Security Assessment Framework Research Articles

ANALISIS KEAMANAN SEBUAH DOMAIN MENGGUNAKAN OPEN WEB APPLICATION SECURITY PROJECT (OWASP) Zap

Along with the development of information technology among the wider community, information systems make it easier for people to access and search for information in the form of websites. The problem of security risk is one of the important aspects of an information system. But, security risks are somehow less priority to be considered. In the present work, a security analysis of a domain was conducted using the Open Web Application Security Project (OWASP) Zap. The research method used is literature review and observation. The literature review is used to collect relevant previous research literatures as well as relevant theories and concepts in terms of Vulnerability Analysis. The literatures are obtained from journals, books, scientific papers, and digital media such as the internet. While observation is used to determine, sort, collect, and review the data needed in the test. The results of show that several vulnerabilities on the akprind.ac.id site that can have a detrimental impact on the campus. The security system on several akprind subdomains still does not meet the CIA TRIAD security principle, namely confidentiality. The OWASP Zap tools are still good as a basis for conducting penetration testing on several sites with the akprind.ac.id domain. Because there are still some security issues that match the owasp list. It is hoped that for the IST AKPRIND web, further research needs to be carried out using the ISSAF (Information System Security Assessment Framework) method so that it can be known more deeply if there are vulnerabilities from the web server.

Framework for assessing water security of Vietnam

To assess Vietnam’s water security, it is necessary to develop a framework along with the indicators for evaluating the water security index (WSI). The water security assessment framework is based on the selection of indicators according to the SMART, KPI criteria, and the WSI framework proposed by several international organisations and scientists around the world, taking into account the characteristics of water resources in Vietnam, including the key factors affecting water security and data, accommodatable data for the calculation requirements, scale, and level of detail. The article presents a framework for assessing water security in Vietnam (national scale, region, river basin, and province/city). At the same time, the authors have provided a method and illustrated how to identify a number of key indicators (or indices) in the water security framework as the basis for assessing Vietnam’s water security.

Energy Diversification and Security in the EU: Comparative Assessment in Different EU Regions

Various methods and tools have been developed to quantify energy supply security; however, there is no ideal framework to measure energy security, as the concept is multifaceted and context dependent. Energy supply security has always been an extremely important issue for European Union (EU) countries due to high import dependency, and recent events linked to the COVID-19 pandemic and the Russian invasion of Ukraine have made it exceptionally important to reconsider this problem to identify the crucial issues and address contemporary policy needs. This study endeavours to systematise the primary energy security indicators in terms of policy relevance and develop an energy security assessment framework to examine energy import dependency and diversification for the EU in view of recent problems. This study introduces an energy import diversification and security index which enables measurement of a country’s energy security level for comparison with other countries and identifies primary areas for improvement. The proposed framework is then applied to a case study of selected EU countries to examine regional differences and identify potential improvements.

A Framework for Assessing Nuclear Terrorism Threats in Bangladesh

We live in a world where thousands of nuclear weapons exist. Many countries and even terrorist organizations want to acquire nuclear weapons. The ambiguous and transnational nature of terrorist organizations challenges the national security of many states. Bangladesh is a small and densely populated country with a nuclear energy plant. Although Bangladesh has a nuclear energy policy, it has no atomic security policy or legal framework. The dearth of military capabilities, administrative facilities, and human resources with proper skills and experiences makes Bangladesh vulnerable to nuclear terrorist attacks. This research aims to build a framework that would be useful in assessing the security threats from the likelihood of nuclear terrorism in a country like Bangladesh. This nuclear security assessment framework could be useful in assessing security threats from nuclear terrorism in non-nuclear-weapon countries.

