Information Breaches Research Articles

Privacy Breaches and the Effect of Customer Notification

Laws requiring firms to disclose privacy breaches to their customers have been adopted extensively worldwide. However, the manner in which these laws affect the security protection behavior of firms disclosing a data breach is poorly understood. To shed light on this issue, we leveraged institutional theory and examined how U.S. state data breach notification laws (DBNLs), under which firms must notify customers of personal information breaches, influenced firm-level incidence of security breaches and how such influence manifested heterogeneously across firms. Exploiting the staggered enactments of DBNLs in a difference-in-differences analysis, we found that firms experienced a significant reduction in data breach incidents after the implementation of DBNLs. This effect was more pronounced among firms that were more reliant on sensitive customer data, operated in stricter privacy protection environments, or held more intangible and digital assets. We document evidence that compared to firms not subject to DBNLs, firms subject to these laws are more likely to appoint IT-specialized executives and remediate IT-related internal control weaknesses, which suggests potential channels that may facilitate DBNLs’ curbing of data breaches. We also found that the reduction in breach incidences following DBNL-mandated disclosure policies relates to both endogenous breaches and exogenous cyberattacks.

Intrusion Detection System using Machine Learning

The objective of this venture is to make an interruption location framework (IDS) that can recognize and halt any security dangers in organize activity by applying machine learning strategies. The system's objective is to successfully distinguish irregularities and designs of unauthorized get to by utilizing administered learning procedures. Real- time observing, tall danger location precision, and adaptability in reaction to changing cyberthreats are among its key characteristics. We are going prepare the framework with an broad dataset of both authentic and malevolent arrange movement. Within the conclusion, the IDS looks for to make strides arrange security and effectively halt information breaches

A Privacy-Preserving Data Mining Through Comprehensive GNIPP Approach in Sensitive Data Sets

The quick growth of methods for analyzing data and the availability of easily available datasets have made it possible to build a thorough analytics model that can help with support decision-making. In the meantime, protecting personal privacy is crucial. A popular technique for medical evaluation and prediction, decision trees are easy to comprehend and interpret. However, the decision tree construction procedure may reveal personal information about an individual. By keeping the statistical properties intact and limiting the chance of privacy leaking within a reasonable bound, differential privacy offers a formal mathematical definition of privacy. To construct a boosting random forest that preserves privacy, we propose a Gaussian Noise Integrated Privacy Preservation (GNIPP) in this study. To address the issue of personal information breaches, we have designed a unique Gaussian distribution mechanism in GNIPP that enables the nodes with deeper depth to obtain more privacy during the decision tree construction process. We propose a comprehensive boosting technique based on the decision forest's prediction accuracy for assembling multiple decision trees into a forest. Furthermore, we propose an iterative technique to accelerate the assembly of decision trees. After all, we demonstrate through experimentation that the suggested GNIPP outperforms alternative algorithms on two real-world datasets.

Practices and systems employed by health professionals toward protection and confidentiality of patient health records in Ghana

ObjectivesHealth information relies on a patient's sensory perceptions as well as objective assessments, diagnoses, and test findings. Ghana's current laws governing the confidentiality of patient health data seems a little pertinent in spite of ongoing conversations on the significance of patient health information and the necessity to protect patient information from improper disclosure. The study therefore investigated the extent of patient confidentiality in Ghana by looking into the guidelines, regulations, and rules that govern patient records. MethodsThe interpretive, phenomenological, and narrative methodologies used in qualitative research were employed to study the phenomenon. Twenty (20) participants were interviewed in a semi-structured manner to gather the data needed for the analysis comprising of Doctors, Nurses, Administrative staff, Record Officers, and Information Communication Technology (ICT0 Technicians of five Departments in La General Hospital. The Activity Theory was used as a theoretical foundation for the study ConclusionsThe study revealed that healthcare professionals uphold the moral standards relating to patient confidentiality and trust. Again, the findings of the study showed that medical records are safely stored through the use of Electronic Health Record system in the hospital in a manner that wouldn't compromise patient confidentiality. However, the results establishes that health care workers can potentially serve as a conduit for the leak or breach of patient information through negligence and unprofessional practices. Public interest statementThe study investigated systems and practices that are employed by health workers in Ghana to ensure that patient health records are safeguarded in order to build patients confidence in how their health records are protected. Health workers were interviewed in this study and the findings of the study show that there are practices and systems put in place to safeguard patient health records in the hospitals. Although, it was established that EHR systems help in safeguarding patient health records, the study recommends the need for users of the Health Electronic Records to be fully involved in the implementation process and strict enforcement of policies regarding the use of the EHR system to help prevent negligence and unprofessional application of the system.

