Technical Controls Research Articles

Biogenéricos: Un Estudio de Vigilancia Tecnológica para el Caso de la Situación en Chile

The activities to know the market of a technological product must know not only the exclusively economic analyses but to consider the technological existing information. The present work was approached as a study of case for the application of some tools of technological alertness to determine the possibility of producing medicines of biotechnological base in Chile. Of the information that exist, is clear that the biogenerics in general are very sophisticated and need for the elaboration, a long period of management, of technical and clinical precise and sophisticated controls and significant amounts of investment in research and development. In Chile, 100 % of the imported biotechnological products are finished products and that does not exist exportation of biotechnological products from Chile. In Chile yet does not have sufficient technological aptitude to include all the stages that are needed to place a biotechnological product on the market.

Blind information security strategy

How do enterprises relate to and manage information security controls? This paper documents a study of twenty enterprises, six of them in the critical infrastructure (CI) domain. The state of security in the CI enterprises differed little from that in the other enterprises. Information security was seen as a technical problem with technical solutions. However, vulnerabilities in processes and human fallibility create a need for formal and informal controls in addition to technical controls. These three controls are interdependent. They vary widely in implementation time and resource needs, which render the task of building security resources a challenging problem. This paper presents a system dynamics model that illustrates how security controls are interconnected and are interdependent at a high level. The model is intended to aid security managers in CI domains to better understand information security management strategies, especially the complexities involved in managing a socio-technical system where human, organizational and technical factors interact. The model also demonstrates how the knowledge gained from proactive security activities can help managers improve the effectiveness of security controls, risk assessments and incident detection capabilities.

Social Engineering: Hacking the Wetware!

ABSTRACT Social engineering is a methodology that allows an attacker to bypass technical controls by attacking the human element in an organization. There are many techniques commonly used in social engineering including but not limited to Trojan and phishing email messages, impersonation, persuasion, bribery, shoulder surfing, and dumpster diving. Hackers rely on social engineering attacks to bypass technical controls by focusing on the human factors. Social engineers often exploit the natural tendency people have toward trusting others who seem likeable or credible, deferring to authority or need to acquiesce to social conformity. Mitigation of social engineering begins with good policy and awareness training, but there are a number of other approaches an organization can take to defend against this type of an attack. Social engineering attacks are likely to increase, and it is becoming increasingly important for organizations to address this issue.

Challenges and complexities of managing information security

Information security (IS) management is both complex and challenging. The complexity stems from the pervasive and multi-functional nature of IS, first, to protect organisations' valued assets, in order to achieve secure and dependable information assurance, and second, to advance business relations for the organisation by creating platforms for trust, business alliance and collaboration. Further, the ever-growing dependence of organisations on technology to drive businesses and to create a competitive advantage makes IS management for organisations extremely challenging. These challenges facing organisations in managing IS are numerous and inherently diverse. A traditional approach in addressing these challenges includes the use of technical controls to treat risks. Whilst technical controls are helpful in protecting valued assets, unfortunately, technical controls alone are insufficient in providing dependable security and information assurance required in a contemporary global enterprise. Global outsourcing, consumer-centricity, security compliance and legislation as emerging global business drivers have imposed new security requirements that complicate traditional perspective in security management.

Aligning Efficacy Beliefs and Competence: A Framework for Developing Technical Knowledge

