Effectiveness Of Security Controls Research Articles

Towards definitive categories for online video game money laundering

Purpose This paper aims to investigate how best to classify money laundering through online video games (i.e. virtual laundering). Currently, there is no taxonomy available for scholars and practitioners to refer to when discussing money laundering through online video games. Without a well-defined taxonomy it becomes difficult to reason through, formulate and implement effective regulatory measures, policies and security controls. As such, efforts to prevent and reduce virtual laundering incidence rates are hampered. Design/methodology/approach This paper proposes three mutually exclusive virtual laundering categorizations. However, instead of fixating on the processes undergirding individual instances of virtual laundering, it is argued that focusing on the initial locale of the illicit proceeds provides the appropriate framing within which to classify instances of virtual laundering. Thus, the act of classification becomes an ontological endeavour, rather than an attempt at elucidating an inherently varied process (as is common of the placement, layering and integration model). Findings A taxonomy is proposed that details three core virtual laundering processes. It is demonstrated how different virtual laundering categories have varied levels of associated risk, and thus, demand unique interventions. Originality/value To the best of the authors’ knowledge, this is the first taxonomy available in the knowledge base that systematically classifies instances of virtual laundering. The taxonomy is available for scholars and practitioners to use and apply when discussing how to regulate and formulate legislation, policies and appropriate security controls.

Effects of Continuous Security Monitoring on Security Controls of Electronic Health Records in Public Hospitals, Tanzania

This paper examines the effects of continuous security monitoring on the security of electronic health records in Tanzanian public hospitals. The study adopted a cross-sectional research design and quantitative research approach using a sample of 300 respondents from the six public hospitals in Tanzania. A questionnaire was used to collect data from the main users of EHRs such as medical doctors, IT officers, nurses, pharmacists, laboratory technologists, record officers and administrative officers. A multiple linear regression model was used to evaluate the effects of continuous security monitoring on the security of electronic health records in Tanzanian public hospitals. The findings revealed that continuous security monitoring is a significant predictor of the security of electronic health records in Tanzanian public hospitals, (B= .509, p< 0.001). This implies that, continuous security monitoring explains 50.9% of the variance in security of electronic health records in Tanzanian public hospitals. Based on this finding, is recommended that, to enhance effective security controls in electronic health records, public hospitals in Tanzanian should consider the adoption of continuous security monitoring by making security controls more automated

Evidence-based cybersecurity policy? A meta-review of security control effectiveness

ABSTRACT Cybersecurity policy should guide firms towards implementing the most effective security controls and procedures. However, there is no authority that collects evidence and ranks cybersecurity controls by efficacy. The evidence needed by policymakers is distributed across academic studies and industry white papers. To address this gap, we conduct a meta-review of studies that empirically evaluate the efficacy of cybersecurity interventions. Attack surface management and patch cadence were consistently the first and second most effective interventions. Reduced cyber insurance claims frequency was associated with migrating to cloud email and avoiding specific VPN providers. Multi-factor authentication was effective in protecting individual accounts, although inconsistent MFA-implementation undermines efficacy when rolled out across an organisation. The evidence suggests effectiveness is driven by how a control is implemented more than by a binary yes-no regarding whether it is implemented. Thus, policy measures that mandate specific controls are unlikely to result in risk reduction. Instead, policymakers should aim to support organisations in administering security controls and making risk-based decisions. Successful examples can be seen in policy measures that improve the efficiency of patch management, such as funding for the US National Vulnerability Database, CERT/CC, and the Known Exploited Vulnerabilities catalog.

Assessing Information Security Risks in Clinical Laboratory in Accordance With ISO/IEC 27001 Standard

Purpose This study aims to assess the information security risks that still arise in a clinical laboratory accredited to ISO 15189 and certified to ISO 9001, as a preparation for digital-based services. Design/methodology/approach Using the ISO/IEC 27001 approach which is embedded in the qualitative method in this study, risk assessment is carried out by identification, analysis and evaluation through interviews with process owners at clinical laboratories in Jakarta. Findings As a result, it was found that the Busdev&IT Department had the most information security risks (35 risks out of 384 total risks), which required further treatment based on the established risk appetite. Therefore, vigilance on the use of information systems in the laboratory needs to be increased in terms of information security. Research limitations/implications The research object was in the preparation stage for ISO 27001 certification, but the risk assessment is not only to comply with requirements, that also to have effective information security control among their process to ensure the sensitive information is secured. Originality/value This study answers the need for establishment of information security risk control in clinical laboratory.

