Security Assessment Framework Research Articles

An intuitive approach to cybersecurity risk assessment for non-governmental organizations

Purpose This study proposes a guided tool for cybersecurity risk assessment tailored for nongovernmental organizations (NGOs), enabling them to comply with cybersecurity policies despite limitations in security awareness, funding and expertise. Design/methodology/approach A digital transformation is indispensable for ensuring the sustainable operation of NGOs. Embracing a digital manifesto necessitates an awareness of cybersecurity risks, highlighting the critical need for a robust cybersecurity risk assessment methodology. Initial research phases revealed significant shortages in security awareness, funding and expertise. Consequently, this study introduces an intuitive approach tailored specifically for NGOs, supported by a customized tool designed to address their unique requirements. The NIST cybersecurity risk assessment framework and National Cyber-security Authority (NCA) were adopted to define the risk assessment approach. The efficacy of this approach is evaluated qualitatively through a case study involving three NGOs in Saudi Arabia, aimed at assessing their capability to utilize the tool effectively. Following the implementation, a Likert-scale survey gauged satisfaction among NGOs regarding the tool’s utility. Findings Results from the case study indicate high satisfaction, affirming its alignment with their operational needs and enhancement of compliance with NCA controls. Furthermore, the use of the tool enhances the awareness of NCA’s cybercity requirements and controls. Originality/value Based on theoretical and empirical grounds, this research proposes a novel design of security assessment framework tailored for NGO requirements and supported by initiative tool enabling complying with cybersecurity policies and enhances the awareness of cybersecurity controls.

Security Assessment Framework for DDOS Attack Detection via Deep Learning

Internet of Things (IoT) is a broad network of actual, physical objects that can exchange data and communicate with other devices and systems over the Internet. Due to the scalability of the internet, the number of IoT users is increasing, and therefore it is vital to ensure the security of user info. Attacks such as DDoS (Distributed Denial of Service) and MitM (Man-in-the-Middle) can seriously interrupt operations and threaten the confidentiality and integrity of sensitive data. In this paper, a novel Iot based Security Assessment for intrusion using Deep Learning (ISAI-DL) technique has been proposed to identify IoT device vulnerabilities such as DDoS and MitM attacks. Initially, the features are extracted from the API documents using Bag of Words (BoW) and Term Frequency-Inverse Document Frequency (TF-IDF) techniques. In proposed ISAI-DL technique, it triggers or activates the vulnerabilities deep within target devices by sending API documents. The vulnerability is detected via the GloVe-CNN-BiLSTM Model; if the attack occurs in an IoT device, the output is classified as either DDoS, MitM, or normal. Evaluation metrics such as accuracy, recall, precision, time efficiency, F1 score, false alarm rate, and detection rate have been used to measure how effective the proposed ISAI-DL technique is. Based on a comparative investigation, the detection rate of the proposed ISAI-DL technique is 17.23%, 18.53%, and 3.24% greater than that of the existing P2ADF, HDA-IDS, and BT-TPF techniques respectively.

A Security Assessment Framework Based on Cloud Technology: A Comprehensive Review

A Security Assessment Framework Based on Cloud Technology: A Comprehensive Review

Assessing soil capacity and condition for “habitat of biodiversity” in the Lower Namoi Valley

