Network Security Data Research Articles

Data Security in Unattended Wireless Sensor Networks

In recent years, wireless sensor networks (WSNs) have been a very popular research topic, offering a treasure trove of systems, networking, hardware, security, and application-related problems. Much of prior research assumes that the WSN is supervised by a constantly present sink and sensors can quickly offload collected data. In this paper, we focus on unattended WSNs (UWSNs) characterized by intermittent sink presence and operation in hostile settings. Potentially lengthy intervals of sink absence offer greatly increased opportunities for attacks resulting in erasure, modification, or disclosure of sensor-collected data. This paper presents an in-depth investigation of security problems unique to UWSNs (including a new adversarial model) and proposes some simple and effective countermeasures for a certain class of attacks.

Remote working: managing the balancing act between network access and data security

These days, it is generally accepted that economic, regulatory and social pressures are coming together to drive growth in remote working in businesses of all sizes and in all sectors. At the same time, organisations have recognised a parallel increase in hacking attacks and other forms of unauthorised access relating to corporate networks.

Online data storage using implicit security

It is advantageous to use implicit security for online data storage in a cloud computing environment. We describe the use of a data partitioning scheme for implementing such security involving the roots of a polynomial in finite field. The partitions are stored on randomly chosen servers on the network and they need to be retrieved to recreate the original data. Data reconstruction requires access to each server, login password and the knowledge of the servers on which the partitions are stored. This scheme may also be used for data security in sensor networks and internet voting protocols.

Infection control resources in New York State Hospitals, 2007

In July 2005, New York State legislation requiring the mandatory reporting of specific hospital-associated infections (HAIs) was passed by the legislature and signed by the governor. In an effort to measure the impact of this legislation on infection control resources, the New York State Department of Health (NYSDOH) conducted a baseline survey in March 2007. This report presents an overview of the methods and results of this survey. An electronic survey of infection control resources and responsibilities was conducted by the NYSDOH on their secure data network. The survey contained questions regarding the number and percent time for infection prevention and control professional (ICP) and hospital epidemiologist (HE) staff members, ICP/HE educational background and certification, infection control program support services, activities and responsibilities of infection prevention and control program staff, and estimates of time dedicated to various activities, including surveillance. Practitioners in 222 of 224 acute care hospitals (99%) responded. The average number of ICPs per facility depended on the average daily census of acute care beds and ranged from a mean of 0.64 full-time equivalent (FTE) ICP in facilities with an average daily census of < or = 100 beds to 6.5 FTE ICPs in facilities with an average daily census of > or = 900 beds. Averaging the ICP resources over the health care settings for which they were responsible revealed that the "average full-time ICP" was responsible for 151 acute care facility beds, 1.3 intensive care units (ICUs) (average, 16 ICU beds), 21 long-term care facility beds, 0.6 dialysis centers, 0.5 ambulatory surgery centers, 4.8 ambulatory/outpatient clinics, and 1.1 private practice offices. The ICPs reported that 45% of their time is dedicated to surveillance. Other activities for which ICPs reported at least partial responsibility include staff education, quality assurance, occupational health, emergency preparedness, construction, central supply/processing, and risk management. This survey was designed to monitor and assess infection prevention and control resources and activities in hospitals as New York State embarks on mandatory public reporting of HAI rates. Monitoring infection control resources and activities will be important as HAI reporting moves forward. The information collected will serve as a baseline, and repeat surveys will be conducted to determine which, if any, of the various indicators correlate with the completeness and accuracy of HAI reporting.

