title: Key factors in building a Secure Web Gateway

authors: Yeh, Jeffrey

subjects: Web proxy security

abstract: A Secure Web Gateway, according to Gartner’s definition, is a solution that provides URL filtering, malicious code detection and blocking, and application controls for cloud applications to filter out objectionable software/malware in outbound Internet traffic generated by end-user devices and has the capability to enforce corporate policy and regulatory compliance [1]. Its predecessor – Web proxy - has been around since the beginning of the Web and evolved to meet the needs of a fast changing Web ecosystem. Traditionally, Web proxy servers have been used to fulfil the following requirements: 1) Enable several machines to share a single Internet connection; 2) Improve Web performance and save bandwidth by caching repeatedly-accessed content locally; 3) Provide a basic URL filtering capability. However, these capabilities are no longer sufficient to meet the requirements of today’s Web ecosystem. Firstly, with the development of Network Address Translation in the late 1990s, the needs to use proxy servers to share an Internet connection has been superseded. Secondly, caching does not improve performance much for mobile clients, and mobile traffic volume has already exceeded that of desktop’s [2, 3]. Thirdly, a Web content filter based on using a URL database cannot keep up with the growth of Internet traffic [4]. In addition, it has become difficult to detect and stop threats such as Botnet and Advanced Persistent Threat [5] because of: 1) The polymorphic characteristics of the threats; 2) The increasing use of encryption on the Web; 3) The increase in threats targeting end-users - the weakest link; 4) The increasing need to use a variety of end-user devices from multiple locations such as the BRING YOUR OWN DEVICE (BYOD) policy requirement. Hence, there is an imminent need to evolve from the current Web proxy solution to a Secure Web Gateway solution. This research provides a categorisation of the key factors in building a Secure Web Gateway, proposes a reference design and architecture, a practical implementation for a home vDSL connection and finally, a testing framework that can be used to evaluate the effectiveness of a Secure Web Gateway deployment.

text: Key factors in building a Secure Web Gateway A Secure Web Gateway, according to Gartner’s definition, is a solution that provides URL filtering, malicious code detection and blocking, and application controls for cloud applications to filter out objectionable software/malware in outbound Internet traffic generated by end-user devices and has the capability to enforce corporate policy and regulatory compliance [1]. Its predecessor – Web proxy - has been around since the beginning of the Web and evolved to meet the needs of a fast changing Web ecosystem. Traditionally, Web proxy servers have been used to fulfil the following requirements: 1) Enable several machines to share a single Internet connection; 2) Improve Web performance and save bandwidth by caching repeatedly-accessed content locally; 3) Provide a basic URL filtering capability. However, these capabilities are no longer sufficient to meet the requirements of today’s Web ecosystem. Firstly, with the development of Network Address Translation in the late 1990s, the needs to use proxy servers to share an Internet connection has been superseded. Secondly, caching does not improve performance much for mobile clients, and mobile traffic volume has already exceeded that of desktop’s [2, 3]. Thirdly, a Web content filter based on using a URL database cannot keep up with the growth of Internet traffic [4]. In addition, it has become difficult to detect and stop threats such as Botnet and Advanced Persistent Threat [5] because of: 1) The polymorphic characteristics of the threats; 2) The increasing use of encryption on the Web; 3) The increase in threats targeting end-users - the weakest link; 4) The increasing need to use a variety of end-user devices from multiple locations such as the BRING YOUR OWN DEVICE (BYOD) policy requirement. Hence, there is an imminent need to evolve from the current Web proxy solution to a Secure Web Gateway solution. This research provides a categorisation of the key factors in building a Secure Web Gateway, proposes a reference design and architecture, a practical implementation for a home vDSL connection and finally, a testing framework that can be used to evaluate the effectiveness of a Secure Web Gateway deployment.

year: 2017

title: Dependence of the IBEX Ribbon Geometry on Pitch-Angle Scattering outside the Heliopause

authors: Zirnstein, E. J.

subjects: Science & Technology

abstract: Interstellar Boundary Explorer (IBEX) observations of the “ribbon” of enhanced energetic neutral atom (ENA) fluxes show that it is a persistent feature that approximately forms a circle in the sky, likely formed from secondary ENAs whose source lies outside the heliopause. The IBEX ribbonʼsgeometry(radius and center) depends on ENA energy and is believed to be influenced by the draping of the ISMF and the latitudinal structure of the SW. In this study, we demonstrate that the ribbonʼs geometry also depends on the pitch-angle scattering rate of ions outside the heliopause, which we simulate under strong and weak-scattering limits. The ribbon radius in the weak-scattering model is ∼4° larger than IBEX observations at most energies, and the strong-scattering model produces radii statistically consistent with IBEX at 1.1–2.7 keV. The simulated ribbon center is shifted between ∼2° and 5° along the B–V plane away from the IBEX center for the weak and strong limits, respectively, suggesting that the pristine ISMF far from the heliosphere is shifted ∼2°–5° away from our simulated ISMF toward the VLISM inflow direction. However, the magnitude needs to be decreased from ∼3to2μG for the weak-scattering model to be consistent with the IBEX ribbon radius, which seems unlikely. We also f ind that the presence of interstellar He does not significantly affect the ribbon in the strong-scattering limit but yields weaker agreement with data in the weak limit. Our results slightly favor the strong-scattering limit for the ribbonʼs origin.

