Indilinga - African Journal of Indigenous Knowledge Systems, 2019
In the first part of the article we explore what decolonisation might entail and why it is needed... more In the first part of the article we explore what decolonisation might entail and why it is needed. The focus here is specifically on decolonisation within higher education and, more specifically, on the academic discipline of Operational Research (OR) and its curriculum. We explicate the specific challenge of decolonising operational research as part of the 'pure' sciences like mathematics. By investigating research in the decolonisation of 'pure' science in an attempt to find some guidance for decolonisation of OR, we found ourselves in uncharted waters. In the last section we contribute to the scholarship of Indigenous Knowledge Systems (IKS) by analysing the war strategies of King Shaka Zulu. We worked out some possibilities for decolonisation of OR by linking the war strategies of King Shaka Zulu to classical OR applications. This layed the foundation for decentring Western knowledge and for a more inclusive historical understanding of OR.
Biometric authentication is a popular method for in-formation security defense and access control... more Biometric authentication is a popular method for in-formation security defense and access control. With the availa-bility of small computing Internet of Things (IoT) devices in con-junction with a hardware peripheral that is able to track hand geometry, multifactor authentication becomes cost-effective and mobile. The proposed system would attempt to authenticate sys-tem users by combining both a user’s hand geometry scan, along with a series of gestures while simultaneously using machine learning classification techniques for user classification. Can-celability will be insured with a novel steganography implemen-tation for user biometric information.
This research presents the exploratory application of behavioural threshold theory on group behav... more This research presents the exploratory application of behavioural threshold theory on group behaviour related to information security. Behavioural threshold analysis is presented as a possi-ble tool for aiding the development of security awareness programs. Generic behavioural thresh-old analysis is presented and then applied in the domain of information security by collecting data on the behavioural thresholds of individuals in a group setting and how they influence each other when it comes to security behaviour. The results of behavioural threshold analysis are presented in order to illustrate the feasibility of the approach as an aid for the development of security awareness programs.
Phishing attacks are a social engineering scam which aim to steal sensitive information like pers... more Phishing attacks are a social engineering scam which aim to steal sensitive information like personal, financial and social details, from unsuspecting consumers. It is based on the premise that a significant number of consumers are ignorant of the technical security practices in a digital environment. These attacks establish trust from the user in order to lull them into a false sense of familiarity in which they are more likely to freely supply their identifying information. In this study an intelligent approach to phishing detection is ...
The state of information security as a whole is a disaster, a train wreck". This view is given by... more The state of information security as a whole is a disaster, a train wreck". This view is given by describing the state of information security towards the end of the first decade of the 21 st century. Amongst solutions offered, the view that security programs have to be holistic is proposed indicating that technical controls are of little value without the workforce understanding the risks of their irresponsible behavior. Another solution proposed by them is the role of awareness and education. All levels of users should be targeted letting them understand their role and responsibility in information security. Password related behavior is often highlighted as a key component of information security awareness. However, studies have shown that password hygiene is generally poor amongst users .
This paper describes a case study in which Data Envelopment Analysis (DEA) methodology was combin... more This paper describes a case study in which Data Envelopment Analysis (DEA) methodology was combined with regression analysis to evaluate the efficiency of an Internal Audit (IA) department over twelve consecutive months. Efficiency of audit projects was first estimated using DEA. These results were then used as one of the outputs to perform a multi-period DEA study with a choice of other inputs and outputs specific to the Internal Audit department under review. The efficiency of audit projects is viewed as one of the key outputs of an IA department and an explanation of these efficiencies would therefore be useful (necessary) to enhance insights gained from the DEA model applied to the twelve months. To assist in this explanation a multiple regression model was employed in which the efficiency score obtained from the DEA computations for the audit projects was used as the dependent variable. Following a description of the models and data, the results are discussed and notes are made of certain aspects pertaining to the department reviewed.
The importance of applying good governance principles has grown over the past decade and many stu... more The importance of applying good governance principles has grown over the past decade and many studies have been performed to investigate the role and impact of such principles. One of the difficulties in the governance arena is to provide sufficient empirical evidence that good corporate governance and good governance of information technology is beneficial. This paper describes a framework, based on a value-focused approach, which is used to identify unique dimensions for evaluation in a large organisation. Following the evaluation a practical phishing experiment was used to show how a learning process can be initiated through security incidents and how organisational learning can be used to focus on the improvement of specific governance areas.
