Information Security Goals Research Articles

Recommendations for using a methodology for assessing the security of an automated control system for critical information infrastructure from DDoS attacks based on Monte Carlo simulation

Objective. The objective of the research is to develop a methodology for the security of an automated control system of critical information infrastructure from DDoS attacks. The methodology allows the decision-maker to obtain an assessment of the risk of exposure of the computer network (CN) to DDoS attacks and take necessary actions to reduce the risk of this threat.Method. To achieve the stated objective of the research, simulation modeling based on the Monte Carlo method was used, implemented within the framework of a specialized software environment, as well as a method for calculating integral risk.Result. A methodology was proposed for assessing the security of an automated control system for critical information infrastructure from DDoS attacks, taking into account the importance of individual nodes of its CN.Conclusion. Thus, the developed methodology is useful when conducting an information security audit to assess the integral risk of impact implementation of a DDoS attack on a CN and is designed to help an organization achieve global information security goals, as well as to justify the amount of the insurance premium paid when insuring cyber risks.

MODELING INFORMATION SECURITY THREATS AND DETERMINATION OF THEIR RELEVANCE FOR INFORMATION SYSTEMS OF INFORMATIZATION OBJECTS OF FEDERAL EXECUTIVE AUTHORITIES

Task. The purpose of writing this article is to improve the security of information in information systems. Model. The article explores methods for modeling information security threats and determining their relevance for information systems of informatization objects of federal executive authorities. Conclusions. The study is based on an assessment method that uses a cluster of outcomes, and the concept of “significance coefficient” is also introduced, as the product of the corresponding values of the priority vectors of outcome clusters. Value. The materials presented in the article will help improve methods for analyzing and evaluating the assets of an informatization object, vulnerabilities, information security threats, possible attacks and security goals.

Asymmetric Data Hiding for Compressed Images with High Payload and Reversibility

Hiding secret data in digital images is an attractive topic in the information security research area. Because the data-embedded stego image looks exactly the same as a regular image, transmitting secret data with stego images does not draw the attention of eavesdroppers, thus fulfilling the goal of information security. Many reversible data hiding (RDH) methods for absolute moment block truncation coding (AMBTC) compressed images have been proposed. These methods hide secret data in an AMBTC-compressed image to produce a stego image and transmit it to the recipient. Upon receiving the stego image, the recipient can extract the secret data and recover the AMBTC-compressed image. In this paper, we propose an RDH scheme for AMBTC-compressed images with an asymmetric embedding rule. Using the AMBTC-compressed version as the basis, the proposed embedding scheme always modifies a pixel value toward its original value with a step size (bitrate) proportional to the gap width. Therefore, the visual quality of the stego image is better than the referred AMBTC version. Additionally, as a result of the adaptive bitrate strategy, the data embedding capacity of the proposed scheme outperforms that of state-of-the-art methods. The security of the resulting stego images was also tested by RS-steganalysis. Experimental results show that the overall performance of the proposed scheme is satisfactory. We revised it, please confirm.

A Study on IoT Devices Vulnerability and Security

Numerous IoT devices are connected to a wireless network environment to collect and transmit data without time and space limitations, but many security vulnerabilities are exposed in these process. But IoT security is not easy to create feasible security standards and device authentication due to differences in the approach or implementation of devices and networks. However, it is clear that the improvement and application of the standard framework for enhancing the security level of the device is the starting point to help the most successful security effect. In this study, we investigate the confidentiality, integrity, availability, and access control implementation plans for IoT devices (which are the basic goals of information security), and standardized security evaluation criteria for IoT devices, and study ways to improve them.

New security approach-based Steganography and Cryptography by modified AES algorithm

The transmission of information through any channel of correspondence needs solid encryption procedures with the end goal of information security. The computerized watermarking assumes a significant part in inserting data into an advanced picture signal, for the check and character of its proprietors. In discrete wavelet change, "investigation channel bank" can be utilized for dissecting picture signals by going through. The channel bank comprises high and low pass channels at every deterioration stage. In this paper, a technique to consolidate steganography (Least Significant Method-LSM) and cryptography Advanced Encryption Standard (AES) is thought to give a safer method to information transmission through any unstable or public organizations. Prior to inserting the content in the picture, the text is scrambled utilizing AES calculation. Utilizing least significant bit (LSB) strategy, encoded the text installed in low-low (LL) subband wavelet decayed of a picture. Converse wavelet changes applied will lead to the output picture is communicated to the recipient. Presently at the collector's end, the picture changed utilizing wavelet and encoded text will be extricated by utilizing the LSB technique. This paper shows how AES calculation is utilized in the decoding of the outcome.

