Critical Information Infrastructure Research Articles

Universal data model for the formation of the critical information infrastructure of the state objects list

Останнім часом у світі спостерігається тенденція до збільшення кількості надзвичайних подій різного роду. Щодня світові ЗМІ повідомляють про природні та техногенні катастрофи, збройні конфлікти, терористичні акти, важкі злочини, акти піратства, вчинені як злочинними організаціями, так і окремими особами. Все частіше, в результаті таких подій, жертвами стає велика кількість людей та завдається шкода життєво важливим для існування держав системам, об’єктам і ресурсам. З огляду на це, більшість провідних держав світу стали приділяти увагу методам та засобам ідентифікації, систематизації та забезпечення захисту об’єктів критичної інфраструктури, втрата або порушення нормального функціонування яких призведе до значних або навіть непоправних негативних наслідків для національної безпеки держави. Проте, як показав проведений аналіз вітчизняної нормативної бази, на сьогодні в Україні досі не сформовано вичерпний перелік об’єктів критичної інформаційної інфраструктури держави та не існує чіткого механізму формування цього переліку. Враховуючи зазначене, у роботі запропоновано універсальну модель даних для формування переліку об’єктів критичної інформаційної інфраструктури держави та, на базі розробленої моделі, сформовано перелік критичних об’єктів у галузі цивільної авіації. У подальших роботах планується розробка ефективних методів і засобів для ідентифікації та ранжування об’єктів, перелік яких формується з використанням запропонованої моделі даних.

Formal logical language to set requirements for secure code execution

Presently, a special attention is paid to the problem of information security when designing and using objects of critical information infrastructure. One of the most common approaches used to secure the information processed on these objects is the creation of an isolated program environment (sandbox). The security of the environment is determined by its invariability. However, the evolutionary development of data processing systems makes it necessary to implement new components and software in this environment on the condition that the security requirements are met. In this case, the most important requirement is trust in a new program code. This paper is devoted to developing a formal logical language to describe functional requirements for program code that allows one to impose further constraints at the stage of static analysis, as well as to control their fulfillment in dynamics.

Experimental study of method of determination the level of critical information infrastructure importance in the civil aviation

In recent times all over the world the number of different emergency situations was increased. Every day mass media informs about natural and man-caused disasters, weapon conflicts, acts of terrorism, global crimes, acts of piracy that were committed by both crime organizations and single offenders. Increasingly frequently as a result of these events many people falls a victim and also state critical importance systems and resources can be damaged. By this means most of world leader states have attended to methods and means of identifying, systematization and security assurance for critical infrastructure objects. Loss or operational breakdown of these objects can cause significant or irreparably damage for national security of the state. For adequacy security methods implementation it`s very important to determine the importance (criticality) level of state information infrastructure objects in some sector. In view of this the method of determination the level of the critical information infrastructure importance in the civil aviation was proposed and it gives a possibility to assess the importance level and rank critical aviation information systems both by both quantitative and qualitative parameters. Follow-up study contains proposed experimental technique and with help of this method adequacy was checked. It confirms ability to determine the importance level of different critical aviation information systems: information systems of air navigation service, aircraft board information systems, information systems of air companies and airports.

Method for Cyberincidents Network-Centric Monitoring in Critical Information Infrastructure

Method for Cyberincidents Network-Centric Monitoring in Critical Information Infrastructure

Protecting Critical Databases – Towards a Risk Based Assessment of Critical Information Infrastructures (CIIS) in South Africa

South Africa has made great strides towards protecting critical information infrastructures (CIIs). For example, South Africa recognises the significance of safeguarding places or areas that are essential to the national security of South Africa or the economic and social well-being of South African citizens. For this reason South Africa has established mechanisms to assist in preserving the integrity and security of CIIs. The measures provide inter alia for the identification of CIIs; the registration of the full names, address and contact details of the CII administrators (the persons who manage CIIs); the identification of the location(s) of CIIs or their component parts; and the outlining of the general descriptions of information or data stored in CIIs.
 