The amount of effort that can be expended on information security depends on funds available and ... more The amount of effort that can be expended on information security depends on funds available and management decisions. Organisations therefore have to prepare an annual budget for the maintenance and improvement of their information security systems. Two of the key issues that confront IT management, when dealing with IT security investments, are how to spend the IT security budget most
IFIP International Federation for Information Processing, 2007
Identity theft is an emerging threat in our networked world and more individuals and companies fa... more Identity theft is an emerging threat in our networked world and more individuals and companies fall victim to this type of fraud. User training is an important part of ICT security awareness; however, IT management must know and identify where to direct and focus these awareness training efforts. A phishing exercise was conducted in an academic environment as part of an ongoing information security awareness project where system data or evidence of users" behavior was accumulated. Information security culture is influenced by amongst other aspects the behavior of users. This paper presents the findings of this phishing experiment where alarming results on the staff behavior are shown. Educational and awareness activities pertaining to email environments are of utmost importance to manage the increased risks of identity theft.
An information security awareness program is regarded as an important instrument in the protectio... more An information security awareness program is regarded as an important instrument in the protection of information assets. In this study, the traditional approach to an information security awareness program is extended to include possible cultural factors relating to people from diverse backgrounds. The human factor, consisting of two closely related dimensions, namely knowledge and behaviour, play a significant role in
ICT resources are important assets of any organization and the protection of these resources are ... more ICT resources are important assets of any organization and the protection of these resources are equally important. To be able to protect themselves and their profitability, many organizations have established information security awareness programs. In order for a security awareness program to add value to an organization and at the same time make a contribution to the field of information
AngloGold Ashanti is an international gold mining company that has recently implemented an inform... more AngloGold Ashanti is an international gold mining company that has recently implemented an information security awareness program worldwide at all of their operations. Following the implementation, there was a normal business need to evaluate and measure the success and effectiveness of the program. A measuring tool that can be applied globally and that addressed AngloGold Ashanti's unique requirements was developed
The state of information security as a whole is a disaster, a train wreck". This view is giv... more The state of information security as a whole is a disaster, a train wreck". This view is given by Forte and Power (2007) describing the state of information security towards the end of the first decade of the 21st century. Amongst solutions offered, the view that security programs have to be holistic is proposed indicating that technical controls are of little value without the workforce understanding the risks of their irresponsible behavior. Another solution proposed by them is the role of awareness and education. All levels of users should be targeted letting them understand their role and responsibility in information security. Password related behavior is often highlighted as a key component of information security
This paper aims at making a contribution to the development of robust linear models by examining ... more This paper aims at making a contribution to the development of robust linear models by examining the feasibility of data elimination and discarding of explanatory variables simultaneously through the use of mathematical programming techniques. The prediction accuracy of models obtained by such a method is considered via a bootstrap approach and examples are provided to illustrate the characteristics of the proposed procedure.
Decision making a b s t r a c t There are many disciplines where the problem of consensus ranking... more Decision making a b s t r a c t There are many disciplines where the problem of consensus ranking plays a vital role.
How secure are passwords that will be used by future health care workers? ... HA Kruger School of... more How secure are passwords that will be used by future health care workers? ... HA Kruger School of Computer, Statistical and Mathematical Sciences North-West University (Potchefstroom Campus), Private Bag X6001, Potchefstroom, 2520, South Africa [email protected]. ...
ABSTRACT Some of the major security risks associated with spam e-mail are the spreading of comput... more ABSTRACT Some of the major security risks associated with spam e-mail are the spreading of computer viruses and the facilitation of phishing exercises. Spam is therefore regarded as one of the prominent security threats in modern organizations. Security controls, such as spam filtering techniques, have become increasingly important to protect information and information assets. In this paper the performance of a Generalized Additive Neural Network on a publicly available e-mail corpus is investigated in the context of statistical spam filtering. The neural network is compared to a Naive Bayesian classifier and a Memory-based technique. Generalized Additive Neural Networks have a number of advantages compared to neural networks in general. An automated construction algorithm performs feature and model selection simultaneously and produces results which can be interpreted by a graphical method. This algorithm is powerful, effective and performs highly accurate compared to other non-linear model selection methods. The paper also considers the impact of different feature set sizes using cost-sensitive measures. These criteria are sensitive to the cost difference between two common types of errors made by filtering systems. Experiments show better performance compared to the Naive Bayes and Memory-based classifiers where legitimate e-mails are assigned the same cost as spams. This result suggests Generalized Additive Neural Networks may be utilized to flag spam e-mails in order to prioritize the reading of messages.
