Violation Of Confidentiality Research Articles

Algorithm for emergency deletion of files by voice command

The Currently, there is a growing interest in various methods and means of protecting information, which is due to the growing number of crimes related to the violation of confidentiality of information, including through physical access to a computer. There are many ways to protect information from unauthorized access, such as physical security measures, password protection, and so on. However, a situation may arise when all defense lines have already been overcome and there is no other way to quickly block or destroy confidential information in any other way than with the help of a voice command. Thus, the topic of the article is relevant. The object of research is an information system containing confidential information. The subject of the research is the methods of emergency deletion of confidential information. The purpose of this article is to develop an algorithm for urgent deletion of files by voice command. In the course of the work, the algorithm for the emergency deletion of files by voice command was developed, which allows blocking the means of inputting information (keyboard and mouse) and deleting files located in a predetermined folder. The algorithm provides protection against accidental pronunciation of a voice command: before deleting files, a timer is first started, the time of which is pre-set by the user. During the duration of the timer, it is possible to cancel the deletion of files by entering a password, however, there is no way to access the information until the appropriate password is entered.

Міжнародне співробітництво у сфері протидії ухиленню від сплати податків та запровадження загального стандарту звітності (CRS)

Introduction. The strengthening of globalization processes caused significant changes in the international taxation system. The negative consequences of globalization include large-scale tax avoidance and erosion of the tax base. These phenomena caused systematic steps by international organizations in the direction of substantiating the scope of action for the realisation of the process of automatic exchange of information on financial accounts in accordance with the General Reporting Standard and other documents. Ukraine has joined the initiatives of the international community and is consistently implementing measures for their adaptation and implementation. At the same time, there are some limitations in the application of the developed standards, which can be used by unscrupulous taxpayers as a loophole for harmful tax practices. Problem Statement. The scientific basis for the implementation of the BEPS Plan, in particular, the introduction of the process of automatic exchange of information on financial accounts in accordance with the General Reporting Standard. Purpose. Identification of key milestones in the formation and implementation of the BEPS Plan, as well as identification of some limitations and shortcomings in the provisions and procedures of automatic exchange of information on financial accounts, which may lead to abuse, improper actions, violations of confidentiality and security. Methods: analysis and synthesis, comparative analysis, analytical, implementation of a systemic approach to the study of issues Results. The systemic steps of international organizations regarding the implementation of the BEPS Countermeasures Plan and the development of relevant decisions and documents were analyzed. Some limitations in the application of the developed solutions, which can be used by unscrupulous taxpayers as a loophole for the continuation of harmful tax practices, have been identified. The actions of the Ukrainian government regarding joining the international community in the matter of automatic exchange of information on financial accounts are outlined. Conclusions. Therefore, systemic measures for the implementation of the BEPS Countermeasures Plan provide for the formation of a methodology for the application of mechanisms for such countermeasures, in particular principles, directions, tools, procedures and technologies that make impossible or complicate the processes of blurring the tax base and avoiding taxation. For this purpose, key international organizations, in particular the OECD, the Council of Europe, the G20 and the G8, have decided and prepared a number of documents, as well as standards, model and standard agreements to involve national governments in the implementation of joint efforts to counter BEPS, among which a special place is occupied by the Model Competent Authority Agreement (CAA) for automatic exchange of information and Common Reporting Standard. At the same time, when implementing agreements and standards, risks arise due to: avoidance of reporting by some financial institutions and other subjects of legal relations; breach of confidentiality; departure of some countries from general practice and standard procedures, etc. While developing a platform for legal, administrative, financial and economic, technical and technological support for the implementation of BEPS countermeasures, Ukraine should take into account the lessons of negative experience and prevent limitations of the specified standards.

