Information Security Assurance Research Articles

Административная ответственность за незаконное применение иностранных мессенджеров: проблемы и перспективы развития

Today, the assurance of information security is of major importance because an illegal access to certain data creates significant threats to the sustainable development of the Russian state. In the conditions of universal informatization and digitalization, messengers are actively used in professional activities of present-day people, however, there currently arise a lot of problems associated with the assurance of security of information transferred through messengers. The presented article analyzes the administrative liability for the illegal use of foreign messengers in activities of certain organizations and institutions that has been introduced in the Russian Federation since June 24, 2023. Based on the conducted study, the paper concludes that the introduction of the above said liability is of justified and timely nature, considering the improvement of laws on information, information technologies and protection of information. The author focuses on certain problems arising in the course of bringing to liability under Art. 13.11.2 of the Administrative Offense Code of the Russian Federation, develops solutions.

Assurance of Network Communication Information Security Based on Cyber-Physical Fusion and Deep Learning

The internet brings high efficiency and convenience to society; however, the issue of information security in network communication has significantly affected every aspect of the society. How to ensure the security of this network communication information has become an important research topic. This paper proposes a diagnosis and prediction method based on cyber-physical fusion and deep learning, such as LSTM and CNN, to diagnose and predict network security in a complex network environment. The experiment results showed that the accuracy of network security diagnosis of the LSTM method in the training set was approximately 80%/ After the CNN training process, it has the highest accuracy rate of 95% on the test data set. This paper analysed the nature of network security problems from the perspective of cyber-physical fusion. CNN-based method to diagnose network security can obtain results with a higher accuracy rate so that technicians can better take measures to protect network security.

Information Security Architecture Design for Cyber-Physical Integration System of Air Traffic Management

With the continuous expansion of air traffic flow, the increasingly serious aviation network security threats have a significant and far-reaching impact on the safe operation of the aviation industry. The networked air traffic management (ATM) system is an integrated space–air–ground network integrating communication, network, satellite, and data chain technology, which adopts a network-centric structure to provide network-enabled services and applications for the air transportation system. In view of the serious network threats faced by networked ATM, this paper studies the basic theories and key technologies of ATM information security assurance and designs a credible security architecture to provide comprehensive and systematic security assurance for networked ATM. Starting from the problems and development trend of ATM security assurance, this paper investigates the dynamic and complex data processing process of ATM system, analyzes the complex interaction between its cyber and physical system, and then constructs the networked ATM cyber–physical fusion system model and threat model. Furthermore, the causal relationship between ATM security threat alert information is mapped into a Bayesian network, and the game model of networked ATM is proposed using Bayesian Nash equilibrium strategy. At last, the information security assurance architecture of networked ATM system based on blockchain technology is formed by establishing a distributed co-trust mechanism and multi-chain storage structure. We expect this paper to bring some inspiration to the related research in academia and aviation so as to provide useful reference for the construction of ATM safety and security system and the development of technology.

Analysis of Network Security Countermeasures From the Perspective of Improved FS Algorithm and ICT Convergence

In this paper, the forward selection (FS) algorithm is introduced on the basis of information and communication technology, and the design of intrusion detection method for communication network is carried out. By studying the classification and detection pattern matching of communication network intrusion behavior, extracting the intrusion behavior features of communication network based on FS algorithm, and optimizing the intrusion detection and learning effect based on the limit learning machine, the intrusion behavior attributes of communication network are clarified, and a new detection method is proposed to solve the problems of low detection accuracy and low recall in the current intrusion behavior detection of complex communication network environments. Compared with the intrusion detection method based on GA-SVM algorithm, the accuracy of the detection results reaches 94.23%, and the recall rate exceeds 97%, which is obviously better than the 85% accuracy and 75% recall rate of the traditional detection method, which can ensure the security of the communication network environment. In addition, this paper proposes the APDR dynamic comprehensive information security assurance system model, which has considerable flexibility and can respond to current network security requirements.

Privacy Law Protection Based on the Information Security Assurance Algorithm.