The Soil Security Assessment Framework (SSAF) has been proposed and developed as a concept to quantitatively ensure a sustainable future for soil, thereby supporting ecosystem sustainability. Evaluating the habitat of biodiversity quantitatively, particularly concerning bacterial communities, is crucial yet challenging, especially for the often-overlooked rare species. This study aims to utilise SSAF to assess the capacity and condition of soil function – the habitat of biodiversity, by examining bacterial communities to understand soil security within Lower Namoi Valley, NSW, Australia. We selected four indicators: relative abundance and alpha diversity of both soil abundant and rare bacterial communities, for capacity and condition, using the pedogenon concept. Our findings indicate significant variations in soil capacity and condition within the valley. Aggregating the indicators as utility scores revealed that the study area has a moderate capacity, with many regions in good condition relative to capacity, especially in less disturbed areas. Specifically, agricultural practices led to a significant increase in conditions for abundant bacterial communities but a decrease in rare bacterial communities. Less disturbed areas exhibited higher scores for rare sub-communities, suggesting better preservation of biodiversity. The study highlights the significant impact of human activities on soil habitat of biodiversity function in the Lower Namoi Valley. By integrating the analysis of abundant and rare microbial biodiversity into the soil security assessment framework, this study offers insights for soil management, advocating practices that support soil biodiversity to ensure long-term ecosystem sustainability.

Security Assessment Framework for IOT via Glove Optimized CNN-BiLSTM

Security Assessment Framework for IOT via Glove Optimized CNN-BiLSTM

Web Application Penetration Testing on Udayana University's OASE E-learning Platform Using Information System Security Assessment Framework (ISSAF) and Open Source Security Testing Methodology Manual (OSSTMM)

Education is a field that utilizes information technology to support academic and operational activities. One of the technologies widely used in the education sector is web-based applications. Web-based technologies are vulnerable to exploitation by attackers, which highlights the importance of ensuring strong security measures in web-based systems. As an educational organization, Udayana University utilizes a web-based application called OASE. OASE, being a web-based system, requires thorough security verification. Penetration testing is conducted to assess the security of OASE. This testing can be performed using the ISSAF and OSSTMM frameworks. The penetration testing based on the ISSAF framework consists of 9 steps, while the OSSTMM framework consists of 7 steps for assessment. The results of the OASE penetration testing revealed several system vulnerabilities. Throughout the ISSAF phases, only 4 vulnerabilities and 3 information-level vulnerabilities were identified in the final testing results of OASE. Recommendations for addressing these vulnerabilities are provided as follows. Implement a Web Application Firewall (WAF) to reduce the risk of common web attacks in the OASE web application. input and output validation to prevent the injection of malicious scripts addressing the stored XSS vulnerability. Update the server software regularly and directory permission checks to eliminate unnecessary information files and prevent unauthorized access. Configure a content security policy on the web server to ensure mitigation and prevent potential exploitation by attackers.

Evaluation of the Omni-Secure Firewall System in a Private Cloud Environment

This research explores the optimization of firewall systems within private cloud environments, specifically focusing on a 30-day evaluation of the Omni-Secure Firewall. Employing a multi-metric approach, the study introduces an innovative effectiveness metric (E) that amalgamates precision, recall, and redundancy considerations. The evaluation spans various machine learning models, including random forest, support vector machines, neural networks, k-nearest neighbors, decision tree, stochastic gradient descent, naive Bayes, logistic regression, gradient boosting, and AdaBoost. Benchmarking against service level agreement (SLA) metrics showcases the Omni-Secure Firewall’s commendable performance in meeting predefined targets. Noteworthy metrics include acceptable availability, target response time, efficient incident resolution, robust event detection, a low false-positive rate, and zero data-loss incidents, enhancing the system’s reliability and security, as well as user satisfaction. Performance metrics such as prediction latency, CPU usage, and memory consumption further highlight the system’s functionality, efficiency, and scalability within private cloud environments. The introduction of the effectiveness metric (E) provides a holistic assessment based on organizational priorities, considering precision, recall, F1 score, throughput, mitigation time, rule latency, and redundancy. Evaluation across machine learning models reveals variations, with random forest and support vector machines exhibiting notably high accuracy and balanced precision and recall. In conclusion, while the Omni-Secure Firewall System demonstrates potential, inconsistencies across machine learning models underscore the need for optimization. The dynamic nature of private cloud environments necessitates continuous monitoring and adjustment of security systems to fully realize benefits while safeguarding sensitive data and applications. The significance of this study lies in providing insights into optimizing firewall systems for private cloud environments, offering a framework for holistic security assessment and emphasizing the need for robust, reliable firewall systems in the dynamic landscape of private clouds. Study limitations, including the need for real-world validation and exploration of advanced machine learning models, set the stage for future research directions.

