This study identifies the impacts to the internal Information Technology (IT) department's policies and procedures caused by outsourcing selective IT functions and assesses the threats and opportunities to an internal IT group, presented by outsourcing selective IT functions. The trend to selectively outsource IT functions implies that this can be done with minimal disruption and risk to the IT departments policies and processes. This research investigates whether this assertion is valid and develops a model for internal IT departments to respond to the challenges presented by selective outsourcing. Existing models of outsourcing currently in use and available to organizations are reviewed to assess their suitability or adaptability for `selective outsourcing' and from this identifies which areas of internal IT policy and procedures are most impacted. An analysis of the threats and opportunities presented to the internal IT department is also provided. Research was conducted into one organization's experience with selective outsourcing to investigate how internal IT departments could approach selective outsourcing of internal IT functions and how internal IT departments could develop strategies for responding to the challenges posed by selective outsourcing. A case study was conducted of a recent selective outsourcing arrangement within the IT group of the target organization. The personal interview method was adopted to survey a cross section of management and staff from the work groups involved in the selective outsourcing arrangement. The results obtained revolved around the major themes of: 1. Planning (identified as time constraints, resource constraints and work load). 2. Management control (which encompasses the structuring of the outsourcing relationship, human resource concerns, level of ownership, communication, structure of the internal IT group and inter-departmental concerns). 3. Process (which applies to the quality of the procedures, inherent internal knowledge required, the informality of the procedures and concerns over adherence to procedures). For an IT group to develop strategies to respond to the challenges of selective outsourcing it was identified that the IT group needs to remove internal barriers to process and strive to achieve single ownership of processes within functional work groups; nurture a shift in internal groups thinking to more planning rather than doing; improve the quality of internal IT procedures and implement appropriate project team structures for task specific selective outsourcing engagements and for ongoing vendor relationship management.

Thesis (M. Phil.)--University of Hong Kong, 2007. / Title proper from title frame. Also available in printed format.

Thesis (M.S.)--Rochester Institute of Technology, 1981. / Typescript. Includes bibliographical references.

M.Sc. (Informatics) / Information is power. Any organization must secure and protect its entire information assets. Management is responsible for the well-being of the organization and consequently for computer security. Management must become and stay involved with the computer security situation of the organization, because the existence of any organization depends on an effective information system. One way in which management can stay continually involved and committed with the computer security situation of the organization, is by -, the periodic evaluation of computer security. The results from this evaluation process can initiate appropriate actions to increase computer security in areas needed. For effective management involvement, a tool is needed to aid management in monitoring the status of implementing computer security on a regular basis. The main objective of this dissertation is to develop such a management tool. Basically the thesis consists of three parts, namely framework for effective computer security evaluation, the definition of the criteria to be included in the tool and lastly, the tool itself. The framework (chapters 1 to 6) defines the basis on which the tool (chapters 7 to 9) is built, e.g. that computer security controls need to be cost-effective and should aid the organization in accomplishing its objectives. The framework is based on a two dimensional graph: firstly, tho various risk areas in which computer security should be applied and secondly, the severity of controls in each of these areas. The tool identifies numerous risk areas critical to the security of the computer and its environment. Each of these risk areas need to be evaluated to find out how well it is secured. From these results an overall computer security situation is pictured. The tool is presented as a spreadsheet, containing a number of questions. The built -in formulae in the spreadsheet perform calculations resulting in an appreciation of the computer security situation. The results of the security evaluation can be used by management to take appropriate actions regarding the computer security situation.

The increasing reliance on information technology to support business processes has emphasised the need for information security mechanisms. This, however, has resulted in an ever-increasing workload in terms of security administration. Security administration encompasses the activity of ensuring the correct enforcement of access control within an organisation. Access rights and their allocation are dictated by the security policies within an organisation. As such, security administration can be seen as a policybased approach. Policy-based approaches promise to lighten the workload of security administrators. Separation of duties is one of the principles cited as a criterion when setting up these policy-based mechanisms. Different types of separation of duty policies exist. They can be categorised into policies that can be enforced at administration time, viz. static separation of duty requirements and policies that can be enforced only at execution time, viz. dynamic separation of duty requirements. This dissertation deals with the specification of both static separation of duty requirements and dynamic separation of duty requirements in role-based workflow environments. It proposes a model for the specification of separation of duty requirements, the expressions of which are based on set theory. The model focuses, furthermore, on the enforcement of static separation of duty. The enforcement of static separation of duty requirements is modelled in terms of invariant conditions. The invariant conditions specify restrictions upon the elements allowed in the sets representing access control requirements. The sets are themselves expressed as database tables within a relational database management system. Algorithms that stipulate how to verify the additions or deletions of elements within these sets can then be performed within the database management system. A prototype was developed in order to demonstrate the concepts of this model. This prototype helps demonstrate how the proposed model could function and flaunts its effectiveness.

