Information Security Experts Research Articles

MULTI-LEVEL ARCHITECTURE OF KNOWLEDGE MANAGEMENT SYSTEM TO IMPROVE INFORMATION SECURITY LEVEL

Information security is a major concern because security risks can greatly affect the assets of an organization. To increase the level of information security, it is proposed to use a knowledge management system with a multi-level architecture in order to improve knowledge exchange and facilitate decision-making, as well as reduce dependence on individual information security experts.

XGBXSS: An Extreme Gradient Boosting Detection Framework for Cross-Site Scripting Attacks Based on Hybrid Feature Selection Approach and Parameters Optimization

With the widespread popularity of the Internet and the transformation of the world into a global village, Web applications have been drawn increased attention over the years by companies, organizations, and social media, making it a prime target for cyber-attacks. The cross-site scripting attack (XSS) is one of the most severe concerns, which has been highlighted in the forefront of information security experts' reports. In this study, we proposed XGBXSS, a novel web-based XSS attack detection framework based on an ensemble-learning technique using the Extreme Gradient Boosting algorithm (XGboost) with extreme parameters optimization approach. An enhanced feature extraction method is presented to extract the most useful features from the developed dataset. Furthermore, a novel hybrid approach for features selection is proposed, comprising information gain (IG) fusing with sequential backward selection (SBS) to select an optimal subset reducing the computational costs and maintaining the high-performance of detector' simultaneously. The proposed framework has successfully exceeded several tests on the holdout testing dataset and achieved avant-garde results with accuracy, precision, detection probabilities, F-score, false-positive rate, false-negative rate, and AUC-ROC scores of 99.59%, 99.53 %, 99.01%, 99.27%, 0.18%, 0.98%, and 99.41%, respectively. Moreover, it can bridge the existing research gap concerning previous detectors, with a higher detection rate and lesser computational complexity. It also has the potential to be deployed as a self-reliant system, which is efficient enough to defeat such attacks, including zero-day XSS-based attacks.

Delphi study of risk to individuals who disclose personal information online

A two-round Delphi study was conducted to explore priorities for addressing online risk to individuals. A corpus of literature was created based on 69 peer-reviewed articles about privacy risk and the privacy calculus published between 2014 and 2019. A cluster analysis of the resulting text-base using Pearson’s correlation coefficient resulted in seven broad topics. After two rounds of the Delphi survey with experts in information security and information literacy, the following topics were identified as priorities for further investigation: personalisation versus privacy, responsibility for privacy on social networks, measuring privacy risk, and perceptions of powerlessness and the resulting apathy. The Delphi approach provided clear conclusions about research topics and has potential as a tool for prioritising future research areas.

Основные положения парадигмы языка единого представления программного кода в интересах поиска в нем средне- и высокоуровневых уязвимостей

Purpose of the study: increasing the efficiency of an expert in searching for medium-level (in algorithms) and high-level (in architecture) vulnerabilities in the program code due to the innovative paradigm of the language for its presentation. Method: consists in the analysis of relevant works on the subject of approaches, methods and notations for representing algorithms and software architecture with highlighting the strengths and weaknesses of solutions, synthesizing the paradigm for the presentation of the program code and qualitatively assessing the effectiveness of each of the provisions of the paradigm (by contradiction method); efficiency is understood as a combination of its three indicators: the number of type I and II errors, the search time and the cognitive stress of the expert. The results obtained: description of the idea and 7 main provisions of the paradigm of the pseudocode language for a unified description of algorithms and architecture with the maximum necessary and minimum sufficient degree of formalization; the main practical significance of the representations of the program code obtained in this way is their intended use for analysis by an information security expert for the presence of medium and high-level vulnerabilities; also, for each position, their qualitative influence on the performance indicators of vulnerability search by an expert was established.

Data augmentation-based conditional Wasserstein generative adversarial network-gradient penalty for XSS attack detection system.

