Search

Do you use Office 365 or Windows 10? How about GoDaddy to support your website? Has it been a while since you connected your iPhone to Wi-Fi instead of merely running off your data? Or is your Samsung phone more than 2 years old? Would it surprise you to learn that some of these products no longer receive security support or automatic updates? If so, you may be surprised to hear that you are being exposed to security risks, as many cyber incidences are the direct result of an absence of security patching and automatic updates. There are many reasons for this. Most companies provide security patches, but they are not always timely and many are not automated, requiring manual effort (often unbeknownst to consumers and businesses). Timely security patching is, upon discovery or notification of a security flaw in a system or product, the release of a security update within a reasonable time that patches and updates the security of a system—sometimes this is automatic, sometimes the security patch is merely a notification that you can and should patch your own system. A contributing factor to this is that there is no legal obligation to provide security support, let alone timely security support. This means that there is no legal requirement to patch known security vulnerabilities and bugs or issue automatic updates. This paper asks whether or not Australia should have a legal obligation to ensure timely security patching and require automatic updates by default in all consumer systems. Our conclusion: yes, it should, since many companies cannot be relied on to self-regulate and put their client’s security interests first, and the stakes in cybersecurity have become too high to continue with the status quo. We conclude by presenting our recommended pathway for legal reform.

The Wearable Internet of Medical Things (WIoMT) is a collective term for all wearable medical devices connected to the internet to facilitate the collection and sharing of health data such as blood pressure, heart rate, oxygen level, and more. Standard wearable devices include smartwatches and fitness bands. This evolving phenomenon due to the IoT has become prevalent in managing health and poses severe security and privacy risks to personal information. For better implementation, performance, adoption, and secured wearable medical devices, observing users’ perception is crucial. This study examined users’ perspectives of trust in the WIoMT while also exploring the associated security risks. Data analysed from 189 participants indicated a significant variance (R2 = 0.553) on intention to use WIoMT devices, which was determined by the significant predictors (95% Confidence Interval; p < 0.05) perceived usefulness, perceived ease of use, and perceived security and privacy. These were found to have important consequences, with WIoMT users intending to use the devices based on the trust factors of usefulness, easy to use, and security and privacy features. Further outcomes of the study identified how users’ security matters while adopting the WIoMT and provided implications for the healthcare industry to ensure regulated devices that secure confidential data.

As the threat landscape continues to evolve, users are becoming less aware, ignorant, or negligent, putting their confidential data at risk. Users easily fall prey to socially engineered ransomware attacks that encrypt and lock a computer or mobile device, holding it hostage unless a ransom is paid. The cryptoware encrypts data securely, making it almost impossible for anyone except the hacker to unlock the device. This research conducts a systematic review to identify methods for executing socially engineered ransomware attacks. Using a CRI framework, 122 studies were synthesized from 3209 research articles highlighting gaps in identifying and analyzing attack vectors, as well as the need for a holistic approach to ransomware with behavioural control as part of the solution. Human vulnerability was found to be a critical point of entry for miscreants seeking to spread ransomware. This review will be useful in developing control models that will educate organisations and security professionals to focus on adopting human-centered solutions to effectively counter ransomware attacks.