PIRAP: Security Assessment Framework for Heterogeneous Web Service Composition

In recent times, enterprise environments such as E-banking, E-commerce, etc., are greatly affected by the evolution of web services and their associated attacks. The process of web service composition gives rise to security issues due to the incompatibility standards of the Simple Object Access Protocol (SOAP) and representational state transfer (REST) features and the compromising service-level agreement (SLA) between the end parties which has not been considered yet. Also, the security assessment process needs to cooperate with good security standards and web services. In case of heterogeneous web services, assessment done using machine learning technologies makes use of pattern analysis where this does not work with the evolving trend behind the web service environment. Hence, there is a need for a security assessment model which will incorporate finite state machine (FSM) in its assessment process to keep track of the various WS-attacks that arise in the web application via web services in heterogeneous environments. The proposed model does the web service composition by compromising all the security conflicts that arise due to the usage of dissimilar web services. We experimented the concept by testing several web services and observed that the performance of the proposed framework in attack detection is accurate and automatic thereby achieving traceability and computability metrics.

A Trailblazing Framework of Security Assessment for Traffic Data Management

A Trailblazing Framework of Security Assessment for Traffic Data Management

SECURITY ANALYSIS ON WEBSITES USING THE INFORMATION SYSTEM ASSESSMENT FRAMEWORK (ISSAF) AND OPEN WEB APPLICATION SECURITY VERSION 4 (OWASPv4) USING THE PENETRATION TESTING METHOD

<p>At this time in the rapid development of technology, there must be advantages and disadvantages of a system or technology that was created. Within the scope of the website, there are also many security holes that irresponsible parties can enter. The state of the website at the Telkom Purwokerto Institute of Technology, both University and Faculty websites, already uses Hypertext Transfers Protocol Secure (HTTPS). This study used the Information System Security Assessment Framework (ISSAF) and Open Web Application Project (OWASP) frameworks with the Penetration Testing method. This study aims to determine vulnerabilities on the website s1if.ittelkom-pwt.ac.id. The result of performing vulnerabilities is several vulnerabilities to the Institut Teknologi Telkom Purwokerto (ITTP) Informatics Study Program website, including not updating jquery on the ITTP website. Ten tests have been carried out, five tests using ISSAF and five tests using OWSP version 4. When performing vulnerabilities in the ISSAF framework, found robots files.txt on the S1 Informatics website which is quite crucial for s1if.ittelkom-pwt.ac.id website which contains an exploitable sitemap. </p>

Energy Security Assessment Based on a New Dynamic Multi-Criteria Decision-Making Framework

Access to energy resources and broadly understood energy security are some of the critical factors influencing the economic development of countries. This article deals with the problem of assessing the energy security of countries, considering this problem in various periods of time, examining the past, present and forecasted future conditions at the same time. For this purpose, the Dynamic Multi-Criteria Decision Making (DMCDM) methodology was developed and applied, based on the classic and fuzzy Multi-Criteria Decision Making (MCDM) methods and the International Energy Security Risk Index (IESRI). In particular, the Simple Additive Weighting (SAW)/Fuzzy SAW and New Easy Approach to Fuzzy PROMETHEE II (NEAT F-PROMETHEE) methods were used. These methods are significantly different from each other in the calculation procedures used. The study showed that methodological differences between these methods cause large differences in the results of the assessment of energy security of countries. However, both methodological approaches indicated the high energy security of New Zealand, Norway, Denmark and the United States, and the very low security of Ukraine, Thailand and South Korea. The results of the assessment of energy security of countries over the 2015–2025 period are the main practical contribution of this article. The scientific contribution of the article consists in developing a framework for dynamic energy security assessment that allows for the aggregation of many periods of time and that defines the aggregation strategies, capturing data from the past, present and future state forecasts while taking into account changes in the weights of criteria and changes in the sets of alternatives and criteria.

Urban ecological security assessment and path regulation for ecological protection - A case study of Shenzhen, China