Effective knowledge representation and utilization for sustainable collaborative learning across heterogeneous systems

AbstractThe increasingly decentralized and private nature of data in our digital society has motivated the development of collaborative intelligent systems that enable knowledge aggregation among data owners. However, collaborative learning has only been investigated in simple settings. For example, clients are often assumed to train solution models de novo, disregarding all prior expertise. The learned model is typically represented in task‐specific forms that are not generalizable to unseen, emerging scenarios. Finally, a universal model representation is enforced among collaborators, ignoring their local compute constraints or input representations. These limitations hampers the practicality of prior collaborative systems in learning scenarios with limited task data that demand constant knowledge adaptation and transfer across information silos, tasks, and learning models, as well as the utilization of prior solution expertise. Furthermore, prior collaborative learning frameworks are not sustainable on a macro scale where participants desire fairness allocation of benefits (e.g., access to the combined model) based on their costs of participation (e.g., overhead of model sharing and training synchronization, risk of information breaches, etc.). This necessitates a new perspective of collaborative learning where the server not only aggregates but also conducts valuation of the participant's contribution, and distribute aggregated information to individuals in commensurate to their contribution. To substantiate the above vision, we propose a new research agenda on developing effective and sustainable collaborative learning frameworks across heterogeneous systems, featuring three novel computational capabilities on knowledge organization: model expression, comprehension, and valuation.

A key distribution technique for wireless sensor networks using spanning trees

Protocols for encrypting communications in wireless sensor networks have rarely been addressed from a classical network optimization perspective. An underlying procedure of such protocols, known as key distribution, involves assigning cryptographic keys to sensors, which are then used to encrypt and decrypt transmitted data. In context of maximizing communications security objectives, the combinatorial nature of assigning keys to sensors with limited memory capacities exhibits properties conducive to developing methods for finding optimal key distributions. This work focuses on the q-Composite key distribution/assignment protocol, which requires that two sensors share at least q common keys to securely exchange data. As a means of reducing the likelihood of large-scale information breaches if a small number of keys are compromised, a security objective of maximizing the number of non-redundant (unique) keys assigned to the sensors is considered. It is demonstrated that node (sensor) degrees in a spanning tree, along with their memory capacities, can be used to exactly determine the maximum possible number of non-redundant keys assigned. Leveraging on these properties, our method reduces the problem of assigning a maximum number of keys to that of finding a degree-bounded spanning tree in a network. A polynomial time solution algorithm along with a linear time algorithm for assigning a maximum number of unique keys is introduced. Broadly, the proposed method provides a novel approach for designing, analyzing, or identifying secure key distributions in large-scale networks by using properties of the underlying graphs.

Understanding patient perspectives on digital therapeutics and its platform for insomnia: insights from focused group interviews

BackgroundDigital therapeutics (DTx) is a treatment option that uses computer software to provide evidence-based interventions for medical disorders. DTx platforms are digital services that facilitate interactions among stakeholders of DTx treatment within a standardized structure. However, there is still a lack of overall awareness regarding the effectiveness and usage of DTx and DTx platforms. This study aimed to investigate insomnia patients’ recognition, thoughts, feelings, and demands for conventional treatments versus DTx for insomnia.MethodsNine participants, aged 19–50 years, who had experience with professional medical interventions for insomnia, were recruited through purposive sampling. Two online focus group interviews, each lasting 1.5 h, were conducted. The interview questions focused on difficulties encountered during conventional treatment, inadequate recognition of DTx, and concerns and demands regarding DTx and its platform. The data were analyzed using thematic analysis.ResultsThe participants reported subjective difficulties associated with receiving conventional treatment, including concerns about drug side effects and dependence, social stigma, and lack of perceived necessity for treatment. They expressed concerns about DTx, such as cost-effectiveness, evidence on efficacy, and concerns about breach of personal information. Additionally, their demands included convenience of use, reduction in social stigma related to the use of DTx, compatibility of DTx with other healthcare systems, and enhanced communication with healthcare providers when using DTx platforms.ConclusionsThe focus group highlighted the need for increased awareness, demonstrated efficacy, cost-effectiveness, cybersecurity measures, and accessibility of insomnia DTx and its platforms. Tailored approaches considering patient characteristics are crucial for widespread adoption of insomnia DTx and its platforms.