 It is argued that the measures to protect CIIs in South Africa are inadequate. In particular, the measures rely on a one-size-fits-all approach to identify and classify CIIs. For this reason the South African measures are likely to lead to the adoption of a paradigm that considers every infrastructure, data or database, regardless of its significance or importance, to be key or critical.

Editorial

The first issue of 2013 contains fifteen contributions dealing with a potpourri of themes. The first contribution is an oratio presented by the retired Dean of the Faculty of Law of the NWU and former editor of PER, Francois Venter, during his exodus in October 2012. He gave his presentation in his mother tongue, Afrikaans, and asks the question if one may assume that being a professor entails belonging to a profession, in other words, an academic profession. The second oratio was a keynote speech delivered by Torsten Stein, the Director of the Institute of European Studies and holder of the chair for European law and European Public Law at Saarland University, Germany. He delivered his speech during November 2012 at the 3rdHuman Rights Indaba on The Role of International Law in Understanding and Applying the Socio-economic Rights in South Africa's Bill of Rights, which was held by the Faculty of Law (NWU, Potchefstroom Campus) in collaboration with the Konrad-Adenauer Foundation. He shared some thoughts about the nature, development and implementation of socio-economic rights within an international and European setting. The next nine articles make up the bulk of this issue. The first one is by Babatunde Fagbayibo, who gives an analytical overview of the common problems affecting supranational attempts in Africa. He argues that Africa's efforts to solidify its unity should be geared towards building on the experiences of past and present experiments at the sub-regional level. Samantha Goosen discusses the very thorny issue of battered women and the elements of self-defence if she has to stand trial for killing her husband. Recent developments in the area of pro bono legal services are the heart of Dave Holness' article. He focuses on legal service delivery for the indigent by attorneys in private practice acting pro bono in civil rather than criminal matters. Henk Kloppers discusses the very topical issue of corporate social responsibility. He gives an overview of the social and ethics committee created in terms of the Companies Act 71 of 2008 as a potential driver of corporate social responsibility. The always newsworthy theme of HIV/AIDS and the question of whether to disclose or not to disclose one's status forms the focal point of Andra le Roux-Kemp's contribution. Chucks Okpaluba gives an overview of South African and Commonwealth decisions dealing with the issue of reasonable and probable cause in the law of malicious prosecution. The never-ending problem of language diversity once again comes to the fore in the article by Loot Pretorius. He asks the question if the recently adopted Use of Official Languages Act 12 of 2012 complies with the normative instructions of the Constitution of the Republic of South Africa, 1996. In his second essay on the Child Justice Act 75 of 2008, Stephan Terblanche deals with a number of procedural issues related to the sentencing of child offenders. The last article, which is by Bonnie Venter, deals with the ethical question of whether the payment of kidney donors could be regarded as constitutionally acceptable or not. In the first of five notes, Nqobizwe Ngema asks if the African custom of theleka (the withholding of a wife by her father or guardian from her husband to coerce him to pay the outstanding lobolo) has an impact on the custody of children in the context of the best interest of the child. The central question Phazha Ngandwe asks is how states can discharge their duties and obligations vis-à-vis their nationals without perpetuating the bottlenecks to and the stigma that attaches to migration and thereby upsetting the international and regional integration objectives of the free movement of people. Mzukisi Njotini's note discusses the adequacy of South Africa's measures designed to protect critical information infrastructures. In the second last note, Anthea Wagener considers the practice of South African motor-vehicle insurers of using gender as a rating variable to classify risks into certain classes, thereby determining insurance premiums, and asks if this practice boils down to unfair discrimination. The final note by Anri Botes deals with the history of labour hire in our neighbouring country, Namibia.
 