The rapid development of urbanization has triggered the contradiction between population, resources and environment. As a result, urban ecological security has attracted more and more attention, and has gradually become the key to restricting the sustainable development of urban social economy. This work constructs a dynamic urban ecological security assessment and prediction research framework, which is verified by taking Shenzhen, a typical big city in China, as an example. Specifically, urban ecological security is evaluated through the “pressure-state-response” (PSR) model, and its key influencing factors are identified by the coupling factor analysis method. Finally, the future ecological security of the city is predicted and analyzed by Monte Carlo. The results show that the comprehensive safety index of Shenzhen urban ecosystem is increasing, and its key impact indicators are comprehensive development factors and human settlements factors respectively. Additionally, it is anticipated that Shenzhen’s urban ecological security level will reach a comfortable level in 2025. To sum up, according to the results of urban ecological assessment and prediction, targeted suggestions on the improvement path of ecological security are put forward. It is suggested that Shenzhen should continue to increase investment in environmental protection, science and technology and other fields to ensure the sustainable development of the urban ecosystem. Using the city of Shenzhen as a case study, this research examines the typical regulatory path for urban ecological security. On the one hand, it can provide a methodological framework for the historical evaluation and future prediction of urban ecological security in China and possibly the entire world. And on the other hand, it can provide a theoretical reference for cities to formulate policies for ecological sustainable development.

Root Cause Analysis for Autonomous Optical Network Security Management

The ongoing evolution of optical networks towards autonomous systems supporting high-performance services beyond 5G requires advanced functionalities for automated security management. To cope with evolving threat landscape, security diagnostic approaches should be able to detect and identify the nature not only of existing attack techniques, but also those hitherto unknown or insufficiently represented. Machine Learning (ML)-based algorithms perform well when identifying known attack types, but cannot guarantee precise identification of unknown attacks. This makes Root Cause Analysis (RCA) crucial for enabling timely attack response when human intervention is unavoidable. We address these challenges by establishing an ML-based framework for security assessment and analyzing RCA alternatives for physical-layer attacks. We first scrutinize different Network Management System (NMS) architectures and the corresponding security assessment capabilities. We then investigate the applicability of supervised and unsupervised learning (SL and UL) approaches for RCA and propose a novel UL-based RCA algorithm called Distance-Based Root Cause Analysis (DB-RCA). The framework’s applicability and performance for autonomous optical network security management is validated on an experimental physical-layer security dataset, assessing the benefits and drawbacks of the SL- and UL-based RCA. Besides confirming that SL-based approaches can provide precise RCA output for known attack types upon training, we show that the proposed UL-based RCA approach offers meaningful insight into the anomalies caused by novel attack types, thus supporting the human security officers in advancing the physical-layer security diagnostics.

A disaggregated assessment of national water security: An application to the river basins in Thailand

Achieving water security is a global concern in the age of changing climate, population increase, urbanization, intensive socio-economic development, and land-use change. Addressing water security challenges is most appropriate at the river basin scale since hydrological boundaries at which water flows differ from administrative boundaries, and it can provide policymakers and decision-makers key insights to better support water management practices. This study carries out a disaggregated assessment of national water security by applying an indicator-based framework to evaluate water security conditions in all twenty-five river basins of Thailand from 2007 to 2015. The framework comprises five broad dimensions and eleven indicators. The study results revealed that the overall water security condition in Thai river basins has improved during this period. However, a fine-grained analysis at the dimensions and indicator level of water security shows that water productivity and the watershed health dimension are of concern in most river basins. The agricultural water productivity and the wastewater treatment capacity have deteriorated over the years in most basins. Likewise, it emerged that basins need to enhance their water resource management plans to account for future water challenges. The water security assessment framework presented in this study links well to the plans, policies, visions, and strategies developed for water resource management in Thailand. Thus, it can act as a decision-support tool to monitor the effectiveness of these plans and policies developed and arrive at interventions to enhance Thailand's water security.

Appraisal of Water Security in Asia: The Pentagonal Framework for Efficient Water Resource Management

Swathes of global water challenges, such as water shortages, water pollution, water-related disasters, and degradation of water environments, have seriously threatened human development. The discussion of water security or insecurity has been instrumental in drawing the attention of political leaders thanks to its political nature and strategic and urgent messages for society to take action. This study introduces a modified concept and definition of water security and a water security assessment framework based on a review of previous works on water security; the water security framework intends to shed light on five core areas: (1) social equity; (2) economic efficiency; (3) environmental sustainability; (4) resilience to water-related disasters; and (5) government competency. A total of 28 countries in Asia and the Pacific have been chosen and appraised for their level of water security. The assessment result unveils that Japan, Malaysia, and South Korea show high levels of water security. In contrast, India, Pakistan, and the Philippines are regarded as the countries with water insecurity. The magnitude of the study lies in critically assessing good or challenging aspects of water security so that the countries can start to consider possible policy options for achieving sustainable water resource management.