PHISHWIPER: Real Time Scam Website Detection and Blocking using Predictive Attention Model

A data breach is a security event, where sensitive data is accessed without any permission from a website or an organization. An information breach will be considered as the purposeful or accidental gathering of secure or personal data from an organization. A breach can be an accession of a data without any permission, these kinds of regulations should be provided with safe and secured framework but this is not happening in many corporations. So, by analyzing the previous attempts (successful or unsuccessful attacks), the proposed model can be trained to adapt to new scenarios and predict the next breach. Further, this research work has designed a model by using machine learning to defend a website from security breaches. The primary aim of this research work is to create a machine learning model, which trains in Real-time and monitors the website or a system and trains from the state-of-art attacks. The proposed model has created a web application, which takes the data from multiple sources such as Amazon, Flipkart, Snapdeal, and Shop clues, which shows the data that is safe to obtain from the website.

Consumer Confidence in Digital Finance: Trust Dynamics in Online Banking

Consumer Confidence in Digital Finance: Trust Dynamics in Online Banking

Precursor of privacy leakage detection for individual user

The pursuit of dividends from the burgeoning realm of data traffic has emerged as a prevailing trend. Given this current state of affairs, the safeguarding of personal information has become an urgent task. Current methods for personal privacy protection primarily offer alerts when information breaches occur, but at that stage, irreversible breaches have already transpired. Thus, the study of preemptive privacy breach prediction is a task of significant importance within the realm of privacy protection. However, the endeavor to predict privacy breaches in advance remains exceedingly challenging, owing to several factors: (i) The complexity of social networks gives rise to high-dimensional features. (ii) Concerning the comprehensive and precise capture of pathways leading to information leakage. (iii) How to employ time series data effectively to realize early predictions.This study proposes a novel approach for constructing graph neural networks and forecasting privacy breaches, centered on the context of user-generated content within specific time frames, integrates spatial graph structures with temporal series information. The integration can entirely achieve the advance prediction of users' privacy status, thereby preventing information leakage. Empirical tests on real-world datasets demonstrate that our approach surpasses traditional time series forecasting methods in privacy breach predictions, achieving a notable average improvement of 2% in F1 score, Recall, and Precision metrics.

Towards Enforcing Good Digital Citizenship: Identifying Opportunities for Adolescent Online Safety Nudges

With the prevalence of risks encountered by youth online, strength-based approaches such as nudges have been recommended as potential solutions to guide teens toward safer decisions. However, most nudging interventions to date have not been designed to cater to teens' unique needs and online safety concerns. To address this gap, this study provided a comprehensive view of adolescents' feedback on online safety nudges to inform the design of more effective online safety interventions. We conducted 12 semi-structured interviews and 3 focus group sessions with 21 teens (13 - 17 years old) via Zoom to get their feedback on three types of nudge designs from two opposing perspectives (i.e., risk victim and perpetrator) and for two different online risks (i.e., Information Breaches and Cyberbullying). Based on the teens' responses, they expressed a desire that nudges need to move beyond solely warning the user to providing a clear and effective action to take in response to the risk. They also identified key differences that affect the perception of nudges in effectively addressing an online risk, they include age, risk medium, risk awareness, and perceived risk severity. Finally, the teens identified several challenges with nudges such as them being easy to ignore, disruptive, untimely, and possibly escalating the risk. To address these, teens recommended clearer and contextualized warnings, risk prevention, and nudge personalization as solutions to ensure effective nudging. Overall, we recommend online safety nudges be designed for victim guidance while providing autonomy to control their experiences, and to ensure accountability and prevention of risk perpetrators to restrict them from causing harm.

A Secure VM Placement Strategy to Defend against Co-residence Attack in Cloud Datacentres

With the increasing number of co-residence attacks, the security of the multi-tenant public IaaS cloud environment has become a growing concern. The co-residence attacker creates a side channel to retrieve the secured data. These attacks help the adversary to leak out the sensitive information of the user with whom it is co-located. This paper discusses a secured VM placement technique, Previous Server and Co-resident users First (PSCF), which focuses on facilitating security against the co-residence attack by minimizing the probability of co-locating the malicious user with the authentic user. Co-location resistance and core utilization metrics are utilized to evaluate the algorithm’s performance. The proposed method is simulated, and the result is analysed and compared with existing approaches like Best Fit, Worst Fit, PSSF, and SC-PSSF. It is observed that the proposed approach furnished maximum co-location resistance of 74.32% and a core utilization of 82.63%. Further, the algorithm has shown significant performance in balancing the load and energy consumption. The result has reduced the probability that malicious users co-located with the authentic one, thus reducing the security breach of confidential information.

