Security Policy Design Research Articles

What Triggers Violation of Information Security Policies

This paper offers a framework for information security professionals to evaluate ISP and understand policy non-adherence. It explores the different types of non-adhering behaviors and the motivations behind them. It goes on to share information about the environmental/organizational climates in which non-compliant behaviors are more or less likely to occur and briefly touches on when users are more likely to commit them. Finally, it suggests a user review process as a critical part of information security policy design and implementation.

South-to-south mentoring as a vehicle for implementing sustainable health security in Africa

BackgroundWhile sustainability has become a universal precept in the development of global health security systems, supporting policies often lack mechanisms to drive policies into regular practice. ‘On-paper’ norms and regulations are to a great extent upheld by frontline workers who often lack the opportunity to communicate their first-hand experiences to decisionmakers; their role is an often overlooked, yet crucial, aspect of a sustainable global health security landscape. Initiatives and programs developing transdisciplinary professional skills support the increased bidirectional dialogue between these frontline workers and key policy- and decisionmakers which may sustainably narrow the gap between global health security policy design and implementation.MethodsThe International Federation of Biosafety Associations’ (IFBA) Global Mentorship Program recruits biosafety and biosecurity champions across Africa to provide local peer mentorship to developing professionals in their geographic region. Mentors and mentees complete structured one year program cycles, where they are provided with written overviews of monthly discussion topics, and attend optional virtual interactive activities. Feedback from African participants of the 2019–2020 program cycle was collected using a virtual Exit Survey, where aspects of program impact and structure were assessed.ResultsFollowing its initial call for applications, the IFBA Global Mentorship Program received considerable interest from professionals across the African continent, particularly in East and North Africa. The pilot program cycle matched a total of 62 individuals from an array of professional disciplines across several regions, 40 of which were located on the African continent. The resulting mentorship pairs shared knowledge, skills, and experiences towards translating policy objectives to action on the front lines. Mentorship pairs embraced multidisciplinary approaches to harmonize health security strategies across the human and animal health sectors. South-to-South mentorship therefore provided mentees with locally relevant support critical to translation of best technical practices to local capacity and work.ConclusionThe IFBA’s South-to-South Global Mentorship Program has demonstrated its ability to form crucial links between frontline biosafety professionals, laboratory workers, and policy- and decision-makers across several implicated sectors. By supporting regionally relevant peer mentorship programs, the gap between health security policy development and implementation may be narrowed.

Examining the role of stress and information security policy design in information security compliance behaviour: An experimental study of in-task behaviour

Based on the transactional theory of stress, the study sets out to explore the relationship between occupational stress, information security policy (ISP) designs, and security behaviour. Results from an in-basket experiment reveal that stress elicited by time constraints leads to ISP non-compliance behaviour in the workplace. In addition, the results of the study show that punishment can buffer the effect of perceived stress on ISP non-compliance. While existing research on stress and ISP compliance focus on stress induced by security requirements, our study extends these findings by providing insights how stressful work environments and ISP designs shape ISP compliance behaviour.

GRBC-based Network Security Functions placement scheme in SDS for 5G security

With the paradigm shift of 5G in terms of computing and infrastructure, 5G security is confronted with new challenges due to the promising introduction of Software Defined Networks (SDN), Network Function Virtualization (NFV) and Cloud Computing. While most of current works on 5G security are focused on high-level analysis of challenges and threats to satisfy the emerging use cases. Software Defined Security (SDS), as a new security paradigm which provides flexible and centralized security protection for varieties of networks especially for SDN and Cloud environment, can be a potential security solution in 5G. Lots of work have focused on the implementations and details of SDS, and most researchers, however, are focusing on the controller design and security policy design. There are few work on the placement strategy of Network Security Functions (NSFs) and devices, which plays a significant role in SDS to improve the optimize defence effects. Most of existing placement schemes are modelled as Integer Linear Programming (ILP) by considering the constrains in terms of resource, time, security and so on, and introduce various heuristic algorithm to reduce its computing complexity. While in this paper, we propose a placement scheme of NSFs and devices in SDS based on underlying routing characteristic and evaluate its performance defending virus attack. The proposed scheme adopts Group Routing Betweenenss Centrality (GRBC) as a metric and introduces a successive algorithm to compute the GRBC. Different to traditional Routing Betweenness Centrality which only considers the importance of single node, the proposed scheme can find the key group of nodes in a SDS underlying network, where the NSFs and security devices should be deployed. In the performance evaluation, we apply our scheme to the scenario of computer virus and worms control in SDS, and the results show that the proposed scheme can improve the performance of security functions in SDS system.

