “a set of procedures, practices and technologies for protecting network servers, network users and their surrounding organizations” (Oppliger, 2000, Preface). The need for network security is caused by the introduction of distributed systems, networks, and facilities for data communication. Improved network security is required because of the rapid development of communication networks. Network security is achieved by using software based tools, that is, network security software (Pulkkis, Grahn & Åström, 2003).
WLAN Security Management
Authors: Pulkkis Göran , Grahn Kaj , Karlsson Jonny
Published: May 2011

In a wired local-area network (LAN), the network ports and cables are mostly contained inside a building. Therefore, a hacker must defeat physical security measures, such as security personnel, identity cards, and door locks, to be able to physically access the LAN. However, the penetration capability of electromagnetic waves exposes the data-transmission medium of a wireless LAN (WLAN) to potential intruders (Potter & Fleck, 2003).
Exposing the Wired Equivalent Privacy Protocol Weaknesses in Wireless Networks
Authors: Curran Kevin , Smyth Elaine
Published: May 2011

This article highlights a number of security issues within wireless networks. Signal leakage for instance, means that network communications can be picked up outside the physical boundaries of the building in which they are being operated, meaning that a hacker can operate from the street outside or discretely from blocks away. In addition to signal leakage, the Wired Equivalent Privacy (WEP) protocol is inherently weak. There are also various other attacks that can be initiated against WLANs, all with detrimental effects. During our investigation, a war-driving expedition was conducted to ascertain the number of unprotected WLAN devices in use locally. We concluded that there was an apparent and serious lack of security on WLAN devices. Even those users that have implemented WEP do not seem to realize just how weak this protocol is or how their networks could be affected.
Access Control Specification in UML
Authors: Koch M. , Parisi-Presicce F. , Pauls K.
Published: May 2011

Security requirements have become an integral part of most modern software systems. In order to produce secure systems, it is necessary to provide software engineers with the appropriate systematic support. This chapter discusses a methodology to integrate the speci?cation of access control policies into UML. The methodology, along with the graph-based formal semantics for the UML access control speci?ca-tion, allows to reason about the coherence of the access control speci?cation. The chapter also presents a procedure to modify policy rules to guarantee the satisfaction of constraints, and shows how to generate access control requirements from UML diagrams. The main concepts in the UML access control speci?cation are illustrated with an example access control model for distributed object systems.
Privacy-Preserving Transactions Protocol Using Mobile Agents with Mutual Authentication
Authors: Han Song , Potdar Vidyasagar , Chang Elizabeth , Dillon Tharam
Published: May 2011

This article introduces a new transaction protocol using mobile agents in electronic commerce. The authors first propose a new model for transactions in electronic commerce, mutual authenticated transactions using mobile agents. They then design a new protocol by this model. Furthermore, the authors analyse the new protocol in terms of authentication, construction, and privacy. The aim of the protocol is to guarantee that the customer is committed to the server, and the server is committed to the customer. At the same time, the privacy of the customer is protected.
Law, CyberCrime and Digital Forensics
Authors: Mitrakas Andreas , Zaitch Damián
Published: May 2011

The steep increase of cyber crime has rendered digital forensics an area of paramount importance to keep cyber threats in check and invoke legal safety and security in electronic transactions. This chapter reviews certain legal aspects of forensic investigation, the overall legal framework in the EU and U.S. and additional self-regulatory measures that can be leveraged upon to investigate cyber crime in forensic investigations. This chapter claims that while full-scale harmonisation of forensic investigation processes across the EU and beyond is unlikely to happen in the foreseeable future, cross-border investigations can be greatly facilitated by initiatives aiming at mutual assistance arrangements based on a common understanding of threats and shared processes. Involving the users through self-regulation and accountability frameworks might also contribute to reducing risks in electronic communications that emanate from cyber criminal threats.
Experiences from Using the CORAS Methodology to Analyze a Web Application
Authors: Braber Folker , Mildal Arne , Nes Jone , Stølen Ketil , Vraalsen Fredrik
Published: May 2011

