Orientador: Jacques Wainer / Dissertação (mestrado) - Universidade Estadual de Campinas, Instituto de Computação / Made available in DSpace on 2018-08-08T19:38:38Z (GMT). No. of bitstreams: 1 Negrello_Fabio_M.pdf: 913255 bytes, checksum: eed18216c9a5ecc1e0eadf834fed5bc5 (MD5) Previous issue date: 2007 / Resumo: Esta dissertação apresenta um modelo discricionário de delegação que permite controlar a formação de cadeias de delegações, tanto através da limitação no comprimento de tais cadeias, como através da definição de condições para utilização e aceitação de novas delegações. Juntamente com o mecanismo de delegação proposto, é apresentado um mecanismo de revogação que considera o máximo comprimento de cada cadeia de delegações, e a relação de força entre delegações, permitindo assim que os sujeitos existentes permaneçam com o maior conjunto de direitos após uma revogação. Uma das principais vantagens em relação à definição de condições associadas à cada delegação é possibilidade de reforçar restrições por conteúdo e contexto. Enquanto o controle de acesso por conteúdo permite que o acesso a determinado objeto, ou recurso, seja controlado com base em atributos e características do próprio objeto em questão, o controle de acesso por contexto considera características de contexto relativas ao sistema como um todo, ou referentes ao contexto em que o usuário solicitou determinado acesso. Será apresentado um mecanismo que permite a utilização deste tipo de informação na definição de condições em delegações. Será apresentado um mecanismo para definição de proibições, que torna possível proibir que usuários utilizem determinadas direitos, mesmo que estes usuários tenham recebido, tais direitos através de delegaçõesde outros usuários do sistema. Através da utilização de condições também é possível a definição de delegações temporais, que são delegações que devem ser consideradas válidas somente durante determinados períodos de tempo, ou enquanto condições de dependência em relação a outras delegações forem atendidas, como será discutido. Finalmente, será apresentado um arcabouço de um servidor de autorizações, que permitiu avaliar o modelo proposto. Neste arcabouço foram implementados os principais algoritmos apresentados, e foi formulada uma arquitetura unificada para criação e revogação de delegações, bem como para verificação de autorizações / Abstract: This thesis presents a model of delegation that makes it possible to control the creation of delegation chains, both by limiting the lenght of such chains, and by defining restrictions for the use and acceptance of new delegations. Together with the proposed delegation mechanism, it is presented a revocation mechanism that considers the maximum length of each delegation chain, and the strength relation between delegations, allowing the existing subjects to retain the maximum set of rights after a revocation. One of the biggest advantages regarding the definition of conditions associated with each delegation is the possibility of enforcing context and content based restrictions. While the content based access control allows the access to a specific object to be controlled based on its attributes and characteristics, the context based access control considers context information related to the system as a whole, or regarding the context in which a user made an access request. It will be presented a mechanism that allows the use of this type of information in the definition of conditions in delegations. A prohibition mechanism will be presented, which prevents users from using certain rights, even though these users have received such rights through other users delegations. As it will be discussed, it is also possible, through the use of conditions, to define temporal delegations, which are delegations that must be considered valid only during specific periods of time, or while dependency condition regarding other delegations are met. Finally, it will be presented a prototype of an authorization server, that was used to validate the proposed model. In this prototype, the main algorithms were implemented, and a unified architecture was formulated both for the creation and recation of delegations, as well as for the verification of authorizations / Mestrado / Mestre em Ciência da Computação

