Room information: Kangaroo

Workshop

Karen RenaudKeynote Speaker

Abertay University

United Kingdom

Karen Renaud is a Scottish computing Scientist working on all aspects of Human-Centred Security and Privacy. She was educated at the Universities of Pretoria, South Africa and Glasgow. She is particularly interested in deploying behavioural science techniques to improve security behaviours, and in encouraging end-user privacy-preserving behaviours. Her research approach is multi-disciplinary, essentially learning from other, more established, fields and harnessing methods and techniques from other disciplines to understand and influence cyber security behaviours. She is Professor Extraordinaire at the University of South Africa and Visiting Professor at Rhodes University in South Africa.

Workshop

Marthie Grobler

CSIRO's Data61

Paul Watters

Ivano Bongiovanni

The University of Queensland

Workshop

Zimbabwe has introduced a number of currency reforms since the beginning of 2019. Of note are the Statutory Instruments 142 (SI142) and SI16 enacted in March 2019, which replaced the multi-currency regime with the Zimbabwe dollar as legal tender, rendering all other currencies illegal. These events constitute a unique opportunity to carry out a “natural experiment”. We used the opportunity to explore the impact of the currency changes on Zimbabweans’ protective PIN shielding behaviours. Our study was carried out spanning both the multi-currency and Zimbabwe Dollar (ZWL) currency periods. We observed far less PIN shielding than in comparable studies in other countries, and we suggest that this is due to uncertainty and reduced currency values. In essence, this was a natural experiment into the impact of currency changes on citizen behaviours, and what we discovered revealed an unexpected real-life risk homeostasis response.

Alfred Musarurwa

Abertay University

United Kingdom

Karen Renaud

Abertay University

United Kingdom

Tim Shuermann

TU Darmstadt

Workshop

Software applications continue to challenge user privacy when users interact with them. Privacy practices (e.g. Data Minimisation (DM), Privacy by Design (PbD) or General Data Protection Regulation (GDPR)) and related privacy engineering" methodologies exist and provide clear instructions for developers to implement privacy into software systems they develop that preserve user privacy. However, those practices and methodologies are not yet a common practice in the software development community. There has been no previous research focused on developingeducational" interventions such as serious games to enhance software developers’ coding behaviour. Therefore, this research proposes a game design framework as an educational tool for software developers to improve (secure) coding behaviour, so they can develop privacy-preserving software applications that people can use. The elements of the proposed framework were incorporated into a gaming application scenario that enhances the software developers’ coding behaviour through their motivation. The proposed work not only enables the development of privacy-preserving software systems but also helping the software development community to put privacy guidelines and engineering methodologies into practice.

Nalin Asanka Gamagedara Arachchilage

La Trobe University, Australia

Mumtaz Abdulhameed

Technovation Consulting & Training PVT

Workshop

Malicious users can exploit undiscovered software vulnerabilities i.e., undiscovered weaknesses in software, to cause serious consequences, such as large-scale data breaches. A systematic approach that synthesizes strategies used by security testers can aid practitioners to identify latent vulnerabilities. The goal of this paper is to help practitioners identify software vulnerabilities by categorizing vulnerability discovery strategies using open source software bug reports. We categorize vulnerability discovery strategies by applying qualitative analysis on 312 OSS bug reports. Next, we quantify the frequency and evolution of the identified strategies by analyzing 1,632 OSS bug reports collected from five software projects spanning across 2009 to 2019. The five software projects are Chrome, Eclipse, Mozilla, OpenStack, and PHP.

We identify four vulnerability discovery strategies: diagnostics, malicious payload construction, misconfiguration, and pernicious execution. For Eclipse and OpenStack, the most frequently used strategy is diagnostics, where security testers inspect source code and build/debug logs. For three web-related software projects namely, Chrome, Mozilla, and PHP, the most frequently occurring strategy is malicious payload construction i.e., creating malicious files, such as malicious certificates and malicious videos.

Farzana Ahamed Bhuiyan

Tennessee Tech University

Akond Rahman

Tennessee Tech University

United States

Patrick Morrison

IBM

Workshop

Smart Buildings are defined as the ``buildings of the future" and use the latest Internet of Things (IoT) technologies to automate building operations and services. This is to both increase operational efficiency as well as maximize occupant comfort and environmental impact. However, these ‘‘smart devices’’ – typically used with default settings – also enable the capture and sharing of a variety of sensitive and personal data about the occupants. Given the non-intrusive nature of most IoT devices, individuals have little awareness of what data is being collected about them and what happens to it downstream. Even if they are aware, convenience overrides any privacy concerns, and they do not take sufficient steps to control the data collection, thereby exacerbating the privacy paradox. At the same time, IoT-based building automation systems are revealing highly sensitive insights about the building occupants by synthesizing data from multiple sources and this can be exploited by the device vendors and unauthorised third parties. To address the tension between privacy and convenience in an increasingly connected world, we propose a user-centric informed consent model to handle the privacy paradox in Smart Buildings. The proposed model aims to (a) inform and increase user awareness about how their data is being collected and used, (b) provide fine-grained visibility into privacy compliance and infringement by IoT devices, and (c) recommend corrective actions through nudges (or soft notifications). We illustrate how our proposed consent model works through a use case scenario of a voice-activated smart office.