Towards Design and Development of Security Assessment Framework for Internet of Medical Things

The majority of medical equipment in use today does not have built-in security features. As a result, whether linked to a hospital system or the cloud, these devices’ built-in weaknesses make them vulnerable to a variety of cyberattacks. In hospitals and clinics, hackers can breach equipment, manipulate data, and disrupt facilities, putting patients’ health as well as their lives in jeopardy. A professional can manage cybersecurity threats by lowering the attack surface of the system. Security analysis, whether as a means to detect possible vulnerabilities that can be exploited by attackers or as a means to prevent cyberattacks, plays an important role in risk mitigation. In addition, throughout the pre-market and post-market phases, security checks are required. This study presents a paradigm for incorporating security check concepts into medical device design and development and healthcare big data security. The security of devices and healthcare data is tested by the integrated fuzzy AHP-TOPSIS method. After the security check of devices, with the parameters security-checked for data, the algorithm is designed and implemented. As a result, the appropriate customized security controls are prompted in order to impede the attack.

A novel deep learning based security assessment framework for enhanced security in swarm network environment

Security assessments are essential in network systems to improve the reliability of the environment. This study presents a deep learning-based security assessment model as a proactive approach for monitoring network activities. This approach can improve security across the network environment and connected computing infrastructures by detecting and classifying various types of security attacks. Deep learning is one of the emerging solutions for integrating intelligent and smart techniques into traditional solutions for improving the performance of security detection. Leveraging a multilayer perceptron (MLP) combined with an XGBoost classifier for large-scale data processing and classification, the performance of the approach demonstrated an accuracy of 93.30% and a precision of 92.73% for malicious attack detection.

Security assessment of transnational power interconnection between China and neighboring countries

China and its neighboring countries are energy-dependent regions with strong resource complementarity and significant benefits of cross-border grid interconnection. However, the power interconnection of the whole Greater China region is still far from being realized. In addition to internal factors, external geopolitical issues, grid interconnection technical issues, and geographical obstacles also pose certain security challenges to the creation of regional power grids. To quantify the security of power grid interconnection between China and neighboring countries, this study proposes a security assessment framework for the power interconnection between China and neighboring countries from the five dimensions of politics, economy, law, technology, and geographic environment. We collected the observable panel data of China's neighboring countries from 2011 to 2018 and used the entropy method to objectively evaluate the security of power interconnection between China and 22 countries in the four regions of Northeast Asia, Central Asia, South Asia, and Southeast Asia. The study proposes the feasible paths for power interconnection between China and surrounding countries based on the investigation on the interconnection advantages and security shortcomings of each region and country by combining the endowment of renewable energy resources in each region.

An improved emergy ecological footprint method for ecological security assessment and quantitative analysis of influencing factors: a case study of Zhejiang Province

A scientific ecological security assessment framework is critical to regional ecological security. This paper improves the emergy ecological footprint model which optimizes the traditional emergy ecological footprint by adding the water supply service, to assess ecological security, and quantitatively analyzed the factors affecting ecological security by partial least squares regression. Zhejiang Province, one of the most developed provinces in China, was selected as a case study. The results show that (1) the emergy carrying capacity (ECC) per capita suffered a reduction from 2004 to 2018. (2) The emergy ecological footprint (EEF) per capita presented a rising trend, with a growth rate of 70.13% from 2004 to 2018. (3) The emergy ecological footprint per capita of biologically productive land has increased except for grassland and waters. (4) There was an ecological surplus in the period of 2004–2009, but an ecological deficit appeared after 2009. (5) The ecological insecurity in Zhejiang Province was increasing, which transformed from a comparably safe state to a relatively unsafe state. (6) The dominant influencing factors affecting Zhejiang’s ecological security were population density, urban built-up area per capita, secondary industry output value, etc. These findings could provide valuable decision support to policy makers in formatting policies on ecological management and sustainable regional development.