Submitted by Luciana Ferreira (lucgeral@gmail.com) on 2017-02-23T13:12:16Z No. of bitstreams: 2 Dissertação - Elias Menta Macedo - 2017.pdf: 1407496 bytes, checksum: ce7379523898d912ffaab559d8fd59fe (MD5) license_rdf: 0 bytes, checksum: d41d8cd98f00b204e9800998ecf8427e (MD5) / Approved for entry into archive by Luciana Ferreira (lucgeral@gmail.com) on 2017-02-23T13:13:18Z (GMT) No. of bitstreams: 2 Dissertação - Elias Menta Macedo - 2017.pdf: 1407496 bytes, checksum: ce7379523898d912ffaab559d8fd59fe (MD5) license_rdf: 0 bytes, checksum: d41d8cd98f00b204e9800998ecf8427e (MD5) / Made available in DSpace on 2017-02-23T13:13:18Z (GMT). No. of bitstreams: 2 Dissertação - Elias Menta Macedo - 2017.pdf: 1407496 bytes, checksum: ce7379523898d912ffaab559d8fd59fe (MD5) license_rdf: 0 bytes, checksum: d41d8cd98f00b204e9800998ecf8427e (MD5) Previous issue date: 2017-01-23 / Coordenação de Aperfeiçoamento de Pessoal de Nível Superior - CAPES / Throughout this dissertation, the aim is to verify if the Programa de Atenção Integral ao Louco Infrator (Program of Full Attention to the Mad Infractor) is a valid alternative to the model that currently takes place in the judicial asylums and custody hospitals, and whether it is capable of becoming a common practice worthy of being nationalized due to its results and to the treatment offered to the patients – and if it is compatible with the principles and values scribed by the Constitution of the Federative Republic of Brazil of 1988. Hence, our starting point is a historical analysis of the treatment given to people with mental suffering in Brazil, highlighting its fundamental historical marks and normative orientations, as well as emphasizing the emerging of the medical speciality known as Psychiatry and its unfolding until these days. We discuss about theoretical references that precede the Brazilian psychiatric reform and also the reformed Psychiatry; we broach the anti-asylum fight movement, the Brazilian Law Project 3.657/1989 and the promulgation of the Bill 10.216/2001. After the historical discussion being set, we examine essential concepts in order to comprehend how the individuals with mental suffering are seen, especially those in conflict with the law; concepts such as biopower, the life unworthy of being lived, total institutions, disciplinary power, the fabrication of docile bodies, stigma, diversion and the figure of the outsider. Subsequently to this conceptualization, we make considerations about the security measures before the promulgation of the Bill 10.216/2001, about the PAILI and its regulatory milestones and also confront the 2011 Census data – which bring an overall vison on the the national reality of the security measures – with those concerning the PAILI, which demonstrate the reality of Goiânia, Brazil. Lastly, we analyze the concepts that have been studied throughout the dissertation and we present our conclusions regarding the originary hypothesis of this work. / No transcorrer da presente dissertação busca-se verificar se o Programa de Atenção Integral ao Louco Infrator é uma alternativa ao modelo posto dos manicômios judiciais e hospitais de custódia, capaz de se tornar uma prática que deva ser nacionalizada em virtude de seus resultados e do tratamento que é oferecido aos pacientes, e se coaduna com os princípios e valores insculpidos na Constituição da República Federativa do Brasil de 1988. Para isso, partimos de uma análise histórica do tratamento da pessoa com sofrimento mental no Brasil, destacando marcos históricos fundamentais e orientações normativas, bem como evidenciando o surgimento da especialidade médica conhecida como psiquiatria e seus desdobramentos até os dias atuais. Discorremos sobre referenciais teóricos que antecedem à reforma psiquiátrica e a psiquiatria reformada [apontando seus modelos], tratamos sobre o movimento da luta antimanicomial, sobre o projeto de Lei 3.657/1989 e sobre a promulgação da Lei 10.216/2001. Passada a discussão histórica, tratamos sobre conceitos fundamentais para compreensão da visão da pessoa com sofrimento mental, especialmente aquela em conflito com a lei, discorrendo sobre biopoder, vida indigna de ser vivida, instituições totais, poder disciplinar, fabricação de corpos dóceis, estigma, desvio e a figura do outsider. Após essa necessária conceituação, tecemos considerações sobre as medidas de segurança antes da promulgação da Lei 10.216/2001, sobre o PAILI e seus marcos regulamentatórios e confrontamos o Censo de 2011 – que traz um panorama da realidade nacional da medida de segurança – com os dados do referido programa que demonstram a realidade goiana. Por fim, analisamos os conceitos trabalhados ao longo da dissertação e apresentamos nossas conclusões quanto à hipótese originária desse trabalho.

