Area Of Information Security Research Articles

The authenticity crisis

Authenticity of information is a term with a clear meaning, not in law, but in the area of information security. There, it involves two aspects, called source-authenticity and message-authenticity; they guarantee certainty about the origin of information, and about its integrity. Authenticity differs from veracity: whether information is true (holds) or not is independent of its authenticity. The authenticity crisis described in the title of this paper refers to the destabilising impact of the lack of authenticity of online information, for instance in fake news. The paper proposes systematic use of digital signatures to guarantee authenticity. A crucial point is that authenticity may be organised via technical means (namely via digital signatures), whereas veracity can not. Authenticity-guarantees make institutions recognisable online and provide people with useful tools for making their own credibility judgements.

Database Management and Information Security Competencies Required by Administrative Office Managers in the Utilization of Electronic Records in Tertiary Institutions for Sustainable Development

The study determined the competencies required by administrative office managers in the utilization of electronic records in tertiary institutions in Taraba State, Nigeria. Two specific purposes, two research questions and two hypotheses guided the study. The design adopted for the study was the survey research design. The population for the study comprised 901 (males 659 and females 242) administrative office managers in nine (9) tertiary institutions located in Taraba State. The sample size consisted of 277, determined using Yaro Yamane’s formula. The instrument for data collection was a 4-point rating scale structured questionnaire titled “Questionnaire on Competencies Required by Administrative Office Managers in the Utilization of Electronic Records in Tertiary Institutions in Taraba State (QOMCUERTITS). The instrument was validated by three experts and was subjected to internal reliability testing using Cronbach Alpha reliability coefficient. The overall reliability index obtained was 0.85. Data collected were analysed using mean and standard deviation to answer the research questions and t-test to test the research hypotheses at 0.05 level of significance. Results revealed that database management and information security competencies are required by administrative managers in the utilization of electronic records. The gender of administrative office managers in tertiary institutions was not significant in database management and information security competencies required in the utilization of electronic records. It was recommended that there should be training and retraining programmes for lecturers to acquire and teach competencies areas of database management and information security.

Database Management and Information Security Competencies Required by Administrative Office Managers in the Utilization of Electronic Records in Tertiary Institutions for Sustainable Development

The study determined the competencies required by administrative office managers in the utilization of electronic records in tertiary institutions in Taraba State, Nigeria. Two specific purposes, two research questions and two hypotheses guided the study. The design adopted for the study was the survey research design. The population for the study comprised 901 (males 659 and females 242) administrative office managers in nine (9) tertiary institutions located in Taraba State. The sample size consisted of 277, determined using Yaro Yamane’s formula. The instrument for data collection was a 4-point rating scale structured questionnaire titled “Questionnaire on Competencies Required by Administrative Office Managers in the Utilization of Electronic Records in Tertiary Institutions in Taraba State (QOMCUERTITS). The instrument was validated by three experts and was subjected to internal reliability testing using Cronbach Alpha reliability coefficient. The overall reliability index obtained was 0.85. Data collected were analysed using mean and standard deviation to answer the research questions and t-test to test the research hypotheses at 0.05 level of significance. Results revealed that database management and information security competencies are required by administrative managers in the utilization of electronic records. The gender of administrative office managers in tertiary institutions was not significant in database management and information security competencies required in the utilization of electronic records. It was recommended that there should be training and retraining programmes for lecturers to acquire and teach competencies areas of database management and information security.

Теоретико-прикладные проблемы психологии безопасности в уголовно-исполнительной системе

The article examines the theoretical and applied problems of the application of psychological knowledge by penitentiary psychologists, employees of services and departments of the penitentiary system in their professional activities in the implementation of its most important task – ensuring security in institutions of the penitentiary system, defined by the Concept of its development for the period up to 2030 (approved by Decree of the Government of the Russian Federation dated 04/29/2021 No. 1138-R.). The conducted research made it possible to establish and substantiate the subject and objects, principles, approaches and relevant directions, mechanisms, techniques and methods of security of the UIS, its complex content. At the present stage of the development of the penitentiary system, the most studied legal scholars are legal, organizational, managerial, educational, engineering, information and computer security areas in the penal system. At the same time, such as psychological, pedagogical, personnel, social, logistical and financial ones also look very in demand and relevant. All professional activities of employees of services and departments take place in the social systems “employee-suspect”, “employeeconvict”, “employee-staff of the Criminal investigation department”, therefore, the psychological direction of security should be given priority, exceptional attention.