Internet Governance emerged as a contentious and key issue at the 2003 World Summit on the Information Society (WSIS) in Geneva. Against the backdrop of digital solidarity – the benefits of the Information Society should be shared amongst citizens of both developed and developing countries to ensure fair and equitable development for all – the author advocates the need for Civil Society to work together to develop a unified voice and a consolidated list of critical issues. The author provides an overview of some of the contentious issues leading up to the Geneva Phase of WSIS. The author also looks at some of the issues addressed in two critical meetings following the Geneva Summit: The International Telecommunication Union Workshop on Internet Governance (ITU Workshop) and the United Nations Information and Communications Technologies Task Force Global Forum on Internet Governance (UN Global Forum). This is followed by an analysis and discussion of what the author perceives to be the most important issues on Internet Governance from the perspective of enhancing human rights and promoting human dignity in the Information Society. The author identifies three prominent issues: appropriate and effective capacity building, language and cultural rights in the domain name system, and a cautionary approach to model laws which could impact on human rights. The author concludes by offering a strategy on how civil society can be most effective in its contribution to Internet Governance issues for the upcoming WSIS meeting in Tunis., Lors du Sommet mondial de la société de l’information (SMSI), qui se tenait à Genève en 2003, la question de la gouvernance de l’Internet est apparue non seulement comme la question clé du sommet mais également comme une question sujette à controverses. Dans un climat de solidarité numérique – les avantages tirés de la société de l’information devraient être partagés entre les citoyens de chaque pays, pays développés et pays en voie de développement, afin que soit garanti à chaque citoyen un développement de l’Internet juste et équitable – l’auteur insiste sur la nécessité pour la société civile de mener une réflexion commune afin de développer une ligne directrice et de consolider la liste des problèmes existants. L’auteur présente une vue d’ensemble des principales questions litigieuses mises de l’avant lors du sommet de Genève, qui constituait la première phase du SMSI. Elle s’intéresse ensuite à différentes problématiques débattues lors des deux réunions qui ont suivi le sommet de Genève : l’Atelier de l’Union internationale des télécommunications dédié à la gouvernance de l’Internet et le Forum concernant la gouvernance de l’Internet organisé par le Comité de réflexion des Nations Unies en charge des questions liées aux technologies de l’information et de la communication. Suivent alors un travail d’analyse ainsi qu’un débat relatif à ce que l’auteur perçoit, au regard de la protection des droits de l’homme et de la dignité humaine, comme constituant les plus importantes questions juridiques concernant la gouvernance de l’Internet. L’auteur identifie trois thèmes fondamentaux : l’intensification efficace et appropriée du renforcement capacités, la protection des droits culturels et linguistiques dans le système des noms de domaine et la prudence quant à la manière d’élaborer des lois qui pourraient éventuellement impacter les droits de l’homme. L’auteur clôt sa réflexion en proposant une stratégie portant sur la façon dont la société civile pourrait le plus efficacement apporter des solutions liées aux problèmes soulevés par la gouvernance de l’Internet, en vue de la prochaine rencontre SMSI à Tunis.

The role of the human in cyber security is well acknowledged. Many cyber security incidents rely upon targets performing specific behavioural actions, such as opening a link within a phishing email. Cyber adversaries themselves are driven by psychological processes such as motivation, group dynamics and social identity. Furthermore, both intentional and unintentional insider threats are associated with a range of psychological factors, including cognitive load, mental wellbeing, trust and interpersonal relations. By incorporating psychology into cyber security education, practitioners will be better equipped with the skills they need to address cyber security issues. However, there are challenges in doing so. Psychology is a broad discipline, and many theories, approaches and methods may have little practical significance to cyber security. There is a need to sift through the literature to identify what can be applied to cyber security. There are also pedagogical differences in how psychology and cyber security are taught and also psychological differences in the types of student that may typically study psychology and cyber security. To engage with cyber security students, it is important that these differences are identified and positively addressed. Essential to this endeavor is the need to discuss and collaborate across the two disciplines. In this paper, we explore these issues and discuss our experiences as psychology and cyber security academics who work across disciplines to deliver psychology education to cyber security students, practitioners and commercial clients.

Over the years, there has been a significant increase in cyber security risks and vulnerabilities with one of the most severe threat being ransomware attacks. Ransomware, a variant of malware, encrypts files, data, and often locks computer systems, and retains the decryption key until victims pay a ransom. Current method of ransomware mitigation is the analysis and classification of the ransomware and its variants to propose solution for detection and prevention. This mitigation approach omits technology users as part of the solution especially given their role in falling prey to ransomware by means of social engineering attack vectors. The purpose of this qualitative study was to highlight current and emerging ransomware vectors, and to identify cyber security awareness and education solutions that can be applied to mitigate socially engineered ransomware attacks. A semi-structured interview with executives and managers from several financial, technology, construction, transportation, education, and health industries revealed the lack of current awareness and training approaches to mitigate against socially engineered ransomware attacks. This study recommends some specific cybersecurity training and awareness approaches to consider in order to enable technology users resist and mitigate against ransomware attacks.

