Application Of Security Policies Research Articles

МЕТОДИ ТА ЗАСОБИ ЗАХИСТУ РЕСУРСІВ В КОМП’ЮТЕРНІЙ SDN-МЕРЕЖІ

The work is dedicated to the analysis and improvement of methods and tools for building the architecture of software-defined networks (SDNs). A crucial aspect involves comparing the differences between network management using traditional methods and utilizing an SDN controller. Primary attention is given to the development of security models based on software-defined networks.The research is grounded in the analysis of specific cases involving the use of such networks, including gathering opinions and expert assessments from professionals in the field. It leverages publicly available information on methods and tools for securing the architecture of software-defined networks. SDN technology provides greater flexibility and speed in implementing security measures, allowing real-time responses to threats. In contemporary conditions, where cyber threats are becoming more complex and pronounced, SDN networks enable the detection of attacks, blocking malicious actions, and applying security policies in real-time. However, the increasing complexity of cyber threats and constant technological changes necessitate further development and enhancement of the information security of SDN network resources for companies. There is a need for further analysis and improvement of methods and tools for protecting information and other resources in computer-based SDN networks. The necessity for further analysis and improvement of methods and tools for protecting information and other resources in computer-based SDN networks serves as the foundation for this research. As a result, an enhancement in the level of information security for SDN network resources has been achieved by: 1) reducing the intervention time in the network; 2) applying an improved method of traffic processing based on network security of packet flows, allowing desired network applications to efficiently manage forwarding.

DATA PROTECTION AT THE STAGES OF ITS FUNCTIONING

Today, computer and information technologies have covered all areas of the economy. For any modern company, information becomes one of the main resources, the preservation and proper management of which is of key importance for business development and reducing the level of various risks. Ensuring information security is an urgent problem today. Methods of data security depend, among other things, on the state of the data. Taking into account what was said in the article, an attempt was made to consider the methods of data security depending on the data states (data at rest; data being transmitted; used data). So, for example, the state of inactive data (state of rest) is characterized by methods of security: in the form of the use of various encryption methods, access rights management, for example, such as SealPath, the use of MDM tools (they allow you to limit access to certain corporate programs, block access to a device or encrypt data on a mobile phone or tablet), DLP (data leakage prevention), CASB (cloud access security brokers): These are systems that allow us to apply security policies to the documentation we have in cloud systems, for example, such as Office 365, Box, Salesforce, etc. For the state of the transmitted data, typical methods of security in the form of application: encryption of e-mail; managed file transfer, such as MFT technology; DLP technologies provide protection because they can detect if sensitive data is being sent outside the organization; CASB (Cloud Access Security Brokers): refers to data transmitted by an untrusted user for this type of data), it may be blocked for download; SealPath technologies; etc. For the state of the data used, the typical methods of security in the form of application: in a successful case, digital rights protection technologies or IRM are recommended, which is one of the most effective means of data protection, because it combines encryption + permission management + identity control. This security allows documentation to be stored safely in its three states and tracked in any state sequentially.

Why businesses shouldn't rely on Istio's Mutual TLS

Containers are everywhere now, and with the help of Kubernetes it has become easy to deploy complex infrastructures. This raises its own challenges regarding visibility and the application of security policies. And while tools such as Istio have appeared to help with this issue, they need to be used with care and can raise security issues of their own.

ClassBench-ng: Benchmarking Packet Classification Algorithms in the OpenFlow Era

Packet classification, i.e., the process of categorizing packets into flows, is a first-class citizen in any networking device. Every time a new packet has to be processed, one or more header fields need to be compared against a set of pre-installed rules. This is done for basic forwarding operations, to apply security policies, application-specific processing, or quality-of-service guarantees. A lot of research efforts have identified better lookup techniques, i.e., finding the best match between packet headers and rules, by capitalizing on the rule sets characteristics. Here, ClassBench has greatly served the community by enabling the generation of IPv4 rule sets. In this paper, we present a new tool, ClassBench-ng, that creates synthetic IPv4, IPv6, and OpenFlow rules. We start from an analysis of classification rules deployed in-the-wild and we use the findings to craft our solution. ClassBench-ng can generate a user-defined number of rules as well as an associated header trace matching them. Compared to state-of-the-art solutions, the rule set generation process is usually more accurate and it is able to produce rules matching a number of different use cases, i.e., from an IPv4 router to an OpenFlow switch, which is unique among current rule set generation tools.