A Gate-Level Information Leakage Detection Framework of Sequential Circuit Using Z3

Hardware intellectual property (IP) cores from untrusted vendors are widely used, raising security concerns for system designers. Although formal methods provide powerful solutions for detecting malicious behaviors in hardware, the participation of manual work prevents the methods from reaching practical applications. For example, Information Flow Tracking (IFT) represents a powerful approach to preventing leakage of sensitive information. However, existing IFT solutions either introduce hardware overheads or lack practical automatic working procedures, especially for hardware sequential logic. To alleviate these challenges, we propose a framework that fully automates information leakage detection at the gate level of hardware. This framework introduces Z3, an SMT solver, to automatically check the violation of confidentiality. On the other hand, an automatic tool is developed to remove the manual workload further. In this tool, the gate level hardware is converted to the formal model firstly, and the integrity of the model is assessed. Along with the model converting step, the property for leakage detection is generated as well. The proposed solution is tested on 25 gate-level netlist benchmarks, where sequential designs are included to validate the effectiveness. As a result, Trojans leaking information from circuit outputs can be automatically detected. The measured time consumption of the entire working procedure validates the efficiency of the proposed approach.

The Development of Digitalization During the War as a Sociocultural Phenomenon

The purpose of the article is to analyze the development of digitalization in the conditions of war as a socio-cultural phenomenon. It is noted that Ukraine continues to fight both in the digital and mental spaces for its own independence, originality, national identity and democratic future. The Ukrainian nation’s struggle for survival has reached a new level – digital. In the conditions of martial law, Ukrainian society is increasingly faced with various types of «cyber attacks» by aggressor countries: failures in the provision of electronic services, blocking of the work of state bodies, phishing attacks by e-mail, cybercrimes, violations of the integrity and confidentiality of data, informational and psychological pressure on population, cyber-terrorism, cyber-espionage, information expansion into the country’s national information space, blocking the work or destruction of enterprises strategically important for the economy and state security, life support systems and high-risk facilities. Modern digital technologies in the conditions of globalization are modernizing the strategies of warfare in the 21st century. In the conditions of martial law, Ukrainian society is increasingly faced with various types of «cyber attacks» by the aggressor country, including: blocking the work of state bodies, phishing attacks by e-mail, cyber crimes, violations of data integrity and confidentiality, information and psychological pressure on Ukrainians, cyber terrorism, cyber espionage, etc. Disinformation, anti-Ukrainian propaganda, fakes, racism, revanchism, political, material, spiritual violence that threaten the national security of our state can be spread through various «information channels» of the aggressor countries. But, on the other hand, in wartime conditions, Ukraine strives to protect the national information space from the negative effects of informational and psychological attacks and continues to implement the policy of digitalization and the introduction of digital technologies. Ukraine strives to protect the national information space, continues to implement the digitalization policy, implements the «State in a Smartphone» program, develops the IT sector that fulfills contracts, exports its own services, provides foreign exchange earnings, and also supports the Ukrainian economy. Provides services through the «Diia» state platform, including for internally displaced persons.

Module for expected losses assessing in the information security risk management system of a construction company

The article examines the problem of the expected losses effective assessment in a construction company upon materialization of information security threats. One of the ways to partially solve this problem is proposed. It is suggested to improve the capabilities of the respective module of the risk management system, which provides the user with a human-machine toolkit for expert assessment of expected losses. This toolkit consists of several stages. The toolkit considers the most effective evaluation scenario given the existing situational decision-making conditions. In order to ensure the operation of the module, the informational and logical connections between the evaluation stages are also defined and the apparatus for the formation of various evaluation scenarios is designed. In addition, to increase the accuracy of the results and increase the flexibility of the proposed algorithm, the possibility of selecting the evaluation scenario by the user with the appropriate role is provided. Since the paper considers the problem of multi-criteria evaluation, the hierarchy of criteria is formalized, and the weight of their influence on the calculation results is also taken into account. When building a logical-mathematical apparatus, the possibility of realizing various types of threats to various information assets (IA) of the enterprise is also considered. The assessment of the consequences of information security threats can be carried out at different levels: general and distributed, taking into account various indicators such as violations of confidentiality, integrity and availability of information. The methods of direct expert evaluation, analytic hierarchy process (AHP), Delphi, linear convolution of criteria, probabilistic modeling are used in the development of the logico-mathematical apparatus. A qualitative-quantitative scale is used to formalize expert judgments. The necessary roles of experts for effective evaluation have been defined. Summarization of experts' assessments is carried out with control of the adequacy of the degree of logic and dispersion of the opinions of each expert, in accordance with the established requirements for the degree of agreement of the opinions of a group of experts. Competence of the experts is also taken into account during assessment.