With the continuous development of network technology, the production and lifestyle of human beings are also quietly changing. People find that the network makes life faster and more convenient and also makes our life more “transparent.” The openness, sharing, and convenience of the network make it easier to infringe on the privacy rights of others, bringing an unprecedented impact on traditional privacy protection. This paper studied information security assurance-related algorithms and built an information security assurance model. Through this model, some privacy violation events existing in the network today were analyzed. Then, a corresponding questionnaire was constructed according to some of the problems of these events. The questionnaire is mainly used for research on people of all age groups, mainly to study their understanding of relevant legal knowledge and their views on the law. A total of 188 valid questionnaires were collected in this survey. Only 37.23% people knew a lot about the law. Most of them learned it from the Internet, and they rarely learned about it from relevant books. About 70% people believe that the law plays a big role in privacy protection, and they will choose legal help if they encounter privacy violations. However, this is inconsistent with some data obtained from the information security assurance model. Through analysis, it can be seen that although they want legal help, they lack the relevant knowledge of the law, and they do not know whether the privacy of individuals has been violated. Therefore, it is necessary to strengthen personal knowledge of privacy protection laws and improve the personal information legal protection and fair use system.

Creating the system of countering fake information as assurance of the state information security

The article focuses on the notion of fake information as a tool of psychological influence in the context of hybrid wars. The theoretical framework of this research constitutes works of the prominent academicians in the area of manipulation studies. Empirical research methods such as observation, comparison, generalization and expert evaluation are used. First of all, types and methods of psychological influences used by mass media and social networks with a view to manipulate public opinions are distinguished. Moreover, the impact of emotions on the critical perception of the news is highlighted. The indicators of manipulative influence are defined in order to resist them. Besides, the ways of creating and distributing false information are described. In addition, the development of fakes identification mechanisms is considered a priority for the governmental and other public institutions. This is illustrated by a range of technologies developed to automatically detect fake news. Apart from that, the degrees of the information reliability are explored. Furthermore, structural elements of fake messages, which include the source and the message itself, are discussed. Misinformation of the public, promotion of certain opinions, encouragement of aggressive actions and installment of doubts are singled out as the main tasks of fake information.

Information Security Assurance and the Role of Security Configuration Management: Substantive and Symbolic Perspectives

ABSTRACT This paper explores whether IT and audit professionals have different perceptions of the substantive and symbolic perspectives of information security assurance and the role of security configuration management (SCM) using a mixture of qualitative and quantitative approaches. Importance performance analysis (IPA) is utilized to identify differences in perceived importance and perceived controllability from both substantive and symbolic perspectives between these two professional groups. Our results suggest that SCM plays a vital role in maintaining consistency between the IT and audit professionals by enhancing their confidence in controlling and managing information security control sets. IPA also helps determine an information security program's strengths and weaknesses and supports remedial strategic actions more efficiently. Implications for both research and practice are discussed.

Information Security Assurance and the Role of Security Configuration Management: Substantive and Symbolic Perspectives

This paper explores whether IT and audit professionals have different perceptions of the substantive and symbolic perspectives of information security assurance and the role of security configuration management (SCM) using a mixture of qualitative and quantitative approaches. Importance performance analysis (IPA) is utilized to identify differences in perceived importance and perceived controllability from both substantive and symbolic perspectives between these two professional groups. Our results suggest that SCM plays a vital role in maintaining consistency between the IT and audit professionals by enhancing their confidence in controlling and managing information security control sets. IPA also helps determine an information security program's strengths and weaknesses and supports remedial strategic actions more efficiently. Implications for both research and practice are discussed.

Aggregated symmetric key-based hierarchical group data sharing in cloud

Cloud computing is defined as a type of computing that relies on sharing computing resources rather than having local servers or personal devices to handle applications. Data sharing is the major advantage in cloud computing, hence cloud computing security is a major concern. Cloud computing security refers to the set of procedures, processes and standards designed to provide information security assurance in a cloud computing environment. A key challenge to designing such encryption scheme lies in the efficient management of encryption keys to be used for the documents. In order to examine the flexibility, scalability and fine grained access scheme of outsourced data in cloud computing, this paper introduces a new scheme called HASK scheme by extending the file sharing capabilities of KASE with a hierarchical taxonomy. In HASK, we propose an algorithm called HASK encryption as the enhanced scheme for KASE.

Enhancing Data Base Security in Cloud Computing

Information security has reliably been a significant issue in data innovation. In the distributed computing condition, it turns out to be especially genuine in light of the fact that the distributed is suitable in better places even in all the globe. Distributed and security insurance are the two fundamental components of client's worries about the cloud innovation. Despite the fact that numerous procedures on the themes in distributed computing have been researched in the two ventures, information security and security assurance are getting progressively significant for the future improvement of distributed computing innovation in government, industry, and business. Information security and protection assurance issues are significant to both equipment and programming in the cloud design. This examination is to survey diverse security methods and difficulties from both programming and equipment angles for ensuring information in the cloud and targets upgrading the information security and protection assurance for the dependable cloud condition. In this paper, we make a relative research examination of the current research work with respect to the information security and security assurance procedures utilized in the distributed computing.