A new strategy for improving cyber-attacks evaluation in the context of Tallinn Manual

In this paper a systematic modeling methodology for evaluating the effects of cyber-attacks on States Critical Information Infrastructure (CII) is introduced. The analysis is focused on the United Nations Charter's normative scheme of the “use of force”, in order to define whether these attacks constitute a wrongful “use of force” under the principles of international law. By using the qualitative criteria for recognising the impact of cyber-attacks as proposed by the International Group of Experts in the Manual on the International Law Applicable to Cyber Warfare (Tallinn Manual) and by applying Multiple Attribute Decision Making (MADM) methods, cyber operations evaluation results are presented. For the analysis a case study of kinetic and cyber-attacks on Supervisory Control and Data Acquisition (SCADA) system is employed. Pros and cons of the Simple Additive Weighting (SAW) method and the Weighted Product Method (WPM) are evaluated. The weaknesses of applying the SAW method in cyber-attacks modelling, as well as the difficulty in defining an appropriate quantitative scale for the classification of such attacks when using WPM (due to the nonlinear relationship between attributes and overall score in WPM), lead us to present a new evaluation strategy. This new strategy combines the use of the above mentioned decision making algorithms and introduces a new grouping of Schmitt's criteria based on their properties for achieving an improved cyber-attacks modelling assessment. Different quantitative scales are applied in the distinct Schmitt's criteria groups in order to quantify them based on their characteristics. The correlation of the qualitative and quantitative methods of analysis leads to more accurate cyber-attack evaluation and classification.

Security assurance assessment methodology for hybrid clouds

The emergence of the cloud computing paradigm has altered the delivery models for ICT services. Unfortunately, the widespread use of the cloud has a cost, in terms of reduced transparency and control over a user's information and services. In addition, there are a number of well-understood security and privacy challenges that are specific to this environment. These drawbacks are particularly problematic to operators of critical information infrastructures that want to leverage the benefits of cloud. To improve transparency and provide assurances that measures are in place to ensure security, novel approaches to security evaluation are needed. To evaluate the security of services that are deployed in the cloud requires an evaluation of complex multi-layered systems and services, including their interdependencies. This is a challenging task that involves significant effort, in terms of both computational and human resources. With these challenges in mind, we propose a novel security assessment methodology for analysing the security of critical services that are deployed in cloud environments. Our methodology offers flexibility, in that tailored policy-driven security assessments can be defined based on a user's requirements, relevant standards, policies, and guidelines. We have implemented and evaluated a system that supports online assessments using our methodology, which acquires and processes large volumes of security-related data without affecting the performance of the services in a cloud environment.

Introduction to the Special Issue: Papers from 2016 Workshops: Parallel Policy Issues: Freedom of Information and Cybersecurity

Introduction to the Special Issue: Papers from 2016 Workshops: Parallel Policy Issues: Freedom of Information and Cybersecurity

Логика первого порядка для задания требований к безопасному программному коду

Currently the problem of information security during designing and exploiting the objects of critical information infrastructure is paid special attention to. One of the most common approaches to providing information security, processed on the objects, is creating isolated programming environment. The environment security is determined by its invariability. However, the evolutional development of data processing systems gives rise to the necessity of implementing the new components and software in this environment under condition that security requirements are satisfied. The most important requirement consists in trust in the new programming code. The given paper is devoted to developing formal logical language of description of functional requirements for programming code, allowing to make further demands at the stage of static analysis and to control their implementation in dynamics.

Комплексний підхід до побудови системи кіберзахисту критичної інформаційної інфраструктури держави

Complex Approach for problems solving to enable Cyber Defence for State Critical Information Infrastructure Objects through best world and home practices, and also approved hardware and software and only software Cyber Defence Tools is presented. Cyber Security Guidance Intellectual Information Technology to effectively implement of this Approach is proposed. The Technology combines authors’ developments for Organizational Decisions (both expert-analytical and business) Making Support with advanced approaches for due Cyber Security Benefits and its violation Risks Management. Applying the Approach will help to improve Cyber Defence of State Critical Information Infrastructure. Problems in programming 2017; 3: 128-148

ТЕНДЕНЦИИ РАЗВИТИЯ ПРАВОВОГО РЕГУЛИРОВАНИЯ ИНФОРМАЦИОННОГО ПРОСТРАНСТВА

The article is devoted to the analysis of scientific concepts of the information space as one of the spheres of realization of state sovereignty. The author considers the influence of the development of information technologies on the nature of legal regulation, as well as the tendencies of globalization and sovereignization. There is a lack of theoretical development and separation of the concepts of "information environment", "information sphere", "information space" both in the science of information law and in the text of the new Doctrine of Information Security of the Russian Federation. The process of forming the institution of international information security, measures to ensure national and international legal protection of critical information infrastructures and facilities is considered. Based on the analysis of documents developed by the Group of Governmental Experts of the United Nations and the new legislative initiatives in the Russian Federation related to the national segment of the Internet and the protection of critical information infrastructure, the conclusion about the willingness of states to sovereignize the information space realized through the localization of information infrastructure on the territory of a particular state is substantiated