Artificial intelligence in medical education: a cross-sectional needs assessment

BackgroundAs the information age wanes, enabling the prevalence of the artificial intelligence age; expectations, responsibilities, and job definitions need to be redefined for those who provide services in healthcare. This study examined the perceptions of future physicians on the possible influences of artificial intelligence on medicine, and to determine the needs that might be helpful for curriculum restructuring.MethodsA cross-sectional multi-centre study was conducted among medical students country-wide, where 3018 medical students participated. The instrument of the study was an online survey that was designed and distributed via a web-based service.ResultsMost of the medical students perceived artificial intelligence as an assistive technology that could facilitate physicians’ access to information (85.8%) and patients to healthcare (76.7%), and reduce errors (70.5%). However, half of the participants were worried about the possible reduction in the services of physicians, which could lead to unemployment (44.9%). Furthermore, it was agreed that using artificial intelligence in medicine could devalue the medical profession (58.6%), damage trust (45.5%), and negatively affect patient-physician relationships (42.7%). Moreover, nearly half of the participants affirmed that they could protect their professional confidentiality when using artificial intelligence applications (44.7%); whereas, 16.1% argued that artificial intelligence in medicine might cause violations of professional confidentiality. Of all the participants, only 6.0% stated that they were competent enough to inform patients about the features and risks of artificial intelligence. They further expressed that their educational gaps regarding their need for “knowledge and skills related to artificial intelligence applications” (96.2%), “applications for reducing medical errors” (95.8%), and “training to prevent and solve ethical problems that might arise as a result of using artificial intelligence applications” (93.8%).ConclusionsThe participants expressed a need for an update on the medical curriculum, according to necessities in transforming healthcare driven by artificial intelligence. The update should revolve around equipping future physicians with the knowledge and skills to effectively use artificial intelligence applications and ensure that professional values and rights are protected.

МОДЕЛИРОВАНИЕ УГРОЗ БЕЗОПАСНОСТИ ИНФОРМАЦИИ БЕСПРОВОДНОГО СТАНДАРТА IEEE 802.11

When building multi-level information protection both in the public and in the private sector, it is necessary to take the measures aimed at preventing threats to information security. Cyberphysical systems, as a means of communication, are actively used for providing information processes. Due to the poor uniformity of such technical solutions, as well as the use of technologies that were developed without taking into account security issues, such systems may be exposed to information security risks from an attacker. These risks, as a rule, lead to a violation of operability, confidentiality, control and other negative consequences for the user or the owner of the information (equipment). The development of a model of information security threats for the wireless networks, the operation of which is based on the protocols of the IEEE 802.11 standard used in the functioning of cyber-physical systems is an urgent problem in the area of information protection. The negative consequences that can lead to the implementation of various threats, and its relevance are analysed. The objects of influence based on the Methodology of assessing threats to the security of information of the FSTEC Russia are summarised. The specific actions of the violator, the levels of danger, the scale of potential damage from the implementation of threats due to the use of vulnerabilities of protocols of the IEEE 802.11 standard are systematized and classified.

ИССЛЕДОВАНИЕ УГРОЗ ФУНКЦИОНИРОВАНИЯ КИБЕРФИЗИЧЕСКИХ СИСТЕМ ЗА СЧЕТ ИСПОЛЬЗОВАНИЯ УЯЗВИМОСТЕЙ БЕСПРОВОДНОГО СТАНДАРТА IEEE 802.11

The purpose of the paper is to analyze and systematize the existing security threats to the functioning of cyber-physical systems through vulnerabilities of wireless networks operating on the basis of protocols defined by the IEEE 802.11 standard. The relevance of the study is explained by ever growing number of devices and various systems using wireless networks to ensure their functioning, including the designated standard. Using examples of existing varieties of this technology (there are more than 15 generations of the standard), the features of wireless local area connections according to this standard as well as the ways of organizing wireless communication lines (with one access point and (or) several, without an access point) are analyzed. Since the functioning of cyber-physical systems at the network level is based on this Wi-Fi technology, major attention is paid to the study of security threats of the IEEE 802.11 wireless standard,. Despite the benefits of using such means of communication, namely: high data transfer rates, high bandwidth, wide coverage area, reliability of the built network, ease of implementation and scalability, the implementation of security threats can lead to a violation of confidentiality and authenticity of the transmitted information, loss of control over the access point, the communication channel itself, the integrity of the transmitted data, etc. The existing security functions implemented in client devices operating on the basis of wireless connection of local area networks of the IEEE 802.11 standard are systematized in the paper as well.