Introduction Managers operating within today's organizations are under the constant pressure of change that results in continuous career challenges. Some of these challenges may be familiar and managers can call upon their past experiences to question, analyze, and address the situation. These challenges will be accepted as opportunities if the situation can be overcome by the managers' robust belief in their ability to acquire and to apply knowledge (Davenport, 2005), to use that knowledge to transform the challenge into innovation and value for themselves and their organizations (Miller, Fern, & Cardinal, 2007), and to add the educational experiences into their concepts of competence (Hogan & Warrenfeltz, 2003). Other challenges, however, may be first encounters of the unfamiliar and unwanted kind, often involving specific areas of expertise or tasks that a given manager has affirmatively avoided throughout his or her career. Such challenges may be more comprehensive in nature than previously encountered and emanate from global competition or from limited natural, capital, or human resources (Ireland & Hitt, 2005). These challenges are often founded on continuous changes within the world's economies and technologies, and individual managers can feel caught up in forces over which they have no control or influence. While it is true that these individuals may have little practical impact on the underlying economic issues, it is very possible for them to be called upon to address the technical elements of such issues, especially if the individual possesses subject matter expertise or specific knowledge about the challenge at hand. Therefore, the question is, where does a manager begin to develop and establish the kind of technical competencies that would aid in addressing the underlying issues of unfamiliar or potentially overwhelming challenges? The answer does not always lie in possessing, developing, or acquiring specific technical expertise in response to changes or challenges, but rather in possessing or developing basic technical competencies to begin breaking down the situation into events, units, or chunks of which can be referenced, analogized, or investigated towards a resolution. In this paper, the authors present a simple technology competency model, called OTIS, that sets forth questions to ask and areas to assess when faced with new or recurring technical challenges. The name is an acronym because the model presents an iterative process for assessing the Objectives, Technology, Implementation, and Support of the challenge to be addressed, as illustrated in Figure 1. [FIGURE 1 OMITTED] Developing a basic familiarity and eventual understanding of these key technical concepts can expand core competencies, as well as enhance career opportunities and establish credibility among peers (Hogan & Warrenfeltz, 2003). The OTIS technical competency model can solidify managers' confidence in their ability to analyze and discuss technical issues within the framework of their professional expertise. For example, a human resources manager should be able to assess the functionality of a human resources information system (HRIS), while a purchasing manager should be able to define workflows and reporting needs for a requisitioning and procurement application. Approach The OTIS model is a starting point to help non-technical managers assess situations involving technology by understanding and relating four basic business concepts to the problems under review. The OTIS model is not intended to replace more sophisticated processes of technical analysis or management controls, such as project management or quality assurance methodologies. Instead, once managers become proficient with the OTIS model, they can extend their education and enhance their competencies by seeking out more sophisticated and comprehensive management methodologies. …

The influence of legislative changes on quality and costs in radiotherapy

Summary Background On 24 December 2002, in compliance with Euratom Directive 97/43, the Minister of Health issued an ordinance on rules and regulations of safe application of ionising radiation for medical purposes and methods of internal control over observance of the rules and regulations. The ordinance obliges managers of institutions which apply ionising radiation for medical purposes (radiotherapy, X-ray diagnostics, nuclear medicine) to implement, maintain and develop the Quality Management System (QMS). On 25 August 2005, the Minister of Health issued an ordinance on rules and regulations of safe application of ionising radiation with reference to all types of medical exposure which overruled the ordinance of 24.12.2002. Aim The purpose of this paper was (i) the comparative analysis of the aforementioned ordinances in the context of three selected aspects: internal audits, external audits and the system of quality management, and (ii) the analysis of the rise in labour costs, services, depreciation and materials in 2002–2005, as a result of the implementation of the aforementioned legal rules and regulations. Materials and Methods A comparative analysis of the two a fore mentioned ordinances of the Minister of Health was performed: concerning (i) external clinical audits, (ii) internal clinical audits and (iii) requirements of the quality management system. The total cost of implementation of such rules and regulations (in particular the cost of the Quality Management System) has been calculated based on an analysis of labour costs, depreciation, materials and services in 2002–2005. Results Legislative changes in the scope of safe application of ionising radiation for medical purposes enhance not only the organisation of health care institutions applying radiotherapy, but also the rise in costs of the organisations as a result of implementation of the changes, e.g. through (i) the costs of salaries for work groups or consulting companies implementing QMS, (ii) costs of external services, dosimetric audits by independent calibration laboratories, (iii) costs of QMS certification, (iv) awards and bonuses for internal auditors, (v) costs of service contracts, etc. Conclusions The implementation of the quality management system, modernisation of technical infrastructure, systematic controls and measurements of apparatuses and procedures, more effective work organisation, repeatability, regularity and homogeneity not only enhance the quality of medical service, but also the costs in radiotherapy.