text: Dependence of the IBEX Ribbon Geometry on Pitch-Angle Scattering outside the Heliopause Interstellar Boundary Explorer (IBEX) observations of the “ribbon” of enhanced energetic neutral atom (ENA) fluxes show that it is a persistent feature that approximately forms a circle in the sky, likely formed from secondary ENAs whose source lies outside the heliopause. The IBEX ribbonʼsgeometry(radius and center) depends on ENA energy and is believed to be influenced by the draping of the ISMF and the latitudinal structure of the SW. In this study, we demonstrate that the ribbonʼs geometry also depends on the pitch-angle scattering rate of ions outside the heliopause, which we simulate under strong and weak-scattering limits. The ribbon radius in the weak-scattering model is ∼4° larger than IBEX observations at most energies, and the strong-scattering model produces radii statistically consistent with IBEX at 1.1–2.7 keV. The simulated ribbon center is shifted between ∼2° and 5° along the B–V plane away from the IBEX center for the weak and strong limits, respectively, suggesting that the pristine ISMF far from the heliosphere is shifted ∼2°–5° away from our simulated ISMF toward the VLISM inflow direction. However, the magnitude needs to be decreased from ∼3to2μG for the weak-scattering model to be consistent with the IBEX ribbon radius, which seems unlikely. We also f ind that the presence of interstellar He does not significantly affect the ribbon in the strong-scattering limit but yields weaker agreement with data in the weak limit. Our results slightly favor the strong-scattering limit for the ribbonʼs origin.

year: 2021-02-01

title: Risk assessment for family violence aggressors in Aotearoa New Zealand

authors: Jolliffe Simpson, Apriel D.

subjects: Family violence

abstract: In recent decades Family Violence (FV) researchers have developed risk assessment instruments to enable practitioners to identify the people who are most likely to commit FV in the future, and the families who are most likely to experience ongoing harm. Indeed, risk assessments have become a standard procedure for FV practitioners who are frequently required to make decisions with potential ramifications for families’ safety and wellbeing. Yet, despite considerable developments in risk assessment research and practice, risk assessment instruments have limitations that curb their value to FV practice. In addition, such instruments should be empirically validated, but there is limited evidence for the validity of risk assessment instruments used by agencies that respond to FV in Aotearoa New Zealand. Therefore, in this thesis, we examined the risk assessment procedures that New Zealand Police and the Integrated Safety Response (ISR) used for FV, with the purpose of contributing to the evidence base about risk assessment for FV in New Zealand and identifying strengths, weaknesses, and opportunities for improvement.
This thesis contains three manuscripts either published in or submitted to peer-reviewed academic journals; as well as supplementary chapters that support, extend, and integrate the research findings. In the first manuscript, we examined the predictive validity of risk categories from the Dynamic Risk Assessment for family violence (DYRA) and Static Assessment of Family Violence Recidivism (SAFVR)—the two risk assessment instruments that New Zealand Police use when responding to FV cases—for a sample of 2,115 cases with FV episodes reported to police in Waikato and parts of Canterbury between 1 November – 9 December 2018 (1,817 of which had complete risk categories). We examined the instruments’ ability to predict recurrence (i.e., a further FV-related call for police service) at three intervals (3 days, 12 weeks, and 24 weeks), and found both instruments had a poor ability to discriminate between aggressors who had a recurrence and those who did not, with the SAFVR outperforming the DYRA, and the DYRA performing especially poorly for non-intimate partner cases, and aggressors who were Māori or women. 
In the second manuscript, we explored the risk assessments that Integrated Safety Response (ISR) triage team members conducted for a sub-sample of 842 cases with FV episodes reported to police between 1 – 14 November 2018. We examined the relationship between the factors triage teams recorded during their risk assessments and the risk categories the teams assigned, then tested the association of both the factors and categories with recurrence and physical recurrence within 24 weeks. The predictive validity of ISR triage teams’ risk categories was comparable to the results produced for the DYRA and SAFVR in manuscript one. The ISR risk categories again performed poorly for aggressors who were women, Māori, and for non-intimate partner cases; and overall, fewer than half of the factors triage teams recorded were associated with recurrence or physical recurrence. Then, in an additional chapter, we explored the triage teams’ factors’ utility for case management and found the factors could be used to create three sub-groups of cases with potential implications for their treatment and management. 
Finally, in the third manuscript, we modeled the behavioral patterns of 2,115 aggressors with a FV episode reported to police in Waikato and parts of Canterbury between 1 November – 9 December 2018, by collecting reports for further FV episodes involving those aggressors during the two years after the index episode. We used this information to describe three latent states behind the information reported to police and identified four common pathways through the latent states over time. We concluded this manuscript by discussing changes that could contribute to improvements in how risk for FV aggressors is conceptualized, assessed, and communicated in practice.
In each chapter, we discussed the theoretical and practical implications of the findings, before integrating those findings and implications in a general discussion chapter. Taken together, the results presented herein indicate that the risk assessment instruments used in New Zealand can predict risk for FV recurrence better than chance, but that those assessments should be further developed to improve their value to FV practice and ensure they adequately capture risk for different types of FV cases and groups of people. This thesis advanced our understanding of the limitations of—and opportunities in—risk assessment research and contributed to the evidence base for risk assessment for FV in New Zealand.