The rapid growth of the worldwide web and accompanied opportunities of web applications in various aspects of life have attracted the attention of organizations, governments, and individuals. Consequently, web applications have increasingly become the target of cyberattacks. Notably, cross-site scripting (XSS) attacks on web applications are increasing and have become the critical focus of information security experts’ reports. Machine learning (ML) technique has significantly advanced and shown impressive results in the area of cybersecurity. However, XSS training datasets are often limited and significantly unbalanced, which does not meet well-developed ML algorithms’ requirements and potentially limits the detection system efficiency. Furthermore, XSS attacks have multiple payload vectors that execute in different ways, resulting in many real threats passing through the detection system undetected. In this study, we propose a conditional Wasserstein generative adversarial network with a gradient penalty to enhance the XSS detection system in a low-resource data environment. The proposed method integrates a conditional generative adversarial network and Wasserstein generative adversarial network with a gradient penalty to obtain necessary data from directivity, which improves the strength of the security system over unbalance data. The proposed method generates synthetic samples of minority class that have identical distribution as real XSS attack scenarios. The augmented data were used to train a new boosting model and subsequently evaluated the model using a real test dataset. Experiments on two unbalanced XSS attack datasets demonstrate that the proposed model generates valid and reliable samples. Furthermore, the samples were indistinguishable from real XSS data and significantly enhanced the detection of XSS attacks compared with state-of-the-art methods.

MD-MinerP: Interaction Profiling Bipartite Graph Mining for Malware-Control Domain Detection

Despite the efforts of information security experts, cybercrimes are still emerging at an alarming rate. Among the tools used by cybercriminals, malicious domains are indispensable and harm from the Internet has become a global problem. Malicious domains play an important role from SPAM and Cross-Site Scripting (XSS) threats to Botnet and Advanced Persistent Threat (APT) attacks at large scales. To ensure there is not a single point of failure or to prevent their detection and blocking, malware authors have employed domain generation algorithms (DGAs) and domain-flux techniques to generate a large number of domain names for malicious servers. As a result, malicious servers are difficult to detect and remove. Furthermore, the clues of cybercrime are stored in network traffic logs, but analyzing long-term big network traffic data is a challenge. To adapt the technology of cybercrimes and automatically detect unknown malicious threats, we previously proposed a system called MD-Miner. To improve its efficiency and accuracy, we propose the MD-MinerP here, which generates more features with identification capabilities in the feature extraction stage. Moreover, MD-MinerP adapts interaction profiling bipartite graphs instead of annotated bipartite graphs. The experimental results show that MD-MinerP has better area under curve (AUC) results and found new malicious domains that could not be recognized by other threat intelligence systems. The MD-MinerP exhibits both scalability and applicability, which has been experimentally validated on actual enterprise network traffic.

Security Value Issues on eHealth Implementation in Indonesia

eHealth is an information technology solution for improving healthcare to be more effective and efficient. eHealth innovations not only give expected benefits but also new problems, one of them is security value issues. This inquiry has purpose to identify problems of security-related value in eHealth implementation in Indonesia involving its stakeholders. We use constructivism as research paradigm with qualitative method. Data was collected through focus group discussion with five information security experts from State Cyber and Code Agency that work on security controls in healthcare sector. Data analysis using thematic coding with Atlas.ti as tool. This research explored some security value issues on eHealth implementation in Indonesia, including regulator value conflict, data integrity and reliability, and data privacy and confidentiality. Some of those problems are caused by specific regulation about information security for healthcare in Indonesia is not available yet that makes some value conflict among stakeholders involved in this sector. Some implications are also proposed, both practically and theoretically.

Adopting Organizational Cultural Changes Concerning Whistle-Blowing in Healthcare Around Information Security in the “Internet of Things” World

Medical labs, hospitals, doctor's offices, and medical devices face significant cyber risks. The insecurity of medical devices, including imaging hardware, threatens patient safety. Health organizations are rich with valuable data as well as weak with information security expertise, protocols, and infrastructure. It is critical for more health organizations to focus creating organizational cultures with processes that offer all employees to fully understand the nature of information security risks and have the ability to be active participants in the minimization and reporting of observable risks. This article will lay a foundation to establish techniques and practices for open door policies.