During a field trial performed at the Norwegian telecom company NetCom from May 2003 to July 2003, a methodology for model-based risk analysis was assessed. The chosen methodology was the CORAS methodology (CORAS, 2000), which has been developed in a European research project carried out by 11 European companies and research institutes partly funded by the European Union. The risk analysis and assessment were carried out by the Norwegian research institute SINTEF in cooperation with NetCom. NetCom (www.netcom.no) is one of the main mobile phone network providers in Norway. Their ‘MinSide’ application offers their customers access to their personal account information via the Internet, enabling them to view and change the properties of their mobile phone subscription. ‘MinSide’ deals with a lot of sensitive customer information that needs to be secure, while at the same time being easily available tithe customer in order for the service to remain usable and competitive. The goal of the analysis was to identify risks in relation to the use of the ‘MinSide’ application and, where possible, suggest treatments for these risks. This was achieved through two model-driven brainstorming sessions based on system documentation in the form of UML sequence diagrams and data flow diagrams.
RFID in the Retail Supply Chain
Authors: Loebecke Claudia
Published: May 2011

The use of RFID (radio-frequency identification) in the retail supply chain and at the point of sale (POS) holds much promise to revolutionize the process by which products pass from manufacturer to retailer to consumer. The basic idea of RFID is a tiny computer chip placed on pallets, cases, or items. The data on the chip can be read using a radio beam. RFID is a newer technology than bar codes, which are read using a laser beam. RFID is also more effective than bar codes at tracking moving objects in environments where bar code labels would be suboptimal or could not be used as no direct line of sight is available, or where information needs to be automatically updated. RFID is based on wireless (radio) systems, which allows for noncontact reading of data about products, places, times, or transactions, thereby giving retailers and manufacturers alike timely and accurate data about the flow of products through their factories, warehouses, and stores.
The Next Big RFID Application
Authors: Wyld David C.
Published: May 2011

This chapter examines the adoption of radio frequency identification (RFID) technology in the commercial aviation industry, focusing on the role of RFID systems for improved baggage handling and security. The chapter provides a timely overview of developments with regard to the implementation of RFID technology in commercial aviation, which promises distinct advantages over the currently used bar-code system for baggage handling. The chapter focuses on how RFID technology can improve customer service through better operational efficiency in baggage handling, which has been demonstrated to be an integral component of the airline’s customer service equation. Developments with RFID technology can dramatically improve the accuracy of baggage handling, which can enable air carriers to close an important service gap among customers in an increasingly turbulent operating environment. Other service industries can certainly benchmark the airline industry’s use of RFID technology in luggage tracking as a way to improve their own operational capabilities.
An Integrated Security Verification and Security Solution Design Trade-Off Analysis Approach
Authors: Houmb S. H. , Georg G. , Jurjens J. , France R.
Published: May 2011

This chapter describes the integrated security verification and security solution design trade-off analysis (SVDT) approach. SVDT is useful when there is a diverse set of requirements imposed upon a security critical system, such as a required security level, time-to-market and budget constraints and end users’ expectations. Balancing these needs requires developers to evaluate alternative security solutions, and SVDT makes this evaluation effective. UMLsec, an extension to UML for secure systems development, is used to specify security requirements, and UMLsec tools are used to verify if the alternative design solutions satisfy security requirements.
Trustworthy Web Services
Authors: Yang Stephen J.H. , Lan Blue C.W. , Hsieh James S.F. , Chung Jen-Yao
Published: May 2011

Web service technology enables seamless integration of different software to fulfill dynamic business demands in a platform-neutral fashion. However, the adoption of loosely-coupled and distributed services will cause trustworthiness problems. In this article, we present an experience-based evaluation of service’s trustworthiness based on trust experience (understanding) and trust requirements (policy). We utilize ontology to specify past experiences of services and trustworthy requirements of the requester. Before invoking found services, the addressed method can help the requester evaluate the trustworthiness of the services based on his or her trustworthy requirements and past experiences of the services. Furthermore, we also present an evaluation method for composite services by taking the structure of the composite services into account. The main contribution of the paper is providing evaluation methods for Web services such that the service requester can make better decisions in selecting found services in terms of service’s trustworthiness.
Perceptions of End-Users on the Requirements in Personal Firewall Software
Authors: Hazari Sunil
Published: May 2011