Data Retention and Privacy in Electronic Communications

The retention of communication data by network providers, often mandated by legislation, raises social and technical security concerns. A generic model combining technical, procedural, and legal controls can help secure retained data and minimize privacy threats against users.

Changing Noise Climate of Ilorin Metropolis

Community noise levels in Ilorin metropolis were measured and analyzed. The noise climate variation was observed to be a function of time due to an increase in population density and other sources of environmental noise. There is increase in the day and night noise levels with growth in population. The noise levels have increased by 2 to 13 dB(A) in the past 20 years in Ilorin metropolis. Statistical analysis shows that the noise level exposure differs significantly from one location to another. High noise levels occur in the daytime at road junctions, followed by commercial centers and passengers loading parks. The noise map developed from this study based on the noise descriptors L D, L N, L DN, TNI, and L NP reveals high noise level exposure at the center of the city where commercial activities and clustered buildings with high population density exist. The noise map provides enough information for technical controls and interim legislation against environmental noise pollution in the metropolis.

New phishes in the pond: a wake-up call for China in the context of management of computer crime

This paper provides an insight into the management of computer crime in the context of China. Given that China, like other countries, face the increasing problem of computer crime, it is prudent that the Chinese government understand that managing computer crime cannot be dealt with technical controls alone, such as firewalls. In presenting this argument, this paper reflects how China should learn lessons from other countries and focus on addressing both the technical and social issues when managing such illicit acts.

Deterring internal information systems misuse

Deterring employee intentions to misuse computer systems requires complementary technical and procedural controls.

The hacker's top five routes into the network (and how to block them)

Stealing corporate data has never been easier. So says a penetration tester writing in this issue: and he should know – he's clocked up 10 years of hacking experience, from both inside and outside organizations. He shares his ‘top five’ network vulnerabilities, showing the most likely routes an attacker would take to compromise your network security. As expected, not everything in this article is about technical controls. The first port of call is the ‘Helpful Staff Member’ – in this case an office receptionist contacted on a ‘pay as you go’ mobile phone, who obligingly gives out the names and e-mail addresses of the IT project leaders for the areas of interest – mostly to do with payroll and payment systems. Then comes the spoof web page, in the same style as the corporate site, even using the same images and logos by embedding the real image paths in the code. And they're off. Breaking into corporate networks has never been easier. Over the past ten years, I have taken part in a large number of penetration tests, from both inside and outside organizations. Over this period several important themes have emerged, which, whilst apparently unrelated, contribute to the failure of organizations to protect their information assets adequately.

Capturing industry experience for an effective information security assessment

An Information System (IS) security programme consists of several essential security controls. In order to verify and maintain the effectiveness of an IS security programme, it is pertinent to identify how security controls are compared to each other in terms of their practical implications. This study reports the results from an experience survey to offer insights of the roles of security controls in IS security programmes. Four clusters of security controls were identified with technical security controls (such as authentication and confidentiality) being high on respondents' perceived importance. An approach to develop SAI with weighted security controls is explained to help security administrators conduct security assessments. The results of this study contribute to IS security budget planning and resource allocation. Managerial implications are also reported.