TZMon: Improving mobile game security with ARM trustzone

As the game industry is moving from PC to smartphone platforms, security problems related to mobile games are becoming critical. Considering the characteristics of mobile games such as having short life-cycles and high communication costs, the server/network-side security technologies designed for PC games are not appropriate for mobile games. In this study, we propose TZMon, a client-side game protection mechanism based on the ARM TrustZone, which protects the confidentiality and integrity of mobile games. TZMon is composed of application integrity protocol, secure update protocol, data hiding protocol, and timer synchronization protocol. To adequately safeguard game codes and data, TZMon is designed considering an environment of frequent communications with the game server, a stand-alone operation environment, and an unreliable environment using a rooted OS. Furthermore, flexibility is provided to game application developers who apply security policies by using the Java Native Interface (JNI). In this study, we use Android and the Open Portable Trusted Execution Environment (OPTEE) as the OS platforms for Normal World and Secure World, respectively. After implementing a full-featured prototype of TZMon, we apply it to several open-source mobile games. We prove through the experiments that the application of the proposed TZMon does not cause any noticeable performance degradation and can detect major cheating techniques of mobile games.

Makespan of routing and security in Cross Centric Intrusion Detection System (CCIDS) over black hole attacks and rushing attacks in MANET

PurposeThe purpose of this paper is to apply security policies over the mobile ad hoc networks. A mobile ad hoc network refers to infrastructure-less, persistently self-designing systems; likewise, there is a noteworthy innovation that supplies virtual equipment and programming assets according to the requirement of mobile ad hoc network.Design/methodology/approachIt faces different execution and effectiveness-based difficulties. The major challenge is the compromise of performance because of unavailable resources with respect to the MANET. In order to increase the MANET environment’s performance, various techniques are employed for routing and security purpose. An efficient security module requires a quality-of-service (QoS)-based security policy. It performs the task of routing and of the mobile nodes, and it also reduces the routing cost by finding the most trusted node.FindingsThe experimental results specify that QoS-based security policy effectively minimizes the cost, response time as well as the mobile makespan (routing cost and response time) of an application with respect to other existing approaches.Research limitations/implicationsIn this paper, the authors proposed an enhancement of Cross Centric Intrusion Detection System named as PIHNSPRA Routing Algorithm (PIHNSPRA).Practical implicationsIt maps the security with the secure IDS communication and distributes the packets among different destinations, based on priority. This calculation is proposed for the purpose of routing and security by considering greatest throughput with least routing cost and reaction time.Social implicationsWhen the concept is applied to practical applications. Quality of Service introduced in the proposed research reduces the cost of routing and improves the throughput.Originality/valueThe proposed calculation is tested by NS2 simulator and the outcomes showed that the execution of the calculation is superior to other conventional algorithms.

A Case Study on the Application of Security Policy for Outsourcing Personnel in case of Large-Scale Financial IT Projects

A Case Study on the Application of Security Policy for Outsourcing Personnel in case of Large-Scale Financial IT Projects

Performance Evaluation of 802.11g Architecture Using Security Protocols Based on Index Policy Method

Wireless local area networks (WLANs) are beginning to play a much larger role in corporate network environments. The 802.11g specification is a standard for wireless local area networks (WLANs) that offers transmission over relatively short distances at up to 54 megabits per second (Mbps), compared with the 11 Mbps theoretical maximum with the earlier 802.11b standard. In this paper, focus is on WLAN security technologies designed to improve 802.11 standard by applying security policies. Response time for authentication and encryption of 802.1X model and VPN model is compared. The comparison is done on most widely used security protocols such as WEP, RSA, EAP and DES based on measurement of policy indexing model implementation. The reports reported till date showed combined effect of encryption and authentication on response time and throughput. Response time increases by 268% and throughput decreases by 73% for 802.1X model. In case of VPN model the researchers found that there is increase in response time by 130% and decrease in throughput by 50%.The calculated results for packet transmission time for security level 2 for 802.1X is 17373 ms while for VPN it is 21996 ms, also for security level 3 it is calculated as 21419 ms for 802.1X and 22243 ms for VPN. The results obtained indicate that VPN policy method take more transmission time as compared to 802.1X policy method, but it provide more security than 802.1X method. The use of different security configuration will provide both the necessary flexibility to network operators and high level of confidence to end users.

Evaluation of isolation in virtual machine environments encounter in effective attacks against memory

AbstractOne of the main features of the hypervisor is the isolation among virtual machine (VM) environments. By isolation between VMs, malicious activity in one VM could not affect all other VMs, so it is necessary to apply security mechanisms in order to improve isolation between VMs. Before applying security policies to a virtualization system, it is necessary to quantitatively measure the hypervisor from isolation point of view aiming at increasing security of isolation among VMs; then considering the circumstances of the VM execution environments and the results of measurements, we can find areas in the virtualization system with the most effective on enhancing isolation. This paper, proposed a semi‐Markov model for evaluation of isolation, by studying the Xen virtualization architecture. We considered certain type of vulnerability that successfully exploiting it can lead to the attacker's malicious codes execution in part of memory address space. We included all three layers in virtualization for the evaluation purpose, because we wanted to consider strength and weakness areas in virtualization system and not just specific layer such as hypervisor, so it can be figured out that improving security in which layer of virtualization is most effective in improving security of isolation, in respect to the increasing or decreasing attacker's (defender's) ability to be successful. The sensitivity analysis results show that MTTSF is more sensitive to the increasing ability of defensive mechanisms to be successful at the application layer and decreasing the attacker's ability to successfully exploit vulnerabilities at the guest operating system layer, model parameters. Copyright © 2015 John Wiley & Sons, Ltd.

