Aspects Of Information Security Research Articles

Target localization image encryption of wind turbines based on DNA strand replacement rule

The continuous development of the industrial internet of things has raised increasingly high requirements for the secure storage and transmission of information. Ensuring that image information avoids malicious attacks and tampering during transmission has become an important aspect of information security. In response to the security requirements for drone-captured image transmission during wind turbine inspection, this paper proposes a new target localization encryption scheme based on DNA strand replacement rules. In traditional methods using DNA encryption, the DNA computing rules used include DNA addition, DNA subtraction, and DNA XOR operations. These operations are relatively simple and have weak biological relevance, making them vulnerable to attack and decryption. To address this issue, this article introduces the principle of DNA strand replacement reaction and proposes a DNA strand displacement reaction rule. The rule has stronger biological relevance and more complex operational rule than traditional DNA algorithms, thus providing stronger security for encrypted images. Experimental results indicate that this encryption algorithm effectively enhances the information security of ciphertext images and can withstand brute-force attacks and various statistical attacks.

A COMPARATIVE REVIEW OF DATA ENCRYPTION METHODS IN THE USA AND EUROPE

Data encryption is a critical aspect of modern information security, and understanding the approaches taken by different regions is vital for a comprehensive analysis. In the United States and Europe, data encryption methods vary in implementation, legal frameworks, and overall priorities. In the United States, encryption methods are primarily governed by a combination of federal laws and industry standards. The National Institute of Standards and Technology (NIST) plays a central role in recommending cryptographic standards, while the Department of Commerce oversees export controls on encryption technology. The focus in the U.S. is on balancing national security needs with individual privacy rights. The tension between law enforcement's desire for access to encrypted data for criminal investigations and the right to privacy has sparked debates and legal battles. On the other hand, Europe has taken a more privacy-centric approach to data protection. The General Data Protection Regulation (GDPR) is a cornerstone in the European Union's efforts to safeguard individual privacy rights. GDPR mandates the use of encryption to protect personal data, and failure to implement adequate measures can result in hefty fines. European countries also emphasize the importance of end-to-end encryption in communication services to ensure confidentiality. Both regions prioritize encryption, but their approaches reflect different values and legal philosophies. The U.S. tends to navigate a delicate balance between national security and individual rights, while Europe places a stronger emphasis on the protection of personal data as a fundamental right. In terms of technological implementation, the encryption algorithms adopted in both regions are often aligned with global standards. Advanced Encryption Standard (AES) is widely accepted and implemented in various sectors. However, the choice of key management and the level of regulatory oversight differ, contributing to the nuanced landscape of data protection. In conclusion, a comparative review of data encryption methods in the USA and Europe reveals the complex interplay between security, privacy, and legal frameworks. Understanding these differences is crucial for multinational organizations and individuals navigating the intricate landscape of global data protection.
 Keywords: Data, Encryption, USA, Europe, Review.

Employees’ information security awareness (ISA) in public organisations: insights from cross-cultural studies in Sweden, France, and Tunisia

ABSTRACT The dominance of national culture in organisational environments has been widely acknowledged. This study aims to explore the impact of national culture on information security awareness by examining cultural characteristics in the public sector. Drawing on Hofstede's model, a literature review was conducted to analyze existing knowledge and identify cultural traits in selected countries. Empirical data were collected through semi-structured interviews conducted in Sweden, France, and Tunisia. The data were analyzed using the Human Aspects of Information Security (HAIS) model, revealing distinct patterns and emphasising the role of culture in shaping behaviours. The findings underscore the importance of involving Swedish employees in the policy design process to effectively enhance information security awareness. For French employees, it was found that learning from past experiences and respecting hierarchical structures are crucial factors in raising awareness. Conversely, in Tunisia, information security initiatives should take into account the social and relational aspects to promote awareness effectively. These insights provide valuable guidance to managers in multinational organisations, enabling them to comprehend the underlying forces and dynamics in countries with similar characteristics.