The Allens Hub for Technology, Law and Innovation is a community of scholars at UNSW Sydney aiming to add breadth and depth to research on the interactions among law, legal practice and technological change in order to enrich scholarly and policy debates and enhance understanding and engagement among the legal profession, the judiciary, industry, government, civil society and the broader community. The views of those participating in this submission are our own, based on our research, and do not represent the official views of UNSW Sydney or Allens. We were grateful for the opportunity to present our views at a consultation on 30 July 2018; this document attempts to summarise these in writing, taking account of the subsequent discussion at that event and conferral with colleagues after the event.

In the late 1980s, Australian hackers penetrated the United States National Aeronautics and Space Administration (NASA) computer system releasing a worm known as WANK (Worms Against Nuclear Killers...

The extent of Internet censorship in countries like China is regularly tested, but the testing methods used from within a censored country can entail risk for humans. A benevolent worm can be used for testing instead: the worm's self-replication, long the bane of suggested benevolent viruses and worms, is shown to be essential here. We describe the design of this benevolent worm, along with some other related applications for it. A technical, ethical, and legal analysis is provided.

Using Internet Service Provider 'Big' metadata as a case study, we examine legal and ethical issues with machine learning Big Data tools developed and deployed in Australia for law enforcement intelligence purposes. In order to do this, we outline the benefits, limitations and risks of these tools, analyze current methods for de-identification and anonymisation, and discuss necessary safeguards.

Leni Riefenstahl is one of the most controversial women and artists of the last century. Painter, actress, dancer, director genius, personal friend of Hitler, and commissioned film director of the Propaganda Ministry in Nazi Germany, Riefenstahl is both reviled and revered. She is best known for her direction of two films, Triumph of the Will (Riefenstahl 1935) and Olympia (Riefenstahl 1938).

Disclosure of security vulnerabilities attracts many different types of legal sanction. The most severe sanction is that of criminal law. This chapter identifies the main criminal offences that would apply to disclosure. The Convention on Cybercrime is briefly explained. The Convention is the only international agreement in the area, and virtually all Western democracies have adopted measures similar to those found in the Convention. The most important provision is what is known as “computer offences” which is often used interchangeably with “hacking offences.” Australia will be used as a case study for the examination of “computer offences” along with more general criminal sanctions such as conspiracy, aiding and abetting/facilitation of a crime, and possession of hacking devices. Additionally, there is discussion around the importance of security research and public interest exemptions to computer offences. At present there are no exceptions to most forms of hacking and disclosure of security vulnerabilities. Elements of responsible disclosure are discussed at the end of the chapter. Tables are provided in Appendix A examining the provisions found in the Convention with the laws of certain jurisdictions including California and Federal US Law, Canada, Hong Kong, India, Japan and the UK.

The method of discovering security vulnerabilities raises separate legal and ethical issues apart from the disclosure of such vulnerabilities. This chapter explains the various methods of discovering and disseminating vulnerabilities (such as the use of a honeynet, youtube concept of proof videos, zero day exploit markets) and provides for an explanation of each method, then uses a case study where possible to introduce legal and ethical issues.

This chapter considers legal areas outside the scope of criminal law. Civil liability and civil liberties are discussed in the context of security disclosure. These are: freedom of expression/free speech, copyright, tort of negligence, defamation, illegal telecommunications interception (surveillance), privacy law, data protection and data breach notification.

While there are many different types of vulnerability disclosure, two broad categories cover most situations. These are third party disclosure and self-disclosure. This chapter looks at a variety of motivations for each of these broad disclosure categories and draws on case studies where possible to provide context and as a means for introducing legal discussion. More detailed legal and ethical discussion is found in Chaps. 4 and 5.