스마트 금융을 위한 비즈니스 로직과 분리된 보안프레임워크

본 연구에서는 스마트금융 서비스를 위한 서버 측 보안 프레임워크를 제안한다. 국내 금융기관의 전자금융서비스를 제공하는 서버 측 프레임워크 구조를 살펴보면 대부분 서비스제공위주의 구조를 가지고 있다. 따라서, 보안관련 요구사항들은 비즈니스 로직들에 같이 포함되어 있는 경우가 대부분이기 때문에 보안 사고에 효과적으로 대응하기 어렵다. 본 논문에서는 전자금융서비스시 보안영역을 비즈니스영역과 분리하여 업무에 대한 의존도(Dependency) 없이 보안 정책을 실시간으로 적용할 수 있는 프레임워크를 제안한다. 이를 통하여 보안관련 위협에 대한 신속하고 효과적인 대응기반을 제시한다. 또한 현재 서비스하고 있는 시스템구조에서도 시스템의 큰 변경없이 제안 프레임워크를 적용할 수 있는 방안을 제시한다. This study introduces server-side security-oriented framework for smart financial service. Most of domestic financial institutions providing e-banking services have employed server-side framework which implement service-oriented architecture. Because such architecture accommodates business and security requirements at the same time, institutions are struggling to cope with the security incidents efficiently. The thesis suggests that separating security areas from business areas in the frameworks makes users to be able to apply security policies in real time without considering how these policies may affect business transactions. Security-oriented frameworks support rapid and effective countermeasures against security threats. Furthermore, plans to avoid significant changes on existing system when institutions implement these frameworks are discussed in the report.

Los problemas de la implementación TOP-DOWN a nivel local. Un estudio de caso sobre seguridad ciudadana

The critics to the top-down model are consistent with the observed reality in one of the largest towns in Chile. Municipal public officials in charge of the execution of the policy carry out an implementation that could be described as «perfectly imperfect» by applying security policies based on subjective criteria and without keeping themselves passive or neutral. This state of affairs can be explained by the neglect of the security policies' designers regarding previous territorial interventions.

Applying security policies and service level agreement to IaaS service model to enhance security and transition

Over a decade ago, cloud computing became an important topic for small, medium and large businesses alike. The new concept promises scalability, security, cost reduction, portability and availability. While addressing the cloud concepts over the past several years, there have been intensive discussions about the importance of the different cloud computing service model. Moreover, there were lots of discussions about the risks in migrating to cloud computing. Therefore, this paper reviews the concept of cloud computing, security policies and concentrates on Infrastructure as a Service (IaaS) model. Also, the paper examines the risks encountered by implementing the Infrastructure as a Service (IaaS) model in organizations. Furthermore, the paper’s aim is to discuss the role of security policies, service level agreement (SLA) and compliance for enhancing the security of the IaaS service model by presenting several applicable policies.

Applying security policies through agent roles: A JAAS based approach

Agents are an emerging technology that grants programmers a new way to exploit distributed resources. Role is a powerful concept that can be used to model agent interactions, both between different agents and between agents and environments. Roles allow agents to dynamically acquire capabilities to perform specific tasks, and therefore enable separation of concerns and code reusability in software development and maintenance. Permissions and security issues related to role’s use should be carefully taken into account, especially when the agent scenario becomes open, including even mobile agents. In a Java agent scenario, we believe that the standard policy file mechanism does not suffice, because a fine grain permission management is required. This paper focuses on how to exploit the Java Authentication and Authorization Service (JAAS) at the role level in order to apply authorizations and local policies to Java agents for controlling the use of their roles.

The application of security policy to role-based access control and the common data security architecture

In this paper, the approaches to introducing security policy into Role-Based Access Control (RBAC) and the Common Data Security Architecture (CDSA) are proposed. We apply security policy to a role's privileges in RBAC. An extended RBAC using PKI and role-assignment policy is described. The improved CDSA supports user-definable trust policy enforcement using trust policy description files. A policy-based CDSA is also presented. Furthermore, a role definition language is given, and a policy representation language is discussed.