Opportunities for developing the information security capability at hazardous plants given current challenges

Aim: One of the biggest challenges people face today is the development of an effective and efficient defence capability against cyber attacks. Nowadays, this is not only an expectation at the public level, but also a real need at the corporate and private user level. In this study, the author primarily wishes to draw attention to the global trends of new types of threats in the 21st century, the most vulnerable sectors, as well as to the development possibilities of the cyber security capabilities of domestic hazardous plants.Methodology: The author has conducted a qualitative research method using primary and secondary data to identify current trends and attack vectors of threats in cyberspace at global and regional levels. In addition, the author has also conducted empirical research using primary data to determine the development possibilities of the management/safety management systems of plants dealing with hazardous substances, as well as to build the resilience of the electronic information systems of these plants against cyber threats.Findings: The number of cyber-attacks have continued to grow over the last few decades, and industrial companies have become the main targets of these new types of attacks. In order for Hungary to develop an effective defence capability, especially in the case of industrial actors, it is important to create the cyber defence capability of plants dealing with hazardous materials under the supervision of the disaster management, industrial safety authority.Value: Taking stock of the possibilities of developing the security management system of domestic hazardous materials plants to protect against 21st century threats. This scientific work intends to provide more detailed information on the addition and feasibility of the management system with information security aspects.

АНАЛІЗ СВІТОВОГО ДОСВІДУ ФОРМУВАННЯ СИСТЕМИ ІНФОРМАЦІЙНОЇ БЕЗПЕКИ В КОНТЕКСТІ ПУБЛІЧНОГО УПРАВЛІННЯ

The article is devoted to the issues of ensuring the functions of public information security management in the context of modern challenges. Informatization processes have covered all spheres of human life, which has led to the emergence of new threats. In today’s world, where electronic technologies are becoming a necessity to ensure the effectiveness of public administration functions, the issue of information security is a key and urgent one. The problems of information security are currently being actualized by a significant increase in the role of accumulation, processing and dissemination of information, in particular, in making strategic, military, political and economic decisions. In this regard, the question of how well the modern public administration system is able to respond to the challenges posed by global digitalization is becoming relevant. The purpose of the paper is to study the peculiarities of ensuring information security in public administration, to analyze current threats and the experience of other countries in overcoming them. In analyzing certain aspects of information security, the paper uses methods of description and classification, as well as methods of studying causal relationships, in particular, the combination of similarities and differences. The article examines the trends in the development of public information security management as a key mechanism for ensuring the security of the State. The author identifies the issue of information security as an element of the State defense policy, which is of particular relevance in the context of full-scale military aggression. The concept of public management of information security can be defined as the process of managing measures aimed at protecting confidential information from unauthorized access, use, disclosure and destruction at the level of the State, organizations or citizens. This process may include the creation of appropriate legislation, the establishment of appropriate control and supervisory bodies, the conduct of information security education and training, and the installation of appropriate security technologies and systems to protect confidential information. The place and role of the system of regulation of information support of management processes at the state level are clarified. Sufficient attention is paid to the peculiarities of ensuring information security in public administration through the analysis of modern information threats. Considering the world experience, the author identifies the key success factors and the problems faced by public administration in overcoming them. We consider it expedient to create national analysis and response centers that will monitor, analyze and respond promptly to cyber threats and improve cybersecurity measures for critical facilities.

Analiza socioloških aspekata informacione bezbednosti primenom HAIS-Q modela

The aim of the paper is to research the sociological aspects of information security through the HAIS-Q model, at the Faculty of Engineering Management. The research was conducted anonymously, within a time frame of four months, on a sample of 179 respondents. The HAIS-Q model is built from seven focus groups, which pervade the variables of knowledge, attitudes and behaviours, while the subject research is focused on the focus area "use of the Internet". By analyzing the variables with the lowest scores in one of the seven focus areas of this model, gaps in information security awareness among employees are explored. The paper highlights the implications of these deficiencies for organizational security and information protection, with an emphasis on the importance of improving the variables with the lowest scores. Through a comprehensive consideration of the sociological dimensions of information security, this paper contributes to a better understanding and management of this important field, emphasizing its importance in today's digital age.

Costs and benefits of business information security

The article considers the process of information security from the position of cost-benefit assessment that allows to understand economic aspects of feasibility study of measures in the field of business information protection. In the practice of Russian business, the issues of information security are focused on compliance with regulatory requirements of the legislation. This leads to the fact that business entities neglect the procedure of comprehensive assessment of measures effectiveness that should consider the costs and benefits of legal, organizational, and technical information protection implementation. At the same time, in order to meet the new conditions of technological development of society, it is necessary to revise the concept of information protection of business entities and to fix in the policy of information security of activities the approaches to risk assessment based on assets value. The study contains a description of the cost/ benefit approach to the constituent components of ensuring information security of business process. To understand the economic aspects of information security, the research focuses on business entities of the market type of economic activity (the enterprise makes profit in its activity). The composition of components of the ensuring information security process has been defined. On the example of risk management costs and benefits of information security have been considered in detail.