SCFS-securing flying ad hoc network using cluster-based trusted fuzzy scheme

AbstractFlying Ad hoc Networks have emerged as a promising technology for number of real-time applications. However, the flexible and unstructured characteristics of these networks make them vulnerable to security threats posed by malicious nodes, such as denial of service attacks, node impersonation, and information breaches. Another major issue is the consideration of those nodes being unable to prove their trustworthiness due to factors like hardware or software failure, or by link interruptions, during the processing of detection of false nodes in the network. The existing mechanisms encompassing encryption, authentication, and intrusion detection highlight limitations to secure real-time applications and services due to the high speed of flying nodes and the absence of fixed network structures. To overcome these constraints, this research paper incorporates a novel framework for evaluating and improving the security of network by introducing an innovative cluster-based approach. Moreover, it presents a fuzzy model that dynamically estimates the trust levels of both individual nodes and clusters, by assigning weight to the parameters to address vulnerabilities. Additionally, a trust reconfiguration mechanism is further proposed to address the issue of nodes unable to substantiate their trust by providing them with additional chances based on the collective trust from previous evaluations. Further, the paper incorporates a dynamic reputation system to proficiently identify and separate malicious and selfish nodes from the network. Simulation results indicate a significant improvement in performance metrics, with a considerable reduction in delay and drop ratio by 41.46% and 36.37%, respectively, while the sufficient rise of 54.71% and 46.05% in throughput and coverage, respectively, comparing with the considered state-of-art.

개인정보 분쟁의 특수성과 분쟁해결제도에 관한 연구

The proliferation of indispensable platforms and services has elevated the utilization of users' personal data, consequently giving rise to an escalation in personal information disputes. Over the past decade, the number of cases managed by the Personal Information Dispute Resolution Committee has surged by 582%. Traditional legal proceedings face formidable challenges due to substantial time and cost constraints, hindering expeditious resolutions. Furthermore, the multifaceted nature of personal information breaches adds complexity to accurately discerning the nuances of the damages incurred.
 Personal information breaches occur on various fronts, disseminating sensitive information through online behavioral tracking technology and big data analysis. Due to the unique characteristics associated with personal information, including anonymity, data intricacies, and technological vulnerabilities, a diverse range of breach methods emerges.
 Personal information breaches occur on various fronts, disseminating sensitive information through online behavioral tracking technology and big data analysis. Due to the unique characteristics associated with personal information, including anonymity, data intricacies, and technological vulnerabilities, a diverse range of breach methods emerges.
 Disputes related to personal information have the potential to evolve into significant issues affecting not only individual concerns but the entire societal landscape. Recognizing and increasing awareness of this importance, along with efforts for legal system enhancements, becomes imperative. This study aims to explore effective improvements in the system and appropriate policy directions for addressing disputes related to personal information.

Dark Web Marketplaces: Data for Collaborative Threat Intelligence

The dark web has become an increasingly important landscape for the sale of illicit cyber goods. Given the prevalence of malware and tools that are used to steal data from individuals on these markets, it is crucial that every company, governing body, and cyber professional be aware of what information is sold on these marketplaces. Knowing this information will allow these entities to protect themselves against cyber attacks and from information breaches. In this article, we announce the public release of a data set on dark web marketplaces’ cybersecurity-related listings. We spent multiple years seeking out websites that sold illicit digital goods and collected data on the available products. Due to the marketplaces’ varied and complex layers of security, we leveraged the flexible Selenium WebDriver with Python to navigate the web pages and collect data. We present analysis of categories of malicious cyber goods sold on marketplaces, prices, persistent vendors, ratings, and other basic information on marketplace storefronts. Additionally, we share the tools and techniques we’ve compiled, enabling others to scrape dark web marketplaces at a significantly lower risk. We invite professionals who opt to gather data from the dark web to contribute to the publicly shared threat intelligence resource.

The Influence of Online Shopping Adoption Determinants on Customer Satisfaction in China: A Technology Acceptance Model (TAM) Approach

The rapid expansion of technologies leads to new ways of business being conducted. E-commerce is the platform used by the business organization to selling their products to customers. Today, we can see the increasing readiness to shop online. This research study the factors that lead to the consumers’ satisfaction to shop online. Online shopping applications raise issues such as breach of information, late delivery, poor good quality, inefficient logistics services, and unfair return policy due to poor e-commerce conduct. The significance of this study is to increase the quality of e-commerce delivered by the business organization especially the Small Medium Enterprise (SMEs) to increase the customers’ satisfaction. According to this research study, the factors that influence the customers’ satisfaction to shop online are security, information availability, shipping, quality, pricing, and time. The data collected through the development of questionnaires distributed using Google Forms. The results gathered will be analysed by using the Statistical Package for Social Sciences (SPSS 26.0) and SmartPLS.

Should consumers be prohibited from storing card data on the internet?