Applications and Current Medico-Legal Challenges of Telemedicine in Ophthalmology.

Background: The digital revolution is redesigning the healthcare model, and telemedicine offers a good example of the best cost-effectiveness ratio. The COVID-19 pandemic has catalysed the use of the telemedicine. The aim of this review is to describe and discuss the role and the main applications of telemedicine in the ophthalmic clinical practice as well as the related medico-legal aspects. Methods: 45 original articles and 5 reviews focused on this topic and published in English language from 1997 and 2021 were searched on the online databases of Pubmed, Scopus, Web of Sciences and Embase, by using the following key words: “telemedicine”, “privacy”, “ophthalmology”, “COVID-19” and “informed consent”. Results: Telemedicine is able to guarantee patient care using information and communication technologies. Technology creates an opportunity to link doctors with the aim of assessing clinical cases and maintaining high standards of care while performing and saving time as well. Ophthalmology is one of the fields in which telemedicine is most commonly used for patient management. Conclusions: Telemedicine offers benefits to patients in terms of saving time and costs and avoiding physical contact; however, it is necessary to point out significant limitations such as the absence of physical examinations, the possibility of transmission failure and potential violations of privacy and confidentiality.

The evolving role of digital media in medical education.

Within the last decade, social media has progressed from a form of mere entertainment to a medium for solution of complex issues in our daily lives. During the last few years, social media has gained value in medical education and the diversity in the use of digital media has given new dimensions to medical education while facing the Covid pandemic. Digital media helps in creating virtual communities which not only bring more harmony between teachers and students but has also shown to have reduced anxiety and stress among students. Common social media platforms such as Facebook and WhatsApp have recently gained popularity as platforms which are being actively used in various ways to enhance learning. Social media in medical education is also utilised to enhance communication skills, professionalism and better patient care, but this should be addressed with caution as violation of patient's privacy and confidentiality remains a threat.

Ethics and Law.

Ethics and Law.

Detecting violations of access control and information flow policies in data flow diagrams

The security of software-intensive systems is frequently attacked. High fines or loss in reputation are potential consequences of not maintaining confidentiality, which is an important security objective. Detecting confidentiality issues in early software designs enables cost-efficient fixes. A Data Flow Diagram (DFD) is a modeling notation, which focuses on essential, functional aspects of such early software designs. Existing confidentiality analyses on DFDs support either information flow control or access control, which are the most common confidentiality mechanisms. Combining both mechanisms can be beneficial but existing DFD analyses do not support this. This lack of expressiveness requires designers to switch modeling languages to consider both mechanisms, which can lead to inconsistencies. In this article, we present an extended DFD syntax that supports modeling both, information flow and access control, in the same language. This improves expressiveness compared to related work and avoids inconsistencies. We define the semantics of extended DFDs by clauses in first-order logic. A logic program made of these clauses enables the automated detection of confidentiality violations by querying it. We evaluate the expressiveness of the syntax in a case study. We attempt to model nine information flow cases and six access control cases. We successfully modeled fourteen out of these fifteen cases, which indicates good expressiveness. We evaluate the reusability of models when switching confidentiality mechanisms by comparing the cases that share the same system design, which are three pairs of cases. We successfully show improved reusability compared to the state of the art. We evaluated the accuracy of confidentiality analyses by executing them for the fourteen cases that we could model. We experienced good accuracy.