Role of Attention and Design Cues for Influencing Cyber-Sextortion Using Social Engineering and Phishing Attacks

Cyber sextortion attacks are security and privacy threats delivered to victims online, to distribute sexual material in order to force the victim to act against their will. This continues to be an under-addressed concern in society. This study investigated social engineering and phishing email design and influence techniques in susceptibility to cyber sextortion attacks. Using a quantitative methodology, a survey measured susceptibility to cyber sextortion with a focus on four different email design cues. One-way repeated measures ANOVA, post hoc comparison tests, Friedman nonparametric test, and Spearman correlation tests were conducted with results indicating that attention to email source and title/subject line significantly increased individuals’ susceptibility, while attention to grammar and spelling, and urgency cues, had lesser influence. As such, the influence of these message-related factors should be considered when implementing effective security controls to mitigate the risks and vulnerabilities to cyber sextortion attacks.

Deployment of Honeypot and SIEM Tools for Cyber Security Education Model In UITM

Nowadays the threat of cyber-attacks is increasing as more organizations undergo digital transformation. Therefore, organizations need to take proactive measures to mitigate the cyber threat to avoid further loss to their business. To mitigate cyber risk effectively, organizations need to employ competent people in the IT security team to implement effective security controls. But there is a shortage of cyber security talent or professionals in the job market and to produce talents in the cyber security field requires extensive effort in education and training. A good cyber security education program should have to date curriculum and provide practical experience. To achieve this, the program must be supported by a cyber security lab equipped with various software, equipment, and tools used by a real professional in the industry. Therefore, this paper proposed a model of a cyber security lab equipped with honeypot and SIEM systems to enhance the quality of cyber security education. The cyber security lab based on the model was deployed at Universiti Teknologi MARA (UiTM) and used for teaching and learning activities. The honeypot will provide student experience analyzing the behaviour of hackers while the SIEM system will aggregate the logs data of the Campus Network Firewall in real-time. To evaluate the effectiveness of the proposed lab model, a functional test and a survey was conducted. The survey result shows that majority of the respondent agreed that the cyber security lab improve their teaching and learning experience while taking the cyber security subject.

Modeling Threats to AI-ML Systems Using STRIDE.

The application of emerging technologies, such as Artificial Intelligence (AI), entails risks that need to be addressed to ensure secure and trustworthy socio-technical infrastructures. Machine Learning (ML), the most developed subfield of AI, allows for improved decision-making processes. However, ML models exhibit specific vulnerabilities that conventional IT systems are not subject to. As systems incorporating ML components become increasingly pervasive, the need to provide security practitioners with threat modeling tailored to the specific AI-ML pipeline is of paramount importance. Currently, there exist no well-established approach accounting for the entire ML life-cycle in the identification and analysis of threats targeting ML techniques. In this paper, we propose an asset-centered methodology—STRIDE-AI—for assessing the security of AI-ML-based systems. We discuss how to apply the FMEA process to identify how assets generated and used at different stages of the ML life-cycle may fail. By adapting Microsoft’s STRIDE approach to the AI-ML domain, we map potential ML failure modes to threats and security properties these threats may endanger. The proposed methodology can assist ML practitioners in choosing the most effective security controls to protect ML assets. We illustrate STRIDE-AI with the help of a real-world use case selected from the TOREADOR H2020 project.

Database security framework design using tokenization

One of the challenging tasks in database management system today is protecting sensitive data that are complex in the database system. Most organization opt for implementation of data encryption which is one of the most effective security control mechanism, but data encryption only render information unreadable to those that do not have the secret decryption key. The core issue with data encryption techniques is that, it is reversibly. In these regards, sensitive data need to be tokenized first before encrypting for better security. Therefore, this work is introducing tokenization technique. Tokenization means replacement or substitution of sensitive data with a token, as an additional technique on database system for protecting sensitive data in all higher institutions and other firms that deal with sensitive data. A database security framework using tokenization was design, implemented using NetBeans 8.1 IDE, Java Platform SE binary (jdk-8u91-windows-x64) and xampp-windows-x64-7.3.7-0-VC15 (Apache and MySQL), an official IDE for Java 8 and then encrypt the tokenized data using AES before storing it in server 127.0.0.1 a localhost phpMyAdmin Database tools and evaluated with other security systems (encoding, hashing and encryption) on student database. Results shows that tokenization technique has 95% capacity to protect sensitive data compare to other security systems.

