Identify Security Risks Research Articles

Accident prevention in construction

Construction is a sector characterized by a high likelihood of accidents, among the factors that have the potential to reduce such accidents, the design stage is important to reduce risks in the life cycle of the enterprise. The need to reduce risks on the construction site early and proactively has fostered the development of digital tools for designs. This study aimed to conduct a systematic review of the literature on the development and application of digital tools capable of identifying security risks in designs and examine them to point out their characteristics and limitations. The review of the literature was based on the Preferred Reporting Items for Systematic Reviews and Meta-Analyses statement. The research showed that although the use of digital tools has great potential for impact on risk mitigation in the design stage, they are still little used and have not reached their maximum potential. In addition, this systematic review indicates possibilities of use, which include the automation of risk verification and provision of security measures, as well as limitations, as the absence of consideration of the dynamism of the work in digital tools. Therefore, the present work presents a basis to help structure future applied research in the area.

Optimizing Online Business Security with Blockchain Technology

This research discusses the implementation of blockchain technology to improve online business security. The main problem facing online businesses today is their vulnerability to security attacks such as data theft and information leaks. The aim of this research is to optimize online business security by utilizing the advantages of blockchain technology in providing data security, integrity, and transparency. This research method includes a literature review to understand existing online business security frameworks and analysis of possible weaknesses. Next, we designed and implemented a blockchain-based solution to mitigate the identified security risks. Data collection is carried out through security attack simulations and reliability testing of the proposed system. The research results show that the application of blockchain technology significantly increases the security of online businesses, reduces the risk of data theft, and provides a high level of transparency. The conclusions of this research support the view that blockchain can be an effective solution to overcome security problems in the context of online business. This research makes a significant contribution to understanding and applying blockchain technology as an innovative security solution in the context of online business.

Intelligence in security countermeasures selection

Identifying security risks in organizations and also determining their severity in order to select appropriate security countermeasures is of great importance in organizations. In the last two decades, a lot of work has been done to increase the accuracy of risk impact calculation as well as the right selection of countermeasures. Also, a variety of work has been proposed to select combined countermeasures instead of single ones. So there is a challenge to balance the cost of security with the improvement of the defense system. In this paper, a dataset that includes the organization business processes, security data, assets, vulnerabilities, and related security countermeasures is suggested for the first time. In the previous work, this chain of information from the content of the organization, which is definitely different from another organization, has not been considered for the analysis of the performance of countermeasures (success or failure). Based on the results of the countermeasures during the organization’s lifetime, more efficient countermeasures can be suggested for new or existing risks. Therefore, by intelligently selecting the security countermeasures presented in this paper, organizations will be able to identify ineffective countermeasures and prevent them from being re-selected to counter attackers. In this way, we can make our organization more resilient to attackers over time.

APPLICATION OF TOOLS OF PRIOR INFORMATION IN THE CONTEXT OF IDENTIFYING SECURITY RISKS: THE EXPERIENCE OF THE UNITED STATES

Purpose. The aim of the article is to study the experience of the United States of America in the application of prior information tools in the context of identifying security risks. Methodology of research. The following methods were used to achieve these goals: induction and deduction, theoretical generalization, abstraction, dialectical knowledge - in the study of scientific sources and research of theoretical aspects of the use of information tools in the context of identifying security risks, determining the categorical apparatus; abstract and logical - to generalize theoretical positions, to form conclusions and proposals on the topic of research. Findings. The tools used by the United States Customs Administration to ensure the security of supply chains are the Automated Manifesto System and the Regulations on Import Security Documents. It has been determined that AMS is an electronic system for transmitting information on cargo imported into US customs territory. AMS is analysed in the context of: the list of information that must be provided to the carrier to the customs authority; exceptions to the submission of the manifesto (list of goods that do not require prior notification and exemption for individual countries and regions; liability for violation of the rules of submission of the electronic manifest). It is noted that ISF is a completely new business process that expands the scope of responsibility of the importer and is designed to improve the orientation of the cargo, which consists in detailing information about the goods before loading them in a foreign port. The elements of data submitted by carriers to the ISF, the features of the presentation of preliminary information for transit cargo, the procedure for making changes and corrections to the information provided and the responsibility for violating the rules of submission of the previous message are studied. Originality. The study of international experience in the use of prior information tools in the context of identifying security risks was further developed. Practical value. The main points of this study can be used in the process of developing proposals to improve the procedure for applying the general declaration of arrival. Key words: prior information, security risks, electronic information transmission system, electronic manifesto.

