Data and infrastructure security auditing in cloud computing environments

For many companies the remaining barriers to adopting cloud computing services are related to security. One of these significant security issues is the lack of auditability for various aspects of security in the cloud computing environment. In this paper we look at the issue of cloud computing security auditing from three perspectives: user auditing requirements, technical approaches for (data) security auditing and current cloud service provider capabilities for meeting audit requirements. We also divide specific auditing issues into two categories: infrastructure security auditing and data security auditing. We find ultimately that despite a number of techniques available to address user auditing concerns in the data auditing area, cloud providers have thus far only focused on infrastructure security auditing concerns.     

Mis-spending on information security measures: Theory and experimental evidence

Information resources are becoming increasingly important to individuals and organizations, and ensuring their security is a major concern. While research in information security has adopted primarily a quantitative method to determine how and how much to invest in security, most decision makers rely on non-quantitative methods for this purpose, thereby introducing a considerable amount of as yet unexplained subjective judgment to the problem. We use a behavioral decision making approach to investigate factors causing possible inefficiencies of security spending decisions. Decision makers in our experiment performed a series of economic games featuring the key characteristics of a typical security problem. We found several biases in investment decisions. For budgeting their investment between major classes of security measures, decision makers demonstrated a strong bias toward investing in preventive measures rather than in detection and response measures, even though the task was designed to yield the same return on investment for both classes of measures. We term this phenomenon the “Prevention Bias.” Decision makers also reacted to security threats when the risk was so small that no investment was economically justified. For higher levels of risk that warranted some security investment, decision makers showed a strong tendency to overinvest. Theoretical and practical implications of the findings are discussed.     

企业价值导向的智力资本分类与管理

智力资本从企业价值的角度可以分为结构化的智力资本、非结构化的内部智力资本和非结构化的外部智力资本三类。实现智力资本的价值潜力需要企业通过帕累托分析和价值链分析,制定具体的行动计划,提高智力资本的存量和结构化程度,这对我国企业当前的管理实践具有重要意义。     

现代风险导向审计的利弊剖析与对策选择

对现代风险导向审计模式的发展历程进行剖析,指出我国引用现代风险导向审计所遇到的现实困难与对策选择。     

农村小额团体贷款防合谋机制设计

在信息不对称条件下,运用机制设计理论设计了个人贷款契约与团体贷款防合谋契约,并研究了村庄成员结构与项目收益对小额信贷机构决策的影响。研究表明,小额信贷机构为规避逆向选择与道德风险,基于匹配效应设计的团体贷款防合谋契约与个人贷款契约相比,能抽取更多的租金且适用范围更广;当村庄成员结构与项目收益使小额信贷机构期望收益不小于0时,小额信贷机构才愿意提供贷款契约,而在资金有限的情况下,还需比较小额信贷机构在各村庄中的期望收益最大值。     

浅议内部审计和企业会计

本文从现代企业内部审计和会计监督工作关系入手,通过阐述两者的联系与区别,揭示内部审计与财务会计在经济监督体系中,不可或缺的重要性,并对在实际工作中如何正确处理好二者关系进行了有益探索。     

国家自然科学基金申请落选原因分析及对策探讨

国家自然科学基金，是衡量高等学校科技实力和学科建设水平的重要标志，提高其申请的中标率是高校科研管理部门和科研教师所面临的难题，也是科研管理者的重要职责和任务。从分析某高校2006年国家自然科学基金申请落选原因人手，针对评审专家的反馈意见，提出相应的对策，以期对科研教师和管理者提供参考。     

基于价值的电子商务模式表示与分析: 以知识资源网站为例

本文通过对电子商务模式研究的文献回顾,讨论了电子商务模式分析的基本目标,提出了基于价值分析的电子商务模式的表示的基本步骤,介绍了如何利用E3-Value工具对电子商务模式进行建模和分析。最后用知识资源网站的电子商务模式分析作为例子,说明基于价值的电子商务模式分析的基本过程,并得到一系列知识资源网站商务模式运作的基本对策。     

Prestige auditing and the market for academic esteem: a framework and an appeal

Much has been written about the remarkable rise of global university rankings from their initial appearance in the Academic Ranking of World Universities (Shanghai) tables in 2003. The examination of all things rankings, however, has arguably outpaced its conceptual uptake. This paper addresses this imbalance by reviewing prestige audits as resource management tools and status allocation measures. The paper argues that audit ambition has courted audit failure in both dimensions. The resource management justification underestimates the challenge of devising reliable proxy variables across international higher education sectors, organizational types, and disciplinary/departmental objectives. Evidential data sets are duly recast as data narratives that compete with each other and cloud the ordinal clarity aspired to in ranking tables. The status competition approach generates Matthew effects and encourages factor gaming. Positional goods investments are also socially and economically wasteful. In either strict (rigid) or relaxed (normed) form, finally, their zero-sum logic fails to account for private and public externalities. The paper closes with an appeal to soft-variable evaluations in higher education contexts as well as to closer scrutiny of the vocabulary informing both quantitative and qualitative assessments.     

公共化学实验室安全隐患防范措施——以河北工业大学公共化学实验室为例

因其开放、共享的特性,公共化学实验室存在着一定的安全隐患.制定健全的安全管理规定,采取行之有效的防范措施和严格的安全检查制度,是防范公共化学实验室安全隐患的重要保障.     

