Security Control Research Articles

A Proposal for a Zero-Trust-Based Multi-Level Security Model and Its Security Controls

The rapid advancement of technology and increasing data utilisation have underscored the need for new models to manage and secure big data effectively. However, the constraints of isolated network environments and the limitations of existing security frameworks hinder the adoption of cutting-edge technologies such as AI and cloud computing, as well as the safe utilisation of data. To address these challenges, this study proposes an enhanced security model that integrates the concepts of Multi-Level Security (MLS) and Zero Trust (ZT). The proposed model classifies data into the following three sensitivity levels: “Classified”, “Sensitive”, and “Open”. It applies tailored security requirements and dynamic controls to each level, enhancing both data security and usability. Furthermore, the model overcomes the static access control limitations of MLS by incorporating ZT’s automated dynamic access capabilities, significantly improving responsiveness to anomalous behaviours. This study contributes to the design and evaluation of a new security model that ensures secure data protection and utilisation, even in isolated network environments such as those of military and governmental organisations. It also provides a foundation for the future development of advanced security frameworks.

The Mediating Role of Security Controls between Information-technology Risks and the Security of Accounting Information Systems: A Field Study in Telecommunication Companies Operating in the Republic of Yemen

This study aims to test Security Controls (SCs) as a mediator between information-technology risks (ITR) and the security of AISs in telecommunication companies operating in Yemen (TCOY). To achieve this objective, a questionnaire was used to collect data according to the comprehensive method, where (356) questionnaire forms were distributed and the validated questionnaire forms for analysis were (218). To analyze the data, (SmartPLS) was used in assessing the measurement model and the structural model, as well as in the evaluation of path coefficients and testing the hypotheses of the study. It has been concluded that ITRs negatively affect the security of AISs before the mediation of SCs (47.6%). The results indicate that the mediation of SCs between ITRs and security of AISs is a partial mediation. Also, ITRs have an indirect negative impact on the security of AISs after the mediation of SCs (25.3%), as part of the impact is transferred through SCs from ITRs to the security of AISs (indirect impact). The study concluded with a set of recommendations, most notably: paying more attention to the confidentiality, integrity and availability of information, keeping abreast of technological developments, implementing SCs and updating them constantly, supporting the information security by the higher management, improving security-response activities, accelerating the implementation of robust authentication, giving great attention to access control, and effectively monitoring security policy-implementation. This is to raise the level of security of AISs and reduce the negative impact of ITRs.

New Approaches to Detection and Secure Control for Cyber-physical Systems Against False Data Injection Attacks

New Approaches to Detection and Secure Control for Cyber-physical Systems Against False Data Injection Attacks

Fully Distributed Event-Triggered Security Control for DC Microgrids Subject to DoS Attacks

Fully Distributed Event-Triggered Security Control for DC Microgrids Subject to DoS Attacks

Data-Importance-Aware Attack Strategy Design and Secure Control Countermeasure

Data-Importance-Aware Attack Strategy Design and Secure Control Countermeasure

Cooperative-Critic Learning-Based Secure Tracking Control for Unknown Nonlinear Systems With Multisensor Faults.

This article develops a cooperative-critic learning-based secure tracking control (CLSTC) method for unknown nonlinear systems in the presence of multisensor faults. By introducing a low-pass filter, the sensor faults are transformed into "pseudo" actuator faults, and an augmented system that integrates the system state and the filter output is constructed. To reduce design costs, a joint neural network Luenberger observer (NNLO) structure is established by using neural network and input/output data of the system to identify unknown system dynamics and sensor faults online. To achieve the optimal secure tracking control, an augmented tracking system is formed by integrating the dynamics of tracking error, reference trajectory, and filter output. Then, a novel cost function is designed for the augmented tracking system, which employs the fault estimation and the discount factor. The Hamilton-Jacobi-Bellman equation is solved to obtain the CLSTC strategy through an adaptive critic structure with cooperative tuning laws. Besides, the Lyapunov stability theorem is utilized to prove that all signals of the closed-loop system converge to a small neighborhood of the equilibrium point. Simulation results demonstrate that the proposed control method has good fault tolerance performance and is suitable for solving secure control problems of nonlinear systems with various sensor faults.

