D.Phil. (Computer Science) / Security needs have changed considerably in the past decade as the economics of computer usage necessitates increased business reliance on computers. As more individuals need computers to perform their jobs, more detailed security controls are needed to offset the risk inherent in granting more people access to computer systems. Traditionally, computer security administrators have been tasked with configuring' , security systems by setting controls on the actions of users. This basically entails the compilation of access rules (contained in security profiles), which state who can access what resources in what way. The task of building these rules is of considerable magnitude and is in general not well understood. Adhoc approaches, characterized by exhaustive interviewing and endless printouts of organizational data repositories, are usually followed. In the end, too much is left to the discretion of the security administrators...

To ensure the likely success of an organisation’s Information Security Governance, discipline leaders recommend that organisations follow the guidelines as set out in Information Security Governance best practice documents. Best practices and related documents from the Information Security Governance discipline, as well as best practices and related documents from the Corporate Governance and Information Technology Governance disciplines, all include sections pertaining to Information Security, Information Security Governance and Information Technology assets. This study puts these sections together, and constructs an Information Security Governance model that combines all aspects of Information Security Governance. In theory, this model should guide an organisation to the ultimate level of Information Security Governance. / Prof. S. H. von Solms

The discussions presented in this dissertation have been undertaken in answer to the need for securing the intellectual assets stored on computer systems. Computer vulnerabilities and their influence on computer systems and the intellectual assets they possess are the main focus of this research. In an effort to portray the influence of vulnerabilities on a computer system, a method for assigning a measure of risk to individual vulnerabilities is proposed. This measure of risk, in turn, gives rise to the development of the vulnerability risk status of a computer system. In short, vulnerability risk status is the total measure of risk a computer system is exposed to according to its vulnerabilities, at a certain point in time. A prototype was developed to create the vulnerability risk status of a computer system, which summarizes the purpose of the research in this dissertation. The discussions start with background information concerning the influence of the inherent vulnerabilities on computer systems. A conceptual model is proposed for achieving the creation of the vulnerability risk status of a computer system. Later chapters are concerned with categorizing all known vulnerabilities so that the main areas of vulnerability within a computer system can be identified. Different security technologies and tools are also evaluated to determine those that could aid the creation of vulnerability risk status. A security tool is selected and the generic, architectural elements are manipulated to allow the added functionality of vulnerability risk status. In conclusion, discussions are evaluated to determine whether the problem statements have been addressed and thoroughly resolved. / Eloff, J.H.P., Prof.

M.Comm.

M.Com. (Information systems) / This study has its origin in the growing need for information systems to be classified as 'secure'. With the increasing use of Computer Aided Software Engineering (CASE) tools in the design of application systems for commercial use, the risks that exist in terms of information security have become more prominent. The importance of considering security during the analysis and design of an information system, in other words, on a logical level, is increasing daily. Usually security features are added to existing application systems on an ad hoc basis. Security design activities should become such an integrated part of systems analysis and design activities on a logical level, that a complete integration of the two fields, security and computer aided software engineering, can be achieved. The aim of this dissertation is to study the literature to discover existing approaches to this integration, and to extract the strengths from them and expand on those strengths in order to compile an approach that is completely implementable in the form of a prototype data flow design tool (DFD tool). The proposed approach to the secure analysis and design of an application system of a logical level, which is presented in Chapter 4, is designed in conjunction with H.A.S. Booysen [Booysen, Kasselman, Eloff - 1994]. Existing CASE-tools have also been studied by the author to determine their current capabilities, especially in terms of security definition activities, but also in terms of their support to the systems analyst during the analysis and design phases of the project life cycle when developing a target application system.

