Improve Security Awareness Research Articles

Security paradigms for IoT in telecom networks: Conceptual challenges and solution pathways

The concept paper explores the critical security challenges posed by the Internet of Things (IoT) in telecom networks and proposes solution pathways to address them. As IoT devices proliferate in telecom networks, they introduce new vulnerabilities and security threats that must be mitigated to ensure the integrity, confidentiality, and availability of network resources and data. The paper begins by highlighting the unique security challenges posed by IoT devices, including their large attack surface, resource constraints, and diverse communication protocols. These challenges are further exacerbated in telecom networks due to the scale and complexity of the infrastructure. To address these challenges, the paper proposes a multi-faceted approach that combines technical, organizational, and regulatory measures. Technical solutions include the use of secure communication protocols, device authentication mechanisms, and encryption techniques to protect data in transit and at rest. Organizational measures focus on improving security awareness and training among network operators and ensuring the secure development and deployment of IoT devices. Regulatory measures advocate for the implementation of standards and regulations that promote security and privacy in IoT deployments. The paper also discusses the importance of collaboration among stakeholders, including network operators, device manufacturers, and regulatory bodies, to address security challenges effectively. By working together, stakeholders can develop and implement best practices that enhance the security of IoT devices and telecom networks. In conclusion, the concept paper highlights the urgent need for robust security paradigms in IoT deployments within telecom networks. By implementing the proposed solution pathways and fostering collaboration among stakeholders, telecom networks can mitigate security risks and ensure the safe and secure deployment of IoT devices. Keywords: IoT, Telecom, Networks, Security.

SECURITY PARADIGMS FOR IOT IN TELECOM NETWORKS: CONCEPTUAL CHALLENGES AND SOLUTION PATHWAYS

The concept paper explores the critical security challenges posed by the Internet of Things (IoT) in telecom networks and proposes solution pathways to address them. As IoT devices proliferate in telecom networks, they introduce new vulnerabilities and security threats that must be mitigated to ensure the integrity, confidentiality, and availability of network resources and data. The paper begins by highlighting the unique security challenges posed by IoT devices, including their large attack surface, resource constraints, and diverse communication protocols. These challenges are further exacerbated in telecom networks due to the scale and complexity of the infrastructure. To address these challenges, the paper proposes a multi-faceted approach that combines technical, organizational, and regulatory measures. Technical solutions include the use of secure communication protocols, device authentication mechanisms, and encryption techniques to protect data in transit and at rest. Organizational measures focus on improving security awareness and training among network operators and ensuring the secure development and deployment of IoT devices. Regulatory measures advocate for the implementation of standards and regulations that promote security and privacy in IoT deployments. The paper also discusses the importance of collaboration among stakeholders, including network operators, device manufacturers, and regulatory bodies, to address security challenges effectively. By working together, stakeholders can develop and implement best practices that enhance the security of IoT devices and telecom networks. In conclusion, the concept paper highlights the urgent need for robust security paradigms in IoT deployments within telecom networks. By implementing the proposed solution pathways and fostering collaboration among stakeholders, telecom networks can mitigate security risks and ensure the safe and secure deployment of IoT devices. Keywords: Security, IoT, Telecom, Solutions, Network.

Machine-Learning-based User Behavior Classification for Improving Security Awareness Provision

Machine-Learning-based User Behavior Classification for Improving Security Awareness Provision

An Information System Risk Management of a Higher Education Computing Environment

Cyber risks, data loss or data leakage, loss exposure are one of the most customer and business significant threats. Those data contained information and were stored in electronic form that made them vulnerable to be hacked. The major target of hackers intruding is the higher education institutions. Therefore, many organizations perform information system risk management to identify their weaknesses and enforce the security of their system. The study aims to identify, analyze, and measure the risks associated with information systems specifically evolve in the higher education sector environment. Then it provides solutions and recommendations for the higher education sector to improve the quality of their information systems. Information system risk management was performed in the computing environment of the Faculty of Medicine, X University. It was conducted using the OCTAVE Allegro framework. The framework can streamline and optimize the information system risk management process through eight steps and various worksheets and questionnaire sheets for guidelines. After completing all the required data, the analysis was conducted to determine the critical information assets for the organization. The results showed that there were 8 (eight) critical information assets. One of them is the Student Profile. It was continued to be assessed using a chronological approach of information system risk management for improving security awareness and formulating mitigation strategies as the control actions. This paper's analysis and results are expected to contribute to the implementation of information system risk management for real case applications in different sectors.