Indilinga - African Journal of Indigenous Knowledge Systems, 2019
In the first part of the article we explore what decolonisation might entail and why it is needed... more In the first part of the article we explore what decolonisation might entail and why it is needed. The focus here is specifically on decolonisation within higher education and, more specifically, on the academic discipline of Operational Research (OR) and its curriculum. We explicate the specific challenge of decolonising operational research as part of the 'pure' sciences like mathematics. By investigating research in the decolonisation of 'pure' science in an attempt to find some guidance for decolonisation of OR, we found ourselves in uncharted waters. In the last section we contribute to the scholarship of Indigenous Knowledge Systems (IKS) by analysing the war strategies of King Shaka Zulu. We worked out some possibilities for decolonisation of OR by linking the war strategies of King Shaka Zulu to classical OR applications. This layed the foundation for decentring Western knowledge and for a more inclusive historical understanding of OR.
Biometric authentication is a popular method for in-formation security defense and access control... more Biometric authentication is a popular method for in-formation security defense and access control. With the availa-bility of small computing Internet of Things (IoT) devices in con-junction with a hardware peripheral that is able to track hand geometry, multifactor authentication becomes cost-effective and mobile. The proposed system would attempt to authenticate sys-tem users by combining both a user’s hand geometry scan, along with a series of gestures while simultaneously using machine learning classification techniques for user classification. Can-celability will be insured with a novel steganography implemen-tation for user biometric information.
This research presents the exploratory application of behavioural threshold theory on group behav... more This research presents the exploratory application of behavioural threshold theory on group behaviour related to information security. Behavioural threshold analysis is presented as a possi-ble tool for aiding the development of security awareness programs. Generic behavioural thresh-old analysis is presented and then applied in the domain of information security by collecting data on the behavioural thresholds of individuals in a group setting and how they influence each other when it comes to security behaviour. The results of behavioural threshold analysis are presented in order to illustrate the feasibility of the approach as an aid for the development of security awareness programs.
Phishing attacks are a social engineering scam which aim to steal sensitive information like pers... more Phishing attacks are a social engineering scam which aim to steal sensitive information like personal, financial and social details, from unsuspecting consumers. It is based on the premise that a significant number of consumers are ignorant of the technical security practices in a digital environment. These attacks establish trust from the user in order to lull them into a false sense of familiarity in which they are more likely to freely supply their identifying information. In this study an intelligent approach to phishing detection is ...
The state of information security as a whole is a disaster, a train wreck". This view is given by... more The state of information security as a whole is a disaster, a train wreck". This view is given by describing the state of information security towards the end of the first decade of the 21 st century. Amongst solutions offered, the view that security programs have to be holistic is proposed indicating that technical controls are of little value without the workforce understanding the risks of their irresponsible behavior. Another solution proposed by them is the role of awareness and education. All levels of users should be targeted letting them understand their role and responsibility in information security. Password related behavior is often highlighted as a key component of information security awareness. However, studies have shown that password hygiene is generally poor amongst users .
This paper describes a case study in which Data Envelopment Analysis (DEA) methodology was combin... more This paper describes a case study in which Data Envelopment Analysis (DEA) methodology was combined with regression analysis to evaluate the efficiency of an Internal Audit (IA) department over twelve consecutive months. Efficiency of audit projects was first estimated using DEA. These results were then used as one of the outputs to perform a multi-period DEA study with a choice of other inputs and outputs specific to the Internal Audit department under review. The efficiency of audit projects is viewed as one of the key outputs of an IA department and an explanation of these efficiencies would therefore be useful (necessary) to enhance insights gained from the DEA model applied to the twelve months. To assist in this explanation a multiple regression model was employed in which the efficiency score obtained from the DEA computations for the audit projects was used as the dependent variable. Following a description of the models and data, the results are discussed and notes are made of certain aspects pertaining to the department reviewed.
The importance of applying good governance principles has grown over the past decade and many stu... more The importance of applying good governance principles has grown over the past decade and many studies have been performed to investigate the role and impact of such principles. One of the difficulties in the governance arena is to provide sufficient empirical evidence that good corporate governance and good governance of information technology is beneficial. This paper describes a framework, based on a value-focused approach, which is used to identify unique dimensions for evaluation in a large organisation. Following the evaluation a practical phishing experiment was used to show how a learning process can be initiated through security incidents and how organisational learning can be used to focus on the improvement of specific governance areas.