Information security is usually considered a technical discipline with much attention being focused on topics such as encryption, hacking, break-ins, and credit card theft. Security products such as anti-virus programs and personal firewall software, are now available for end-users to install on their computers to protect against threats endemic to networked computers. The behavioral aspects related to maintaining enterprise security have received little attention from researchers and practitioners. Using Q-sort analysis, this study used students as end-users in a graduate business management security course to investigate issues affecting selection of personal firewall software in organizations. Based on the Q-sort analysis of end-users in relation to seven variables identified from review of the information security literature, three distinct group characteristics emerged. Similarities and differences between groups are investigated and implications of these results to IT managers, vendors of security software and researchers in information security area are discussed.
Model Driven Security for Inter-Organizational Workflows in E-Governent
Authors: Hafner Michael , Weber Barbara , Breu Ruth , Nowak Andrea
Published: May 2011

Model Driven Architecture is an approach to increase the quality of complex software systems by creating high-level system models and automatically generating system architectures and components out of these models. We show how this paradigm can be applied to what we call Model Driven Security for inter-organizational workflows in e-government. Our focus is on the realization of security-critical inter-organizational workflows in the context of Web services, Web service orchestration and Web service choreography. Security requirements are specified at an abstract level using UML diagrams. Out of this specification security relevant artifacts are generated for a target reference architecture based on upcoming Web service security standards. Additionally, we show how participants of a choreography use model dependencies to map the choreography specifications to interfaces for their local workflows.
Entrepreneur Behaviors on E-Commerce Security
Authors: Kyobe Michael
Published: May 2011

Electronic communication developments have always been associated with many security risks since the ARPANET implementation in 1960s. In 1972, John Draper (Captain Crunch) unlocked the AT&T phone network marking the beginning of the modern technology of hacking. Later in the 1980s, the seminal developments in the U.S. laid the conceptual and practical foundation for future electronic crime tools such as trapdoors, trojans, and viruses. More recently in the Internet environment, electronic attacks have reached an epidemic level (US-CERT, 2004). In South Africa alone, over 500 Web sites were defaced in January 2005 and e-crime losses are estimated at around 40 billion a year.
A Model of Information Security Governance for E-Business
Authors: Fink Dieter , Huegle Tobias , Dortschy Martin
Published: May 2011

This chapter identifies various levels of governance followed by a focus on the role of information technology (IT) governance with reference to information security for today’s electronic business (e-business) environment. It outlines levels of enterprise, corporate, and business governance in relation to IT governance before integrating the latter with e-business security management. E-business has made organisations even more reliant on the application of IT while exploiting its capabilities for generating business advantages. The emergence of and dependence on new technologies, like the Internet, have increased exposure of businesses to technology-originated threats and have created new requirements for security management and governance. Previous IT governance frameworks, such as those provided by the IT Governance Institute, Standards Australia, and The National Cyber Security Partnership, have not given the connection between IT governance and e-business security sufficient attention. The proposed model achieves the necessary integration through risk management in which the tensions between threat reduction and value generation activities have to be balanced.
Workarounds and Security
Authors: Brady Fiona
Published: May 2011

The project uses an actor network (ANT) framework. The value of this approach in relation to the adoption of technology is well established (Callon, 1987; Latour, 1996; Star, 1991; Law, 2000). ANT presents an alternative to the concept that innovations spread by diffusion. The adoption of innovation is seen rather as complex and unpredictable, laborious and political.
Policy-Based Management of Web and Information Systems Security
Authors: Perez Gregorio Martínez , García Clemente Félix J. , Gómez Skarmeta Antonio F.
Published: May 2011