Psicoterapia sistémica, psicología y responsabilidad social: la hipótesis de la convergencia entre sabiduría y conocimiento técnico

<p style="text-align: justify;">La versión moderna de la psicoterapia como un asunto técnico ha conducido a la psicología, en el campo de la clínica y la salud mental, a exigirse una ética de la previsión en la acción y reconocer la emergencia del principio de la responsabilidad, ajustada a las circunstancias humanas propias del encuentro terapéutico. En este contexto, la ponencia se centra en reflexionar sobre una vieja y nueva hipótesis: la convergencia entre la sabiduría y el conocimiento técnico; por lo tanto, presentamos de manera sucinta las dimensiones conceptuales y pragmáticas en las que se fundamentan la psicoterapia sistémica para resolver el dilema. Éstas son entre otras las dimensiones a mostrar: la vulnerabilidad de la naturaleza humana y la heurística de la fragilidad; las distinciones entre los dominios técnicos y el saber ecológico como fundamento; la moral y la ética más allá del individuo, es decir, la ética ecológica y, por último, el saber de lo posible como principio fundante del encuentro humano. El análisis anterior pretende mostrar la visión de una psicología relacional, simbólica y compleja que pretende resolver las preocupaciones epistemológicas de la psicología en la modernidad.</p><p style="text-align: justify;"><strong>Palabras clave: </strong>terapia sistémica, conocimiento técnico, psicología relacional, psicopatología, heurística, fragilidad.</p>

Monitoring and Controlling E-Mail Systems

As the criticality of e-mail for electronic business activity increases, ad hoc e-mail implementation, prolonged management neglect, and user abuse of e-mail systems have generated negative effects. However, management’s ability to rectify problems with e-mail systems is hindered by our understanding of its organizational use. Research on e-mail systems is often dated and based on quantitative methodologies that cannot explain the interaction between various controls in organizational settings. Updating our understanding of the organizational aspects of e-mail systems utilizing qualitative methods is necessary. This paper presents a multiple case study investigation of e-mail system monitoring and control. The study examines the interaction between key elements of e-mail control identified by previous researchers and considers the role of such controls at various implementation phases. The findings reveal the effectiveness of e-mail committees, training, policies, and sustained awareness when combined with e-mail monitoring, and concludes by identifying key formal, informal, and technical controls.

Insertion et équilibration occlusale

Prosthetic denture insertion is a basic moment in the treatment of complete edentation during which technical and clinical controls of polymerised prostheses are performed prior to installation of the new prosthesis in the patient's mouth. Occlusal equilibration is one of the steps of this procedure and is performed according to precise and strict guidelines. In fact, occlusal equilibration is not simply an occlusal correction since it has a direct influence on manducation rehabilitation and on treatment timelessness. Only accurate occlusal equilibration, by its harmonious distribution of occlusal loads and orientation of the forces that ensure stabilization and prosthetic retention, may ensure long-term preservation of the prosthetic pressure areas.

Plasticity and Tissue Regenerative Potential of Bone Marrow-Derived Cells

Diverse in vivo studies have suggested that adult stem cells might have the ability to differentiate into cell types other than those of the tissues in which they reside or derive during embryonic development. This idea of stem cell "plasticity" has led investigators to hypothesize that, similar to embryonic stem cells, adult stem cells might have unlimited tissue regenerative potential in vivo, and therefore, broad and novel therapeutic applications. Since the beginning of these observations, our group has critically examined these exciting possibilities for mouse bone marrow-derived cells by taking advantage of well-characterized models of tissue regeneration, Cre/lox technology, and novel stem cell isolation protocols. Our experimental evidence does not support plasticity of hematopoietic stem cells as a frequent physiological event, but rather indicates that cell fusion could account for reported cases of hematopoietic stem cell plasticity or "transdifferentiation" in vivo. Our studies highlight the need for meticulous technical controls during the isolation, transplantation, tracking, and analysis of bone marrow-derived cells during in vivo studies on plasticity. Further studies will be necessary to better define experimental conditions and criteria to unequivocally prove or reject plasticity in vivo. In this review, we focus on results from several studies from our laboratory, and discuss their conclusions and implications.