The Emerging Trends and Patterns of Non-State Actors Involvement in Crime Prevention and Control in South-West Nigeria: Old Wine in New Bottle

Globally, the use of formal security apparatus is approved standard of ensuring safety of lives and property in any sane society. The most developed countries of the world has fashioned out effective security control model to guarantee safety of lives and protection of citizens properties. This security measure is one of the many challenges confronting most developing nations including Nigeria.. It is a very serious problem when a country cannot protect the lives and properties of its citizens. It is even a bigger problem when the lives of its citizens mean nothing to the government of the day. The continuous incidence of boko-Haram and herdsmen attack, kidnapping, suicide bombing, violence and abduction is a clear indication that present government have failed its citizen in securing them and their valuable. This study examined the emerging trends and patterns on non state actor involvement in crime prevention and control in South-West Nigeria: An old wine in new bottle. The paper adopted the Karl Mark (1874) theory of exploitation as its theoretical current. The study made used of the survey research design. Sample size of 200 was determined using Yamane sample size technique. The cluster, simple random and purposive sampling techniques were used to select respondents for the study. The study made use of questionnaire and key informant interviews as instruments for data collection. Simple percentage tables and frequency were employed to present quantitative data. Qualitative data was analyzed using content analysis technique and ethnographic summaries. The results revealed that the Non state actors involvement in security via Amotekun has drastically reduced crime rate, safeguard lives and property, promote socio-economic development, exposes criminals, promote peace and unity amongst others. The paper recommended that the government must make security a top priority by providing all that is required to guarantee safety of lives and properties of its citizens’. The citizens must support the government and its agencies in all means possible to reduce crime rate in the area. Effective legislation, enforcement and adequate sanction should be advocated for those caught to be perpetrating crime or sabotaging crime prevention and control efforts of the government.

Predicting Cyber-Attack using Cyber Situational Awareness: The Case of Independent Power Producers (IPPs)

The increasing critical dependencies on Internet-of-Things (IoT) have raised security concerns; its application on the critical infrastructures (CIs) for power generation has come under massive cyber-attack over the years. Prior research efforts to understand cybersecurity from Cyber Situational Awareness (CSA) perspective fail to critically consider the various Cyber Situational Awareness (CSA) security vulnerabilities from a human behavioural perspective in line with the CI. This study evaluates CSA elements to predict cyber-attacks in the power generation sector. Data for this research article was collected from IPPs using the survey method. The analysis method was employed through Partial Least Squares Structural Equation Modeling (PLS-SEM) to assess the proposed model. The results revealed negative effects on people and cyber-attack, but significant in predicting cyber-attacks. The study also indicated that information handling is significant and positively influences cyber-attack. The study also reveals no mediation effect between the association of People and Attack and Information and Attack. It could result from an effective cyber security control implemented by the IPPs. Finally, the study also shows no sign of network infrastructure cyber-attack predictions. The reasons could be because managers of IPPs had adequate access policies and security measures in place.

О МОДЕЛЯХ И МЕТОДАХ ВЕРОЯТНОСТНОГО АНАЛИЗА ЗАЩИТЫ ИНФОРМАЦИИ В СТАНДАРТИЗОВАННЫХ ПРОЦЕССАХ СИСТЕМНОЙ ИНЖЕНЕРИИ

Purpose: rational and description of the methodological apparatus of system engineering in terms of risk prediction, taking into account the requirements for information protection. Research methods include: methods of probability theory, risk-oriented models for predictive analysis of standardized processes of system engineering. Result: interrelated models and methods systematized for use in the planning and implementation of standardized processes of system engineering are described. Their use makes it possible to analyze the impact of information security in terms of predicted risks. Methods and models are implemented in a set of system engineering standards and analytically support the effective implementation of agreement, organizational project- enabling, technical management and technical processes according to GOST R 57193 (ISO/IEC/IEEE 15288) in relation to systems for various purposes (a total of 30 processes). The proposed models and methods of system analysis of information security in standardized processes of system engineering develop established approaches to risk prediction, ensuring and improving system security. The use of the proposed models and methods in the life cycle of systems helps to identify «bottlenecks», rational ways to reduce risks in the implemented standardized processes, taking into account the requirements for information protection, supports the making decisions in analytical problems of system engineering. Scientific novelty: the proposed methodological apparatus develops the existing approaches to risk prediction, ensuring and improving systems security. The ideas are implemented in the national standards GOST R 59329 – GOST R 59357. They allow enterprises to move to the pragmatic implementation of a risk-based approach using the analytical capabilities of solving inverse problems of effective security control, based on the specified level of acceptable risk.