Edge AI for Internet of Energy: Challenges and perspectives

The digital landscape of the Internet of Energy (IoE) is on the brink of a revolutionary transformation with the integration of edge Artificial Intelligence (AI). This comprehensive review elucidates the promise and potential that edge AI holds for reshaping the IoE ecosystem. Commencing with a meticulously curated research methodology, the article delves into the myriad of edge AI techniques specifically tailored for IoE. The myriad benefits, spanning from reduced latency and real-time analytics to the pivotal aspects of information security, scalability, and cost-efficiency, underscore the indispensability of edge AI in modern IoE frameworks. As the narrative progresses, readers are acquainted with pragmatic applications and techniques, highlighting on-device computation, secure private inference methods, and the avant-garde paradigms of AI training on the edge. A critical analysis follows, offering a deep dive into the present challenges including security concerns, computational hurdles, and standardization issues. However, as the horizon of technology ever expands, the review culminates in a forward-looking perspective, envisaging the future symbiosis of 5G networks, federated edge AI, deep reinforcement learning, and more, painting a vibrant panorama of what the future beholds. For anyone vested in the domains of IoE and AI, this review offers both a foundation and a visionary lens, bridging the present realities with future possibilities.

Early Formalization of AI-tools Usage in Software Engineering in Europe: Study of 2023

This scientific article presents the results of a study focused on the current practices and future prospects of AI-tools usage, specifically large language models (LLMs), in software development (SD) processes within European IT companies. The Pan-European study covers 35 SD teams from all regions of Europe and consists of three sections: the first section explores the current adoption of AI-tools in software production, the second section addresses common challenges in LLMs implementation, and the third section provides a forecast of the tech future in AI-tools development for SD. The study reveals that AI-tools, particularly LLMs, have gained popularity and approbation in European IT companies for tasks related to software design and construction, coding, and software documentation. However, their usage for business and system analysis remains limited. Nevertheless, challenges such as resource constraints and organizational resistance are evident. The article also highlights the potential of AI-tools in the software development process, such as automating routine operations, speeding up work processes, and enhancing software product excellence. Moreover, the research examines the transformation of IT paradigms driven by AI-tools, leading to changes in the skill sets of software developers. Although the impact of LLMs on the software development industry is perceived as modest, experts anticipate significant changes in the next 10 years, including AI-tools integration into advanced IDEs, software project management systems, and product management tools. Ethical concerns about data ownership, information security and legal aspects of AI-tools usage are also discussed, with experts emphasizing the need for legal formalization and regulation in the AI domain. Overall, the study highlights the growing importance and potential of AI-tools in software development, as well as the need for careful consideration of challenges and ethical implications to fully leverage their benefits.

Information security: international legal aspect

The article highlights the international legal aspects of information security. The results of the analysis of international legal norms in the field of information security, as well as foreign experience in this field, are presented. The importance of the experience of certain foreign countries in the field of information security for Ukraine is emphasized. Given the global nature of communication networks, it is concluded that information security should be ensured only through effective international cooperation between states. During the research, priorities and issues related to information security in Eastern European countries are determined. Prioritized directions for legal support of information security in Ukraine have been identified.

Information Security Management: American Experience

The purpose of the article is a comprehensive analysis of the American concept of threats to information security and determination of priority areas of the US’s activity in creating a secure national cyberspace. The methodological basis of the study is general scientific and special methods of cognition, in particular, systemic approach, analysis, synthesis, and logical method. Methods of content analysis, comparative and analytical monitoring of Internet resources of US government bodies responsible for information security are also used. The scientific novelty of the study consists in the expansion of ideas about theoretical aspects in the field of information security and the systematic analysis of instrumental, conceptual foundations and practical aspects of information security in the United States. Conclusions. The globalisation of information systems has created a completely new situation in the security field. In cyberspace the main threat to the US national security comes from states and intermediaries acting in their interests. They have the necessary skills and technologies to carry out destructive cyberattacks for military and political purposes, and also effectively use cyberespionage methods, which not only entails economic losses, but also causes great damage to strategically important industries for the US. The American concept covers such three key levels of cyber security as the state, private business and individual users. There are such defence priorities for the United States as ensuring the protection of critical infrastructure, information networks and systems; quality control of used IT equipment; formation of effective mechanisms of interlevel communication and raising awareness at all levels. An important component of the US National Cyber Strategy is international cooperation on information security issues. In this regard, at the international level the United States seeks to implement such opportunities as to encourage countries to increase responsibility for ensuring the security of information systems and networks at the national and global level; to create the legal regime necessary to ensure cross-border access to information; to form a regime of collective cyber defence within the framework of NATO and other bilateral and multilateral agreements with strategic partners; to preserve the maximum possible freedom of action in cyberspace in order to conduct all types of information operations both during military conflicts and in peacetime. Keywords: cyberspace, information threat, information war, information security, information management, informatisation, ICT.