Reliable and secure control center to station device communication

Reliable and secure control center to station device communication

THE ADVANTAGES AND IMPLEMENTATION CHALLENGES WITHIN THE SCOPE OF THE BASIC PRINCIPLES OF TRANSITION TO ZERO TRUST ARCHITECTURE

As the number of people working remotely increases, it is insufficient for organizations to protect the boundaries of their digital networks. To protect these boundaries, organizations need adaptive solutions that perform full authentication, authenticate every access request, and quickly detect and respond to both on- and off-network threats. Within this motivation, zero trust is a next generation security strategy based on the principle of “never trust, always verify”. In this study, the basic principles applied from the transition processes to zero trust architecture are evaluated and the advantages of this architecture to the security scope are examined. At the same time, the challenges that organizations that want to implement zero trust architecture will face in this transition are evaluated. The transition to zero trust architecture requires cumulative serious changes in the IT infrastructure of organizations. Zero trust architecture aims to build a system in which all information assets, users and data flow are constantly labeled as untrustworthy and therefore need to be constantly verified. The successful implementation of the zero-trust approach in organizational structures provides advantages such as dynamic authentication, increased endpoint security and strict control over data flows. However, it is also seen that challenges such as network identity management and data monitoring arise during the transition and implementation of zero trust architecture.

The effectiveness of e-procurement systems in Zambia: A case study of Ministry of Health Lusaka province

E-procurement is a dynamic process that involves the seamless integration of various online activities, such as order creation, supplier selection, contract signing, and product delivery, all facilitated by the Internet. Governments worldwide are increasingly emphasizing the importance of effective electronic procurement systems in promoting transparency, accountability, and efficiency in public procurement processes, where taxpayer funds are utilized. In Zambia, despite significant efforts by the government to promote the adoption of electronic procurement systems, such as e-procurement, challenges persist in ensuring their effectiveness. The failure to address the effectiveness of e-procurement within the Ministry of Health could have severe consequences. Inadequate adherence to procurement laws and regulations, as evidenced by the ZPPA report, may lead to inefficiencies, delays in procurement processes, and mis-allocation of resources. These inefficiencies can ultimately compromise the quality and availability of healthcare services, negatively impacting patient outcomes and public health. Additionally, the inability to harness the potential benefits of e-procurement, such as cost savings and streamlined processes, may perpetuate resource wastage and hinder efforts to improve healthcare delivery in Zambia. The main objective of this study was to assess the effectiveness of E-procurement systems at the Ministry of Health. The research philosophy for this study adopted a Quantitative approach that emphasized the practical utility of research methods in addressing the research problem. The findings of the study showed that the evaluation of the e-procurement system within the Ministry yielded a comprehensive understanding of its current performance and highlighted areas needing improvement. The e-procurement system has generally been well-received by the majority of respondents, reflecting its positive impact on procurement processes. Users have rated the system as effective in streamlining operations, enhancing procurement efficiency, and being user-friendly. Based on the comprehensive analysis and findings of the study, the following recommendations were proposed to enhance the effectiveness of the e-procurement system within the Ministry: Enhance Communication, Boost Supplier Participation, Improve Supplier Responsiveness, Strengthen Data Security and Privacy Controls and Increase Transparency. By addressing these recommendations, the Ministry can significantly improve the effectiveness of its e-procurement system, leading to more efficient procurement processes, greater satisfaction among stakeholders, and a more streamlined and secure procurement environment. In practice, the study offered actionable insights for healthcare practitioners and industry professionals involved in supply chain management. From a policy perspective, the study informed the development of evidence-based policies within the Ministry of Health and other relevant governmental bodies

Perpindahan Ibu Kota Jakarta Ke Kalimantan: Peranan Masyarakat Pantai Timur Sabah dalam Meminimumkan Impak Keselamatan Nasional (Jakarta Capital’s Shift To Kalimantan: The Role of Sabah’s East Coast Community In Minimising National Security Impact)

This study analyzes the impact of Indonesia’s capital relocation from Jakarta to Kalimantan on the communities along the East Coast of Sabah, Malaysia. It is undeniable that both countries have signed several agreements related to border security control, such as the Basic Agreement on Border Crossing1967, the Malaysia-Indonesia Border Trade Agreement 1970, the Joint Demarcation and Joint Land Border Survey 1973, and the Border Sea Trade Agreement 1973. However, issues like smuggling of goods, drugs, and human trafficking remain significant. Give these factors, the relocation of the capital from Jakarta to Kalimantan has the potential to increase smuggling, human trafficking, and the opening of new illegal routes, which could threaten the stability and security of both nations. This study, therefore raises two research questions: (1) What types of cross-border security issues threaten the relocation of the new capital, Ibu Kota Nusantara (IKN), along Malaysia-Indonesia’s land and maritime borders? (2) What alternative solutions can address cross-border security issues in both countries? The study applies the concept of the Grey Area Phenomenon (GAP), which analyses non-traditional issues in the post-Cold War era. To obtain more comprehensive findings, this research employs qualitative methods, including literature reviews and structured interviews. The findings indicate that border control involves not only the governments of both nations but also the role of local communities. This includes providing information to the government on smuggling and piracy activities, particularly from those living in the border areas between the two countries, as part of the efforts to reduce security threats.