Efficient Hybrid Cryptography Algorithm

Cryptography is the operation of transferring a specific message to prevent an attacker from accessing the contents of a message. To increase the level of security in any communication, both parties must have a copy of the encryption key. The Data Encryption Standard algorithm is insufficient due to its weak key generation, so that the key must be reconfigured to make this algorithm more secure, effective, and stronger. The key for encryption enhances securities of the Data Encryption Standard algorithm. This research assumed a combination of two efficient encryption algorithms to achieve the goal of information security by adding a new level of security to the Data Encryption Standard algorithm using the elliptic curve cryptography algorithm. This aim was met by adding two new key functions; the first one is EncK(), and the second one is DecK() for an encryption and decryption key of the Data Encryption Standard algorithm to make this algorithm more secure against attackers. The results obtained from this research also demonstrate good resistance against a brute-force attack, which makes the system more effective by applying the elliptic curve cryptography algorithm to encrypt and decrypt keys using the Data Encryption Standard. In addition, these modifications enhance the degree of complexity, increase key search space, and make the ciphered message more difficult for an attacker to crack.

Gaze Touch Cross PIN: Secure Multimodal Authentication using Gaze and Touch PIN

The basic goal of information security is, to protect the privacy, reliability, and availability of information on devices that manipulate and store the information. To protect this information, the fundamental step is user authentication. The most common method for authentication on devices is the personal identification number (PIN) method, which is vulnerable to shoulder surfing attack. Shoulder surfing attack used by attacker especially in the crowded public places. For shoulder surfing attack prevention several methods had been proposed. This paper proposed a GazeTouchCrossPIN authentication method that overcome the limitations found in the earlier work. we propose a multimodal authentication system that combines between the gaze gesture and touch PIN authentication systems. The results illustrate that the proposed GazeTouchCrossPIN method is more secure hence it decreases the shoulder surfing rate in both side attacks and iterative attacks.

Productivity vs security: mitigating conflicting goals in organizations

PurposeThis paper aims to contribute to the understanding of goal setting in organizations, especially regarding the mitigation of conflicting productivity and security goals.Design/methodology/approachThis paper describes the results of a survey with 200 German employees regarding the effects of goal setting on employees’ security compliance. Based on the survey results, a concept for setting information security goals in organizations building on actionable behavioral recommendations from information security awareness materials is developed. This concept was evaluated in three small- to medium-sized organizations (SMEs) with overall 90 employees.FindingsThe survey results revealed that the presence of rewards for productivity goal achievement is strongly associated with a decrease in security compliance. The evaluation of the goal setting concept indicates that setting their own information security goals is welcomed by employees.Research limitations/implicationsBoth studies rely on self-reported data and are, therefore, likely to contain some kind of bias.Practical implicationsGoal setting in organizations has to accommodate for situations, where productivity goals constrain security policy compliance. Introducing the proposed goal setting concept based on relevant actionable behavioral recommendations can help mitigate issues in such situations.Originality/valueThis work furthers the understanding of the factors affecting employee security compliance. Furthermore, the proposed concept can help maximizing the positive effects of goal setting in organizations by mitigating the negative effects through the introduction of meaningful and actionable information security goals.

Toward Proper Authentication Methods in Electronic Medical Record Access Compliant to HIPAA and C.I.A. Triangle.

This paper examines various methods encompassing the authentication of users in accessing Electronic Medical Records (EMRs). From a methodological perspective, multiple authentication methods have been researched from both a desktop and mobile accessibility perspective. Each method is investigated at a high level, along with comparative analyses, as well as real world examples. The projected outcome of this examination is a better understanding of the sophistication required in protecting the vital privacy constraints of an individual's Protected Health Information (PHI). In understanding the implications of protecting healthcare data in today's technological world, the scope of this paper is to grasp an overview of confidentiality as it pertains to information security. In addressing this topic, a high level overview of the three goals of information security are examined; in particular, the goal of confidentiality is the primary focus. Expanding upon the goal of confidentiality, healthcare accessibility legal aspects are considered, with a focus upon the Health Insurance Portability and Accountability Act of 1996 (HIPAA). With the primary focus of this examination being access to EMRs, the paper will consider two types of accessibility of concern: access from a physician, or group of physicians; and access from an individual patient.

English

In incident response the Computer Emergency Response Team (CERT) or Computer Incident Response Team (CIRT) investigates an incidence in order to have a detailed description on how a crime was conducted, who was responsible and ways of making sure that the incident will not happen in future. In order for an investigation to commence there is need for someone to report the incident. The forensic expert or investigatorquarantines the crime scene, takes a photograph of the area and seizes the evidence in a forensically sound manner whilst preserving the integrity of data. The evidence media is taken to the forensic lab or workstation where an investigation is conducted. In most cases the investigator is qualified and skilled to perform the operation. The investigation process consists of two sub processes which are Data Collection and Data Analysis. Data collection is the process of acquiring the data that will assist in the investigation process for example through the use of Incident Response Toolkit. Data Analysis is the process of examining the collected data by using various forensic tools that follow the Association Chief of Police Officers (ACPO) principles in order to obtain results. The goals of information security are to protect the confidentiality, integrity and availability of data.Hackers compromise the information security and use anti- forensic techniques to make it difficult for investigators to detect and prove the existence and involvement in the crime. The aim of this paper is to design and implement an application that will provide a solution to some of the anti-forensic data hiding techniques.