Risk Prediction of IoT Devices Based on Vulnerability Analysis

Internet of Things (IoT) devices are becoming more widespread not only in areas such as smart homes and smart cities but also in research and office environments. The sheer number, heterogeneity, and limited patch availability provide significant challenges for the security of both office networks and the Internet in general. The systematic estimation of device risks, which is essential for mitigation decisions, is currently a skill-intensive task that requires expertise in network vulnerability scanning, as well as manual effort in firmware binary analysis. This article introduces SAFER, 1 the Security Assessment Framework for Embedded-device Risks, which enables a semi-automated risk assessment of IoT devices in any network. SAFER combines information from network device identification and automated firmware analysis to estimate the current risk associated with the device. Based on past vulnerability data and vendor patch intervals for device models, SAFER extrapolates those observations into the future using different automatically parameterized prediction models. Based on that, SAFER also estimates an indicator for future security risks. This enables users to be aware of devices exposing high risks in the future. One major strength of SAFER over other approaches is its scalability, achieved through significant automation. To demonstrate this strength, we apply SAFER in the network of a large multinational organization, to systematically assess the security level of hundreds of IoT devices on large-scale networks. Results indicate that SAFER successfully identified 531 out of 572 devices leading to a device identification rate of 92.83 %, analyzed 825 firmware images, and predicted the current and future security risk for 240 devices.

Nonequilibrium Initialization: Seamless Connection Between Dynamic State Estimation and Dynamic Security Assessment

With the integration of renewable energy and demand response, the behavior of power systems has become more fluctuating than ever before. This challenges traditional dynamic security assessment based on the “steady-state” assumption of current operating points. To address these challenges, we formulate here a dynamic state estimation (DSE)-based dynamic security assessment (DSA <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sup> ) framework. In the new framework, we propose to use nonequilibrium initialization techniques to bridge DSE and DSA. Case studies demonstrate how the proposed nonequilibrium initialization can capture the dynamic that cannot be reflected in traditional static state-estimation–based security assessment.

Robustness of the international oil trade network under targeted attacks to economies

In the international oil trade network, trade shocks triggered by extreme events may spread over the entire network through trade links and even lead to the collapse of the whole system. To investigate the robustness of the international oil trade network under targeted attacks (i.e. shocks) to economies, we focus on the concept of “too central to fail”. The results of the centrality measurement of economies and international organizations show that there are significant differences in the results of identifying the centrality of economies by different indicators. The judgment of influence by a single indicator cannot be considered from multiple levels. The simulation results show that the regional aggregation of oil trade is an essential source of the oil trade network's vulnerability and the global oil trading system becomes more fragile after encountering major events. Maintaining oil trade stability and security requires to focus on economies with greater influence within the network module. We improve the framework of oil security and trade risk assessment based on the topological index of the network, and provide a reference for finding methods to maintain network robustness and oil trade stability.

Urban water security: A comparative assessment and policy analysis of five cities in diverse developing countries of Asia

Cities are rapidly expanding and invariably moving toward densification. Global challenges such as climate change, land use change, environmental degradation, and expanding economy in urban areas increase water-related problems. This study addresses the difficulty of operationalizing the concept of urban water security by applying an integrative indicator-based urban water security assessment framework, formed by integrating two well-established frameworks, to evaluate the water security state in five different cities in Asia: Bangkok, Jaipur, Hanoi, Islamabad, and Madaba. The study carries out a comparative assessment of the outcomes of the indicators, and interlinks the plans, strategies, and policies of the cities with the indicators of the integrated framework to identify policy gaps and to suggest steps to improve urban water management in these five cities. Based on the results obtained, Hanoi currently has the best water security condition among these five cities. Despite the multiple dimensions of water security, the plans and policies formulated in the five cities focus mostly on water supply sanitation and human well-being among the dimensions pertinent to the framework. This study's approach is applicable as a prototype study for a comparative assessment of urban water security parameters across cities globally.