The amount of effort that can be expended on information security depends on funds available and ... more The amount of effort that can be expended on information security depends on funds available and management decisions. Organisations therefore have to prepare an annual budget for the maintenance and improvement of their information security systems. Two of the key issues that confront IT management, when dealing with IT security investments, are how to spend the IT security budget most
IFIP International Federation for Information Processing, 2007
Identity theft is an emerging threat in our networked world and more individuals and companies fa... more Identity theft is an emerging threat in our networked world and more individuals and companies fall victim to this type of fraud. User training is an important part of ICT security awareness; however, IT management must know and identify where to direct and focus these awareness training efforts. A phishing exercise was conducted in an academic environment as part of an ongoing information security awareness project where system data or evidence of users" behavior was accumulated. Information security culture is influenced by amongst other aspects the behavior of users. This paper presents the findings of this phishing experiment where alarming results on the staff behavior are shown. Educational and awareness activities pertaining to email environments are of utmost importance to manage the increased risks of identity theft.
An information security awareness program is regarded as an important instrument in the protectio... more An information security awareness program is regarded as an important instrument in the protection of information assets. In this study, the traditional approach to an information security awareness program is extended to include possible cultural factors relating to people from diverse backgrounds. The human factor, consisting of two closely related dimensions, namely knowledge and behaviour, play a significant role in
ICT resources are important assets of any organization and the protection of these resources are ... more ICT resources are important assets of any organization and the protection of these resources are equally important. To be able to protect themselves and their profitability, many organizations have established information security awareness programs. In order for a security awareness program to add value to an organization and at the same time make a contribution to the field of information
AngloGold Ashanti is an international gold mining company that has recently implemented an inform... more AngloGold Ashanti is an international gold mining company that has recently implemented an information security awareness program worldwide at all of their operations. Following the implementation, there was a normal business need to evaluate and measure the success and effectiveness of the program. A measuring tool that can be applied globally and that addressed AngloGold Ashanti's unique requirements was developed
The state of information security as a whole is a disaster, a train wreck". This view is giv... more The state of information security as a whole is a disaster, a train wreck". This view is given by Forte and Power (2007) describing the state of information security towards the end of the first decade of the 21st century. Amongst solutions offered, the view that security programs have to be holistic is proposed indicating that technical controls are of little value without the workforce understanding the risks of their irresponsible behavior. Another solution proposed by them is the role of awareness and education. All levels of users should be targeted letting them understand their role and responsibility in information security. Password related behavior is often highlighted as a key component of information security
This paper aims at making a contribution to the development of robust linear models by examining ... more This paper aims at making a contribution to the development of robust linear models by examining the feasibility of data elimination and discarding of explanatory variables simultaneously through the use of mathematical programming techniques. The prediction accuracy of models obtained by such a method is considered via a bootstrap approach and examples are provided to illustrate the characteristics of the proposed procedure.
Decision making a b s t r a c t There are many disciplines where the problem of consensus ranking... more Decision making a b s t r a c t There are many disciplines where the problem of consensus ranking plays a vital role.
How secure are passwords that will be used by future health care workers? ... HA Kruger School of... more How secure are passwords that will be used by future health care workers? ... HA Kruger School of Computer, Statistical and Mathematical Sciences North-West University (Potchefstroom Campus), Private Bag X6001, Potchefstroom, 2520, South Africa [email protected]. ...
ABSTRACT Some of the major security risks associated with spam e-mail are the spreading of comput... more ABSTRACT Some of the major security risks associated with spam e-mail are the spreading of computer viruses and the facilitation of phishing exercises. Spam is therefore regarded as one of the prominent security threats in modern organizations. Security controls, such as spam filtering techniques, have become increasingly important to protect information and information assets. In this paper the performance of a Generalized Additive Neural Network on a publicly available e-mail corpus is investigated in the context of statistical spam filtering. The neural network is compared to a Naive Bayesian classifier and a Memory-based technique. Generalized Additive Neural Networks have a number of advantages compared to neural networks in general. An automated construction algorithm performs feature and model selection simultaneously and produces results which can be interpreted by a graphical method. This algorithm is powerful, effective and performs highly accurate compared to other non-linear model selection methods. The paper also considers the impact of different feature set sizes using cost-sensitive measures. These criteria are sensitive to the cost difference between two common types of errors made by filtering systems. Experiments show better performance compared to the Naive Bayes and Memory-based classifiers where legitimate e-mails are assigned the same cost as spams. This result suggests Generalized Additive Neural Networks may be utilized to flag spam e-mails in order to prioritize the reading of messages.
Uploads
Papers by Hennie Kruger