Perpindahan Ibu Kota Jakarta Ke Kalimantan: Peranan Masyarakat Pantai Timur Sabah dalam Meminimumkan Impak Keselamatan Nasional (Jakarta Capital’s Shift To Kalimantan: The Role of Sabah’s East Coast Community In Minimising National Security Impact)

This study analyzes the impact of Indonesia’s capital relocation from Jakarta to Kalimantan on the communities along the East Coast of Sabah, Malaysia. It is undeniable that both countries have signed several agreements related to border security control, such as the Basic Agreement on Border Crossing1967, the Malaysia-Indonesia Border Trade Agreement 1970, the Joint Demarcation and Joint Land Border Survey 1973, and the Border Sea Trade Agreement 1973. However, issues like smuggling of goods, drugs, and human trafficking remain significant. Give these factors, the relocation of the capital from Jakarta to Kalimantan has the potential to increase smuggling, human trafficking, and the opening of new illegal routes, which could threaten the stability and security of both nations. This study, therefore raises two research questions: (1) What types of cross-border security issues threaten the relocation of the new capital, Ibu Kota Nusantara (IKN), along Malaysia-Indonesia’s land and maritime borders? (2) What alternative solutions can address cross-border security issues in both countries? The study applies the concept of the Grey Area Phenomenon (GAP), which analyses non-traditional issues in the post-Cold War era. To obtain more comprehensive findings, this research employs qualitative methods, including literature reviews and structured interviews. The findings indicate that border control involves not only the governments of both nations but also the role of local communities. This includes providing information to the government on smuggling and piracy activities, particularly from those living in the border areas between the two countries, as part of the efforts to reduce security threats.

Zero Trust Principles in Cloud Security: A DevOps Perspective

This research introduces Zero Trust Security models integrated into DevOps workflows. The paper outlines the implementation of security controls in GCP environments and evaluates their efficacy in mitigating risks associated with modern cloud infrastructures. The rise of cloud computing has revolutionized enterprise IT environments but has also introduced new security challenges. Zero Trust principles, which advocate "never trust, always verify," have emerged as a robust framework for securing cloud infrastructure. This paper explores the integration of Zero Trust principles within the DevOps lifecycle to enhance cloud security. It highlights how DevOps practices such as continuous integration/continuous delivery (CI/CD) and infrastructure as code (IaC) can align with Zero Trust methodologies to enforce granular access controls, continuous verification, and real-time threat detection. By embedding Zero Trust within the DevOps paradigm, organizations can establish a resilient security posture that adapts to evolving threats while maintaining operational agility.

THE ROLE OF BLOCKCHAIN IN THE DEVELOPMENT OF THE DIGITAL ECOSYSTEM

The digital ecosystem is evolving rapidly, driven by technological advancements that enhance communication, commerce, and innovation. Originally linked to cryptocurrencies, blockchain technology is now revolutionizing numerous industries by delivering secure, transparent, and efficient systems. Its decentralized structure removes intermediaries and ensures data integrity, positioning it as a crucial element of contemporary digital infrastructures. This paper explores the core principles of blockchain, including decentralization, immutability, transparency, and smart contracts. Decentralization reduces risks associated with single points of failure, while immutability ensures data accuracy. Transparency allows for public verification of transactions, promoting accountability. Smart contracts streamline processes by automating tasks, minimizing human errors, and removing the reliance on intermediaries. Blockchain’s applications in finance, healthcare, supply chain management, and education are discussed. In finance, decentralized finance (DeFi) platforms are revolutionizing traditional services. In healthcare, blockchain improves data security and interoperability, while in supply chains, it enhances traceability and reduces costs. In education, blockchain offers secure credential verification, reducing administrative burdens. However, blockchain faces challenges, including scalability, regulatory uncertainty, and environmental concerns. High energy consumption of certain consensus mechanisms and fragmented regulatory frameworks hinder its broader adoption. Addressing these issues is crucial for blockchain’s continued growth. Looking forward, the fusion of blockchain technology with artificial intelligence (AI) and the Internet of Things (IoT) is set to open up innovative possibilities for automation and efficient data management. The rise of decentralized applications (dApps) further highlights blockchain's potential to enhance security and user control over data. Blockchain provides substantial potential for driving innovation, enhancing efficiency, and ensuring transparency across multiple industries. By overcoming challenges, blockchain can drive the evolution of the digital ecosystem, creating a more secure and inclusive digital future.