\u2018Dialogue, partnership and empowerment for network and information security\u2019: the changing role of the private sector from objects of regulation to regulation shapers

The protection of cyberspace has become one of the highest security priorities of governments worldwide. The EU is not an exception in this context, given its rapidly developing cyber security policy. Since the 1990s, we could observe the creation of three broad areas of policy interest: cyber-crime, critical information infrastructures and cyber-defence. One of the main trends transversal to these areas is the importance that the private sector has come to assume within them. In particular in the area of critical information infrastructure protection, the private sector is seen as a key stakeholder, given that it currently operates most infrastructures in this area. As a result of this operative capacity, the private sector has come to be understood as the expert in network and information systems security, whose knowledge is crucial for the regulation of the field. Adopting a Regulatory Capitalism framework, complemented by insights from Network Governance, we can identify the shifting role of the private sector in this field from one of a victim in need of protection in the first phase, to a commercial actor bearing responsibility for ensuring network resilience in the second, to an active policy shaper in the third, participating in the regulation of NIS by providing technical expertise. By drawing insights from the above-mentioned frameworks, we can better understand how private actors are involved in shaping regulatory responses, as well as why they have been incorporated into these regulatory networks.

Evaluation of information needs of agricultural extension agents in Ghana

The agricultural sector plays a decisive role in Ghana’s economy, employment, and food security. The study set out to assess the information needs of agricultural extension agents across all the agro-ecological zones of Ghana, in order to provide them with the right information. A structured field survey methodology was used for the study and 472 agricultural extension agents from 40 districts in Ghana served as the respondents. The findings of the study revealed that agricultural extension agents regularly sourced for information from books and reports; visual or pictorial information was the most preferred format for package of information. The AEAs used agricultural extension information to assist in the discharge of their work, and as a basis for advice to farmers on general farm planning and consultancy among others. Challenges identified in accessing information included inadequate information infrastructure and training avenues. The AEAs suggested that critical information infrastructure such as libraries, information centers, and databases be provided as measures to offset the challenges. The study recommended that efforts should be directed at improving extension agents’ access to information infrastructure and that different and wide-ranging media should be developed to supply information to the AEAs.

A Review of Intrusion Alerts Correlation Frameworks

The advancement of modern computers, networks and internet has led to the widespread adoption and application of Information Communication Technology in modern organizations. As a result, large amount of information is generated, processed and distributed through digital devices. On the other side, digital crimes have increased in number and sophistication and they compromise the organization’s critical information infrastructure affecting the confidentiality, integrity and availability of its information resources. In order to detect these malicious activities, organizations deploys multiple Network Intrusion Detection Systems (NIDSs) in their corporate networks. They generate huge amount of low quality alerts and in different formats when an attack has already taken place. Thus Alert and event correlation is required to preprocess, analyze and correlate the alerts produced by one or more network intrusion detection systems and events generated from different systems and security tools to provide a more succinct and high-level view of occurring or attempted intrusions. This work will review current alert correlation systems in terms of approaches and propose design consideration for an efficient alert correlation technique. We conclude by highlighting the opportunity to include attack prediction component in a real time multiple sensors environment.

Reconceptualising Cyber Security

The cyber security discourse is dominated by states and corporations that focus on the protection of critical information infrastructure and databases. The priority is the security of information systems and networks, rather than the protection of connected users. The dominance of war metaphors in the cyber security debates has produced a security dilemma, which is not sufficiently addressing the needs of people. This article underlines this shortcoming and views cyber security through a human-centric perspective. Freedom of expression and the right to privacy are under attack in the era of cyber surveillance. From a human-centric perspective such rights should be understood as a critical part of cyber security. Human rights protections need to be effectively addressed in the digital sphere and gain their place in the cyber security agendas.