The Development of a Security Evaluation Model Focused on Information Leakage Protection for Sustainable Growth

This research establishes a security evaluation model from the insider leakage perspective and suggests an objective evaluation measurement. Organizational security risks are fused and compounded both inside and outside the organization. Although multiple security controls are implemented to minimize an organization’s security risk, effective security control requires management to preemptively check the organization’s security level. Existing criteria for evaluating security level are limited to external security risks and have improper limit points for dealing with security risks that are fused and compounded within an organization. The focus of this study is the prevention of technical information leakage. Furthermore, we propose a method for measuring the level at which the objectivity of certain items is secured. We compiled 26 detailed evaluation items, considering the security requirements to prevent technical information leakage. We not only performed suitability, reliability, and factor analyses and statistical validation, but also established a method to measure the security level. This measurement method ensures the effectiveness and objectivity of the evaluation of security level, mitigating the risks of security incidents caused by insiders. The results serve as a reference for organizations when designing security evaluation criteria and automated tools based on our evaluation model for future research.

Optimisation of cyber insurance coverage with selection of cost effective security controls.

Nowadays, cyber threats are considered among the most dangerous risks by top management of enterprises. One way to deal with these risks is to insure them, but cyber insurance is still quite expensive. The insurance fee can be reduced if organisations improve their cyber security protection, i.e., reducing the insured risk. In other words, organisations need an investment strategy to decide the optimal amount of investments into cyber insurance and self-protection.In this work, we propose an approach to help a risk-averse organisation to distribute its cyber security investments in a cost-efficient way. What makes our approach unique is that next to defining the amount of investments in cyber insurance and self-protection, our proposal also explicitly defines how these investments should be spent by selecting the most cost-efficient security controls. Moreover, we provide an exact algorithm for the control selection problem considering several threats at the same time and compare this algorithm with other approximate algorithmic solutions.

A robust cyberattack detection approach using optimal features of SCADA power systems in smart grids

Smart grids are a type of complex cyber–physical system (CPS) that integrates the communication capabilities of smart devices into the grid to facilitate remote operation and control of power systems. However, this integration exposes many existing vulnerabilities of conventional supervisory control and data acquisition (SCADA) systems, resulting in severe cyber threats to the smart grid and potential violation of security objectives. Stealing sensitive information, modifying firmware, or injecting function codes through compromised devices are examples of possible attacks on the smart grid. Therefore, early detection of cyberattacks on the grid is crucial to protect it from sabotage. Machine learning (ML) methods are conventional approaches for detecting cyberattacks that use features of smart grid networks. However, developing an effective, highly accurate detection method with reduced computational overload, is still a challenging research problem. In this work, an efficient and effective security control approach is proposed to detect cyberattacks on the smart grid. The proposed approach combines both feature reduction and detection techniques to reduce the extremely large number of features and achieve an improved detection rate. A correlation-based feature selection (CFS) method is used to remove irrelevant features, improving detection efficiency. An instance-based learning (IBL) algorithm classifies normal and cyberattack events using the selected optimal features. This study describes a set of experiments conducted on public datasets from a SCADA power system based on a 10-fold cross-validation technique. Experimental results show that the proposed approach achieves a high detection rate based on a small number of features drawn from SCADA power system measurements.

Security Control Assessment of Supervisory Control and Data Acquisition for Power Utilities in Tanzania

The primary purpose of this research was to assess the adequacy and effectiveness of security control of the Supervisory Control and Data Acquisition (SCADA) communication network used by infrastructure companies. Initially, the SCADA networks were physically separated from other networks connected to the internet and hence assumed secure. However, the modern SCADA are now integrated with other network resulting in new security vulnerabilities and attacks similar to those found in traditional IT. Thus, it is important to reassess the security controls of the SCADA because it is operated in an open network environment. In this research, a case of the SCADA security controls in the power sector in Tanzania was assessed, whereby a specific SCADA implementation was studied. The data were gathered using observation, testing, interviews, questionnaire and documentation reviews. The results were analyzed using the Cyber Security Evaluation Tool (CSET) and checked for compliance based on the National Institute of Standards and Technology (NIST) and North America Electric Reliability Corporation (NERC) standards. The findings have shown that there exist security vulnerabilities both in security compliance of the standard and component-based vulnerabilities. Additionally, there is inadequate of audit and accountability, personnel security and system and information integrity. Also, for the component-based security compliance, the finding shows that identification and authentication, security management and audit and accountability. On the basis of the results, the research has indicated the areas that require immediate action in order to protect the critical infrastructure.