Factors Influencing Information Security Culture in Organizations Dealing With Economic Crime in Kenya

Information security culture is very important for any organization, especially in the public sector, where sensitive information is regularly processed and stored. This importance has become more pronounced in recent years because the frequency and sophistication of cyber-attacks have increased, highlighting the need for effective information security measures such as control policies including access controls, password regulations. However, the success of these measures depends on the development of a strong information security culture within the organization. This study thus aimed to establish the organizational factors influencing information security culture in the organization dealing with economic crime in Kenya. The study focused on information security control, organization structure and organizational culture and how they influence information security culture. The study was underpinned on Security Culture Framework, CIA triad model, structural contingency theory and organizational culture theory. Descriptive research design was adopted. The study targeted 5729 employees in the Economic crimes investigative organizations in Kenya. Stratified random sampling approach was used to classify the sample frame. Simple random sampling technique was utilized to select respondents from each stratum to come up with a sample size of 361 respondents. Data was gathered from the five organizations located in Nairobi County, using self-administered questionnaires. The questionnaires were distributed through a drop and pick-up method, wherein the researcher personally delivered them to the respondents at their workplace. The study produced quantitative data that was coded and entered into Statistical Packages for Social Scientists (SPSS Version 26) for analysis, using both descriptive and inferential statistics. The quantitative data was presented using tables and graphs, with accompanying explanations in prose. The study concludes that information security control has a positive and significant effect on information security culture in five selected state-owned organizations dealing with economic crime in Kenya. In addition, the study concludes that organization structure has a positive and significant effect on information security culture in five-selected state-owned organization dealing with economic crime in Kenya. Further, the study concludes that organizational culture has a positive and significant effect on information security culture in five-selected state-owned organization dealing with economic crime in Kenya. Based on the study findings, the study recommends that the management of state-owned organization dealing with economic crime in Kenya should establish a dedicated and well-defined information security governance structure. This involves creating a specialized information security department or team that reports directly to top management, ensuring that information security is prioritized at the highest organizational level.

Advancing Information Governance in AI-Driven Cloud Ecosystem: Strategies for Enhancing Data Security and Meeting Regulatory Compliance

This study explores adaptive information governance models to address critical challenges in AI-driven cloud environments, focusing on enhancing data security and achieving regulatory compliance. Existing frameworks often fail to account for the complexities introduced by AI and cloud integration, leaving significant gaps in incident response, privacy protection, and governance practices. To bridge these gaps, this research evaluates governance components—Privacy-Enhancing Technologies (PETs), ethical oversight, and incident response metrics—through advanced quantitative methods, including Structural Equation Modeling (SEM), Cox Proportional Hazards Modeling, and Difference-in-Differences (DiD) analysis. Key findings highlight the significant influence of incident response metrics (β = 0.51, p < 0.001) and PET integration (β = 0.25, p = 0.001) on governance effectiveness, with model fit indices (RMSEA = 0.04, CFI = 0.96) confirming the robustness of the proposed framework. Industry-specific vulnerabilities were identified, with retail and technology sectors experiencing a 25% increased risk of incidents due to minimal security controls. The adoption of PETs, such as federated learning and homomorphic encryption, significantly improved privacy compliance and data utility, particularly in high-risk sectors. The study recommends the integration of advanced security controls and PETs to mitigate risks and improve compliance, especially in vulnerable industries like retail and technology. It also emphasizes the continuous optimization of AI-driven incident response protocols to reduce the impact of emerging threats. Furthermore, ethical oversight should be prioritized to ensure fairness, accountability, and public trust in AI applications within cloud ecosystems. These actionable strategies provide a roadmap for organizations to achieve secure and ethically governed cloud environments.