Data Security in Ad Hoc Networks Using Randomization of Cryptographic Algorithms

Data Security in Ad Hoc Networks Using Randomization of Cryptographic Algorithms

Information fusion and visualization of cyber-attack graphs

Many security sensors and other protection mechanisms are deployed at different levels to provide what is known as defensein-depth for systems and networks. However, the large volume of security alerts experienced makes it challenging for operators to analyze the attack situation and take an appropriate response. Based on network configurations there are two major challenges to display and analyze potentially very-large and complex graphs of multi-step cyber attacks against networks. One is to transform large quantities of network security data into real-time actionable intelligence. The other is to visualize the complex graphs, including all possible network attack paths, while still keeping complexity manageable. We have proposed a comprehensive and innovative approach that is based on of three bodies of work: attack graph research,1–4 alert correlation research,5–10 and attack visualization research.11–16 As can be seen in Figure 1, there are two major components: attack analysis and attack-graph visualization modules. Based on the proposed these, we can easily display and analyze potentially very-large and complex graphs of multi-step cyber attacks against networks based upon network vulnerabilities, connectivity, and attacker exploits. The attack graph visualization module consists of three fundamental blocks: hierarchy construction, hierarchical graph complexity reduction, and radial space-filling (RSF) hierarchy visualization. The visualization module provides access to all possible network attack paths while keeping complexity manageable via interactive hierarchical graph complexity reduction. Moreover, the RSF technique has the advantage of efficiently using the display space while conveying the hierarchical strucFigure 1. Analysis and visualization model for large complex multistep cyber attack graphs.

An overlay approach to data security in ad-hoc networks

While it has been argued that application-layer overlay protocols can enhance services in mobile ad-hoc networks, hardly any empirical data is available on the throughput and delay performance achievable in this fashion. This paper presents performance measurements of an application-layer overlay approach that ensures integrity and confidentiality of application data in an ad-hoc environment. A key management and encryption scheme, called neighborhood key method, is presented where each node shares secrets only with authenticated neighbors in the ad-hoc network, thus avoiding global re-keying operations. All proposed solutions have been implemented and empirically evaluated in an existing software system for application-layer overlay networking. Results from indoor and outdoor measurement experiments with mobile handheld devices provide insight into the performance and overhead of overlay networking and application-layer security services in ad-hoc networks.

Monitoring health care workers after smallpox vaccination: Findings from the hospital smallpox vaccination-monitoring system

The Advisory Committee on Immunization Practices and the Healthcare Infection Control Practices Advisory Committee recommended that hospitals establish on-site, daily assessments of health care workers vaccinated with smallpox vaccine. The Hospital Smallpox Vaccination Monitoring System (HSVMS) was 1 component of the smallpox vaccination plan to monitor adverse events on-site in hospitals. This report presents findings from February to August 2003. All US institutions participating in the smallpox vaccination program were eligible to enroll in and use HSVMS through the Internet-based Centers for Disease Control Secure Data Network. Of the 730 enrolled vaccinees, 341 (47%) were nurses; 122 (17%) physicians; 75 (10%) laboratory, patient care, radiology, or other technicians; 39 (5%) administrators; 22 (3%) housekeepers; 21 (3%) physical or respiratory therapists; 20 (3%) infection control professionals; 19 (3%) safety or security staff; and 17 (2%) epidemiologists; and 54 (7%) were workers in other job categories. Most (86%) vaccinees had been previously vaccinated. Postvaccination signs and symptoms were frequent: itching (75.2%), pain at the vaccination site (31.6%), swollen or tender lymph nodes (26.4%), fatigue (26.2%), and headache (20.8%). Symptoms were highest during the first week after vaccination; symptoms were more frequently reported among vaccinees without previous vaccination. Adherence to recommended vaccination site care was reported in 2732 of 3091 (88.4%) follow-up visits among workers with patient contact. Of the 4379 days workers planned to work, during 31 (0.7 per 100) days, workers performed restricted activities, and, in 60 (1.4 per 100) days, workers were absent. Findings from HSVMS indicate that adherence to post-smallpox vaccination site care was high and that the number of days of work affected was low.

KNOWLEDGE NEEDS AND DATA SECURITY AS THEY APPLY TO NETWORK INTRUSION DETECTION SYSTEMS

This research examines users of network intrusion detection systems (NIDS) in an effort to identify their understanding of NIDS. Thirty participants were studied using a qualitative case study methodology. This study focused on security analysts and managers responsible for operations, implementation, and the management of network intrusion detection systems and patterns of knowledge awareness related to the technology. Knowledge levels were categorized using Bloom’s Taxonomy of Cognitive Learning. This research provides recommendations for improving the level of knowledge in an effort to enhance the overall understanding of the technology, which in turn may strengthen data network security.