Kajian Keamanan Sistem Informasi Akademik Menggunakan Framework COBIT 5

This study examines the security of academic information systems using the COBIT 5 Framework. Key issues are uncertainty in protecting student and staff data, the potential for cyberattack vulnerabilities, and non-compliance with international security standards. The goal is to evaluate the security level of the system and suggest improvement recommendations according to COBIT 5 principles. Research methods include Renstar IT policy analysis, system audits, and interviews with IT personnel and related academic communities. Data is analyzed quantitatively to identify weaknesses and opportunities for improvement. The COBIT 5 framework is used as a security assessment framework. The results highlight the need for improvement, including access management, activity monitoring, and continuous improvement plans. Using COBIT 5, substantial measures such as strengthening access controls and developing disaster recovery plans can be identified. The research emphasizes the importance of a structured approach in improving the security of academic information systems, with COBIT 5 as a useful tool. With the right measures, system security can be enhanced to protect the integrity, confidentiality, and availability of critical data for educational institutions. In conclusion, these measures demonstrate how important COBIT 5 implementation is in addressing information security challenges in academic environments.

A Framework for Security Assessment of Android Mobile Banking Applications

Mobile banking applications make users' daily lives easier by allowing them to access banking services, such as balance inquiries and bill payments, anytime and anywhere. Since these applications manage very sensitive financial data, special attention must be paid to data security. Several works in the literature assess the security of mobile banking applications. However, we observe the lack of a widely adopted framework among researchers for assessing the security of mobile banking applications. In this paper, we propose a framework consisting of twenty-six criteria for assessing the security of Android mobile banking applications. These criteria are divided into five categories: mobile device security, data in transit, data storage, cryptographic misuse, and others. Subsequently, we evaluate the proposed framework based on predefined requirements. These requirements are no redundancy, no ambiguity, and comprehensiveness. As a case study, we assess the security of the Android mobile banking applications of seven major Canadian banks. The results show that data in transit is adequately protected by these applications.

Integrated assessment and prediction of ecological security in typical ecologically fragile areas.

In order to safeguard and restore ecological security in ecologically fragile regions, a regionally appropriate land use structure and ecological security pattern should be constructed. Previous ecological security research models for ecologically fragile areas are relatively homogenous, and it is necessary to establish a multi-modeling framework to consider integrated ecological issues. This study proposes a coupled "PLUS-ESI-Circuit Theory" framework for multi-scenario ecological security assessment of the Ningxia Hui Autonomous Region (NHAR). Firstly, the PLUS model was used to complete the simulation of four future development scenarios. Secondly, a new ecological security index (ESI) is constructed by synthesizing ecological service function, ecological health, and ecological risk. Finally, the Circuit Theory is applied to construct the ecological security pattern under multiple scenarios, and the optimization strategy of ecological security zoning is proposed. The results show that (1) from 2000 to 2030, the NHAR has about 80% of grassland and farmland. The built-up area is consistently growing. (2) Between 2000 and 2030, high ecological security areas are primarily located in Helan Mountain, Liupan Mountain, and the central part of NHAR, while the low ecological security areas are dominated by Shapotou District and Yinchuan City. (3) After 2010, the aggregation of high-security areas decreases, and the fragmentation of patches is obvious. Landscape fragmentation would increase under the economic development (ED) scenario and would be somewhat ameliorated by the ecological protection (EP) and balanced development (BD) scenarios. (4) The number of sources increases but the area decreases from 2000 to 2020. The quantity of ecological elements is on the rise. Ecological restoration and protection of this part of the country will improve its ecological security.