Towards Security Effectiveness Evaluation for Cloud Services Selection following a Risk-Driven Approach

Cloud computing is gaining a lot of popularity with an increasing number of services available in the market. This has rendered services selection and evaluation a difficult and challenging task, particularly for security-based evaluation. A key problem with much of the literature on cloud services security evaluation is that it fails to consider the overall evaluation context given the cloud characteristics and the underlying influence factors including threats, vulnerabilities, and security controls. In this paper, we propose a holistic risk-driven security evaluation approach for cloud services selection. We first use fuzzy DEMATEL method to jointly assess the likelihood and impact of threats with respect to the cloud service types, the exploitability of vulnerabilities to the identified threats, and the effectiveness of security controls in mitigating those vulnerabilities. Consequently, the overall diffusion of risk is captured via the relations across these concepts, which is leveraged to filter and prioritize the most critical security controls. The selected controls were then weighted using a combination of fuzzy DEMATEL and fuzzy ANP methods based on several factors, including their effectiveness in preventing the identified risks, user’s preferences and level of control (i.e., responsibilities). The latter denotes how much control a cloud user is transferring to the cloud provider. To enhance the reliability of the results, the subjective weights were integrated with objective weights using the Entropy method. Finally, the TOPSIS method was employed for services ranking and the Improvement Gap Analysis (IGA) method was leveraged to provide more insights on the strength and weaknesses of the selected services. An illustrative example is given to demonstrate the application of the proposed framework.

Strategic value alignment for information security management: a critical success factor analysis

PurposeEffective information security management is a strategic issue for organizations to safeguard their information resources. Strategic value alignment is a proactive approach to manage value conflict in information security management. Applying a critical success factor (CSF) analysis approach, this paper aims to propose a CSF model based on a strategic alignment approach and test a model of the main factors that contributes to the success of information security management.Design/methodology/approachA theoretical model was proposed and empirically tested with data collected from a survey of managers who were involved in decision-making regarding their companies’ information security (N = 219). The research model was validated using partial least squares structural equation modeling approach.FindingsOverall, the model was successful in capturing the main antecedents of information security management performance. The results suggest that with business alignment, top management support and organizational awareness of security risks and controls, effective information security controls can be developed, resulting in successful information security management.Originality/valueFindings from this study provide several important contributions to both theory and practice. The theoretical model identifies and verifies key factors that impact the success of information security management at the organizational level from a strategic management perspective. It provides practical guidelines for organizations to make more effective information security management.

Security policy rules and required procedures for two crucial cloud computing threats

Cloud computing is the most accurate paradigm of next generation internet-based distributed computing systems providing an innovative business model for organisations. It offers potential benefits including cost savings, flexibility and improved business outcomes for organisations. Despite the potential advantages of cloud computing, security is one of the major issues remaining questionable. In this paper, two crucial security threats of cloud computing systems are presented and are assigned to one of four categories of our security policy. We facilitate both users and providers to know about these security threats and we propose security metrics that providers could use to evaluate the security of their services. Finally, the necessary policy rules and required procedures are described. Our approach tackles the cloud security issues providing guidance in the form of a set of rules which can be utilised for monitoring the implementation and effectiveness of security controls in cloud environments.

Security Policy Rules and Required Procedures for two Crucial Cloud Computing Threats

Cloud computing is the most accurate paradigm of next generation internet-based distributed computing systems providing an innovative business model for organisations. It offers potential benefits including cost savings, flexibility and improved business outcomes for organisations. Despite the potential advantages of cloud computing, security is one of the major issues remaining questionable. In this paper, two crucial security threats of cloud computing systems are presented and are assigned to one of four categories of our security policy. We facilitate both users and providers to know about these security threats and we propose security metrics that providers could use to evaluate the security of their services. Finally, the necessary policy rules and required procedures are described. Our approach tackles the cloud security issues providing guidance in the form of a set of rules which can be utilised for monitoring the implementation and effectiveness of security controls in cloud environments.

Ranking information security controls by using fuzzy analytic hierarchy process

Information security can be achieved by implementing a set of appropriate controls. However, identifying and selecting the most effective information security controls in organizations have been major challenges for years. Although many studies have been done to address these challenges, there is still lack of research to rank these controls. In this study, a fuzzy Analytic Hierarchy Process was used to prioritize and select effective managerial domains and control objectives in information security controls. In this research, the process of implementing ISO 27001 Information Security in National Iranian Oil Products Distribution Company was selected. According to results, the access control, information systems acquisition, development and maintenance have the highest priorities among the information security controls in managerial domains. On the other hand, the business continuity management and asset management have the lowest priorities among the studied information security controls. Furthermore, it was found that among 39 control objectives, the user access management and third party service delivery management have the highest and lowest priorities, respectively.