Cascade of distributed and cooperating firewalls in a secure data network

Security issues are critical in networked information systems, e.g., with financial information, corporate proprietary information, contractual and legal information, human resource data, medical records, etc. The paper addresses such diversity of security needs among the different information and resources connected over a secure data network. Installation of firewalls across the data network is a popular approach to providing a secure data network. However, single, individual firewalls may not provide adequate security protection to meet the users needs. The cost of super firewalls, design flaws, as well as implementation inappropriateness with such firewalls may retain security loopholes. The idea proposed is to introduce a cascade of (potentially simpler and less expensive) firewalls in the secure data network, where, between the attacker node and the attacked node, multiple firewalls are expected to provide an added degree of protection. This approach, broadly following the theme of redundancy in engineering systems' design, will increase the confidence and provide more completeness in the level of security protection by the firewalls. The cascade of (i.e., multiple) firewalls can be placed across the secure data network in many ways, not all of which are equally attractive from cost and end-to-end delay perspectives. Toward this, we present heuristics for placement of these firewalls across the different nodes and links of the network in a way that different users can have the level of security they individually need, without having to pay added hardware costs or excess network delay. Three metrics are proposed to evaluate these heuristics: cost, delay, and reduction of attacker's traffic. Performance of these heuristics is presented using simulation, along with some early analytical results. Our research also extends the firewall technology into the well-known advantages of distributed firewalls. Furthermore, the distributed firewalls can be designed to cooperate and stop an attacker's traffic closest to the attack point, thereby reducing the amount of hacker's traffic into the network.

Trusted …or… trustworthy: the search for a new paradigm for computer and network security

On the occasion of the presentation of the Kristian Beckman Award for 2002 it is appropriate to pause and reflect on the state of computer and associated data network security at the start of the new millennium; appropriately in a country that itself pioneered the use of encryption some thousands of years ago. This paper sets out a number of major questions and challenges which include: • Just what is meant by ‘trusted’ or ‘trustworthy’ systems after 20 years of experience, or more likely, lack of business level experience, with the ‘trusted computer system’ criteria anyway? • Does anyone really care about the adoption of international standards for computer system security evaluation by IT product and system manufacturers and suppliers (IS 15408) and, if so, how does it all relate to business risk management anyway (IS 17799)? • With the explosion of adoption of the microcomputer and personal computer some 20 years ago, has the industry abandoned all that it learnt about security during the ‘mainframe era’; or — “whatever happened to MULTICS” and its lessons? • Has education kept up with security requirements by industry and government alike in the need for safe and secure operation of large scale and networked information systems on national and international bases, particularly where Web or Internet-based information services are being proposed as THE major “next best thing” in the IT industry? • Has the ‘fourth generation’ of computer professionals inherited the spirit of information systems management and control that resided by necessity with the last ‘generation’, the professionals who developed and created the applications for shared mainframe and minicomputer systems? Overall, this paper proposes that, like other industries before it, from the car industry to food to pharmaceuticals and drugs, the role of government in relation to its community care responsibilities cannot be ignored in societies that have now become dependent upon the safe, secure and reliable operation of computer systems and data networks; so-called “National Information Infrastructure Protection” or NIIP. Is it time for government to enact legislation that places firm and legally binding obligations on the information technology industry to create and distribute safe and secure products and systems; to be liable for deliberate, or even negligent, release of faulty software products and the like? For the computer professionals creating the necessary applications that enable such systems to be used, is it time for legal responsibility based around concepts of professional conduct and education? Finally, in relation to specialized information security professionals acting to manage such critical information systems, is it time for government registration of those IT security professionals and, if so, just what has to be the base levels of education and training needed for a person to act as such? Unlike other industries, some professionals given charge of IT security may have had little more INFOSEC education than “buying a copy of Bruce Schneier’s book” (an actual statement made to the author in relation to IT security training in a business situation and the nomination of an IT manager as the ‘security’ manager).