Estimating surrogates, utility graphs and indicator sets for soil capacity and security assessments using legacy data

Context Legacy data from prior studies enable preliminary analysis for soil security assessment which will inform future research questions. Aims This study aims to utilise the soil security assessment framework (SSAF) to evaluate the capacity of soil in fulfilling various roles and understand the underlying drivers. Methods The framework entails: (1) defining a combination of role(s) × dimension(s) and identifying a target indicator (a soil property that can be used to evaluate a particular role × dimension combination) or a surrogate indicator (an alternative indicator when there is not a clear target indicator); (2) transforming the indicator into a unitless score (ranging from 0 to 1) using a utility graph based on expert knowledge; (3) fitting the remaining soil properties (potential indicators) into utility graphs and weighing them using (a) ordination and (b) regression method. The application of this framework is demonstrated in evaluating two soil roles: nutrient storage and habitat for biodiversity (with pH and microbial DNA Shannon’s diversity index as surrogates, respectively) for an area in the lower Hunter Valley region, New South Wales, Australia. Key results The regression model provides utility estimates that were similar to those obtained from surrogates, in comparison to the utility derived from the ordination model. Conclusions This study provides a methodological pathway to examine the capacity and drivers of fulfilling different soil roles. The standardisation of this method opens the door to a complete quantification under the SSAF. Implications Indicators derived from a legacy dataset can be used for soil security assessment.

Assessing inequalities in urban water security through geospatial analysis

Water security, which is key for sustainable development, has been broadly investigated through different spatial scales, time frames and perspectives, as a multi-dimensional concept. Fast growth and the diversity of the urban environment add to the challenges of reaching good levels of water security in cities. Yet, few studies have focused on evaluating the heterogeneous distribution of water security in urban areas, which is a key step to highlight where inequalities in large cities are present and how to best guide interventions. The objective of this research is to investigate the spatial heterogeneity of urban water security as well as quantifying inequalities using the new assessment presented in this paper. A holistic indicator-based evaluation framework to intra-urban sectors of the city of Campinas in Brazil is applied, followed by an inequality analysis to describe the distribution of water security aspects. A spatial correlation analysis is then carried out to identify patterns for high inequality indicators. Results show that even though Campinas has established good overall water security conditions, spatial heterogeneity is still noticeable in the urban area. Quantification of inequality by the Theil index highlighted aspects, such as vegetation cover, social green areas, and wastewater collection, that are inequitably distributed in the urban area. The subsequent analysis of spatial patterns exposed areas on the outskirts of the city where infrastructure challenges and social vulnerability coincide. This novel approach has been therefore successfully validated in a city in Brazil, and it has been demonstrated that our water security assessment framework identifies what are the main water security challenges and where they are in the city. For the first time we show that associating spatial and inequality analysis with conventional evaluation of urban water security has the potential to help target areas in need and tackle specific water security issues in the urban area. This is crucial to inform urban planning and policy making for a sustainable and inclusive urban water management strategy.

Water resource security evaluation and barrier analysis in Henan Province utilizing the DPSIR framework

Water resource health is one of the necessary conditions for society to achieve sustainable development. Due to the predominant focus of most studies on relatively short time spans, with limited attention to long time series and spatial trends, this study, using various regions of Henan Province as a case study, constructs a water resource security assessment framework based on the DPSIR model encompassing Drivers (D), Pressures (P), State (S), Impact (I), and Response (R) dimensions, with a selection of 19 evaluation indicators. Based on this evaluation index system, the CRITIC-TOPSIS evaluation method is formulated by integrating the CRITIC (Criteria Importance Through Intercriteria Correlation) and TOPSIS (Technique for Order Preference by Similarity to Ideal Solution) models. This method is employed to assess the degree of water resource security in Henan Province from 2013 to 2022. And the Obstruction Degree Model is introduced to diagnose the water resource security levels in various regions of Henan Province. The assessment results indicate that over the past decade, the overall level of water resource security in various regions of Henan Province has shown an increasing trend. Irrigated area, per capita water resources, water consumption per unit of industrial value added, per acre water consumption for agricultural irrigation, the ratio of river length meeting water quality standards, groundwater supply proportion, and sewage treatment rate are identified as the primary obstacles influencing the water resource security levels in different regions of Henan Province. The research outcomes of this study can serve as theoretical foundations to enhance urban water resource security globally, ultimately facilitating sustainable development.