Comparing Information Security Compliance Between New Zealand, USA, and Vietnam

ABSTRACT The number of employees working remotely has grown significantly in recent years, creating new challenges for information security functions within organizations. The increasing threat surface and lack of control over personal employee networks and devices pose a significant risk, especially when it comes to information handling and incident reporting. We built upon prior work on the human aspects of information security and conducted a quantitative study to compare behaviors, attitudes, and knowledge of employees from New Zealand, the USA, and Vietnam. Our findings suggest that although information security best practices are universal, some of them are understood and applied differently across the globe. Our study offers valuable practical and theoretical implications and can serve as a foundation for organizations to revise their security education, awareness, and training (SETA) programs to reflect more accurately the nuanced nature of the diverse workforce of the 21st century.

Изучение вопросов социальной инженерии и организационно-правовых аспектов информационной безопасности раздела «Цифровая грамотность» курса информатики среднего общего образования с применением кейсов

The article is devoted to the preparation and use of cases on social engineering to consider organizational and legal aspects of information security. With the increasing availability of digital tools, the topic of personal information security remains relevant, as the proportion of people who are deceived by fraudsters is only increasing. Sophisticated phishing scenarios and attacks on social networks and messengers have become especially popular. The formation of a holistic view in the field of information security with an emphasis on the formation of digital competencies in the field of information ethics and law is becoming increasingly demanded in general education. To achieve subject outcomes on the topic, computer science teachers are encouraged to use interactive social engineering cases in a computer science course at the secondary general education level.

Implementasi Kombinasi Enkripsi Base64 Dengan Hashing Sha-1 Dan Md5 Pada Aplikasi Perpustakaan Universitas Muhammadiyah Bengkulu

One of the aspects of information security that can be done for a system is by adding security to a system, if using Base64 with static Sha-1 and Md5 hashing there is little possibility of data theft by hackers because they have been given layered security, to apply base64 with hashing-1, a cryptographic science mechanism is needed in it. Lately, many universities in the library unit section have placed web-based applications on the internet as a medium for displaying information systems that are very cheap, many activities can be carried out by users on these presentation media, such as accepting registration for new library members, ordering books, presentation of scientific journals, presentation of student final assignments (thesis, theses and dissertations) and others. Data security that still uses the usual method often causes several problems, such as being exposed to attacks and break-ins by hackers which can result in leaks and loss of existing data. This problem arises because there is no security system for library applications, the purpose of this research is to implement security for the library system by implementing a combination of Base64 encryption with sha-1 and MD5 hashing so that important data contained in the library unit is safe from leaks. After implementing the collaborative use of Base64 with sha-1 and MD5 hashing, the results of hacking a simple Python script to test a brute force attack for testing password storage security using a combination of Base64 encryption and SHA-1 and MD5 hashing on library applications with after results testing a brute force attack on the Visual Studio Code (VSC) application, the results obtained are "Passwords do not match", this result indicates that the collaboration of several algorithms was successful.

Cyber resilience and cyber security issues of intelligent cloud computing systems

It is necessary to provide the cyber security of cloud computing according to the components that constitute its structure. The first step in advancing the cyber security of this technology is to accurately identify its threats. In this paper, a new cyber security reference model of the cloud system, which consists of components making up separate layers of cloud computing is proposed. Available reference models of cloud computing security do not describe the virtualization and service layers and the important components for providing the cyber security of cloud computing in detail, do not consider the social media IoT sensor layer, which collects the text data typed by attackers to carry out cyber attacks on the cloud infrastructure, and the cyber resilience issues of the cloud computing at all In addition, this paper studies the cyber security issues of cloud computing service models, and constructs an attack model to provide security of cloud systems. It gives an interpretation of standards and legislative acts on the cyber security of cloud computing. According to security aspects, clarification of the cyber security and cyber resilience concepts of cloud systems is provided. The cyber resilience architecture of intelligent cloud systems is developed. The advantage of developed cyber resilience model over available one is that, it determines the information security and cyber security aspects of cloud computing and combines them to form the cyber resilience aspects of cloud systems.