Cyber Security Education and Research in the Finland's Universities and Universities of Applied Sciences

The revolution in information technology that began in the 1990s has been transforming Finland into an information society. Imaginative data processing and utilization, arising from the needs of citizens and the business community, are some of the most important elements in a thriving society. Information and know-how have become key ‘commodities' in society, and they can be utilized all the more efficiently through information technology. For all nations, the information technology revolution quietly changed the way business and government operate, as well as the daily life of citizens. Our daily life, fundamental rights, social interactions and economies depend on information and communication technology working seamlessly. An open and free cyberspace has promoted political and social inclusion worldwide; it has broken down barriers between countries, communities and citizens, allowing interaction and sharing of information and ideas across the globe. Individuals, public and private organizations alike depend on the cyber world. From the citizens using social media, to banks growing their business, to law enforcement supporting national security – every sector of the society is increasingly dependent upon technology and networked systems. While the public sector, the economy and the business community as well as citizens benefit from globally networked services, the digital IT society contains inherent vulnerabilities which may generate security risks to citizens, the business community or the vital functions of society. Without sufficient awareness of the risks in cyber world, however, behavioral decisions and unseen threats can negatively impact the security of the critical infrastructure and can cause physical damage in the real world. On an individual level, what is at stake is the vulnerability of each individual user in cyber world. As the world grows more connected through cyber world, a highly skilled cyber security workforce is required to secure, protect, and defend national critical information infrastructure. Across the private and public sector organizations are looking for well-trained professionals to assess, design, develop, and implement cyber security solutions and strategies. While the demand for cyber security professionals is high, the supply is low. Meeting the growing demand for cyber security professionals begins in the education system. The most efficient custom to increase cyber security is the improvement of the know-how. The cyber security strategies and development plans require the improvement of the know-how of the citizens and actors of the economic life and public administration. Pursuant to Finland's Cyber Security Strategy (2013) “the implementation of cyber security R&D and education at different levels does not only strengthen national expertise, it also bolsters Finland as an information society.” In this article are analyzed the cyber security research and education which is offered in Finland's universities and universities of applied sciences.

Building national cyber resilience and protecting critical information infrastructure

ABSTRACTThe digital transformation poses a challenge to all societies and economies, with Information and Communication Technologies forming a substrate for critical services and economic growth. National cyber policy-makers are faced with many priorities, including protecting critical infrastructure, reducing cybercrime, raising awareness, and following national security and foreign policy interests. The protection of critical services and infrastructure, fight against cybercrime, cyber incident response and recovery form a basis of nations’ cyber resilience in the digital era. In the light of recent cyber security regulations passed in the US and the European Union, the article offers an overview of how to organise and provide leadership for an efficient national cyber effort. It also discusses several methods from a public policy perspective of how to provide better cyber security for critical services and infrastructures.

Modern approaches to critical infrastructure objects detection and identification

Modern trends in information technologies led phenomenal dependence on public services, which provide by different spheres of infrastructure. Today, quality and accessibility of services is one of the main indicators of the state infrastructure level, and ensure their security and stable operation is an essential and indispensable part of the national security of developed countries. Increased concentrations of tools and resources to secure various types of electronic infrastructure necessitated ranking of infrastructure facilities, the allocation of the most important ones and the emergence of the concept of critical infrastructure. In view of this, in the paper the multi criteria analysis of approaches was carried out to identify critical facilities to assess their capacity to detect and identify the most important objects of critical information infrastructure. It was established that the most effective information infrastructure approaches are based on graph theory and simulation, but most existing approaches do not take into account the full set of parameters and information component. That’s why the development of a universal method for critical information infrastructure identification is necessary.

Auditing Community Software Development

Abstract In accordance with European efforts related to Critical Information Infrastructure Protection, in Hungary a special department called LRL-IBEK has been formed which is designated under the Disaster Management. While specific security issues of commercial applications are well understood and regulated by widely applied standards, increasing share of information systems are developed partly or entirely in a different way, by the community. In this paper different issues of the open development style will be discussed regarding the high requirements of Critical Information Infrastructures, and possible countermeasures will be suggested for the identified problems.