Dynamic Security Assessment Framework for Steel Casting Workshops in Smart Factory

Security assessment (SA) system is crucial to ensure the production safety of a smart factory with rapid development of artificial intelligence. In this article, we propose a novel SA framework. Different from the conventional static monitoring systems based on traditional sensing technologies, the proposed framework can automatically detect objects via visual sensing. We use a skeleton-based graph convolutional network to generate action vocabulary for the intermediate representations of action-to-action cooccurrence relations. These representations are encoded into the sequential interaction models to form the interaction representations. Integrating the states of molten steel levels as the reference labels, the sequential representations are fed into a recurrent neural network model with multilayer gated recurrent units (GRUs) to capture the key interactions leading to the accidents, in which an attention mechanism is used to reweight the actions and eliminate the invalid interactions. The predicted labels and the hidden states of the scenes are passing among multilayer GRUs. Finally, we optimize the global output to dynamically assess the security by calculating a joint objective function with a regularized cross-entropy loss. On the self-collected dataset from our partner Iron and Steel company and on-line video clips, the proposed framework performs better than the existing SA schemes.

The development of water security index in urbanized sub-Himalayan region: the study of Jammu city

ABSTRACT As small and medium-sized cities of Himalayan and Sub-Himalayan India are rapidly urbanizing, certain structural issues like water management, climate change, the economic conditions, and poor urban planning contribute to growing water insecurity. The Jammu city in India’s sub-Himalayan region relies heavily on water from the Tawi River, a tributary of the Chenab River, and also from the groundwater sources for personal and commercial uses. As the city stares at uncertain future scenario, implementing city-specific equitable water supply strategies is the only way forward. This research using Water Security Assessment Framework with five major dimensions (water supply and sanitation; water productivity; water-related disasters; water environment; and water governance) and twelve related indicators, quantifies the water security index for Jammu city. It further finds that the sub-Himalayan city needs a comprehensive and integrated strategy for planning and managing urban water.

Critical zone identification framework for bulk electric system security assessment

Climate change introduces a new set of vulnerabilities. It might cause unexpected voltage and frequency violation problems that can damage the existing power system configurations. Identifying the zones containing more critical violations in a bulk system under different climatic conditions and contingencies is crucial to securing the power system operation and infrastructure safety. This paper presents an advanced critical zone identification framework that can retrieve information from extensive data yielded by dynamic contingency analysis results from a large interconnected power grid. A machine learning (ML) based clustering approach is applied to identify the critical zone under hundreds of scenarios. The developed framework is tested using the 2028 western electricity coordinating council (WECC) system, and the detailed results are discussed in this paper.

Dynamic financial and monetary security risk assessment based on information service security assessment model and blockchain

With the rapid development of blockchain technology, the financial and monetary (FM) blockchain fields also began to collide. Therefore, this study aims to explore the relationship between the two fields and efficiently evaluate the security of financial information. Firstly, this study introduces the theoretical basis of blockchain in the dynamic linkage mechanism of FM and gives the overall framework of digital currency based on blockchain. Meanwhile, the relationship between blockchain and digital finance is empirically analyzed and designed. Secondly, the framework of financial information service security assessment (ISSA) is created using blockchain technology, and the frame of security risk evaluation is verified by taking electronic invoice information as the research object. Finally, the results show that: (1) foreign exchange (forex) events and major stock index decline events have a significant impact on the return of Bitcoin (BTC) in the short term. Moreover, more than 70% of uncertainty events will make BTC’s abnormal return (AR) significantly positive; (2) Under the influence of forex uncertainty events, only one BTC’s AR is remarkably negative in short order, while the other seven times are markedly positive. In the uncertainty events of major stock indexes, only two times are significantly negative, and the other six times are positive. This indicates that uncertain events in the short run make prominent AR of BTC; the proposed blockchain-based ISSA model and assessment index are scientific, feasible, and operable.

