Identify Security Threats Research Articles

Novel Method of Detecting Moving Object in Video

In the modern trends, intelligent video surveillance system is a very important and relevant topic of research. It is well suited for a broad range of applications which includes, video communication, security and surveillance, public areas such as airports, traffic control, monitoring activities at traffic intersections for detecting congestions, and then predicting the traffic flow which assists in regulating traffic, underground stations, mass events, etc. The main disadvantage of the system is, the storage space required for storing these data and retrieval of the same on demand. For these human resources are needed but manually reviewing the large amount of data often impractical. The proposed work focused on bringing effective and efficient system with intelligence to avoid human intervention in identifying security threats. In this paper, the moving objects in a video detected by using a method of optic flow with morphological operation.

An Approach for Systematically Analyzing and Specifying Security Requirements for the Converged Web-Mobile Applications

As the use of web and mobile applications is becoming pervasive for service delivery and user mobility support, enterprises are now increasingly fighting against a huge number of emerging security threats which interfere with the process of service delivery. As an attempt to help the enterprises in dealing with the emerging security threats in the converged service delivery architecture, this paper presents a methodology for security threat analysis and security requirements specification in web/mobile applications development. The presented methodology is based on a case study Livestock Data Center (LDC) system, which is being developed and it allows both web and mobile interfaces as service delivery channels. Hence the system serves as a representative of other similar setups of service delivery. In addition to the processes of analysis and security specification, the methodology involves threat modeling as well. There are several threat models in the literature. The STRIDE threats model is one among the existing threats models that is used to identify security threats that needs to be addressed in systems such as the LDC system. The STRIDE threats model has been used to identify the likely security threats to our case study. On applying the STRIDE threats model the following threats were identified as prominent: sensitive data exposure, weak server side controls, client side injection, and weak authentication and authorization. The identified security threats were compared to existing threats in traditional web and mobile applications separately in order to figure out the changes when the two computing platforms come together. The findings from our case study have shown that the proposed methodology for security threat analysis and security design can be useful in security requirements specifications in the converged web-mobile applications during development, and can be generally used to assist developers of other similar systems.

Żandarmeria Wojskowa – oddziały służące zapewnianiu bezpieczeństwa i porządku publicznego w Polsce i Unii Europejskiej

There are many threats to national security today. Some of them are the negative aspects of globalisation. Increasing crime in many areas (as the results of social, economic and political consequences of terrorist acts, the excessive influx of illegal immigrants – often from other cultures and civilisations), as well as threats to personal safety have forced governments to search for new methods and tools to combat and prevent various types of threats – within the area of a single country and the entirety of the EU. Given its geographical position in Europe, Poland participates naturally in a number of supranational economic, political and military structures. Preventing threats has forced institutions today to become involved in securing safety across many fields of cooperation. The inability to accurately identify security threats requires advance planning, flexibility, responsiveness and a comprehensive approach to security and defense. This includes taking various initiatives using allied and multinational militaries and non-military solutions in response to contemporary threats. Both the Polish and European Gendarmerie Forces belong to a branch of special police constituted only by elements of police forces with military status in order to perform all police tasks within the scope of crisis management operations.

Threat Modeling and Countermeasures Study for the Internet of Things

There are a lot of security threats during the development of the Internet of Things and the issues are needed to be resolved in the system development process. Establishing a threat model after security threats analysis is an essential step to build a security system. A perfect designed threat model can help designers to identify security threats that exist in the system quickly and make decision timely to protect the data security and normal operation of the system. In this paper, first, we will give a security threat analysis for the perception layer, the transport layer and the application layer according to the actual situation that the system is facing such as the mass nodes manager and heterogeneous network integration and so on. Then we will show the threat modeling process focusing on the perception layer with the method of threat tree model. At last, we will give the final threat tree model and corresponding security countermeasures. This model can provide a theoretical basis for making the follow-up security measure study and finishing the risk assessment work.

“A framework for development of secure software”

To design, build and deploy secure systems, we must integrate security into our application development life cycle and adapt current software engineering practices and methodologies to include specific security-related activities. Developers enforces security measures during design phase of software development processes which may end up in specifying security related architecture constraints that are not really necessary. To eliminate this problem, we propose a Framework for Security Engineering Process that involves converting security requirements and threats into design decisions to mitigate the identified security threats. The identified design attributes are prioritized and a security design template is prepared. We have stored various cryptographic techniques and their analytic attributes in the repository to find out the specific cryptographic technique that would eventually help in the later stages of the design process by eliminating unnecessary design constraints in a particular scenario.