Key Problems of the Critical Information Infrastructure through Scada Systems Research

In the current age, cyber security is an essential element of any information system. A key aspect is in the critical information infrastructure, where information security has become a top priority for information and network security experts. The interoperability of an ICT infrastructure with other components of it is an important aspect of its life cycle. Because Supervisory Control and Data Acquisition (SCADA) systems form part of the critical infrastructure, their cyber protection is particularly important in strategically important industrial and infrastructure sites — power plants, refineries, oil pipelines, treatment plants, manufacturing facilities, communications and transportation infrastructures. Along with the advancement of technology, the increasing number of Scada devices available online, the vulnerability of the sectors controlled by them has also increased. In the world of Internet of things (everything), the end devices cause a new wave of possible vulnerabilities in SCADA. They become the new places for attacks and breaches trough wich the system may be accessed or even compromised. There are a number of critical infrastructures in the Community whose disruption or destruction would have significant cross-border implications for more than one sector as a result of the interdependence of interconnected infrastructures. Such European critical infrastructures have been established and launched under a common procedure developed by the European Commission, with security requirements assessed according to a common minimum approach.
 The present article exposes and examines the critical infrastructures of the European Union and Bulgaria. Trough presenting the structure of a Scada system the vulnerabilities and the various possibilities of attacking it were analised. As an example, a specific case based on trees has been considered, and the obtained results were summarized and visualized. The consequences were analized and respecctive conclusion was done.

INFORMATION SECURITY MANAGEMENT FRAMEWORK SUITABILITY ESTIMATION FOR SMALL AND MEDIUM ENTERPRISE

Information security is one of the key concerns of an enterprise or organization. To assure suitable management of information security a list of information security management frameworks has been developed by a number of institutions and authors. A condensed information in information security management framework is very important to a small and medium enterprise as this type of enterprise usually lacks resources for information security expertise and deep analysis. Despite the fact, the information security management process and its frameworks, on the other hand, are very complex and require a big number of different elements. At the moment the comparison it is very shallow, as all properties of the comparison are treated equally important. In real life, the importance of different criteria of information security management framework and their suitability for small and medium enterprise vary. Therefore we use the Analytic Hierarchy Process to construct a hierarchy of information security management frameworks quality and applicability in small and medium enterprise and define the weights for each of the criteria. Weighted criteria express the importance of the criteria and executed the final comparison of alternatives (five information security management frameworks) is more realistic (similar to experts opinion) comparing to existing comparisons.

Five ICS cybersecurity myths based on Kaspersky Lab ICS CERT experience

Abstract Today, industrial cybersecurity is in the early stages of its development, gradually evolving into a science and technology discipline that will become the cornerstone of industrial manufacturing and construction technologies, the infrastructure of modern cities, transportation, healthcare, etc. The community of researchers and engineers is constantly looking for solutions to protect both existing systems and future technologies. As we depart from the starting point, we must build our assumptions on an objective assessment of the current situation, because, at this stage, even seemingly insignificant misconceptions can cause major fluctuations that prevent us from choosing the right strategy. In this article, we will discuss typical misconceptions and common errors in assessing the security of industrial control systems that Kaspersky Lab ICS CERT experts encounter in their day-to-day communication with people from different industrial sectors and the community of information security experts. We will support our conclusions with the results of the past several years’ research into the various cyberthreats affecting industrial enterprises.

One of the main functions of an information security system is the identification of any access subject to be able to investigate information security incidents. During executing procedures of scanning and vulnerability exploitation, qualified adversaries

One of the main functions of an information security system is the identification of any access subject to be able to investigate information security incidents. During executing procedures of scanning and vulnerability exploitation, qualified adversaries regularly change identifying features. Such operations can not only obfuscate logging the data in subsystems, thus, complicating the restoring of events chronology for an information security expert but also call into question the irrefutability of the evidence of participation of particular adversary to particular illegal operations. 
 In the paper analyses of application of modern approaches of adversary identification in web resources, which does not require authentification of main part of users, is given (fingerprinting, analysis of behavioral features). 
 Along with widely used in web analytics “thermal maps”, user adapted profile and computer model of dynamics of “user-mouse” system, authors offer to identify the subjects of information security incident in readily available informational resources of the Internet. The main idea of the prospective approach consists of the following: when a thermal map is built, not only the density of data layout should be considered but also statistical parameters should be defined by an expert (the distance of intensity gradient, distance overlap, etc.). The authors also offer to consider the dynamics of user operations (e.g. calculation of the average duration of data entry into interactive elements). A description of each step of an appropriate technique and also information on its practical implementation are given. Robustness of the given approach is confirmed by a practical experiment. The offered technique is not a universal instrument of adversary identification . Only manual targeted attacks are considered, the cURL tools etc. used by adversaries are not taken into account. Therefore, it is recommended to use this technique exclusively in addition to working protective systems (WAF, IPS, IDS).