Using Chaotic Dynamics in Quantum Cryptographic Systems: Chaotic Cryptography and Repeaters

Quantum cryptography is a potential technique for data security in communications networks. However, it still must overcome some implementation problems to become commercial, such as the limited distance between network's users, low transmission rate of quantum data and the decoherence suffered by the quantum state during propagation in the channel. On the other hand, chaotic systems show rich dynamics with very interesting properties that can be used in communications. In this direction, we propose the use of suitable properties of chaotic systems, such as great sensitivity to initial conditions, unpredictability, controllability and synchronisation of chaotic systems to overcome some problems of quantum cryptography.

Test and measurements [1999 technology analysis and forecast

This article presents a test and measurements technology analysis and forecast for 1999. The subject covered include network instruments, virtual testers, measurement automation, data security and PC-based next-generation instruments.

Security in data networks

The explosive growth of data networks and their commercial application is driving the need for improved security. This paper aims to raise awareness of the features of secure data networks and the role that encryption plays in this context. An overview of data network security is provided by examining a number of currently available technologies, and how they may be combined to provide a secure network. This is illustrated by a review of existing and proposed encryption services offered by BT/Concert. Taking a glimpse into the future, the ATM Forum's proposals for security in ATM networks are summarised.

A new era in data network security: Protocol‐sensitive encryption

AbstractA protocol‐sensitive security solution becomes a security overlay on top of a data communications network. No modification or access to the data network is required and, if implemented properly, users are unaware that their data is being secured.

The defense message system

The U.S. Department of Defense (DoD) plans to modernize the Defense Message System (DMS) to reduce costs and improve services. DMS includes all hardware, software, procedures, standards, facilities, and personnel used to exchange messages electronically in DoD. DMS today has two separate parts. The AUTODIN system handles formal messages between organizations, and the Defense Data Network's electronic mail system handles other messages. The DMS plan has a target architecture, for the year 2008, that integrates those separate systems, uses CCITT X.400 message handling and X.500 directory services, and provides writer-to-reader security with the Secure Data Network System developed by the National Security Agency. The implementation strategy has three phases that extend over 20 years. The plan has an indirect but strong effect on the Internet outside DoD.

Defense data network security architecture

The Department of Defense (DOD) is changing the security structure of the Defense Data Network. Existing classified backbones are merging to form a single segment. DISNET, that uses a new host - to - host encryption system. When completed, DISNET will carry classified data of all security levels, while MILNET continues to carry unclassified traffic. MILNET is being strengthened by link encryption devices on trunk and access lines. Subscriber computers and network elements in both DISNET and MILNET will have to satisfy at least Class C2 (Controlled Access Protection) of the DOD Trusted Computer System Evaluation Criteria. There are no similar plans for the Internet.

The Secure Data Network System

Providing security for data communications is quite complex, especially in contrast to traditional security systems for voice communications. The Secure Data Network System (SDNS), a joint program of the U.S. government and telecommunications and computer industry representatives, is developing security standards for data networking. The SDNS program is incorporating security into the Open Systems Interconnection (OSI) framework to ensure interoperability and compatibility of equipment and services. SDNS functionality will be built into or added onto communications equipment such as personal computers, workstations, and host computers, and will provide security services such as confidentiality, integrity, authentication, access control, and sender nonrepudiation. Both real-time and store-and-forward communications will be supported.

Swedish state data network security “inadequate”, report claims

Swedish state data network security “inadequate”, report claims

Data Security in Computer Networks: Guest Editor's Introduction

Security in networks differs in several aspects from security in a centralized computer system. This is because (1) the switching nodes and concentrators are distributed physically and cannot be considered secure, and (2) the network protocols, if not properly designed, can be used by an intruder to gain access to the network data or have it misrouted. This special issue describes many developments in the above-mentioned aspects of data security in networks. The first article surveys digital signatures. Both private-key and public-key encryption techniques can be used to generate digital signatures. Since an unauthorized party can counterfeit public keys or use private keys that have been compromised, the use of public-key encryption alone does not ensure secrecy or a correct digital signature. The next article discusses the protection of public keys and signature keys. A protocol is a set of rules to be followed by users to ensure orderly communication. The next work describes several issues in protocol design and implementation. The importance of arbitrators in the design of secure protocols is explained and some implementations are described. An application of the RSA digital signature to electronic mail is described in the last article.