Cyber-Risk Management: Technical and Insurance Controls for Enterprise-Level Security

Traditional approaches to security architecture and design have attempted to achieve the goal of the elimination of risk factors — the complete prevention of system compromise through technical and procedural means. Insurance- based solutions to risk long ago admitted that a complete elimination of risk is impossible and, instead, have focused more on reducing the impact of harm through financial avenues, providing policies that indemnify the policy holder in the event of harm.

Computer crimes: theorizing about the enemy within

A majority of computer crimes occur because a current employee of an organization has subverted existing controls. By considering two case studies, this paper analyzes computer crimes resulting because of violations of safeguards by employees. The paper suggests that various technical, procedural and normative controls should be put in place to prevent illegal and malicious acts from taking place. Ultimately a good balance between various kinds of controls would help in instituting a cost-effective means to make both accidental and intentional misconduct difficult. This would also ensure, wherever possible, individual accountability for all potentially sensitive negative actions.

Evaluation of inter-scorer and inter-laboratory reliability of the mouse epididymal sperm aneuploidy (m-ESA) assay.

The mouse epididymal sperm aneuploidy (mESA) assay using 3-chromosome fluorescence in situ hybridization (FISH) was recently developed for assessing the aneugenic potential of chemicals on male germ cells. This study was designed to identify the major technical factors that affect inter-scorer and inter-laboratory variability of the mESA assay. Two laboratories participated in this study (GSF and Lawrence Livermore National Laboratory, LLNL). Mice (102/ElxC3H/El) F(1) were exposed in one laboratory (GSF) to vinblastine (VBL; single intraperitoneal injection of 0, 0.5, 1.0 or 2.0 mg/kg), one of the 10 priority compounds of the Commission of the European Communities (CEC) Aneuploidy Program. Twenty-two days later the mESA assay was applied to analyze sperm aneuploidy. In the initial evaluation, small but statistically significant differences were found between the two laboratories in baseline frequencies and there was also disagreement in the determination of a VBL aneuploid effect. Therefore, experiments were conducted to identify the sources of the inter-laboratory differences and technical factors that affected assay reliability and the VBL study was repeated. A harmonization experiment was conducted by bringing the microscope scorers from both laboratories to the same site (LLNL) for a cross-training exercise. Following this exercise, a second group of VBL-treated and control mice were evaluated, and we concluded that VBL is not a sperm aneugen. Our research has identified scoring criteria as the major source of inter-laboratory variation and emphasizes the importance of strict technical controls for the mESA assay, including controlling slide preparations for treatment-induced reductions in sperm count, coding of slides and selection of statistical tests. These considerations are particularly important for the interpretation of small effects (< or =2-fold) on sperm aneuploidy. Our findings suggest that 2-fold differences in frequencies can result from differences among scorers, samples and treatment groups, and are readily within the normal variation for the mESA assay. Such small differences should be viewed with caution until independently confirmed.

Low-CO2 Energy Pathways versus Emission Control Policies in Acidification Reduction

Integrated assessment models were applied to analyze the side-benefits of structural changes in the energy systems of Finland and the EU to reduce acidity critical load exceedances in Finland. The acidification reduction potential of structural measures, induced by the need to restrict carbon dioxide (CO2) emissions, was compared with international agreements limiting acidifying emissions. The impacts of the UN/ECE Gothenburg protocol and the European Commission’s proposal for a National Emission Ceilings (NEC) Directive were assessed together with domestic and bilateral policy scenarios. The study utilized point-source emission databases of Finland and the neighboring areas and a meso-scale deposition model together with the Europe-wide transfer matrices of the EMEP/MSC-W and European emission scenarios of IIASA. Further technical reduction measures in the adjacent large sulfur emission sources in Russia would reduce considerably deposition to nearby Finnish areas. Energy saving and shifts in the EU energy system towards less carbon-intensive fuels instead of further technical emission controls were found to have significant potential in limiting acidifying deposition. Implementation of the Kyoto protocol in the EU could reduce the Finnish areas at risk of acidification more than the Gothenburg protocol and the NEC Directive together.