Network, service, and application management today faces numerous challenges, ones that older ways of doing things cannot solve. The concept of policy-based management (PBM) addresses some of these problems and offers possible solutions. It provides a system-wide view of the network and its services and applications, and shifts the emphasis of network management and monitoring away from specific devices and interfaces toward users and applications. This chapter describes the technology on the policy-based management paradigm which is consideredrelevant for providing a common base for researchers and practitioners who need to understand the current status of this emerging technology and how it can be applied to the Web and information systems security field.
A Security Blueprint for E-Business Applications
Authors: Du Jun , Jiao Yuan-Yuan , Jiao Jianxin ("Roger")
Published: May 2011

This chapter develops a security blueprint for an e-business environment taking advantage of the three-tiered e-business architecture. This security blueprint suggests best practices in general. It involves (1) security control by layers — from physical access, to network communication, to operating systems, to applications, and (2) different stages of the management process, including planning, deployment, administration, and auditing. Also reported is a case study of the implementation of the proposed security blueprint in a Singapore multinational corporation. Such issues as security control analysis, management process analysis, and cost-benefits analysis are discussed in detail.
Malware and Antivirus Deployment for Enterprise Security
Authors: Sharman Raj , Krishna K. Pramod , Rao H. Raghov , Upadhyaya Shambhu
Published: May 2011

Threats to information security are pervasive, originating from both outside and within an organization. The history of computer security is dotted with the tales of newer methods of identification, detection, and prevention of malware, only to be followed by a new set of threats that circumvent those safeguards. The explosive growth of the Internet and wide availability of toolsets and documentation exacerbates this problem by making malware development easy. As blended threats continue to combine multiple types of attacks into single and more dangerous payloads, newer threats are emerging. Phishing, pharming, spamming, spoofing, spyware, and hacking incidents are increasing at an alarming rate despite the release of breakthrough security defense products. A multi-layered, integrated approach using different security products in conjunction with well-defined security policies and antivirus software will form the foundation for effective enterprise security management.
What is the Social Responsibility in the Information Age? Maximising Profits?
Authors: Stahl Bernd Carsten
Published: May 2011

Social responsibility is a highly popular term, and it seems to be of importance to what is happening in the information age. In this paper, the notion of social responsibility is analysed and its relationship to the information age is discussed. The result is that, while the term social responsibility may make sense, it is imperative to clarify its definition before drawing any further conclusions from it. On this condition, talking about social responsibility can be helpful in expressing some of the normative questions of the information age. If a clear definition is lacking, however, it might be a better idea to forget about the term rather than come to a counterintuitive conclusion as the one hinted at in the title of the paper, namely that it is an expression of social responsibility to maximise profits.
A Psychoanalytic Perspective of Internet Abuse
Authors: Kuo Feng-Yang
Published: May 2011

In this chapter I discuss Internet abuse from a psychoanalytic perspective. Internet abuse refers to the misuse of the Internet that leads to deterioration of both public and individual welfares. While past research has treated most computer abuse as the result of conscious decisions, the school of psychoanalysis provides insight into how the unconscious mind may influence one’s abusive conduct. Therefore, I argue that effective resolution of Internet abuse requires the knowledge of the unconscious mind. Although modern knowledge of this domain is still limited, I believe that this orientation is beneficiary to the construction of social systems embedding the Internet and their application to our work.
Insights from Y2K and 9/11 for Enhancing IT Security
Authors: Lally Laura
Published: May 2011

In the post-9/11 environment, there has been an increasing awareness of the need for information security. This chapter presents an analysis of the Y2K problem and 9/11 disaster from the perspective of Lally’s extension of Perrow’s Normal Accident Theory and the Theory of High Reliability Organizations. Insights into: 1) how characteristics of current IT infrastructures and organizational cultures make disasters more likely, 2) how organizations can respond to potential threats and mitigate the damage of those that do materialize, and 3) how IT can be used to identify future threats and mitigate their impact in the future, emerge from the analysis.
Security in Pervasive Computing
Authors: Das Sajal K. , Agah Afrand , Kumar Mohan
Published: May 2011