Information Warfare, Threats and Information Security

The article presents the opposite, but dependent on each other's reality - Revolutionary War information,information security goals and objectives of their study within the scheme "challenge-response", methodological and analytical support, the role of elites and the information society in promoting information security. One of the features of contemporaneityis the global spread of ICT, combined with poor governance and other difficulties in the construction of innovation infrastructures that are based on them in some countries. This leads to the reproduction of threats, primarily related to the ability to use ICT for purposes that are inconsistent with the objectives of maintaining international peace and security, compliance with the principles of non-use of force, non-interference in the internal affairs of states, etc. In this regard, include such terms as "a threat of information warfare", "information terrorism" and so forth. Information warfare, which stay in the policy declared the struggle for existence, and relationships are defined in terms of "friend-enemy", "ours-foreign". Superiority over the opponent or "capture of its territory" is the aim of political activity. And information security, serving activities similar process of political control, including a set of components, is a technology until their humanitarian. From the context and the decision itself is the ratio of the achieved results of information and political influence to the target - a positive image of Russia. Bringing its policy in line with the demands of a healthy public opinion provides conductivity of theauthorities initiatives in the country and increases the legitimacy of the Russian Federation actions in the world.

The Impact of the Goals of Information Security Standards to Ensure Information Security

The study presents the results of the analysis of the goals of information security to ensure information security through a case study of the income tax department and sales inJordan. The goal of the analysis is to identify the security situation in the department of information and the development of information system security software and knowledge of the impact of these standards on the security of computerized information systems in this department. The study sample consists of 360 questionnaires, of which 270 questionnaires subjected to statistical analysis, which accounted for 88%, the researcher has conducted a descriptive study to get to the analytical results and the achievement of the objectives of the study. The results showed the presence of a positive effect to the goals of the information security standards to ensure information security in this organization, where the information security is characterized by extreme sensitivity to external threats.

An Enhanced Authentication Based on Biometric and Neural Network

Because of the significant in the field of information technology, increasing means of communication and networks , proliferation of electronic crimes and personality theft, the security of information and verification of the identity of the user became the biggest concerns of institutions and individuals. Hence, several types to verify the reliability of people appeared, some of them relied on traditional means like passwords and smart cards, other modern methods adopted the biometric features for which vital statistics, which depends on the characteristics of natural or unique behavior in people. The artificial neural networks have been used by a large number of researchers to achieve the goals of information security and so as it is ability of learning and modeling of complex relationships between inputs and Outputs.This research suggest a way to improve the user authentication scheme in high security applications in networks. Artificial neural network is used (Back propagation network) to provide privacy to the user and vital feature (fingerprint iris of the eye) being one of the best biometric features to verify the identity of the user as it is the consistency and accuracy in addition to ease of use .

Project Commitment in the Context of Information Security

This research investigates the role of project commitment in the context of information systems security. In doing so, the research adopts a psychological point of view by exploring and discussing the concept of project commitment in setting information security goals. Information security can be viewed as the efficient control of uncertainty arising from malicious acts intended to exploit valuable assets, and in the context of information systems the valuable assets under consideration are data. Data were collected by using an interpretive approach through in-depth interviews and observation within a single case study in Greece. The contribution of this research to interpretive information-systems consists of the study of project commitment and goal theory in an information security-management context, and its grounding within an interpretive epistemology. Ultimately, this research promotes an interdisciplinary and interorganizational theory that fosters a dialogue transcending industry-specific contexts and explores different management practices that can improve security project commitment and management in its real life context.

Common Sense for Your Network

Modern IT managers need to focus on commonsense network security concepts. A primary goal of information security is to limit data access to only authorized individuals.To control network access and properly assign workstations to the proper domain, each port in the enterprise need to be controlled. Another commonsense security concept that organizations have tried to adopt is a password policy. Good password policies can dramatically slow down attackers and their ability to use stolen credentials.

Information security

Nowadays, information is one of the very important assets in almost all organizations. Once the internal networks of those organizations are connected to the Internet, it becomes a potential target for cyber attacks. In order to secure the systems and information, each company or organization should conduct a self-hacking-audit, analyze the threats and eliminate it beforegetting any problem. This paper explains about the main goals of information security, its major threats and some suggestions to prevent the systems from major threats.

Information security considerations in open systems architectures

Information security and issues related to its achievement in open systems architectures are discussed. Beginning with a discussion of the goals of information security and their relation to open systems, examples are provided of the threats to electric utility computer systems and the consequences associated with these threats. Basic countermeasures applicable to all computer systems are presented. Issues specific to open systems architectures are discussed.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>