A blockchain consensus mechanism for real-time regulation of renewable energy power systems

With the ongoing development of renewable energy sources, information technologies and physical energy systems are further integrated, which leads to challenges in ensuring the secure and stable operation of renewable energy power systems in the face of potential cyber threats. The strengths of blockchain in cybersecurity make it a promising solution to these challenges. However, existing blockchains are not well-suited for control tasks due to their low real-time performance. Here, we present a consensus mechanism that enables real-time security control of systems, called Proof of Task. Instead of solving meaningless hash puzzles in Proof of Work, Proof of Task addresses problems closely related to the stable operation and control performance of these systems. With the proposed verification mechanism, Proof of Task significantly enhances the real-time performance of blockchain while mines its computational resources for tasks of interest. To demonstrate the effectiveness and necessity of Proof of Task, it is deployed across three renewable energy power systems. The results show that Proof of Task markedly fortifies the security and computing capability of these systems, ensuring their reliable and stable operation. This work highlights the promise of blockchain to facilitate security control and trusted computing of large-scale, complex-dynamic systems.

Thematic Exploration and Analysis of Cybersecurity Policies of Businesses: An NLP-Based Approach

ABSTRACT Cybersecurity is a prime concern today for businesses due to the rapid increase in cyber-attacks, inadequate security controls, stricter regulations, and lack of security awareness among the workforce. A robust cybersecurity policy can address the security needs of businesses with directives on acceptable actions and behavior. Developing such a policy for business entities requires adequate skill and knowledge. Reviewing voluminous policy texts to identify best practices is also time-consuming. Therefore, the objective of this study is to provide a natural language processing (NLP)-based methodology that can quickly identify the significant topics and themes from the cybersecurity policies of leading global businesses. Text mining and Latent Dirichlet Allocation-based topic modeling technique have been used on cybersecurity policy-related textual contents obtained from 10 leading Fortune Global 500-listed business organizations and the extracted output is then mapped to the globally popular cybersecurity standard ISO/IEC 27,001:2022 to determine the relevancy. The study reveals significant topics and themes that can be used for the development or enhancement of cybersecurity policies to protect businesses from cyber threats.

Eight caring technology principles: development and implementation of a framework for responsible health technology innovation

ABSTRACT Successfully implementing care technology to enhance people's health-related quality of life poses several challenges. Although many technological tools are available, we lack consensus on values and principles, regulatory systems, and quality labels. This article describes the FIDE process of the Belgian ‘Teckno 2030' project: Future-thinking Interdisciplinary workshops for the Development of Effectiveness principles, resulting in a framework of eight Caring Technology principles. These principles are built on three overarching values: autonomy, justice, and trust. The framework enables responsible health technology innovation by focusing on the needs of users and society, data security, equity, participatory governance, and quality control. A learning community was established to support the framework’s implementation in projects, organizations, and the broader innovation community. We also discuss the barriers, facilitators, and practical tools developed within this learning community. The FIDE process, caring technology principles, and learning community provide a case study for responsible innovation in care technology.

Security of the state border of the Republic of Moldova on the military aggression of the Russian Federation against Ukraine

The war launched by the Russian Federation against Ukraine is shaping up to be the most important military conflict since the end of World War II. The Russian-Ukrainian war is not just a regional war. In the context of the military aggression of the Russian Federation in Ukraine, ensuring the “border security” of the state currently becomes an imperative of the time. The presence of multiple problems at the border of the Republic of Moldova requires an additional effort to ensure border control. Ensuring “security and border control” is the essential function of every state. This article highlights the main problems present at the border of the Republic of Moldova. The problems faced by the Republic of Moldova in securing its own borders in the context of Russia’s aggression in Ukraine are also reflected.

Space cybersecurity challenges, mitigation techniques, anticipated readiness, and future directions

Space Cybersecurity (SC) is becoming critical due to the essential role of space in global critical infrastructure – enabling communication, safe air travel, maritime trade, weather monitoring, environmental surveillance, financial services, and defence systems. Simultaneously, involving diverse stakeholders in space operations further amplifies this criticality. Similarly, previous research has identified isolated vulnerabilities in SC and proposed individual solutions to mitigate them. While such studies have provided useful insights, they do not offer a comprehensive analysis of space cyber-attack vectors and a critical evaluation of the effectiveness of mitigation strategies. This study addresses this problem by holistically examining the scope of potential space cyber-attack vectors, encompassing the ground, space, user, cloud, communication channels, and supply chain segments. Furthermore, the study evaluates the effectiveness of legacy security controls and frameworks and outlines SC-vector-aligned counterstrategies and mitigation techniques to tackle the unique SC threats. Based on the analysis, the study proposes future research directions to develop and test advanced technological solutions and regulatory and operational frameworks to establish international standards policies and foster stakeholder collaboration. The study contributes a multi-disciplinary foundation and roadmap that researchers, technology developers, and decision-makers can draw on in shaping a robust and sustainable SC framework.