An Proficient Quad Verification Strategy in Cloud Storage

In this investigation, distributed storage plan is recommended to have a four-factor information security assurance instrument with factor revocability. This framework enables a sender to send an encoded message to a collector by means of a distributed storage server. The sender just needs to understand the personality of the collector, however no other data, (for example, the key or authentication of their state). The collector must have two stuff to unscramble the ciphertext. The primary thing put away in the PC is its mystery key. The subsequent thing is a particular person. With no piece, it is difficult to decode the ciphertext. All the more critically, this gadget will be pulled back once the wellbeing gadget is looted or lost. No ciphertext can be decoded. The cloud server can do this, which will quickly play out certain calculations to modify the current ciphertext with the goal that this machine can un-decode it. This strategy is absolutely straightforward to the transmitter. What's more, no ciphertext can be decoded by the cloud server whenever. The appraisal of wellbeing and viability demonstrates that not exclusively is our framework safe yet in addition useful.

Security monitoring and information security assurance behaviour among employees

PurposeThe purpose of this research is to explain the influence of information security monitoring and other social learning factors on employees’ security assurance behaviour. Security assurance behaviour represents employees’ intentional and effortful actions aimed towards protecting information systems. The behaviour is highly desired as it tackles the human factor within the information security framework. The authors posited that security assurance behaviour is a learned behaviour that can be enhanced by the implementation of information security monitoring.Design/methodology/approachTheoretical framework underlying this study with six constructs, namely, subjective norm, outcome expectation, information security monitoring, information security policy, self-efficacy and perceived inconvenience, were identified as significant in determining employees’ security assurance behaviour (SAB). The influence of these constructs on SAB could be explained by social cognitive theory and is empirically supported by past studies. An online questionnaire survey as the main research instrument is adopted to elicit information on the six constructs tested in this study. Opinion from industry and academic expert panels on the relevance and face validity of the questionnaire were obtained prior to the survey administration.FindingsFindings from this research indicate that organisations will benefit from information security monitoring by encouraging security behaviours that extend beyond the security policy. This study also demonstrates that employees tend to abandon security behaviour when the behaviour is perceived as inconvenient. Hence, organisations must find ways to reduce the perceived inconvenience using various security automation methods and specialised security training. Reducing perceived inconvenience is a challenge to information security practitioners.Research limitations/implicationsThere are some limitations in the existing work that could be addressed in future studies. One of them is the possible social desirability bias due to the self-reported measure adopted in the study. Even though the authors have made every effort possible to collect representative responses via anonymous survey, it is still possible that the respondents may not reveal true behaviour as good conduct is generally desired. This may lead to a bias towards favourable behaviour.Practical implicationsIn general, the present research provides a number of significant insights and valuable information related to security assurance behaviour among employees. The major findings could assist security experts and organisations to develop better strategies and policies for information security protection. Findings of this research also indicate that organisations will benefit from information security monitoring by encouraging security behaviours that extend beyond the security policy.Social implicationsIn this research, the social cognitive learning theory is used to explain the influence of information security monitoring and other social learning factors on employees’ security assurance behaviour; the finding implies that monitoring emphases expected behaviours and helps to reinforce organisational norms. Monitoring may also accelerate learning when employees become strongly mindful of their behaviours. Hence, it is important for organisations to communicate the monitoring practices implemented, even more imperative whenever security monitoring employed is unobtrusive in nature. Nonetheless, care must be taken in this communication to avoid resentment and mistrust among employees.Originality/valueThis study is significant in a number of ways. First, this study highlights significant antecedents of security assurance behaviour, which helps organisations to assess their current practices, which may nurture or suppress information security. Second, using users’ perspective, this study provides recommendations pertaining to monitoring as a form of information security measure. Third, this study provides theoretical contribution to the existing information security literature via the application of the social cognitive learning theory.

