Comprehensive Security Program Research Articles

Enhancing Data Security in Higher Education Administration: Strategies for Protecting Student Information and Institutional Integrity in Cloud-Based Systems

The widespread adoption of cloud-based systems in higher education has brought significant benefits and heightened concerns over data security. This research paper explores practical strategies for enhancing data security in cloud-based systems used by higher education institutions. The study employed a literature review, case studies, and surveys to gather data on current practices, challenges, and technological solutions in data security. The findings reveal that while cloud computing offers convenience and cost savings, it also introduces new vulnerabilities that must be addressed through a comprehensive security program. The paper discusses the importance of risk assessment, transparent governance, encryption, access controls, and the integration of emerging technologies like blockchain and AI. The implications of this research suggest the need for policymakers, administrators, and IT professionals to prioritize data security as a critical component of cloud-based system adoption in higher education.

ІНФОРМАЦІЙНА БЕЗПЕКА СУБ’ЄКТІВ МАЛОГО ПІДПРИЄМНИЦТВА В УМОВАХ ЦИФРОВІЗАЦІЇ

The article defines and analyzes the characteristic features of modern society digitalization, in particular the digital economy. It is noted that progress in the digital technology environment requires the application of information security measures, primarily in the financial and economic activities of small businesses. The interpretation of the definitions «information security» and «economic security» has been clarified. Attention is drawn to a conscious understanding of the interaction between people and technology during the digital transformation of the economy in such a way that the latest technologies must adapt to people, and not vice versa. It is emphasized that such an understanding can come only in the process of training and acquiring appropriate professional competencies, especially among small businesses. The types of small businesses information that are subject to protection and components of economic security are determined. Proposals have been formed for the creation of a comprehensive security program, which should include an action plan aimed at protecting the functioning of the enterprise's information system from external and internal influences, and a set of measures designed to protect the confidentiality, availability, and integrity of data from internal and external, malicious and accidental threats. Information security of small businesses in the context of digitalization should be based on the following positions: the management of the enterprise should regularly train all employees in the principles of Information Security, data protection and protect physical data carriers from cyber attacks; the corporate network should be segmented, and access to it – controlled; partnership with service providers from the point of view of information security should be equivalent; remote access to the corporate network of the enterprise, which is now becoming more widespread, should be as secure as possible and comply with information security standards. A promising area of further research is the development of a set of measures at the state level, which includes streamlining the simplified tax system, promoting the development of innovative entrepreneurship, cluster organization of small businesses, the formation of a modern information infrastructure to support entrepreneurship, the formation of a favorable business climate.

Framework to identify and manage risks in Web 2.0 applications

Web 2.0 applications are continuously moving into the corporate mainstream. Each new development brings its own threats or new ways to deliver old attacks. In order to mitigate these security risks, internal controls should be implemented at different levels. In order to identify the risks, a proper control framework of generally accepted control techniques and practices are needed as a benchmark. Because, implementing these control techniques on their own is merely ad hoc, if not linked to a proper control framework or model. The objective of this study is to develop a framework that can be used to identify the security issues an organisation is exposed to through Web 2.0 applications, with specific focus on unauthorised access. An extensive literature review was performed to obtain an understanding of the technologies driving Web 2.0 applications. Thereafter, the technologies were mapped against control objectives for information and related technology (CobiT) and trust service principles and criteria and associated control objectives relating to security risks. These objectives were used to develop a framework that can be used to identify risks and formulate appropriate internal control measures in any organisation using Web 2.0 applications. Every organisation, technology and application is unique and the safeguards depend on the nature of the organisation, information at stake, degree of vulnerability and risks. A comprehensive security program should include a multi-layer approach comprising of a control framework, combined with a control model considering the control processes in order to identify the appropriate control techniques. Key words: Web 2.0, social networking, security risks, computer risks, control framework, control objectives for information and related technology (CobiT), trust service principles and criteria.

Incremental risks in Web 2.0 applications

PurposeThe purpose of this paper is to identify and investigate the security issues an organisation operating in the “new” online environment is exposed to through Web 2.0 applications, with specific focus on unauthorised access (encompassing hackers). The study aims to recommend possible safeguards to mitigate these incremental risks to an acceptable level.Design/methodology/approachAn extensive literature review was performed to obtain an understanding of the technologies driving Web 2.0 applications. Thereafter, the technologies were mapped against Control Objectives for Information and Related Technology (CobiT) and Trust Service Principles and Criteria and associated control objectives relating to security risks, specifically to hacker risks. These objectives were used to identify relevant risks and formulate appropriate internal control measures.FindingsThe findings show that every organisation, technology and application is unique and the safeguards depend on the nature of the organisation, information at stake, degree of vulnerability and risks. A comprehensive security program, including a multi‐layer technological, as well as an administrative component, should be implemented. User training on acceptable practices should also be conducted.Originality/valueObtaining an understanding of Web 2.0 and Web 2.0 security is important, as Web 2.0 is a new, poorly understood technology and with the growing mobility of users, the potential surface area of attack increases and should be managed. The paper will help organisations, information repository managers, information technology (IT) professionals, librarians and internal and external auditors to understand the “new” risks relating to unauthorised access, which previously did not exist in an on‐line environment, and will assist the development of a framework to limit the most significant risks.