Submitted in fulfillment of the requirements for the Degree of Master in Technology: Public Administration-Peace Studies, Durban University of Technology, 2017. / Since Zimbabwe’s independence in 1980, the issue of achieving sustainable peace and development has remained a challenge due to a lack of comprehensive approaches to issues of human rights violations. With such a problem, it becomes easy for individuals and society to use violence as a means to an end and, thus, it has become culturally acceptable, not only in political spheres but also in the school sphere. Therefore, this study aims to promote positive attitudes among students to reduce levels of bullying and to enable to realise the prevention mechanisms that exist within themselves through an action research intervention. Action research with a group of ten students was used create awareness on the negative impact of bullying and also the importance of creating and maintaining peaceful schools. Research proved that violent behaviour among students appears to be a serious problem at Prince Edward School and at Cranborne High School. I worked together with students in two schools to design, implement and evaluate a programme designed to reduce bullying behaviour. It is recommended that students, academic staff, police and the Ministry of Education work together to design interventions that include students in reducing bullying in schools. / M

The challenge of having to create and remember a secure password for each user account has become a problem for many computer users and can lead to bad password management practices. Simpler and less secure passwords are often selected and are regularly reused across multiple user accounts. Computer users within corporations and institutions are subject to password policies, policies which require users to create passwords of a specified length and composition and change passwords regularly. These policies often prevent users from reusing previous selected passwords. Security vendors and professionals have sought to improve or even replace password authentication. Technologies such as multi-factor authentication and single sign-on have been developed to complement or even replace password authentication. The objective of the study was to investigate the password habits of South African computer and internet users. The aim was to assess their attitudes toward password security, to determine whether password policies affect the manner in which they manage their passwords and to investigate their exposure to alternate authentication technologies. The results from the online survey demonstrated that password practices of the participants across their professional and personal contexts were generally insecure. Participants often used shorter, simpler and ultimately less secure passwords. Participants would try to memorise all of their passwords or reuse the same password on most of their accounts. Many participants had not received any security awareness training, and additional security technologies (such as multi-factor authentication or password managers) were seldom used or provided to them. The password policies encountered by the participants in their organisations did little towards encouraging the users to apply more secure password practices. Users lack the knowledge and understanding about password security as they had received little or no training pertaining to it.

Careful examination of the composition and concentration of malicious traffic in transit on the channels of the Internet provides network administrators with a means of understanding and predicting damaging attacks directed towards their networks. This allows for action to be taken to mitigate the effect that these attacks have on the performance of their networks and the Internet as a whole by readying network defences and providing early warning to Internet users. One approach to malicious traffic monitoring that has garnered some success in recent times, as exhibited by the study of fast spreading Internet worms, involves analysing data obtained from network telescopes. While some research has considered using measures derived from network telescope datasets to study large scale network incidents such as Code-Red, SQLSlammer and Conficker, there is very little documented discussion on the merits and weaknesses of approaches to analyzing network telescope data. This thesis is an introductory study in network telescope analysis and aims to consider the variables associated with the data received by network telescopes and how these variables may be analysed. The core research of this thesis considers both novel and previously explored analysis techniques from the fields of security metrics, baseline analysis, statistical analysis and technical analysis as applied to analysing network telescope datasets. These techniques were evaluated as approaches to recognize unusual behaviour by observing the ability of these techniques to identify notable incidents in network telescope datasets

Smartphones are proliferating into the workplace at an ever-increasing rate, similarly the threats that they pose is increasing. In an era of constant connectivity and availability, information is freed up of constraints of time and place. This research project delves into the risks introduced by smartphones, and through multiple cases studies, a maturity measurement model is formulated. The model is based on recommendations from two leading information security frameworks, the COBIT 4.1 framework and ISO27002 code of practice. Ultimately, a combination of smartphone specific risks are integrated with key control recommendations, in providing a set of key measurable security maturity components. The subjective opinions of case study respondents are considered a key component in achieving a solution. The solution addresses the concerns of not only policy makers, but also the employees subjected to the security policies. Nurturing security awareness into organisational culture through reinforcement and employee acceptance is highlighted in this research project. Software consultancies can use this model to mitigate risks, while harnessing the potential strategic advantages of mobile computing through smartphone devices. In addition, this research project identifies the critical components of a smartphone security solution. As a result, a model is provided for software consultancies due to the intense reliance on information within these types of organisations. The model can be effectively applied to any information intensive organisation.