This thesis performs an investigation into issues concerning the broad area ofIdentity and Access Management, with a focus on open environments. Through literature research the issues of privacy, anonymity and access control are identified. The issue of privacy is an inherent problem due to the nature of the digital network environment. Information can be duplicated and modified regardless of the wishes and intentions ofthe owner of that information unless proper measures are taken to secure the environment. Once information is published or divulged on the network, there is very little way of controlling the subsequent usage of that information. To address this issue a model for privacy is presented that follows the user centric paradigm of meta-identity. The lack of anonymity, where security measures can be thwarted through the observation of the environment, is a concern for users and systems. By an attacker observing the communication channel and monitoring the interactions between users and systems over a long enough period of time, it is possible to infer knowledge about the users and systems. This knowledge is used to build an identity profile of potential victims to be used in subsequent attacks. To address the problem, mechanisms for providing an acceptable level of anonymity while maintaining adequate accountability (from a legal standpoint) are explored. In terms of access control, the inherent weakness of single factor authentication mechanisms is discussed. The typical mechanism is the user-name and password pair, which provides a single point of failure. By increasing the factors used in authentication, the amount of work required to compromise the system increases non-linearly. Within an open network, several aspects hinder wide scale adoption and use of multi-factor authentication schemes, such as token management and the impact on usability. The framework is developed from a Utopian point of view, with the aim of being applicable to many situations as opposed to a single specific domain. The framework incorporates multi-factor authentication over multiple paths using mobile phones and GSM networks, and explores the usefulness of such an approach. The models are in tum analysed, providing a discussion into the assumptions made and the problems faced by each model. / Adobe Acrobat Pro 9.5.1 / Adobe Acrobat 9.51 Paper Capture Plug-in

published_or_final_version / Business Administration / Master / Master of Business Administration

published_or_final_version / abstract / Electrical and Electronic Engineering / Master / Master of Philosophy

A methodology is proposed for optimizing the allocation of resources in the detection of computer fraud. The methodology consists of four major segments. First, a threat assessment is performed. A general threat assessment is provided which relies upon reported incidents of computer fraud. Then, recognizing the limitations of computer fraud reporting, a specific threat assessment technique is provided which is based entirely on the characteristics of a given computer system. Both the general and specific threat assessment techniques use a matrix approach which evaluates and assigns threat values by type of computer fraud and perpetrator. Second, a Detection Quotient is established which measures the effectiveness of computer fraud detection resource allocation for all of the possible combinations of computer fraud types and perpetrators. However, for many computer systems, the large number of possible resource allocation alternatives results in a Combinatorial Dilemma whereby the phenomenally large number of alternatives precludes comprehensive analysis. This leads to the third major segment of the dissertation, a General Solution to the Combinatorial Dilemma which ensures an alternative very near the optimum while evaluating only an extremely small percentage of possible alternatives. Fourth, a Resource Optimization Model is provided which, beginning with the results of the Threat Assessment, iteratively assigns varying levels of computer fraud detection resources to different fraud type and perpetrator combinations. Using the general solution to the Combinatorial Dilemma and the Detection Quotient as a measure of the effectiveness of each combination, the model produces a statistically defensible near optimum allocation of available resources to computer fraud detection. Also provided are the results of the research into reported cases of fraud in the form of a Typology. This Typology combines frequency of occurrence and dollar impact of reported cases of fraud into a measure of vulnerability for various types of fraud and perpetrator. Finally, an overview of investigative techniques and automated tools for evaluating the propriety of computer systems is provided.

Approved for public release; distribution is unlimited. / Since 1997, Government agencies have been implementing seat management approaches to information technology contracting. Also known as desktop outsourcing, seat management is a process whereby agencies outsource all maintenance and ownership of their desktop computers, including all required hardware, software, network support, maintenance, and help desk services with pricing computed an a per user - or per seat - basis. The Navy Marine Corps Intranet - or NMCI - is arguably the largest and most complex seat management effort undertaken to date. It is designed to eventually cover approximately 360,000 Navy and Marine Corps users. This thesis explores the seat management method of contracting and the challenges inherent in this method of acquiring desktop computing power. Such challenges include benchmarking technical performance requirements, establishing performance measures, creating effective incentives, preparing for the transition to seat management, and managing the required culture change. The NMCI program's approach to addressing these challenges is analyzed and recommendations are provided as to where improvements can be made in order to increase the likelihood that NMCI will achieve its expected benefits. / Department of the Navy author (civilian).