text: Risk assessment for family violence aggressors in Aotearoa New Zealand In recent decades Family Violence (FV) researchers have developed risk assessment instruments to enable practitioners to identify the people who are most likely to commit FV in the future, and the families who are most likely to experience ongoing harm. Indeed, risk assessments have become a standard procedure for FV practitioners who are frequently required to make decisions with potential ramifications for families’ safety and wellbeing. Yet, despite considerable developments in risk assessment research and practice, risk assessment instruments have limitations that curb their value to FV practice. In addition, such instruments should be empirically validated, but there is limited evidence for the validity of risk assessment instruments used by agencies that respond to FV in Aotearoa New Zealand. Therefore, in this thesis, we examined the risk assessment procedures that New Zealand Police and the Integrated Safety Response (ISR) used for FV, with the purpose of contributing to the evidence base about risk assessment for FV in New Zealand and identifying strengths, weaknesses, and opportunities for improvement.
This thesis contains three manuscripts either published in or submitted to peer-reviewed academic journals; as well as supplementary chapters that support, extend, and integrate the research findings. In the first manuscript, we examined the predictive validity of risk categories from the Dynamic Risk Assessment for family violence (DYRA) and Static Assessment of Family Violence Recidivism (SAFVR)—the two risk assessment instruments that New Zealand Police use when responding to FV cases—for a sample of 2,115 cases with FV episodes reported to police in Waikato and parts of Canterbury between 1 November – 9 December 2018 (1,817 of which had complete risk categories). We examined the instruments’ ability to predict recurrence (i.e., a further FV-related call for police service) at three intervals (3 days, 12 weeks, and 24 weeks), and found both instruments had a poor ability to discriminate between aggressors who had a recurrence and those who did not, with the SAFVR outperforming the DYRA, and the DYRA performing especially poorly for non-intimate partner cases, and aggressors who were Māori or women. 
In the second manuscript, we explored the risk assessments that Integrated Safety Response (ISR) triage team members conducted for a sub-sample of 842 cases with FV episodes reported to police between 1 – 14 November 2018. We examined the relationship between the factors triage teams recorded during their risk assessments and the risk categories the teams assigned, then tested the association of both the factors and categories with recurrence and physical recurrence within 24 weeks. The predictive validity of ISR triage teams’ risk categories was comparable to the results produced for the DYRA and SAFVR in manuscript one. The ISR risk categories again performed poorly for aggressors who were women, Māori, and for non-intimate partner cases; and overall, fewer than half of the factors triage teams recorded were associated with recurrence or physical recurrence. Then, in an additional chapter, we explored the triage teams’ factors’ utility for case management and found the factors could be used to create three sub-groups of cases with potential implications for their treatment and management. 
Finally, in the third manuscript, we modeled the behavioral patterns of 2,115 aggressors with a FV episode reported to police in Waikato and parts of Canterbury between 1 November – 9 December 2018, by collecting reports for further FV episodes involving those aggressors during the two years after the index episode. We used this information to describe three latent states behind the information reported to police and identified four common pathways through the latent states over time. We concluded this manuscript by discussing changes that could contribute to improvements in how risk for FV aggressors is conceptualized, assessed, and communicated in practice.
In each chapter, we discussed the theoretical and practical implications of the findings, before integrating those findings and implications in a general discussion chapter. Taken together, the results presented herein indicate that the risk assessment instruments used in New Zealand can predict risk for FV recurrence better than chance, but that those assessments should be further developed to improve their value to FV practice and ensure they adequately capture risk for different types of FV cases and groups of people. This thesis advanced our understanding of the limitations of—and opportunities in—risk assessment research and contributed to the evidence base for risk assessment for FV in New Zealand.

year: 2023