Formalizing the Blockchain-Based BlockVoke Protocol for Fast Certificate Revocation Using Colored Petri Nets

Protocol flaws such as the well-known Heartbleed bug, security and privacy issues or incomplete specifications, in general, pose risks to the direct users of a protocol and further stakeholders. Formal methods, such as Colored Petri Nets (CPNs), facilitate the design, development, analysis and verification of new protocols; the detection of flaws; and the mitigation of identified security risks. BlockVoke is a blockchain-based scheme that decentralizes certificate revocations, allows certificate owners and certificate authorities to revoke certificates and rapidly distributes revocation information. CPNs in particular are well-suited to formalize blockchain-based protocols—thus, in this work, we formalize the BlockVoke protocol using CPNs, resulting in a verifiable CPN model and a formal specification of the protocol. We utilize an agent-oriented modeling (AOM) methodology to create goal models and corresponding behavior interface models of BlockVoke. Subsequently, protocols semantics are defined, and the CPN models are derived and implemented using CPN Tools. Moreover, a full state-space analysis of the resulting CPN model is performed to derive relevant model properties of the protocol. The result is a complete and correct formal BlockVoke specification used to guide future implementations and security assessments.

Research on Intelligent Analysis Technology of Network Security Risk Based on Big Data

Aiming at the severity and distribution of abnormal behaviour, attack behaviour, compliance, and vulnerability of equipment in the power information system, this article applies big data technology to analyse and evaluate abnormal behaviour in the network, and uses machine learning to improve the network, the ability to identify security risks and the accuracy of assessments provide strong guarantees and technical support for improving the security and reliability of power information systems.

A Systematic Literature Review on Cloud Computing Security: Threats and Mitigation Strategies

Cloud computing has become a widely exploited research area in academia and industry. Cloud computing benefits both cloud services providers (CSPs) and consumers. The security challenges associated with cloud computing have been widely studied in the literature. This systematic literature review (SLR) is aimed to review the existing research studies on cloud computing security, threats, and challenges. This SLR examined the research studies published between 2010 and 2020 within the popular digital libraries. We selected 80 papers after a meticulous screening of published works to answer the proposed research questions. The outcomes of this SLR reported seven major security threats to cloud computing services. The results showed that data tampering and leakage were among the highly discussed topics in the chosen literature. Other identified security risks were associated with the data intrusion and data storage in the cloud computing environment. This SLR’s results also indicated that consumers’ data outsourcing remains a challenge for both CSPs and cloud users. Our survey paper identified the blockchain as a partnering technology to alleviate security concerns. The SLR findings reveal some suggestions to be carried out in future works to bring data confidentiality, data integrity, and availability.

Development of electronic banking: a case study of Ukraine

The article examines the practice of providing financial services in the conditions of security electronic business and outlines the preconditions for the transformation of financial services using various forms of electronic banking. The phases of development of Internet banking and use of mobile banking are considered. The international practice of electronic banking on the example of Poland with a detailed analysis of clients and the characteristics of the leading Polish banks is analyzed. The market of domestic Internet banking services is characterized and the main problems that hinder its development in modern conditions are revealed. The advantages and disadvantages of the wide dissemination of Internet technologies in Ukraine are formulated. Almost all banks that occupy leading positions in the market of banking services offer e-banking services, as it enables clients, without attending a branch of banks, to carry out a wide range of banking operations: to manage the volume of resources on their own account; exchange currency; make payments and transfers; pay for services of mobile communication, Internet, utilities, taxes, fines. The introduction of innovative forms of remote-servicing expands the profile of traditional risks and creates new sources of their occurrence. Therefore, the process of identifying security risks in the use of electronic banking, assessments and risk minimization techniques is a prospect for further research.

A security risk mitigation framework for cyber physical systems

AbstractCyber physical systems (CPSs) are safety‐critical, be it weapon systems, smart medical devices, or grid stations. This makes ensuring security of all the components constituting a CPS unavoidable. The rise in the demand of interconnectedness has made such systems vulnerable to attacks, ie, cyberattacks. Over 170 cases of cyber‐security breaches in CPS were reported over the past two decades. An increase in the number of cyberattack incidents on CPS makes them more exposed and less trustworthy. However, identifying the security requirements of the CPS to pinpoint the relevant risks may help to counteract the potential attacks. Literature reveals that the most targeted security requirements of CPS are authentication, integrity, and availability. However, little attention has been paid on certain crucial security attributes such as data freshness and nonrepudiation. One major reason of security breaches in CPS is the lack of custom or generalized countermeasures. Therefore, we propose a security risk mitigation framework for a CPS focused on constraints, ie, authentication, data integrity, data freshness, nonrepudiation, and confidentiality. Furthermore, we evaluate the proposed work using a case study of a safety critical system. The results show a decrease in the severity of the identified security risks, ie, man‐in‐the‐middle attack, spoofing, and data tempering.