Making the case for Community Interpreting in health care: from needs assessment to risk management

In Canada, community interpreting is little recognized and valued by public institutions, including those in the healthcare sector. Although many healthcare practitioners recognize the crucial role played by interpreters in delivering healthcare services, some of them ascribe to the notion that the inability to communicate with English-speaking or French-speaking patients is the patient ’s problem, and that any linguistic miscommunication which may occur is the responsibility of the patient. This attitude contributes to the degree to which healthcare practitioners rely on interpreting provided by family members, including children, without consideration either for risks of errors and omission or for potential violations of confidentiality, which are likely to occur when askingfriends or relatives to provide interpreting services. This “wall of resistance” has been deemed responsiblefor much of the difficulty experienced in Canada by immigrant and minority language advocacy groups in trying to ensure community interpreting services for immigrants, refugees and those Canadians with limited proficiency in English and/or French. A recently completed research studyfunded by the Government of Canada suggests that a paradigm shift may be operating in the healthcare sector, and that instead of still seeing language barriers solely as a human rights issue, language barriers should be considered from a risk-management perspective as well. This paper will review some of the mainfindings of this study.

Trying to fit in: dressing like a doctor

After her objective structured clinical examination (OSCE) in July, Eilidh Wilcockson, a third year medical student at Newcastle University, received some surprising feedback: not about her clinical knowledge or examination...

Smart City and Crisis Management: Lessons for the COVID-19 Pandemic.

COVID-19 shocked cities around the world and revealed the vulnerability of urban lives and functions. Most cities experienced a catastrophic disturbance that has lasted for a long time. Planning plays a critical role in responding efficiently to this crisis and enabling rapid functional recovery in the post-disaster era. Cities that have implemented digitalization initiatives and programs are likely to have more capacity to react appropriately. Specifically, digitalized cities could ensure the well-being of their residents and maintain continuity of urban functions. This research aims to analyze the role of technology in crisis management in the last two decades and provide appropriate policy recommendations for dealing with the COVID-19 pandemic. Systematic literature review and subjective content analysis are employed to investigate the effects of technology on community well-being and making cities more resilient in past crises. This study shows that different technology-driven policies and actions enable crisis management, enhance community well-being, and increase urban resilience. Technology has enhanced coping and recovery capacities by increasing participation and social connectedness, enhancing physical and mental health and maintaining the functionality of education and economic systems. These have been achieved through various solutions and technologies such as social media, telehealth, tracking and monitoring systems, sensors and locational applications, teleworking systems, etc. These solutions and technologies have also been used during the COVID-19 pandemic to enhance community well-being and sustain urban functions. However, technology deployment might have adverse effects such as social exclusion, digital divide, privacy and confidentiality violation, political bias and misinformation dissemination, and inefficient remote working and education. It is suggested that to mitigate these side effects, policymakers should liberate the process of digitalization, increase the accessibility to digital services, and enhance digital literacy.

Violation of Tax Confidentiality as an Offence

Reveal of informations and documents within scope of tax confidentiality of taxpayers and persons related to taxpayers or using them for benefit is a tax offense. Violation of tax confidentiality may cause material and moral damage to taxpayers and related persons, as well as a loss of trust in public and deterioration of public order. Because taxpayers who are concerned about the safety of their information are less likely to cooperate with the tax administration and would be more hesitant to share their information. Ensuring tax confidentiality is a guarantee provided by the state to taxpayers and is a taxpayer’s right. However, this study examines the violation of tax confidentiality as a criminal offense. For this purpose, first of all, definition of tax confidentiality, in legal terms and the people required to comply with tax confidentiality as regulated in Tax Procedure Law No. 213 have been briefly mentioned. Next, we examine elements of that offense and how perpetrators have been punished within the context of Turkish Criminal Code No. 5237. Finally, the offense of violation of tax confidentiality has been analyzed in terms of attempt, participation, repetition, and aggregation which are special appearance of offense.

Secured Access Control in Security Information and Event Management Systems

Nowadays, Security Information and Event Management (SIEM) is very important in software. SIEM stores and monitors events in software and unauthorized access to logs can prompt different security threats such as information leakage and violation of confidentiality. In this paper, a novel method is suggested for secured and integrated access control in the SIEM. First, the key points where the SIEM accesses the information within the software is specified and integrated policies for access control are developed in them. Accordingly, the threats entered into the access control module embedded in this system are carefully detected. By applying the proposed method, it is possible to provide the secured and integrated access control module for SIEM as well as the security of the access control module significantly increases in these systems. The method is implemented in the three stages of the requirements analysis for the establishment of a secure SIEM system, secure architectural design, and secure coding. The access control module is designed to create a secured SIEM and the test tool module is designed for evaluating the access control module vulnerabilities. Also, to evaluate the proposed method, the dataset is considered with ten thousand records, and the accuracy is calculated. The outcomes show the accuracy of the proposed method is significantly improved. The results of this paper can be used for designing an integrated and secured access control system in SIEM systems.