ТЕСТУВАННЯ БЕЗПЕКИ ПРИСТРОЇВ ІНТРЕНЕТУ РЕЧЕЙ НА БАЗІ МІКРОКОНТРОЛЕРА ESP32

In the paper analysis of current trends in IoT technologies enabled us to identify a segment for which information security assurance may encounter a lack of its level. These are IoT devices based on ESP32 microcontroller, that designed and implemented at home by non-professionals. The physical model of a handmade IoT system that includes device for measuring temperature based on ESP32 (small-sized ESP32-based development board ESP32 devKit V2 produced by Espressif and digital temperature sensor DS18B20), WiFi home network (based on router TL-WR841N) and web interface (based on node-red-dashboard) was proposed and implemented upon laboratory scale. The initial conditions of the experiment included the following: the use of the UDP protocol, authentication and data encryption based on WPA2-PSK specification, attacker skill level sufficient for use Aircrack-ng tools, Airmon-ng, Airodump-ng, Aireplay-ng, Besside-ng, Wireshark. The result of the experiment based on this model to attempt to gain unauthorized access to the transmitted data was successful. Attack scenario was formulated and consist of four stages: 1 – gaining unauthorized access to a network (network card transfers to monitor mode (Airmon-ng), view available access points (Airodump-ng), handshake interception, guessing the password (Besside-ng); 2 – network traffic interception and analysis (Wireshark); 3 – creating fake ESP32 client using the captured data (Arduino) and connect it to the network; 4 – disconnecting original ESP32 from a server (Aircrack-ng). It is shown that the attacker, who has the basic knowledge and skills in working with common wireless network hacking tools and a basic knowledge of ESP32 and ESP32 programming skills can access the system and send fake information to the web interface. To reduce the probability of the proposed scenario it is recommended to use TCP protocol, which is in contrast to UDP ensures data integrity and sender notification of transmission results.

Internet of Things: information security challenges and solutions

Keeping up with the burgeoning Internet of Things (IoT) requires staying up to date on the latest network attack trends in dynamic and complicated cyberspace, and take them into account while developing holistic information security (IS) approaches for the IoT. Due to multiple vulnerabilities in the IoT foundations, many targeted attacks are continuing to evolve. This survey of related work in the very specialized field of IS assurance for the IoT develops a taxonomy of typical attacks against IoT assets (with special attention to IoT device protection). Based on this taxonomy, the key directions for countering these attacks are defined. According to the modern demand for the IoT and big IS-related data processing, we propose applying the Security Intelligence approach. The results obtained, when compared with the related work and numerous analogues, are based on the following research methodology: view the IoT as a security object to be protected, leading to understanding its vulnerabilities and possible attacks against the IoT exploiting these vulnerabilities, and from there approaches to protecting the IoT. A few areas of the future research, among which the IoT operational resilience and usage of the blockchain technology seem to us the most interesting, are indicated.

Intelligent cloud computing security using genetic algorithm as a computational tools

An essential change had occurred in the field of Information Technology which represented with cloud computing, cloud giving virtual assets by means of web yet awesome difficulties in the field of information security and security assurance. Currently main problem with cloud computing is how to improve privacy and security for cloud “cloud is critical security”. This paper attempts to solve cloud security by using intelligent system with genetic algorithm as wall to provide cloud data secure, all services provided by cloud must detect who receive and register it to create list of users (trusted or un-trusted) depend on behavior. The execution of present proposal has shown great outcome.

Концептуальні засади формування системи забезпечення інформаційної безпеки держави

Концептуальні засади формування системи забезпечення інформаційної безпеки держави

On the international research-to-practice conference on modern problems and tasks of information-security assurance (SIB’2017)

This article considers the results of a conference held at the Moscow University of Finance and Law in April 2017. The conference had three sections: Information Security Assurance Technologies, Data Protection Hardware and Software, and Upcoming Trends in Information Security Assurance. More than 40 reports were presented. A brief review of the plenary and main sectional reports is provided.

Pengaruh Perceived Security terhadap Pengadopsian In-App Purchase pada Aplikasi Mobile

In-App Purchase or payment system based on application is one of promising revenue model in mobile application for application developers or marketers. However, in-app purchase is placed in the lowest rate compared to other model. This paper attempts to present the analysis of in-app purchase adoption viewed from the user behavior of mobile application as consumers. This study is conducted by combining the unified theory of acceptance and use of technology approach that was developed (UTAUT2) with involving perceived security aspect. The result shows that the habit of potential users, information security assurance, and hedonic motivations of potential users are the main supporting factors in adopting in-app purchase. Those factors can be admitted as a reference in developing mobile application, in order to make in-app purchase can be accepted and used by potential users of mobile application.

Developing an Empirical Relationship to Propose an Information Security Assurance Model for Collaborating Business Processes

Developing an Empirical Relationship to Propose an Information Security Assurance Model for Collaborating Business Processes

МОДЕЛЬ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ ИНФОРМАЦИОННОЙ СОВЕТУЮЩЕЙ СИСТЕМЫ

The problems in assurance of information security for the automated system under development are considered. The model of threats to security is formulated. A topicality and possibility of threats realization, a level of design protection of the information system developed are defined. Peculiarities in the formation of an information security module and its correlation with other elements of a structural-functional circuit of an automated system are considered.