Information security investment prioritization using best-worst method for small and medium enterprises

In recent years, cyber security has become an increasingly important aspect of the decision-making process of corporations. It is essential to make investments in cybersecurity at this point to guard against the frequent disruption of business operations posed by cyberattacks. In the context of small and medium-sized organizations, this study recommends using a multicriteria decision-making technique to evaluate information security aspects. The information security index is derived as the foundation for every one of these features. The best-worst method is carried out to establish the best and worst possible security investments. In order to validate these findings, a survey was distributed to a variety of professionals and business decisionmakers. The criteria for selection are laid forth in the form of categories labeled technology and organization, respectively. The findings are presented in a rating system with three tiers, with the highest level representing the absolute best of the results. In the final section of the study, we will examine potential future possibilities for research and policy.

Teaching Social Science Aspects of Information Security

As information security has become increasingly crucial in our daily lives, there is a growing need to teach its social science aspects. This paper explores the challenges and best practices for teaching social science aspects of information security. It begins with the importance of information security and cyberspace and highlights the human aspects of information security. Next, it discusses the role of social science in understanding information security and how social science can help us better design and implement security measures. The paper identifies challenges in teaching social science aspects of information security, such as the interdisciplinary nature of the subject and the need for a standardised curriculum. Finally, the paper outlines best practices for teaching social science aspects of information security, such as using case studies and real-world examples, incorporating interactive and experiential learning, and leveraging existing resources. The conclusion highlights the importance of incorporating social science aspects of information security in education and suggests future research directions.

DIGITAL LITERACY OF THE POPULATION AS A MEANS OF INFORMATION SECURITY IN THE REPUBLIC OF BELARUS AND THE RUSSIAN FEDERATION

The article deals with digital literacy as a means of ensuring information security in the Republic of Belarus and the Russian Federation. The study covers both the regulatory and institutional aspects of information security, incl. through increasing the digital literacy of the population. A number of directions have been proposed to raise the level of digital literacy of citizens, incl. through the introduction of modern tools of information interaction in the state system of dissemination of legal information. The content of the powers of the state bodies of the Russian Federation and the Republic of Belarus in the field of ensuring the information security of the state, society and citizens is also disclosed. Particular attention is paid to the information security of children (youth).

Ensuring Information Security of OLAP-Containing Distributed Electronic Systems using Blockchain Technology

The article outlines the properties of blockchain technology, according to which the content of blockchain blocks is immutable and the use of a peer-to-peer (P2P) network implies decentralized management. It describes the essence and meaning of smart-contracts and smart-views derived from them, which are involved in the process of data analysis and decision making. The article considers the papers devoted to various approaches to the problem of integration of blockchain technology and data storage. To ensure all three key aspects of information security — the integrity, availability and confidentiality of information, which is important for both government and corporate structures, the article proposes to use a private blockchain, instead of a public one. A modification of the model of an electronic decision support system containing an OLAP block, which includes a private blockchain, is developed. It is shown that this DSS model can be used as an electronic demographic DSS, which is an infrastructure for solving state problems in this area, since many of the characteristics of this model correspond to the multisectoral nature of demography.

УСТОЙЧИВОСТЬ ТЕХНОЛОГИЧЕСКИХ ПРОЦЕССОВ В АСПЕКТЕ БЕЗОПАСНОСТИ КРИТИЧЕСКОЙ ИНФОРМАЦИОННОЙ ИНФРАСТРУКТУРЫ

The purpose of the paper is to study the sustainability of technological processes in the aspect of the security of critical information infrastructure (CII). Cybercrime today brings attackers an income (affecting critical information infrastructure objects) of about $1.5 trillion a year, which means that the security of critical information infrastructure is still requiring due attention. Currently, there is no generally accepted approach to conducting such an assessment and its definition remains an urgent problem. It is also important to understand that the stability of technological (including significant, critical) processes does not always ensure their safety (management safety), as well as ensuring safety does not ensure the execution of technological processes. The object of the study is the objects of the CII. The subject of the study is technological processes in the context of threats to information security. The technological process and its stability at CII facilities in the aspect of information security are studied. The analysis of regulatory legal acts (NPA) and scientific publications on the research topic is carried out. The analysis of the NPA of the CII showed that there are serious problems in this area. In order to formulate specific measures of sustainability of indicators, one can use the given sustainability matrix. The paper formulates the requirements for evaluation indicators. Based on the results of the study, it was found that the assessment of the stability of the functioning of objects can be implemented on real significant objects of the CII, while the stability coefficients of the elements can be detailed in more detail. Definitions and problems are considered, the main sources confirming the importance of the study are presented. The results of the study can be used when considering approaches to assessing the sustainability of technological processes in the context of CII safety.