Analysis of Safety Factors of Urban Sewage Treatment Plant Based on AHP Method

In the process of social and economic development, the process of urbanization is also accelerating. Environmental engineering has become an important task to ensure the urban environment and the quality of people’s living and living, and is also a key link to achieve urban layout optimization. Due to the late start of environmental engineering in China, there are still many problems to be solved. Based on China’s actual national conditions, this paper classifies the identified security risks and builds a safety evaluation index system for urban sewage treatment plants. Finally, the analytic hierarchy process is used to construct the importance model of security risk factors, and the importance ranking of the main security risk factors is obtained.

Security risk assessment within hybrid data centers: A case study of delay sensitive applications

Data centers are considered a critical form of infrastructure in today’s information society. They are at the core of the cloud computing and services revolution, which has changed the business models on how organizations deal with IT infrastructure costs. The hybrid data center architecture incorporates both legacy and fully virtualized infrastructures. On the one hand, the composite infrastructure has improved resource utilization and consolidation by adding flexibility and scalability factors, making the data center more cost effective and more agile. On the other hand, the hybrid infrastructure has imposed a new set of security challenges that need to be brought into focus. The lack of resource availability can be a great risk for delay sensitive applications such as voice over IP (VoIP) and online gaming when cloud computing is the deployment model. This study addresses the emerging risk problem by conducting a comprehensive security risk assessment using the NIST national vulnerability database (NVD) combined with EBIOS risk analysis and evaluation methodology. This study focuses on resource availability problem emanating from delay variations and queuing mechanisms in virtualized systems and its impact on delay sensitive applications. The study argues for the existence of availability risk within the hybrid data center infrastructure, which can deteriorate the performance of delay sensitive applications. Security remedial and countermeasures to the identified security risks are suggested in an extended discussion at the end of the study.

Introducing OSSF: A framework for online service cybersecurity risk management

This paper proposes a new framework for online services security risk management which can be used by both service providers and service consumers. The proposed framework was validated through a case study performed in a large enterprise environment. The key components of the proposed framework are Threat model and Risk model. These models are designed to fit specific features of online services and the surrounding cyberspace environment. A risk management process is an integral part of the framework. The process is suitable for frequent and recurrent risk assessments. The process execution results in identification and performance of proper tasks which contribute to treatment of identified security risks and deficiencies. Online services risk score could be continuously documented and reported if the process is executed on a regular basis.

Identifying and Analyzing Security Risks in Android Application Components

Android operating system provides a rich inter-application message passing system. The mechanism encourages inter-application collaboration and reduces developer burden by facilitating component reuse. Unfortunately, message passing is also an application attack surface. The content of messages can be sniffed, modified, stolen, or replaced, which can compromise user privacy. In this paper, we examine Android application interaction and identify security risks in application components. We provide a method that detects application communication vulnerabilities. And the effectiveness of the method is verified by experiments.

Mitigating Risks Associated with Transitive Trust in Service-Based Identity Propagation

ABSTRACT Over the past 20 years, software has evolved from monolithic, stove-piped applications to services that communicate with other distributed components over communications networks. The rise in popularity of Service-oriented Architecture (SOA) and web services has presented unique challenges for securely conveying the identity of end users at every point, especially when mashups, Web service composition and orchestration solutions combine multiple distributed components throughout a network, and where each component may need to know the identity of the end user. Over the past decade, many U.S. government projects have embraced SOA, have identified security risks with certain types of identity propagation, and have built solutions for mitigating the risks. This paper focuses on identity propagation in Web service transactions and describes how several early SOA-based projects utilized “transitive trust” approaches. We categorize the security risks found and describe how these projects minimized or mitigated the risks. Finally, we discuss approaches used in current projects and provide guidance for future implementations.

Web 2.0 Technologies and Social Networking Security Fears in Enterprises

Web 2.0 systems have drawn the attention of corporation, many of which now seek to adopt Web 2.0 technologies and transfer its benefits to their organizations. However, with the number of different social networking platforms appearing, privacy and security continuously has to be taken into account and looked at from different perspectives. This paper presents the most common security risks faced by the major Web 2.0 applications. Additionally, it introduces the most relevant paths and best practices to avoid these identified security risks in a corporate environment.

Supply Chain Security: Adding to a Complex Operational and Institutional Environment

There has been an avalanche in new supply chain security focused controls. The aim of these controls is to seek cooperative arrangements between regulatory agencies and businesses, and to identify security risks before goods move. This paper shows the complexity of the cross-border environment, including the operational frustrations experienced by interviewed representatives at United Kingdom (UK) ports. It also maps out the institutional mechanisms between public and private sector actors shaping cross-border procedures. It is argued that current mechanisms for shaping governing rules and procedures are insufficient. Further alignment of institutions with operational requirements is required to ensure that supply chain security objectives are met.