SAWIT—Security Awareness Improvement Tool in the Workplace

Cyberattacks are becoming increasingly sophisticated and severe, and an organization’s protection depends on its weakest member. Although users are aware of the risks in cyberspace, most of them do not follow best practices, and there is a need for permanent structured training. The majority of previous training programs concentrated on technically educated users, but the organization is only as secure as the most vulnerable link in it. The paper presents SAWIT, a new Web tool, created with the goal of improving security awareness among employees. It is an innovative artificial intelligence framework aimed at improving the cyber security knowledge of employees by using collaborative learning and assessment within the specified knowledge transformation model.

Design and development of vulnerability management portal for DMZ admins powered by DBPowder

It is difficult to promote cyber security measures in research institutes, especially in DMZ networks that allow connections from outside network. This difficulty mainly arises from two types of variety. One is the various requirements of servers operated by each research group. The other is the divergent skill level among server administrators. Unified manners rarely fit managing those servers. One of the solutions to overcome the above mentioned difficulties is vulnerability management. To overcome these challenges, There are two possible approaches. One of the options is to offer a simple and powerful vulnerability management service to the administrators of the DMZ hosts (DMZ admins). The other is to facilitate flexibility and efficiency in the development process of the service. To achieve these requirements, we designed and developed a vulnerability management portal site for DMZ admins, named DMZ User’s Portal. This paper describes the design of DMZ User’s Portal and the development process using a development framework, named DBPowder. Using the DMZ User’s Portal, each DMZ admin can perform a vulnerability scan on his/her own servers with ease. In other words, this delegates security vulnerability discovery and responsibility to individual DMZ admins that improve security awareness for them. Then, each DMZ admin can grasp and manage the security by himself/herself. The 13-year result from vulnerability scans show that the status of security in the KEK-DMZ has been kept in good conditions. Also, we are developing DBPowder object-relational mapping (ORM) framework to improve the flexibility and efficiency in the development process of DMZ User’s Portal.

Design and preliminary evaluation of a cyber Security Requirements Education Game (SREG)

Context: Security, in digitally connected organizational environments of today, involves many different perspectives, including social, physical, and technical factors. In order to understand the interactions among these correlated aspects and elicit potential threats geared towards a given organization, different security requirements analysis approaches are proposed in the literature. However, the body of knowledge is yet to unleash its full potential due to the complex nature of security problems, and inadequate ways to improve security awareness of key players in the organization. Objective: Objective(s) of the research study is to improve the security awareness of players utilizing serious games via: (i) Know-how of security concepts and security protection; (ii) guided process of identifying valuable assets and vulnerabilities in a given organizational setting; (iii) guided process of defining successful security attacks to the organization. Method: Important methods used to address the above objectives include: (i) a comprehensive review of the literature to better understand security and game design elements; (ii) designing a serious game using cyber security knowledge and game-based techniques combined with security requirements engineering concepts; (iii) using empirical evaluation (observation and survey) to verify the effectiveness of the proposed game design. Result: The solution proposed is a serious game for security requirements education, which: (i) can be an effective and fun way of learning security related concepts; (ii) mimics a real life problem setting in a presentable and understandable way; (iii) motivates players to learn more about security related concepts in future. Conclusion: From this study, we conclude that the proposed Security Requirement Education Game (SREG) has positive results and is helpful for players of the game to get an understanding of security attacks and vulnerabilities.

Review of cybersecurity issues in industrial critical infrastructure: manufacturing in perspective

ABSTRACTNowadays, the industrial sector is being challenged by several cybersecurity concerns. Direct attacks by malicious persons and (or) software form part of the severe jeopardies of industrial control systems (ICSs). These affect products/production qualities, brand reputations, sales revenues, and aggravate the risks to health and safety of human lives. These have been enabled due to progressive adoption of technology trends like Industry 4.0, BYOD, mobile computing, and Internet-of-Things (IoT), in the quest for improved relevance and value of production decisions, minimised operational overheads, optimum resource utilisation, markets globalisation, etc. However, several security vulnerabilities and risks have also emerged, and are increasingly being exploited in the industrial sector especially manufacturing. To manage this phenomenon, refined and holistic (combining people, process, and technology perspectives) security strategies and solutions are required to enhance security in ICS. This paper offers an insightful review of possible solution path beginning with the understanding of ICS security trends relative to cyber threats, vulnerabilities, attacks and patterns, agents, risks, and the impacts of all these on the industrial environment and entities that depend on it. Such episteme can improve security awareness, proficiency for respective stakeholders, and advance the development of appropriate security mechanisms, and adoption of recommendations.