Identity fraud as a term and concept in its formative stages was often presumed to be identity theft and visa versa. However, identity theft is caused by the identities (or tokens) of individuals or organisations being stolen is an enabling precursor to identity fraud. The boundaries of identity fraud and identity theft are now better defined. The absence of specific identity crime legislation could be a cause of perpetrators not classified as breaching identity crimes but under other specific entrenched law such as benefit fraud, or credit card fraud. This metrics overlap can cause bias in crime management information systems. This study uses a multi-method approach where data was collected in both a quantitative and qualitative manner. These approaches are used as a lens for defining different classes of online identity crimes in a crime management (IS) security context. In doing so, we contribute to a deeper understanding of identity crime by specifically examining its hierarchical classes and definitions; to aid clearer structure in crime management IS. We seek to answer the questions: should current law around identity fraud continue to be reinforced and measures introduced to prevent identity crime; should laws be amended; or should new identity crime laws be constructed? We conclude and recommend a solution incorporating elements of all three. Refereed/Peer-reviewed

Computers and robots have long been used in “physical” environments where it is too dangerous, hostile, or difficult for humans to perform tasks. What about situations where the danger stems from political and legal environments? This paper will look at the ethical and legal use of a computer worm to perform anti-censorship tasks. Two specific scenarios will be examined. The first will look at the use of a computer worm to monitor and test Internet censorship of “the Great Firewall of China”. The second will highlight the use of a worm for anonymous networks, and to deflect encryption detection through chaffing and winnowing. The third will look at the use of a computer worm to disseminate vital information in situations where public health is threatened by government censorship drawing on the health epidemics of AIDS, SARS and Avian Bird Flu in the People’s Republic of China. Ethical and legal issues will be examined in a general fashion and then within the framework of human rights and Confucius moral philosophy. Technical and political issues will also be examined to the extent that they better inform the ethical debate.

Censorship in the area of public health has become increasingly important in many parts of the world for a number of reasons. Groups with vested interest in public health policy are motivated to censor material. As governments, corporations, and organizations champion competing visions of public health issues, the more incentive there may be to censor. This is true in a number of circumstances: curtailing access to information regarding the health and welfare of soldiers in the Kuwait and Iraq wars, poor health conditions in Aboriginal communities, downplaying epidemics to bolster economies, and so forth. This paper will look at the use of a computer worm (the benevolent health worm) to disseminate vital information in␣situations where public health is threatened by government censorship and where there is great risk for those who ‹speak out’. The discussion of the benevolent health worm is focused on the Peoples’ Republic of China (China) drawing on three public health crises: HIV/AIDS, SARS and Avian Influenza. Ethical issues are examined first in a general fashion and then in a specific manner which uses the duty-based moral philosophy of Confucianism and a Western human rights-based analysis. Technical, political and legal issues will also be examined to the extent that they better inform the ethical debate.

The exposure draft for the Copyright Amendment (Technological Protection Measures) Bill 2006 was released with the aim of replacing Australia's existing technological protection measure scheme. This paper examines areas where the Bill can be improved. It criticises the broad definitions of 'technological protection measure' and 'circumvention' contained in the Bill and suggests there is a need to strengthen the new exceptions proposed.

International audience; Several end-to-end encryption technologies for emails such as PGP and S/MIME exist since decades. However, end-to-end encryption is barely applied. To understand why users hesitate to secure their email communication and which usability issues they face with PGP, S/MIME as well as with pEp (Pretty Easy Privacy), a fairly new technology, we conducted an online survey and user testing. We found that more than 60% of e-mail users are unaware of the existence of such encryption technologies and never tried to use one. We observed that above all, users are overwhelmed with the management of public keys and struggle with the setup of encryption technology in their mail software. Even though users struggle to put email encryption into practice, we experienced roughly the same number of users being aware of the importance of email encryption. Particularly, we found that users are very concerned about identity theft, as 78% want to make sure that no other person is able to write email in their name.