Establishing a valuable method of packet capture and packet analyzer tools in firewall

Packet capture is the act of capture the data packets across a computer network. Packet captures is used by the network administrators and security engineers for the purposes of Monitor network traffic, analyzes traffic patterns, Identify and troubleshoot network problems. Problem statement: The Conventional firewall is performed the packet capture followed by allowing or disallowing the packet as per user specified policy. Approach: our approach is to implement the Deep packet capture (DPC), Deep packet Inspection (DPI) and also analyze the packet in effective manner. This approach is helpful for monitor the all activates in the public or private network. Deep packet capture (DPC) is the act of capturing, at full network speed, complete network packets payload, crossing a network with a high traffic rate. Deep packet inspection (DPI) to review network packet data, perform forensics analysis to uncover the root cause of network problems, identify security threats, and ensure data communications and network usage complies with outlined policy. Some DPCs can be coupled with DPI and can result as, inspect, and analyze all networks traffic in real-time.

Teaching Johnny not to fall for phish

Phishing attacks, in which criminals lure Internet users to Web sites that spoof legitimate Web sites, are occurring with increasing frequency and are causing considerable harm to victims. While a great deal of effort has been devoted to solving the phishing problem by prevention and detection of phishing emails and phishing Web sites, little research has been done in the area of training users to recognize those attacks. Our research focuses on educating users about phishing and helping them make better trust decisions. We identified a number of challenges for end-user security education in general and anti-phishing education in particular: users are not motivated to learn about security; for most users, security is a secondary task; it is difficult to teach people to identify security threats without also increasing their tendency to misjudge nonthreats as threats. Keeping these challenges in mind, we developed an email-based anti-phishing education system called “PhishGuru” and an online game called “Anti-Phishing Phil” that teaches users how to use cues in URLs to avoid falling for phishing attacks. We applied learning science instructional principles in the design of PhishGuru and Anti-Phishing Phil. In this article we present the results of PhishGuru and Anti-Phishing Phil user studies that demonstrate the effectiveness of these tools. Our results suggest that, while automated detection systems should be used as the first line of defense against phishing attacks, user education offers a complementary approach to help people better recognize fraudulent emails and websites.

Key Establishment and Pairing Management Protocol for Downloadable Conditional Access System Host Devices

In this paper, we investigate the possible security threats to downloadable conditional access system (DCAS) host devices. We then propose a DCAS secure micro (SM) and transport processor (TP) security protocol that counters identified security threats using a secure key establishment and pairing management scheme. The proposed protocol not only resists disclosed SM ID and TP ID threats and indirect connection between TA and TP threats, but also meets some desirable security attributes such as known key secrecy, perfect forward secrecy, key compromised impersonation, unknown key-share, and key control.

Aspect-oriented specification of threat-driven security requirements

This paper presents an aspect-oriented approach to integrated specification of functional and security requirements based on use-case-driven software development. It relies on explicit identification of security threats and threat mitigations. We first identify security threats with respect to use-case based functional requirements in terms of security goals and the STRIDE category. Then, we suggest threat mitigations for preventing or reducing security threats. To capture the crosscutting nature of threats and mitigations, we specify them as aspects that encapsulate pointcuts and advice. This provides a structured way for separating functional and security concerns and for analysing the interaction between them.

The security of power systems and the role of information and communication technologies: lessons from the recent blackouts

This paper analyses the impact of information and communication technologies upon the security of networked infrastructures, making specific reference to the situation of the electric power sector. It discusses the lessons learnt from the recent blackouts, and concludes with the identification of the main technological security challenges faced in this field. In recent years, both Europe and the USA have experienced a significant number of huge blackouts, whose frequency and impact looks to be progressively growing. This paper shows that these events had common roots in the fact that current risk assessment methodologies and current system controls no longer appear to be adequate. Beyond the growing complexity of the electrical system as a whole, two main reasons can be listed: (1) system analysis procedures based on these methodologies did not identify security threats emerging from failures of critical physical components; and (2) online controls were not able to avoid system collapse.