Selective Sharing of Outsourced Encrypted Data in Cloud Environments

Owing to the vast volume of information gathered by computers, data protection and security has become a problem for organizations with the enormous rise in data transmission. Due to many advantages that cloud service providers provide, mainly economic benefits, several data owners outsource their data to cloud repositories. However, data owners do not have full ownership of the data after their data are outsourced. Thus, external data management systems are implemented to manage the data. Several kinds of research refer to the use of encryption techniques to prevent unauthorized access to data. Selective encryption aims at supporting selective and private access to outsourced data. However, the combination of this approach and indexing techniques cause confidentiality violations. In this article, a blockchain-based approach to data access is presented by implementing smart contracts over data access. These executable scripts bind users by stating access policies on the data. Furthermore, we provide a system, where users can offload their computational capabilities due to limitations in their computations. Our systems' computational capabilities outperform that of when users do the computation on their own. The results show a practical approach to data access management using blockchain technology.

Problems of personal data and information protection in corporate computer networks

The article discusses the problems of personal data and information protection from intruders as well as methods of authentication and identification in corporate networks. Various methods of authentication and identification in computer networks are presented. Their comparative analysis is carried out, the features and disadvantages in various areas of use are highlighted, risks and possible damage from violation of data confidentiality are analyzed. The magnitude of violations of confidentiality, availability and integrity of information is growing every year, at the same time, the caused damage is growing. This situation makes it necessary for information security specialists to analyze all the risks of illegal access to information more and more thoroughly, and then resort to the introduction of modern means authentication, use new encryption methods, increasingly generate new passwords to access the system. Today, there are many ways and methods of authentication, but the specific of their application depends on the location of the information storage and its value. Meanwhile, authentication methods are not perfect protection methods, they are also vulnerable and here the situation is mostly depends on the skills of the attackers. In addition, the article discusses the problems of information security threats to flash drives, analyzes the FAT32 and NTFS file systems of flash drives as well as their vulnerabilities to malicious programs. The features of the algorithm of virus action on flash drives are highlighted. Today, there are many ways and methods of flash drives protection, but the specifics of their use depends on the location of the information storage and its value.

Mass Personalization Strategy in Modern Education

The article analyzes mass personalization as a model for arrangement educational activities, the innovativeness of which is due to the modern technological capabilities of creating or adapting an educational product in accordance with the individual needs of the student. The author shows the dependence of the social demand for mass personalization in education via a number of mega-trends in economic and social development. The concept of mass personalization in the economic aspect is examined; the possibility of extrapolating the idea of mass personalization to the field of modern education is substantiated. The author considers the strategy of mass personalization as one of the ways to develop a more open architecture of education and increase the social effectiveness of educational practices. The first part of the article analyzes the potential of mass personalization for the development of education itself and for solving a wide range of social development problems. It is noted that the increasing variety of technological solutions allows one to design non-linear educational schemes, develop educational ecosystems, and shape the educational landscape to meet the heterogeneous social order for education. The urgency of the tasks of the development of “digital pedagogy” for the formation of motivation and subjectivity of individuals as the main condition of the effectiveness of mass personalization and for minimizing errors in determining the goals of learning is emphasized. The possibility of shifting the emphasis in the axiology of education from an instrumental interpretation of educational results to emphasizing the importance of education as a process of formation of personality in its integrity is considered. The article then moves on to examine the possible risks of implementing a mass personalization strategy. Risks of the development of educational inequality, a departure from the principles of egalitarianism in the organization of education are considered, the risks of violations of privacy and confidentiality of students associated with the use of big data are analyzed, the possibilities of manipulating the consciousness of students, managing their attention as potential threats are noted. The conclusion is made about the possible prospects for the development of mass personalization strategy.