Impact assessment of cascade freshwater reservoir using the ecological security assessment (ESA) model across a four-year timescale

The existence of cascade reservoirs in complex ecosystems not only assists humans to regulate and use water resources efficiently, but the presence of hydropower also contributes to reducing carbon emissions. In recent decades, the ecology of the water sources comprising cascade reservoirs has been subject to a wide range of threats. Assessing these threats is essential for sustainable operation and management strategies of cascade reservoirs. This paper aimed to propose an ecological security assessment framework using an improved Driver-Pressure-State-Impact-Response model to assess a typical riverine cascade reservoir located in the subtropical region of Zhejiang, China. Combining quantitative and qualitative methods to describe the indicators involved in social, economic, ecological, and management. Simultaneously, the degree of deviation from the standard state of ecological security in the study area is assessed with the help of the ecological security index. The analysis shows that the ecological security index of the study area for the four years increased from 81.67 in 2019 to 90.14, where the lowest value has been the socio-economic impact index, indicating that the study area is in a state of ecological security with a score higher than 90.00, but the impact of socio-economic activities on the study area is more pronounced in comparison with other aspects. The model shows that control management with a score of 92.70 in 2022 plays a vital connecting role. Good control management increases socio-economic growth by 16.82%, improves ecological health by 10.23%, and enhances ecosystem services by 5.25% compared to 2019.

How to measure urban water security? An introduction to the Water Security Assessment Tool (WATSAT)

The objective of the project was to develop a web-based digital tool called the Water Security Assessment Tool (WATSAT) to help city authorities and decision-makers make an objective evaluation of the water security situation in the city. It uses an indicator-based methodology that measures five distinct dimensions (broad elements) of water security: “Water supply and sanitation”, “Water productivity”, “Water-related disasters”, “Water environment”, and “Water governance”, which together culminate into a Water Security Index (WSI). The tool is developed based on the water security assessment framework developed by Babel, Dang, Sharma, and Shinde (2015). WATSAT results in a quantitative assessment of water security in a city, wherein the WSI provides an overall picture of the water security situation in a city, while the evaluation of the various dimensions helps identify areas of concern. WATSAT aids city authorities in having a holistic understanding of water security and interconnections of various factors affecting it and assists them in informed decision-making to arrive at system-based interventions to tackle water security threats in the cities.

ANALISIS KEAMANAN SEBUAH DOMAIN MENGGUNAKAN OPEN WEB APPLICATION SECURITY PROJECT (OWASP) Zap

Along with the development of information technology among the wider community, information systems make it easier for people to access and search for information in the form of websites. The problem of security risk is one of the important aspects of an information system. But, security risks are somehow less priority to be considered. In the present work, a security analysis of a domain was conducted using the Open Web Application Security Project (OWASP) Zap. The research method used is literature review and observation. The literature review is used to collect relevant previous research literatures as well as relevant theories and concepts in terms of Vulnerability Analysis. The literatures are obtained from journals, books, scientific papers, and digital media such as the internet. While observation is used to determine, sort, collect, and review the data needed in the test. The results of show that several vulnerabilities on the akprind.ac.id site that can have a detrimental impact on the campus. The security system on several akprind subdomains still does not meet the CIA TRIAD security principle, namely confidentiality. The OWASP Zap tools are still good as a basis for conducting penetration testing on several sites with the akprind.ac.id domain. Because there are still some security issues that match the owasp list. It is hoped that for the IST AKPRIND web, further research needs to be carried out using the ISSAF (Information System Security Assessment Framework) method so that it can be known more deeply if there are vulnerabilities from the web server.