M.Sc. (Informatics) / A need has been identified for guidelines to Top Management on the implementation of an Information Security Policy and its associated documentation. In this dissertation, the Model for Information Security Documentation (lSD-model) for the organisation and content of documentation on information security is proposed. The proposed model is divided into three distinct levels respectively containing the Information Security Policy Document, the Goal Documents and the Application Guideline Documents. A document is placed on the different levels of the ISO-model according to the amount of detailed information it contains and the management level mainly concerned with that document. Guidelines are given regarding the content and format of each of the levels. Particular emphasis is laid on the Information Security Policy Document, which is the highest level, and a number of existing Information Security Policy Documents are evaluated according to the guidelines given for the lSD-model. Finally, a comparison is made between C. C. Wood's guidelines on Information Security Policies and those given for the ISO-model.

M.Comm. / Worldwide an increasing amount of legal credibility is being assigned to digital signatures and it is therefore of utmost importance to research and develop additional measures to secure the technology. The main goal of this dissertation is to research and identify areas in which the user’s private key, used for the digital signing of messages, is exposed to the risk of being compromised and then develop a prototype system (SecureSign) to overcome the identified vulnerabilities and secure the digital signing process. In order to achieve the above stated, use will be made of a cryptographic token, which will provide secure storage and a secure operational environment to the user’s private key. The cryptographic token is at the heart of SecureSign and it is where the user’s private key will be created, stored and used. All operations requiring the user’s private key will be performed on the token, which is equipped with its own processor for this purpose.

No description available.

In today’s business world, information has become the driving force of organizations. With organizations transmitting large amounts of information to various geographical locations, it is imperative that organizations ensure the protection of their valuable commodity. Organizations should ensure that only authorized individuals receive, view and alter the information. This is also true to Higher Education Institutions (HEIs), which need to protect its examination papers, amongst other valuable information. With various threats waiting to take advantage of the examination papers, HEIs need to be prepared by equipping themselves with an information security management system (ISMS), in order to ensure that the process of setting examination papers is secure, and protects the examination papers within the process. An ISMS will ensure that all information security aspects are considered and addressed in order to provide appropriate and adequate protection for the examination papers. With the assistance of information security concepts and information security principles, the ISMS can be developed, in order to secure the process of preparing examination papers; in order to protect the examination papers from potential risks. Risk assessment form part of the ISMS, and is at the centre of any security effort; reason being that to secure an information environment, knowing and understanding the risks is imperative. Risks pertaining to that particular environment need to be assessed in order to deal with those appropriately. In addition, very important to any security effort is ensuring that employees working with the valuable information are made aware of these risks, and can be able to protect the information. Therefore, the role players (within the examination paper preparation process (EPPP)) who handle the examination papers on a daily basis have to be equipped with means of handling valuable information in a secure manner. Some of the role players’ behaviour and practices while handling the information could be seen as vulnerabilities that could be exploited by threats, resulting in the compromise in the CIA of the information. Therefore, it is imperative that role players are made aware of their practices and iv behaviour that could result in a negative impact for the institution. This awareness forms part and is addressed in the ISMS.

The human being is commonly considered as being the weakest link in information security. Subsequently, as information is one of the most critical assets in an organization today, it is essential that the human element is considered in deployments of information security countermeasures. However, the human element is often neglected in this regard. Consequently, many criminals are now targeting the user directly to obtain sensitive information instead of spending days or even months trying to hack through systems. Some criminals are targeting users by utilizing various social engineering techniques to deceive the user into disclosing information. For this reason, the users of the Internet and ICT-related technologies are nowadays very vulnerable to various social engineering attacks. As a contribution to increase users’ social engineering awareness, a model – called SERUM – was devised. SERUM aims to cultivate social engineering resistance within a community through exposing the users of the community to ‘fake’ social engineering attacks. The users that react incorrectly to these attacks are instantly notified and requested to participate in an online social engineering awareness program. Thus, users are educated on-demand. The model was implemented as a software system and was utilized to conduct a phishing exercise on all the students of the Nelson Mandela Metropolitan University. The aim of the phishing exercise was to determine whether SERUM is effective in cultivating social engineering resistant behaviour within a community. This phishing exercise proved to be successful and positive results emanated. This indicated that a model like SERUM can indeed be used to educate users regarding phishing attacks.