ABSTRACT In March 2020, the Reserve Bank of India’s guidelines on Payment Aggregators and Payment Gateways prohibited merchants from storing data on cards used by customers. This paper argues that such a prohibition on card data storage impacts upon the ease of transactions for consumers, and effectively tilts consumer preference towards other payment instruments. This runs the risk of technological choices in the industry being made or substantially shaped by the regulator. The documents released lack a cost-benefit analysis of this prohibition and do not demonstrate that the chosen intervention is the best one. This raises concerns in the light of emerging Indian jurisprudence on the standards of regulatory governance to be met by statutory regulatory agencies. We show alternative approaches to address concerns relating to breaches of card information stored by consumers on the internet. These include better security standards and liability frameworks.

An Escalated Eavesdropping Attack on Mobile Devices via Low-Resolution Vibration Signals

With the global prevalence of mobile devices, concerns about mobile devices regarding privacy breaches and data leakage are rising. Although sensor permissions are required for mobile applications to access outputs of built-in sensors, motion sensors (e.g., accelerometer and gyroscope) can be visited directly without permission requirement. Extant studies have shown that motion sensors may cause breaches of confidential information, such as passwords, digits, and voice-based commands, but whether it is possible to synthesize intelligible speech waveforms from low-resolution motion sensors has been understudied. In this paper, we present an escalated side-channel attack of built-in speakers by synthesizing intelligible speech waveforms from low-resolution vibration signals. Opposite to traditional classification problems, we formulate this task as a generative problem and introduce an end-to-end synthesis framework dubbed as <i>AccMyrinx</i> to eavesdrop on the speaker via the low-resolution vibration signals. In <i>AccMyrinx</i>, we introduce the data alignment solution to provide the pair-wise voice-vibration sequences and present wavelet-based MelGAN (WMelGAN) with multi-scale time-frequency domain discriminators to generate intelligible acoustic waveforms. We conducted intensive experiments and demonstrated the feasibility of synthesizing the intelligible acoustic signals from low-resolution solid-borne vibration signals. Compared with existing synthesis solutions, our proposed solution outperforms the baselines in both subject and object metrics with the smoothed word error rate of 42.67&#x0025; and the Mel-Cepstral distortion of 0.298. In addition, the quality of synthetic speeches could be impacted by several factors, including gender, speech rate, volume, and sampling frequency.

영업비밀보호에 관한 형사법적 보호방안

In the rapidly evolving high-tech industry, the significance of safeguarding trade secrets is growing exponentially as the risk of unauthorized access and information breaches continues to escalate. A “trade secret” is information, including a method of manufacture, method of sale, technical or business information useful in the conduct of business, which is not publicly known, is the subject of reasonable efforts to maintain its secrecy, and has independent economic value. The Unfair Competition Prevention and Trade Secret Protection Act in Korea serves to shield these trade secrets from infringement. Nonetheless, the current penalty structure outlined in the Unfair Competition Prevention and Trade Secret Protection Act faces several shortcomings. In practical terms, the offense of breaching professional trust has been widely employed to facilitate criminal sanctions against trade secret violations. However, this excessive reliance on the breach of professional trust crime has resulted in a lack of clarity regarding the elements stipulated in the Unfair Competition Prevention and Trade Secret Protection Act. To effectively penalize accomplices involved in trade secret infringements and those attempting to unlawfully obtain trade secrets, a comprehensive and well-grounded approach must be adopted. This necessitates considering attempts, preparations, and conspiracies as integral components of the Unfair Competition Prevention and Trade Secret Protection Act.

University students' awareness of e-waste and its disposal practices in Pakistan: a construction of the conceptual framework.

Pakistan is among the few countries generating and receiving enormous e-waste, which posits a threat to itsfuture generations. A systematic literature review also suggests exploring e-waste awareness in Asia to understand awareness and behavior. Therefore, the present study explored university students' awareness of e-waste and the factors hindering the disposal of laptops, personal computers, and cellphones and suggested a conceptual framework. The study used the qualitative research approach and non-probability sampling. We collected data through four focus group discussions (FGDs) with students at a Pakistani university. After data saturation, we developed themes from FGDs and found computer sciences and engineering students with better awareness than others. The factors hindering e-waste disposal were lower monetary benefits for disposal, breach of sensitive information, nostalgic association with devices, and non-availability of disposal facilities. Other variables like lower resale value and high family sharing increased the storage of e-devices and reduced e-waste disposal. The research is among a few initial attempts to explore e-waste awareness and factors hindering disposal behavior in e-waste-receiving countries (e.g., Pakistan) and provides evidence from students who are the primary users. Our findings are crucial for policymakers to take corrective actions, introduce monetary benefits, and secure disposal to reduce e-waste.