A Study of the Effectiveness of a Workplace Violence Intervention for Small Retail and Service Establishments

Examine the effectiveness of a robbery and violence prevention program in small businesses in Los Angeles. Gas/convenience, liquor and grocery stores, bars/restaurants, and motels were enrolled between 1997 and 2000. Intervention businesses (n = 305) were provided training, program implementation materials, and recommendations for a comprehensive security program. Control businesses (n = 96) received neither training nor program materials. Rate ratios comparing intervention to control businesses were 0.90 for violent crime (95% confidence limits [CL] = 0.53, 1.53) and 0.81 for robbery (95% CL = 0.38, 1.73). The reduction in violent crime was concentrated in high-compliance intervention businesses (risk ratio = 0.74, 95% CL = 0.40, 1.36). Low-compliance intervention businesses had practically the same postintervention crime as the control businesses. Our results suggest that the workplace violence intervention may reduce violent crime among high-risk businesses, especially those with high program compliance.

Managing The Legal Risks Related to Information Security

Information security has become a critical issue. The risks of computer hackers, computer viruses ana worms, identity theft, denial of service attacks, theft, terrorist attacks, sabotage, surveillance and intrusion by competitors and malicious acts by disgruntled employees, among other vulnerabilities, are increasing at an alarming exponential rate. Managing the risks from these unprecedented threats to the enterprise has become a vital risk management concern for the company's board of directors and top management, with the result that effective security programs have become a necessity. Prudent risk management and due care with respect to security programs are necessary to avoid potential liability. Information security is a risk management process to protect the confidentiality, integrity and availability of systems and content. The federal Information Security Act of 2002 (44 U.S.C. § 3542) defines Security as ... protecting and systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide - (A) integrity, which means guarding against improper modification or destruction and includes ensuring nonrepudiation and authenticity; (B) confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and (C) availability, which means ensuring timely and reliable access to and use of information. This article examines the evolving standard in the United States to provide reasonable security requiring a risk-based process to develop and maintain a comprehensive security program. This process is based upon recent Federal Trade Commission (FTC) consent orders relating to security. The FTC has significantly broadened the scope of its enforcement actions by asserting that a failure to provide appropriate security was, itself, an unfair trade practice in violation of Section 5 of the FTC Act. These information security FTC cases are very instructive in defining the scope and extent of a company's legal obligation to implement security measures. These cases point to the emergence of a standard respecting security. They demonstrate that security is no longer just good business practice. Information security has become a obligation.

Why Water and Wastewater Utilities Should Be Concerned about Cyber Security

This article discusses the importance of water utilities adopting a comprehensive security program, including cyber security controls, appropriate control system policies and procedures, incident response and disaster recovery planning, and a continuous monitoring and improvement process for risk mitigation. This is due to the “cyber‐vulnerability” of modern control systems and communications technologies such as supervisory control and data acquisition (SCADA) systems. The article focuses on the work of an ad hoc committee of representatives from several California water districts that has taken the lead in promoting awareness of cyber security throughout the state's public water utilities.

Compliance to a Workplace Violence Prevention Program in small businesses

Background Robberies are the leading motive for work-related homicide and assault. Interventions to reduce robberies and related injuries have been limited to convenience stores, and evaluations have not addressed compliance as a factor in program effectiveness. Setting/participants A total of 314 intervention and 96 control businesses were included in this intervention evaluation. Intervention The Workplace Violence Prevention Program provided a customized robbery and violence prevention program to a stratified random sample of 314 small, high-risk businesses in Los Angeles City. An additional 96 comparison businesses did not receive the intervention. The intervention included individualized consultation, printed materials, training brochures, and a video. Interventions were conducted from August 1997 through August 2000. Main outcome measures For both intervention and comparison businesses, a comprehensive security program assessment was conducted at baseline and at 3- and 12-month follow-up visits. Crime rates in intervention and comparison businesses were examined for 12 months pre- and post-intervention with the use of police reports. Results By the second follow-up visit, compliance to the intervention program was significant for each program component. Employee training was the most frequently implemented intervention component. Neighborhood crime level, primary language spoken by the business owner, and the number of employees were all related to compliance. Although crime rates generally increased for all businesses from the pre- to post-intervention periods, businesses with high compliance to the program experienced a decrease in overall violent crime and robbery. Conclusions Participating businesses were willing to voluntarily implement components of the intervention program, and greater implementation was related to reductions in robbery and violent crime.