LARGen: Automatic Signature Generation for Malwares Using Latent Dirichlet Allocation

As the quantity and complexity of network threats grow, Intrusion Detection Systems (IDSs) have become critical for securing networks. Achieving computer network intrusion detection with these IDSs requires high-level information technology and security expertise because malicious traffic has to be rigorously analyzed and the appropriate IDS rules written to effectively detect vulnerabilities that may potentially be exploited. However, incorrect IDS rules may produce numerous false positives, thereby degrading the performance of the IDS, and even worse, paralyzing the network. In this paper, we present a novel approach that exploits the Latent Dirichle Allocation (LDA) algorithm to generate IDS rules. Our proposed method, called L DA-based A utomatic R ule Gen eration ( LARGen ), automatically performs an analysis of the malicious traffic and extracts the appropriate attack signatures that will be used for IDS rules. LARGen first extracts multiple signature strings embedded in network flows. Then, the flows are classified based on the extracted signature strings, and key content strings for malicious traffic are identified through the LDA inferential topic model. Those key content strings are the core of an IDS rule that can detect malicious traffic. We study the effectiveness of LDA in the context of network attack signature generation via extensive experiments with real network trace data, consisting of both benign and malicious traffic. Experimental results confirm that threat rules generated from LARGen accurately detect every cyber attack with high accuracy.

АНАЛИЗ СОСТОЯНИЯ СИСТЕМЫ ПОДГОТОВКИ СПЕЦИАЛИСТОВ В ОБЛАСТИ ИФОРМАЦИОННОЙ БЕЗОПАСНОСТИ

The analysis of the training system for specialists working in the field of information security plays an important role to improve staffing in the field of information security in the Russian Federation in the context of new challenges and threats in the information sphere. The article presents the results of analysis and summarizes the data on state of the system of training, retraining and advanced training provided for information security experts. The presented analytical materials are taking into account the results of the data analysis about the security specialists working in Federal Executive authorities (Federal authorities), regional executive authorities, local governmental bodies and their subordinate organizations, corporations, and organizations of licensees of the FSTEC of Russia. The presented analytical materials can be used for development of proposals in order to improve the national system of training, professional retraining and advanced training of information security specialists, as well as for development of control indicators for the admission of persons to the training in the field of information security at the expense of the Federal budget allocations.

On inter-Rater reliability of information security experts

The Confidentiality-Availability-Integrity (CIA) triad is a time-honored warhorse of security analysis. Qualitative assessment of security requirements based on the CIA triad is an important step in many standard procedures for selecting and deploying security controls. However, little attention has been devoted to monitoring how the CIA triad is used in practice, and how reliable are experts’ assessment that make use of it. In this paper, a panel of 20 security experts was asked to use the CIA triad in 45 practical security scenarios involving UAV-to-ground transmission of control and information data. The experts’ responses were analyzed using Fleiss’ kappa, a specific statistics test for inter-rater reliability. Results show agreement to be low (from 13.8% to 20.1% depending on the scenario), but higher on scenarios where the experts’ majority estimates tight security to be needed. Low number of polled experts is found to affect inter-rater reliability negatively, however, increasing this number beyond ten does not provide additional reliability. A bias to give a specific rate could be identified with 14 out of the 20 experts. The six unbiased experts showed a higher inter-rater agreement. These findings suggest that (i) there is no guaranteed “safety in numbers” for recruiting security expert panels and (ii) expert selection for security rating processes should include verification of agreement level on toy problems for all subsets of the panel to highlight subsets showing high inter-rater agreement.