Security requirements for pervasive computing environments are different from those in fixed networks. This is due to the intensity and complexity of the communication between the user and the infrastructure, the mobility of the user, and dynamic sharing of limited resources. As pervasive computing makes information access and processing easily available for everyone from anywhere at anytime, the close relationship between distributed systems and mobile computing with a pervasive infrastructure leads us to take a closer look at different types of vulnerabilities and attacks in such environments. Pervasive computing includes numerous, often transparent, computing devices that are frequently mobile or embedded in the environment, and are connected to an increasingly ubiquitous network structure. For example, when an organization employs pervasive computing, the environment becomes more knowledgeable about the users’ behavior and, hence, becomes more proactive with each individual user as time passes. Therefore, the user must be able to trust the environment and the environment must be confident of the user’s identity. This implies security is an important concern in the success of pervasive computing environments. In this chapter we evaluate the suitability of existing security methods for pervasive environments.
Analysis and Justification of Privacy from a Buddhist Perspective
Authors: Hongladarom Soraj
Published: May 2011

The perspective of various Buddhist traditions offers an illuminating insight into the nature and justification of the concept of privacy in information ethics. This chapter begins by outlining the major literature in the West that deals with the issue. What has emerged in the literature is a common assumption of a separately existing individual whose privacy needs to be protected. Then I present the thoughts of two Buddhist thinkers, Nagasena (1894) and Nagarjuna (1995), who are representatives of the two major traditions: Theravada and Mahayana, respectively. The two Buddhist saints agree that the concept of privacy is a construct, since it presupposes the inherently existing individual, which runs contrary to the basic Buddhist tenet of no-self. However, this does not mean that there can be no analysis and justification of privacy in Buddhism, because there is the distinction between two views regarding reality—the conventional and the ultimate views. Both are indispensable.
Computer Security in Electronic Government
Authors: Radl Alison , Chen Yu-Che
Published: May 2011

As e-government projects proliferate at all levels of government, and as they transition from voluntary to mandatory participation, close examination is required, particularly the examination of security issues. The CIA (confidentiality, integrity, availability) model offers a framework for examining e-government projects. This study examines the factors impacting security, using as a case study an education information system in the 2003-2004 school year. The study focuses on how CIA factors relate to a host of variables, such as school district size, software selection, technology staffing, technical competence and support, awareness of security issues, and project commitment. For the organizations participating in the project, typical factors of district size and software selection are found to be insignificant, and technical support is identified as one of the key factors promoting security.
Integrating Security and Software Engineering
Authors: Mouratidis H. , Giorgini P.
Published: May 2011

The previous chapters of this book have presented promising approaches in the secure software engineering ?eld. However, the ?eld is still in its infancy and a number of challenges still need to be answered. The main aim of this chapter is to list and discuss nine challenges that we ?nd important for the advance of the secure software engineering ?eld. The main idea behind each challenge is presented in a short sentence followed by a discussion, which indicates why the challenge is important. In some cases, the discussion provides some ideas of how the challenge could be met.
Analyzing the Privacy of a Vickrey Auction Mechanism
Authors: Rodriguez Ismael , Lopez Natalia
Published: May 2011

This article studies the properties of a distributed mechanism to perform the Vickrey auction. This mechanism, which was originally presented in López, Núñez, Rodríguez, and Rubio (2004), has the main characteristic that most of the information concerning the bids is kept private for both bidders and the auctioneer without the necessity of any trusted third party. In particular, after the auction is finished, only the value of the second-highest bid and the identity of the highest bidder are publicly revealed. However, in that paper, several questions about the applicability of the protocol were left unanswered. In particular, no implementation was provided. Besides, the analysis of the collusion risk was too brief. In this paper, we address these issues in a deeper way. Let us note that, as it is stated in Brandt and Sandholm (2004), it is impossible to create a completely private mechanism to perform the Vickrey auction. In particular, we identify a gap between the proposed protocol and the complete privacy: If any n-2 bidders and the winning bidder collude, the privacy is lost. Besides, some privacy properties can be broken by chance if some specific situations appear, though the probability of this threat decreases as the number of bidders increases. In addition, we present and analyze a simple implementation of the protocol, and we consider its practical applicability.
Computer Security and Risky Computing Practices
Authors: Aytes Kregg
Published: May 2011