GakuNinMoodle: Toward Robust E-Learning Services Using Moodle in Japan

In this study, we aim to improve security awareness education by developing more robust e-learning services that can maintain itself in the busy period including the beginning of new semesters. This paper focuses on the improvement of e-learning services on Moodle with limited system resources. The course design and Moodle management were improved as follows after some workarounds: (1) The “Final Test,” which is a JavaScript-based test inside the Shareable Content Object Reference Model (SCORM) content was divided into a Moodle quiz module. “Conditional Activities” were then adopted to allow users to take the “Final Test” after the completion of the SCORM content. (2) The course was reset annually to delete all SCORM tracking data. In this study, we obtain effective operational findings for developing robust e-learning services, particularly for Moodle. As a result, we can provided robust e-learning services in Japan because GakuNinMoodle and the security awareness education course for federated institute, “Learn with Princess Rin Rin: Cyberethics” are accessed by 102 institutes including Kyoto University, Gunma University, and National Institute of Technology through actual operations. In general, database optimization is the best method for improving LMS performance with limited system resources. Specifically, online courses that include SCORM content should be considered as an overhead of API calls between LMS and SCORM content to determine a temporary solution under the constraint of limited resources to improve the performance of LMS when numerous accesses and downloads of learning reports are requested. Therefore, robust e-learning services with Moodle can be obtained even with limited resources. Additional research is being conducted to analyze learning records and system logs to improve the contents according to the assumption that the best method to improve e-learning is by considering learner's behavior.

Only play in your comfort zone: interaction methods for improving security awareness on mobile devices

In this paper, we study the concept of security zones as an intermediate layer of compartmentalization on mobile devices. Each of these security zones is isolated against the other zones and holds a different set of applications and associated user data and may apply different security policies. From a user point of view, they represent different contexts of use for the device, e.g., to distinguish between gaming (private context), payment transactions (secure context), and company-related email (enterprise context). We propose multiple visualization methods for conveying the current security zone information to the user, and interaction methods for switching between zones. Based on an online and a laboratory user study, we evaluated these concepts from a usability point of view. One important result is that in the tension field between security and usability, additional hardware can support the user’s awareness toward their zone context.

How Management Goes Wrong? – The Human Factor Lessons Learned from a Cyber Incident Handling Exercise

A cybersecurity hazard in a Critical Infrastructure (CI) is not only about computer malfunction, but is also affecting safety and business continuity of CI. The study on human contribution to cyber resilience is unexplored terrain in the field of critical infrastructure security. So far cyber resilience has been discussed as an extension of the IT security research. Although cybersecurity training is a common measure to implement because of its low cost, most of the training courses aim at improving security awareness of employees, in order to prevent the human-error. However, this approach does not address resilience in handling a cyber incident. The authors conducted observations in a full-scale adversarial cyber security training for CI, where participants are divided into an offensive and a defensive team. The latter acts as one organization and its members play assigned roles such as manager, factory operator and IT administrator. From our observations, some tendencies are found in the defensive team's negative social behaviors and the management issues that lead to malfunction of the team. In fact, these behaviors are perceived in every group of participants, regardless of the variation in their experience and in knowledge on the field. In this paper, the findings from the above mentioned observations are presented as possible challenges in real-world cyber incident management.

Reducing Risky Security Behaviours: Utilising Affective Feedback to Educate Users

Despite the number of tools created to help end-users reduce risky security behaviours, users are still falling victim to online attacks. This paper proposes a browser extension utilising affective feedback to provide warnings on detection of risky behaviour. The paper provides an overview of behaviour considered to be risky, explaining potential threats users may face online. Existing tools developed to reduce risky security behaviours in end-users have been compared, discussing the success rates of various methodologies. Ongoing research is described which attempts to educate users regarding the risks and consequences of poor security behaviour by providing the appropriate feedback on the automatic recognition of risky behaviour. The paper concludes that a solution utilising a browser extension is a suitable method of monitoring potentially risky security behaviour. Ultimately, future work seeks to implement an affective feedback mechanism within the browser extension with the aim of improving security awareness.

The Roundup

The Roundup

Experience with video games for security

This paper describes the creation of video games to teach security. The first section explains why video games can be effective tools for improving security awareness. The next section provides an overview of existing video games related to security. The third section describes why three platforms for building videogames were selected. The last section describes the prototypes created and the results of classroom testing.

Managing threats by the use of visualisation techniques

Identification of threats in networked systems is one of the important risk management processes that should be followed in order to be aware of all risks. In general, risk assessment guidelines for threat analysis propose to use historical organisation's data, thus, novel and unheard threats often are skipped from an analysis. In this paper, we propose a novel onion skin model (OSM) which consists of visualisation techniques, such as attack graphs, often applied for qualitative and quantitative risk assessment analyses. The model can be used to facilitate in threat identification and decision-making process by focusing on attack scenarios that illustrate vulnerable nodes, threats and shortest attack paths to the attacker's goal. The model can be used as part of risk management practices to improve security awareness through different attack scenarios and manage all system risks.