Design of Security Policy Based on User Identity Authentication Technology in Cloud Environment

Cloud computing application fields are growing, Apply Identity authentication to the cloud environment has certain limitation and particularity. How to ensure the safety of the cloud computing by the identity authentication technology is a problem that the service providers should concern and it is also difficult. CPK technology is a technology with independent intellectual property rights in China. The biggest advantage of CPK is to create a large scale key by a few resources. Identity authentication and access control is an indispensable part in cloud computing security. This thesis proposes a new access control scheme which combine the rolebased access control scheme and the public key authentication scheme. It can enhance the security of the access control model so as to improve the security of cloud computing. It may occur forgery attacks due to the large number of users in the cloud computing environment. To solve this problem, this thesis proposes a twoway authentication schemes to resist different kinds of forgery attacks. This thesis designs an experiment for the CPK authentication system on the Cloud Sim platform. The results of the simulation show that the user authentication can be effective in cloud computing environment.

Design a Resilient Network Infrastructure Security Policy Framework

The information security policy development life cycle tend to lack focus on use of standard terms and semantics. This results in blurred outlines for monitoring, evaluation and enforcement of the security policy for the employees causing confusion in adhering and implementing it which leads to lack of process of publishing form the security policy, end user awareness, translation of high level policy to lowest level component configuration plans and actions to take in time of crisis. This leads to the critical need for the designing an empirically tested, comprehensive security policy design. This paper proposes bridging the gap between the high level information security policy descriptions with the low level network infrastructure security implementation. Background Objectives: With new and innovative technologies such as Cloud, Remote computing, Enterprise Mobility, e-commerce on the rise, network security has remained an ever increasing challenge. This paper presents a security framework to bridge the gap between high level specification requirements and the low level implementation phase for network infrastructure security using the network architecture model with the security policies associated with the network components required to be enforced. Methods/Statistical Analysis: To achieve the framework design, architectural model and a set of design-level security policies are taken into consideration. Also discussed are the advantages and desired characteristics of the model, relating to existing process worked in the design area; and future research directions are pointed. Findings: The current information security policy development life cycle tends to have few disadvantages with the most critical being the overall lack of view of the policy. Typically a narrow view can be found when focusing only on development of the security policy documents and not including the actual practices for implementation or even maintenance of the security policies. This process does not address how the security policy would be development and enforced or even evaluated. The life cycle designs usually focus on policy for development instead of focusing on development process of the information security policy. Application: Utilizing Hybrid cloud architecture design so that internet facing tiers tend to be public clouds and internal secure applications and database tend to be private clouds. This change in network architecture helps take on the volumetric network and application layer DDoS attacks to ensure the traffic reaching the internal network tiers is free from such attackers. Using Rate controls, built-in intelligent WAFs, Client Reputation monitoring, be used in combination as part of a comprehensive defense against all types and sizes of cyber threats.

Users’ perceptions about mobile security breaches

Apart from the technological perspective of security in mobile devices and applications, the economic perspective has been increasingly attracting the academic and business interest. This paper aims to investigate the perceptions of mobile users about the economic importance of security breaches. Instead of considering mobile users as a whole, they were examined as distinct user types based on Brandtzaeg's mobile user typology. These types are: (1) sporadic users, (2) socializers, (3) entertainment type users, (4) instrumental users, and (5) advanced users. In the context of the research part of this study, a survey was conducted in a sample of smartphone and tablet owners. The five user types were identified in our sample by setting specific classification rules, based on the frequency and the variety of mobile services used. Mobile users' perceptions were assessed in terms of ten different kinds of security breaches. The findings indicated that the user types perceive differently the economic importance of security breaches, implying that the design of security policies and/or the development of tools totally for the community of users are not the appropriate practices. Our research could contribute to the knowledge considering mobile users and their perceptions about security breaches. Mobile content providers and developers could use the findings of this study to evaluate and redesign, if needed, their current strategies so as to meet users' needs regarding security.