Despite rapid technological advances in computer hardware and software, insecure behavior by individual computer users continues to be a significant source of direct cost and productivity loss. Why do individuals, many of whom are aware of the possible grave consequences of low-level insecure behaviors such as failure to backup work and disclosing passwords, continue to engage in unsafe computing practices? In this chapter we propose a conceptual model of this behavior as the outcome of a boundedly rational choice process. We explore this model in a survey of undergraduate students (N = 167) at two large public universities. We asked about the frequency with which they engaged in five commonplace but unsafe computing practices, and probed their decision processes with regard to these practices. Although our respondents saw themselves as knowledgeable, competent users and were broadly aware that serious consequences were quite likely to result, they reported frequent unsafe computing behaviors. We discuss the implications of these findings both for further research on risky computing practices and for training and enforcement policies that will be needed in the organizations that these students will be entering shortly.
Information Technology as a Target and Shield in the Post 9/11 Environment
Authors: Lally Laura
Published: May 2011

This paper draws upon Normal Accident Theory and the Theory of High Reliability Organizations to examine the potential impacts of Information Technology being used as a target in terrorist and other malicious attacks. The paper also argues that Information Technology can also be used as a shield to prevent further attacks and mitigate their impact if they should occur. A Target and Shield model is developed, which extends Normal Accident Theory to encompass secondary effects, change and feedback loops to prevent future accidents. The Target and Shield model is applied to the Y2K problem and the emerging threats and initiatives in the Post 9/11 environment.
Community-Based Information Networking in Developing Countries
Authors: Rahman Hakikur
Published: May 2011

The information era refers to a period in this globalized world when economies, social dimensions, and demography are largely dominated and driven by information, in contrast to the previously industrial development driven society. Information society, information network, and digital divide are terms inducted in very recent days. The key element in this periphery, is the information, and it is the easy and free flow of information to the demand routes. Because of the information-based nature of the modern economy, the globalization of the telecommunication industry, and the interdependent global environment, the value of the global network grows and more users are interlinked. The information society is driven by information, similar to the industrial society. This society is produced by a reliance on information as the most significant factor in the terms of production. Hence, it relies on the information economy to produce products, services, employment, wealth, and lifestyle on which the community depends. Ultimately the whole community of a country can be benefited by optimum utilization of information to be flown into each territory of the society. Given the right incubation, a community based information network molded by information can accelerate the pace of development. Rapid advancements and convergence of information and communications technologies (ICTs) have a deep and far-ranging impact on economic, social, and political life. The increase in the speed of and variations in communication flows is catalyzing an unprecedented growth in the exchange of ideas, goods, and services. Government, organizations and businesses that ignore this development and lag behind in adaptation risk themselves becoming uncompetitive, marginalized and out of the game (ABDI, 2002). Efforts have been given to accommodate propositions on fabricating nationwide information networks through utilization of the existing information backbones especially in developing countries, and a centrally driven content repository may eventually be established.
E-Readiness and Successful E-Commerce Diffusion in Developing Countries
Authors: Molla Alemayehu
Published: May 2011

This chapter explores the impact of organizational and environmental e-readiness factors on the successful diffusion of e-commerce. It presents a conceptual framework of e-readiness and e-commerce success, identifies the constructs and variables to operationalize the framework and reports the e-readiness and e-commerce success assessments of a sample of business organizations from South Africa. Business managers and policy makers, by understanding the e-readiness factors affecting e-commerce diffusion can make effective decisions to exploit specific e-commerce opportunities. Furthermore, researchers can use the developed framework to study the level of e-commerce adoption, the success of the process that led to it and the benefits to users, organizations and the economy.
ICT and Business in the New Economy
Authors: Sagi John , Carayannis Elias , Dasgupta Subhashish , Thomas Gary
Published: May 2011