云计算网络安全现状与思考

云计算是一种新型的资源高效利用模式,它的高效率和高资源利用率使得云计算逐步成为信息时代的主流,然而随着云计算的横空出世,可信云计算、云计算安全的问题也纷至沓来。可信云计算技术与安全云计算技术两者既可以组合使用,也可以独立使用。它们共同构成了云计算网络安全技术。云计算网络安全技术的技术支撑是可信访问控制,密文检索与处理,数据存在与可使用性证明,数据隐私保护,虚拟安全技术,云资源访问控制等。可信云安全计算技术及其特征支撑着整个可信安全云系统,包括可信云服务数据中心、可信云用户端以及可信云管理平台。可以构建可信云安全技术的各应用系统,包括可信政务云系统、可信家务云系统、可信企业云系统、可信商务云系统。     

TPM虚拟域安全模型

针对TPM访问控制机制无法直接应用于虚拟计算、云计算等环境的问题,重点分析TPM内部对象间依赖关系,并结合虚拟域的安全需求,建立TPM虚拟域安全模型.该模型对TPM对象的访问请求增加了虚拟域的完整性、机密性等安全约束,解决了多虚拟域环境下的TPM对象的创建、使用、销毁等问题.还进一步对该模型的安全规则进行了相关逻辑分析,并通过实际原型系统的测试,证明了TPM虚拟域安全模型的实施对可信虚拟平台的性能影响非常小.     

西藏科技信息服务平台建设的需求分析及设计

本文以集成资源、共建共享、健全体系、完善机制、突出特色为主线,通过平台实施,实现科技信息服务科技创新、服务产业发展、服务新农村建设的目标,以网络、通讯技术为手段,以科技信息资源为基础,建成一个技术手段先进,服务优质,信息提供及时、便捷,藏汉双语互动的科技信息服务平台.     

中国海外矿产资源供应安全评价与形势分析

为系统研究我国矿产资源海外供应的总体安全状况,本文创建了集资源综合对外依存度、资源通道依存度和资源地域依存度为一体的海外矿产资源供应安全指标体系,及对应的计算模型。收集了2013年我国39种矿产资源的进出口价值、消费量等数据,测算了2013年我国资源综合对外依存度、资源通道依存度和资源地域依存度,分析了我国海外矿产资源供应安全形势。研究结果表明,我国矿产资源综合对外依存度过高,而且呈不断上升趋势,对资源安全影响较大;我国南海地区尤其是马六甲海峡,资源通道依存度过高,对资源安全风险较大;我国中东、非洲矿产资源地域依存度相对较高,存在一定安全风险。建议增加陆路通道资源进口比例,加强我国矿产品、产地和产能储备工作,保障我国矿产资源安全。     

营销功能审计评价模型设计与分析

营销功能审计是营销审计的重要组成部分。它通过对企业营销组合的各因素进行评价,识别出存在的问题并提出改进建议,以达到提高企业的营销效率的目的。本文建立了实施营销功能审计的指标体系和模型,借助层次分析法(AHP)将这种定性与定量分析结合的审计过程定量化,使得开展营销功能审计更简单可行。     

The evolution of argumentation mining: From models to social media and emerging tools

Argumentation mining is a rising subject in the computational linguistics domain focusing on extracting structured arguments from natural text, often from unstructured or noisy text. The initial approaches on modeling arguments was aiming to identify a flawless argument on specific fields (Law, Scientific Papers) serving specific needs (completeness, effectiveness). With the emerge of Web 2.0 and the explosion in the use of social media both the diffusion of the data and the argument structure have changed. In this survey article, we bridge the gap between theoretical approaches of argumentation mining and pragmatic schemes that satisfy the needs of social media generated data, recognizing the need for adapting more flexible and expandable schemes, capable to adjust to the argumentation conditions that exist in social media. We review, compare, and classify existing approaches, techniques and tools, identifying the positive outcome of combining tasks and features, and eventually propose a conceptual architecture framework. The proposed theoretical framework is an argumentation mining scheme able to identify the distinct sub-tasks and capture the needs of social media text, revealing the need for adopting more flexible and extensible frameworks.     

NTRU比特安全性的简单证明

根据NTRU加密算法的可延展性,在简单的确定性模型下证明了它的比特安全性.若预言机能够输出询问密文对应的明文多项式所有系数之和的奇偶性时,则预言机可以通过一 系列的询问获得对应的明文.与Mats等人的证明相比,文中的模型更简单,更切合实际中NTRU解密机工作的情形.最后,分析了比特安全性与不可区分性之间的关系,指出形式化强安全定义将具有更高的实用性.     

信息内容安全技术国家工程实验室

信息内容安全技术国家工程实验室是国家发改委拟建的100个工程实验室之一．也是首批批复的工程实验室之一,建设期为三年。工程实验室的依托单位是中科院计算技术研究所。合作单位有国家计算机网络与信息安全管理中心、哈尔滨工业大学、北京邮电大学和深圳市任子行网络技术有限公司。工程实验室实行理事会领导下的实验室主任负责制。     

质量工资制的模型设计与分析

实施质量工资制是企业管理的经济导向,有利于企业内部机构的设置与优化,是现代企业管理的中心环节。针对这个中心管理环节,对质量效益工资模型进行了设计及适用性分析,为确定质量与工资挂钩提供了效益前提,从而实现企业的薪酬标准化管理。     

指向镜控制系统的建模与设计

针对光电探测系统中常用的指向镜伺服系统,对其控制方法进行设计和仿真,构建了永磁同步电机的动力学模型. 确立了空间矢量脉宽调制的算法,并给出仿真模型和结果. 基于此系统进行了电流环、速度环、位置环的设计,采用位置前馈和重复控制器,最终得到一种易于实现、定位精度高的控制器. 理论分析和仿真实验证明,该控制器能够较好地改善伺服系统的动态特性,具有调节时间短、无超调和动态响应准确快速等优点,并能有效提高系统位置控制精度,所得结论对此类伺服系统具有一定的指导意义.