Real-time and intelligent private data protection for the Android platform

As the number of smart mobile devices and applications continue to grow dramatically, private data stored and handled by such mobile devices have become the primary targets of hackers and malicious software. Today, many malicious mobile applications steal user information, make premium calls, and send advertisement messages without the user’s permission. Unfortunately, the Android system, currently the most popular smart mobile platform, only provides the users with a simple permission granting mechanism during the installation of applications, which are often ignored since most of the users do not pay attention to the potential hidden risks. Even though some vendors have integrated mechanisms to let the users grant or revoke the permissions associated with any applications at any time, such mechanisms are rarely used because the users do not know when, how and what sensitive information have been leaked.In this paper, we proposed mechanisms to track the use of sensitive information by Android applications. We extended TaintDroid to build a real-time security framework, called PasDroid, with mechanisms to trace dubious data flow, map user–application interactions and alert the users about potential privacy leakage on the fly. The information provided by PasDroid enables the users to determine if a transmission should be allowed or blocked with intelligent security policies. Our experimental results show that PasDroid can be deployed with an affordable runtime overhead to help protect users against malicious applications. The design of security policies is key to eliminate false alarms and improve the user experience.

Rational security: Modelling everyday password use

To inform the design of security policy, task models of password behaviour were constructed for different user groups—Computer Scientists, Administrative Staff and Students. These models identified internal and external constraints on user behaviour and the goals for password use within each group. Data were drawn from interviews and diaries of password use. Analyses indicated password security positively correlated with the sensitivity of the task, differences in frequency of password use were related to password security and patterns of password reuse were related to knowledge of security. Modelling revealed Computer Scientists viewed information security as part of their tasks and passwords provided a way of completing their work. By contrast, Admin and Student groups viewed passwords as a cost incurred when accessing the primary task. Differences between the models were related to differences in password security and used to suggest six recommendations for security officers to consider when setting password policy.

A methodology for integrating access control policies within database development

Security in general and database protection from unauthorized access in particular, are crucial for organizations. While functional requirements are defined in the early stages of the development process, non-functional requirements such as security tend to be neglected or dealt with only at the end of the development process. Various efforts have been made to address this problem; however, none of them provide a complete framework to guide, enforce and verify the correct design of security policies, and eventually generate code from that design.We present a novel methodology that assists developers, in particular database designers, to design secure databases that comply with the organizational security policies that are related to access control. The methodology is applied in two main levels: organizational level and application development level. At the organizational level, which takes place before the development of a specific application, organizational policies are defined in the form of security patterns. These patterns encapsulate accumulated knowledge and best practices on security related problems. At the application development level, the data-related security requirements are defined as part of the data model. The security patterns, which have been defined at the organizational level, guide the definition and implementation of the security requirements. The correct implementation of the security patterns is verified during the design stage of the development process, before the automatic generation of the database code. The methodology is supported by a CASE tool that assists its implementation in the various stages.

Formal Specification and Verification of Modular Security Policy Based on Colored Petri Nets

Security policies are one of the most fundamental elements of computer security. Current security policy design is concerned with the composition of components in security systems and interactions among them. Consequently, in a modular specification and verification of a policy, the composition of the modules must consistently assure security policies. A rigorous and systematic way to predict and assure such critical properties is crucial. This paper addresses the problem in a formal way. It uses colored Petri net process (CPNP) to specify and verify security policies in a modular way. It defines fundamental policy properties, i.e., completeness, termination, consistency, and confluence in Petri net terminology and gets some theoretical results. According to the eXtensible Access Control Markup Language (XACML) combiners and property preserving Petri net process algebra (PPPA), several policy composition operators are specified and property preserving results are stated for the policy correctness verification. As an application, the approach is illustrated for the design of Chinese Wall Policy.

Beyond separation of duty

The process of introducing security controls into a sensitive task, which we call secure task design in this article, consists of two steps: high-level security policy design and low-level enforcement scheme design. A high-level security policy states an overall requirement for a sensitive task. One example of a high-level security policy is a separation of duty policy, which requires a task to be performed by a team of at least k users. Unlike low-level enforcement schemes such as security constraints in workflows, a separation of duty policy states a high-level requirement about the task without referring to individual steps in the task. While extremely important and widely used, separation of duty policies state only requirements on the number of users involved in the task and do not capture the requirements on these users' attributes. In this article, we introduce a novel algebra that enables the formal specification of high-level policies that combine requirements on users' attributes with requirements on the number of users motivated by separation of duty considerations. We give the syntax and semantics of the algebra and study algebraic properties of its operators. After that, we study potential mechanisms to enforce high-level policies specified in the algebra and a number of computational problems related to policy analysis and enforcement.

Globální bezpečnost a její vliv na koncipování bezpečnostní politiky

Global Security and Its Impact on the Design of Security Policies