Many authors argue that information and communications technology (ICT) in this New Economy is causing a globalized, unified society. Others take the opposite stand, viewing local factors such as national culture as very important to the success of information technology (IT). Research indicates that related factors such as gender may also play important roles in the use and acceptance of IT. This paper uniquely examines these perspectives by using electronic commerce as the common technology. Business students from the U.S., Greece and England expressed opinions on the important issues of national control, privacy cost, property rights and consumer preferences. The authors find evidence that concludes that there are statistically significant differences in attitude about e-commerce among cultural groups, but not with gender.
The Internet and Global Markets
Authors: Ortega Egea José Manuel , Menedez Manuel Recio
Published: May 2011

This chapter examines the impact of the Internet and related technologies on global marketing activities (global e-marketing), under consideration of the following aspects: • Special implications for multinational corporations (MNCs) and small and medium-sized companies (SMCs) • Distinction between business-to-consumer (B2C) and business-to-business (B2B) markets • Role of the Internet as a complementary or supplementary marketing channel In order to clarify the special characteristics and challenges involved in global e-marketing practices, the authors have carried out a review of related empirical and conceptual research. The following conclusions can be drawn with regard to the characteristics of reviewed studies: 1. Due to the global nature of the Internet, relatively little research explicitly accounts for the differences between domestic and global e-marketing practices. Further research is needed on issues directly related to the Internet “global reach.” 2. Relatively more studies analyze global Internet marketing from a theoretical point of view. Academics are recently recognizing the need to carry out empirical research, both in B2C and B2B online environments.
Web-Based Distance Learning and the Second Digital Divide
Authors: Burghstahler Sheryl
Published: May 2011

Web-based distance learning programs promise learning options anywhere, anytime, to anyone. However, some individuals with disabilities are locked out of these opportunities when courses are designed in such a way that they are inaccessible to individuals using assistive technology. This chapter provides an overview of access challenges for people with disabilities; suggestions for course developers on creating accessible courses; and suggestions for administrators on developing accessiblity policies, guidelines, and procedures.
Large-Scale Sustainable Information Systems Development in a Developing Country
Authors: Okunoye Adekunle
Published: May 2011

Information technology (IT) transfer to developing countries is often affected by various problems. Most available application packages are too expensive and were originally designed to work in a developed economy. The international features of the application packages reduced the problems associated with long duration and huge cost of customization. Nevertheless, there are still some processes that require many peculiar requirements that customization of the off-the-shelf applications cannot meet. With the rapid changes in IT and the business environment, it is becoming essential to rely on information system that can be sustained and upgraded without much cost in order to meet those changes. This case describes a project for the development of such a system. We present the background of the IT company and an Islamic bank as the customer. We highlight the circumstances that led to their decision to develop the systems locally. We discuss the facts that surround the development of the system: the outsourcing decision made by the African Arab Islamic Bank (AFAIB), the project management and systems development at Technology Associates Ltd. (TA), and other information system issues related to developing countries and their effect on the project’s success.
Software Confederation - An Architecture for Global Systems and Global Management
Authors: Kral Jaroslav , Zemlicka Michal
Published: May 2011

Many (especially the large) software systems tend to be virtual peer-to-peer (P2P) networks of permanent autonomous services (e.g., e-government should be supported by the network of information systems of individual offices). The services are loosely coupled, a service can join/leave the system quite easily. We call such networks software confederation (SWC). The paradigm of the SWC is orthogonal to the paradigm of the object-oriented methodology. The architecture of SWC is an engineering necessity in the case of global or very large information systems (IS) and provides many software engineering advantages like incremental development, openness, modifiability, maintainability, etc. SWC is a necessity in many other cases. SWC supports the trend of large enterprises or modern states to be decentralized, dynamic, and able to work in the time of globalization. Software confederations are the result of the tendency to globalization, and at the same time, the tool allowing of implementation of IS for a globalized society. SWC changes basic features of a CEO’s work as well as a CIO’s. In both cases, it supports the decentralization. This paper discusses the motivation of software confederations, the techniques of their design and implementation, including the use of XML (inclusive SOAP-UDDI), their software engineering advantages, relation to object-oriented technology and methodological consequences of their use. The main conclusion is that the concept of SWC is the crucial for the future software and information technologies and substantially changes the management tasks of the CIO and CEO.