Chehara Pathmabandu

Monash University

Mohan Baruwal Chhetri

Data61 CSIRO Australia

John Grundy

Monash University, Australia

Australia

Zubair BaigAuthor

Deakin University

Australia

Workshop

Context: Insecure coding patterns (ICPs), such as hard-coded passwords can be inadvertently introduced in infrastructure as code (IaC) scripts, providing malicious users the opportunity to attack provisioned computing infrastructure. As performing code reviews is resource-intensive, a characterization of co-located ICPs, i.e., ICPs that occur together in a script can help practitioners to prioritize their review efforts and mitigate ICPs in IaC scripts. Objective: The goal of this paper is to help practitioners in prioritizing code review efforts for infrastructure as code (IaC) scripts by conducting an empirical study of co-located insecure coding patterns in IaC scripts. Methodology: We conduct an empirical study with 1613, 2764 and 2845 Puppet scripts respectively collected from three organizations namely, Mozilla, Openstack, and Wikimedia. We apply association rule mining to identify co-located ICPs in IaC scripts. Results: We observe 17.9%, 32.9%, and 26.7% of the scripts to include co-located ICPs respectively, for Mozilla, Openstack, and Wikimedia. The most frequent co-located ICP category is hard-coded secret and suspicious comment. Conclusion: Practitioners can prioritize code review efforts for IaC scripts by reviewing scripts that include co-located ICPs.

Farzana Ahamed Bhuiyan

Tennessee Tech University

Akond Rahman

Tennessee Tech University

United States

Workshop

With the exponential growth of social media platforms like Twitter, a seemingly vast amount of data has become available for mining to draw conclusions about various topics, including awareness systems requirements. The exchange of health-related information on social media has been heralded as a new way to explore information-seeking behaviour during pandemics and design and develop awareness systems that address the public’s information need. Online datasets such as Twitter, Google Trends and Reddit have several advantages over traditional data sources, including real-time data availability, ease of access, and reduced cost.

In this paper, to explore the pandemic awareness systems’ requirements, we utilize data from the large accessible database of tweets and Reddit’s posts to explore the contextual patterns and temporal trends in Canadians’ information-seeking behaviour during the COVID-19 pandemic. To validate our inferences and to understand how google searches regarding COVID-19 were distributed throughout the course of the pandemic in Canada, we complement our Twitter and Reddit data with that collected through Google Trends, which tracks the popularity of specific search terms on Google. Our results show that Social media content contains useful technical information and can be used as a source to explore the requirements of pandemic awareness systems.

Esmaeil Shakeri

University of Calgary

Behrouz Far

University of Calgary

Workshop

Many individuals find it difficult to meet their personal health and wellbeing goals. To address this, mobile health (mHealth) apps aimed at improving individuals’ diet, physical activity, sleep and mental health, are emerging at an increasing pace. These modern digital health interventions are a promising solution to promote behaviour change and help people maintain better health while controlling rising healthcare expenditures. However, the real-life effects of mHealth apps are often overshadowed by high dropout rates, with the loss of participants during the intervention seeming to be the rule rather than the exception. We designed the mHealth4U model as a sample-based study of user requirement and design preferences to enable more targeted health and wellbeing self-management. This model is aimed at understanding how life-changing digital health interventions can be designed and what software design components might increase consumers’ acceptance, adherence and continuous engagement. We put forward three hypotheses in terms of designing an mHealth app that is consumer-centred: consumers prefer (1) self-management mHealth apps that target multiple key health and wellbeing dimensions, (2) intelligent recommendations, and (3) behaviour change support delivered precisely where, when and how it is needed most. We design the mHealth4U model around the 3U cyber security design components (user, usage and usability) and validate the hypotheses through a randomised sampling test with 114 participants. The results of this research will inform the design of a next-generation of digital health interventions capable of supporting the end-users to achieve the healthy lifestyle they deserve.

Hamza Sellak

CSIRO's Data61

Australia

Marthie Grobler

CSIRO's Data61

Workshop

For software projects, significant delays can result in heavy penalty which may end up with project costs exceeding their budgets. As a consequence,employees,i.e.,software developers,are often requested to work overtime in order to reduce or even eliminate the delays. By doing so, overtime payment may often be introduced and excessive overtime payment can also easily swallow company profit which may even lead to serious overdraft. Hence software manager needs to decide who should work overtime and how much overtime they would take in order to control the cost. This means that it is important to investigate how to reduce or eliminate the overall penalties by taking multiple concurrent software projects into account. In practice, there is normally a number of available employees with same or similar skills and domain knowledge from other similar concurrent projects. In addition,they have different skill proficiency. So rescheduling those employees with appropriate overtime may be feasible to find a solution which can reduce or eliminate the penalties of delayed software projects. Since this kind of scheduling is a typical NP-hard problem, a novel generic strategy is proposed to help select appropriate employees and determine how much overtime to be assigned to the delayed activities. The new strategy combines the features of ant colony optimization algorithm and Tabu strategy and includes four rules to reduce the search space. A set of comprehensive generic experiments is carried out in order to evaluate the performance of the proposed strategy in a general manner. In addition,three real world software project instances are also utilized to evaluate our strategy. The results demonstrate that our strategy is effective which outperforms the other representative strategies which are applied successfully at software project scheduling.

wei zhang

East China University of Technology

Yun Yang

Swinburne University of Technology