The correlation between employee theft and various employee attitudes is investigated with 489 subjects from a large discount store chain located in the southeastern United States. Subjects completed two tests: Personnel Decisions, Inc. 's Employment Inventory/Customer Service Inventory which measures employee reliability and orientation toward providing customer service; and the Organization Responsiveness Questionnaire which measures satisfaction and perceived store security. Individual scores on the tests were correlated with a performance rating form completed by the subject's supervisor. Scores were computed for each store and correlated with inventory shrinkage rates. Results revealed relatively weak correlations for some variables. The multiple regression analysis was unable to significantly predict any of the criterion variables.

This research seeks to derive and examine a multidimensional definition of information security awareness, investigate its antecedents, and analyze its effects on compliance with organizational information security policies. The above research goals are tested through the theoretical lens of technology threat avoidance theory and protection motivation theory. Information security awareness is defined as a second-order construct composed of the elements of threat and coping appraisals supplemented by the responsibilities construct to account for organizational environment. The study is executed in two stages. First, the participants (employees of a municipality) are exposed to a series of phishing and spear-phishing messages to assess if there are any common characteristics shared by the phishing victims. The differences between the phished and the not phished group are assessed through multiple discriminant analysis. Second, the same individuals are asked to participate in a survey designed to examine their security awareness. The research model is tested using PLS-SEM approach. The results indicate that security awareness is in fact a second-order formative construct composed of six components. There are significant differences in security awareness levels between the victims of the phishing experiment and the employees who maintain compliance with security policies. The study extends the theory by proposing and validating a universal definition of security awareness. It provides practitioners with an instrument to examine awareness in a plethora of settings and design customized security training activities.

With recent advances in data-as-a-service (DaaS) and cloud computing, outsourcing data to the cloud has become a common practice. In a typical scenario, the data owner (DO) outsources the data and delegates the query processing service to a service provider (SP). However, as the SP is often an untrusted third party, the integrity of the query results cannot be guaranteed and is thus imperative to be authenticated. To tackle this issue, a typical approach is letting the SP provide a cryptographic proof, which can be used to verify the soundness and completeness of the query results by the clients. Despite extensive research on authenticated query processing for outsourced databases, existing techniques have only considered limited query types. They fail to address a variety of needs demanded by enterprise customers such as supporting aggregate queries over set-valued data, enforcing fine-grained access control, and using distributed computing paradigms. In this dissertation, we take the first step to comprehensively investigate the authenticated query processing in the cloud that fulfills the aforementioned requirements. Security analysis and performance evaluation show that the proposed solutions and techniques are robust and efficient under a wide range of system settings.

Agro-terrorism has become a major concern since the September 11, 2001, terrorist attacks due to characteristics that create unique problems for managing the threat of an agro-terrorist attack. The costs of trucking delays alone were in the tens of millions of dollars. Over the last few years, the government has spent billions of dollars on biological surveillance and record keeping in preventing potential attacks. Several public and private initiatives are currently in use. Examples include 1) the bio-terrorism regulation of 2004 on maintenance of records; 2) establishment of food protection centers for research and teaching excellence; and 3) investments in emerging technology, such as radio frequency monitoring (RFEM) technology, with the potential to track shipments and provide real-time data that can be used to prevent agro-terrorism risks along food supply chains. This thesis addresses the costs and risk premiums associated with alternative tracking strategies, where and when along the milk supply chain these strategies will reduce the most risks, and what policy implications are associated with the most costeffective tracking strategy. To accomplish these objectives, stochastic optimization is used to determine the costs and risk premiums of alternative tracking strategies. Next, the realoptions method along with a portfolio of options, also referred to as the "tomato garden" framework, is used to determine where and when alternative intervention strategies should be implemented to reduce the most risks. Finally, policy implications are derived on the cost-risk tradeoffs, probability of attacks, and containment efforts if there is an attack by using game theory to determine the incentives needed to motivate participants in the milk supply chain to invest in security measures.