Policies, Regulations and Procedures and their Effects on Mobile Money Systems in Uganda

AbstractThe introduction of mobile money systems in emerging economies has enabled the would‐be unbanked population to gain access to financial services. The number of mobile money users and value of transactions is on the increase. This rapid growth of mobile money services and value transactions in emerging economies is attributed to the light‐touch regulatory framework which allows minimal limitations on who should operate mobile money system and few restrictions on who can function as an agent. These increases both in services and transactions indicate that mobile money systems hold a lot of valuable customer financial information that needs to be jealously protected against information breaches and abuse by the various stakeholders in the mobile money ecosystem.Taking an interpretive qualitative approach, Activity Theory (AT) has been used to analyse the mobile money management activities focusing on information security policies, regulations and procedures. In order to comprehend the aspects revealed by the Activity Theory analysis that raise information security management concerns in mobile money operations, Mobile Network Operator (MNO) management issues, in terms of the security of mobile money operations, are detailed.Our findings look at the reasons given by various stakeholders for information security management gaps in mobile money operations in emerging economies. Our findings disclose the roles of MNO staff, who are not information security experts, in the development and compliance monitoring of policies, regulations and procedures related to the safety of financial information in mobile money systems.

An empirical test of the perceived relationship between risk and the constituents severity and probability

Purpose In methods and manuals, the product of an information security incident’s probability and severity is seen as a risk to manage. The purpose of the test described in this paper is to investigate if information security risk is perceived in this way, if decision-making style influences the perceived relationship between the three variables and if the level of information security expertise influences the relationship between the three variables. Design/methodology/approach Ten respondents assessed 105 potential information security incidents. Ratings of the associated risks were obtained independently from ratings of the probability and severity of the incidents. Decision-making style was measured using a scale inspired from the Cognitive Style Index; information security expertise was self-reported. Regression analysis was used to test the relationship between variables. Findings The ten respondents did not assess risk as the product of probability and severity, regardless of experience, expertise and decision-making style. The mean variance explained in risk ratings using an additive term is 54.0 or 38.4 per cent, depending on how risk is measured. When a multiplicative term was added, the mean variance only increased by 1.5 or 2.4 per cent. For most of the respondents, the contribution of the multiplicative term is statistically insignificant. Practical Implications The inability or unwillingness to see risk as a product of probability and severity suggests that procedural support (e.g. risk matrices) has a role to play in the risk assessment processes. Originality/value This study is the first to test if information security risk is assessed as an interaction between probability and severity using suitable scales and a within-subject design.

An empirical study on security expert ecosystem in the future IoT service environment

As society become increasingly information-oriented, the use of cyberspace is also expanding, and people are exposed to various cyber-terror threats and security incidents. Additionally, according to the development of convergence security that extends from information security to all industrial sectors, the demand for an information security workforce has increased along with the development of the information security industry. Despite the expectation of a shortage of information security workforce due to the great demand surpassing the supply of available workers, the turnover among existing information security experts is very serious. The reasons why this turnover is such problem are as follows. First, the expert training system for the information security workforce is incomplete. Second, these experts do not receive an appropriate education for turnover in information security area or information as an insufficient data against the distribution or job mobility of the information security area though there are various occupations in information security area. Therefore, this paper will conduct research on the distribution of information security roles and the frequency of such job mobility in order to resolve these problems.

Information Security and Expert's Knowledge Autoformalization

To implement the proposed Information Security (IS) Maintenance Concept, the IS experts’ knowledge autoformalization algorithm was created as the problems of IS assessment and protection level prediction are based mainly on the experts’ informal professional knowledge.

SecureUse: Balancing Security and Usability within System Design

The interdependency of information security and usability has been evident for several years, yet this area is largely under-represented within the Literature. Consequently, no standards yet exist that address the balance between security and usability within system design. To address this gap in knowledge, the authors propose a method that can be used by experts in information security, experts in usability, and by representative users to quickly assess the security and usability of a system. From this assessment, a single metric, known as a SecureUse score, would be derived, which will help to ensure that future systems are both secure and usable.