MEASUREMENT OF INFORMATION SECURITY AND PRIVACY AWARENESS USING THE MULTIPLE CRITERIA DECISION ANALYSIS (MCDA) METHOD

Information security is an asset that has value so it must be protected, along with increasing assets it is undeniable that many people wish to gain access and control it so that behind the convenience in the digital world there are many risks to information assets. There are several cases that occur related to information security such as data theft, illegal access, information leakage and vandalism where this becomes the privacy of the user. So it is necessary to do research from the user's perspective to measure the level of information security and privacy awareness of students and lecturers as well as recommendations that will be suggested based on the results of measuring information security and privacy awareness. The objects in this research are students and lecturers at the XYZ University. The method used is Multiple Criteria Decision Analysis (MCDA) by measuring the dimensions of knowledge, attitude, behavior in six areas of information security and three areas of privacy. Data were obtained by distributing questionnaires using a Likert scale of 5. Based on the questionnaire from the respondents, it can be seen students and lecturers have awareness that is at a "good" level of 85% in information security while privacy is at a "good" level with a result of 89% but in the behavior dimension there are several areas that are included in the "average" level including the area passwords by 62%, mobile equipment area by 77% incident area by 70% and on privacy security on the behavior dimension there is one area namely the login activity area by 78% so this needs to be given recommendations for improvement in order to reach a "good" level by providing socialization/ training for students and lecturers

D-Penicillamine@Ag/Cu Nanocluster-Based Fluorescent Nanoneuron for Logic Screening Phosphonate-Type Organophosphate Pesticides and Steganographically Encrypting Information.

Organophosphate pesticides are used in agriculture due to their high effectiveness and low persistence in eradicating insects and pests. However, conventional detection methods encounter the limitation of undesired detection specificity. Thus, screening phosphonate-type organophosphate pesticides (OOPs) from their analogues, phosphorothioate organophosphate pesticides (SOPs), remains a challenge. Here, we reported a d-penicillamine@Ag/Cu nanocluster (DPA@Ag/Cu NCs)-based fluorescence assay to screen OOPs from 21 kinds of organophosphate pesticides, which can be used for logic sensing and information encryption. Acetylthiocholine chloride was enzymatically split by acetylcholinesterase (AChE) to produce thiocholine, which reduced the fluorescence of DPA@Ag/Cu NCs due to the transmission of electrons from DPA@Ag/Cu NCs donor to the thiol group acceptor. Impressively, OOPs acted as an AChE inhibitor and retained the high fluorescence of DPA@Ag/Cu NCs due to the stronger positive electricity of the phosphorus atom. Conversely, SOPs possessed weak toxicity to AChE, which led to low fluorescence intensity. By setting 21 kinds of organophosphate pesticides as the inputs and the fluorescence of the resulting products as the outputs, DPA@Ag/Cu NCs could serve as a fluorescent nanoneuron to construct Boolean logic tree and complex logic circuit for molecular computing. As a proof of concept, by converting the selective response patterns of DPA@Ag/Cu NCs into binary strings, molecular crypto-steganography for encoding, storing, and concealing information was successfully achieved. This study is expected to advance the progress and practical application of nanoclusters in the area of logic detection and information security while also enhancing the relationship between molecular sensors and the world of information.

KESADARAN KEAMANAN DAN PRIVASI DATA PENGGUNA WHATSAPP (STUDI KASUS DI PROVINSI JAWA BARAT)

Social media applications provide convenience with the features available but can also cause problems, such as security and privacy, in their use, which is also possible in WhatsApp. The condition of security and privacy awareness among WhatsApp users can be an illustration of how users are aware of minimizing various kinds of risks that can arise when using WhatsApp. This study provides an overview of WhatsApp usage, security awareness, and privacy data from respondents, and sociodemographic relationships with the synthesis framework of data security and privacy in WhatsApp usage. The study was conducted quantitatively, with WhatsApp users in West Java Province serving as the unit of analysis and the locus. The questionnaire instrument was distributed online through time sampling within a certain period and accidental sampling. The results of the study provide an overview of WhatsApp usage. The perspective on data security and privacy in West Java Province also shows that many respondents have this awareness. The relationship between sociodemographic variables and the use of WhatsApp shows significant results in several main areas, namely the information security area, the perceived mobile apps area, the perceived control area, and the disclosure information detection area.

THE LEGAL ASPECTS OF THE SECURITY OF THE STATE'S INFORMATION AND COMMUNICATION INFRASTRUCTURE

The discussion of the Article focuses on new information and communication technologies and their impact on the functioning of modern States and information societies and on technological threats to the information security of the State. The main focus of the study is the domestic legal regulation on the concept of information and communication infrastructure of the State and the normative requirements and standards of its security, as well as an analysis of the views of the local science of various disciplines of knowledge in the area of information security of the State.

Artificial intelligence techniques for encrypt images based on the chaotic system implemented on field-programmable gate array

<span lang="EN-US">Image encryption is an important issue in protecting the content of images and in the area of information security. This article proposes a novel method for image encryption and decryption using the structure of the artificial neural network (ANN)-based chua chaotic system (CCS). This structure was efficiently designed on a field-programmable gate array (FPGA) chip utilizing the xilinx system generator (XSG) tool with the IEEE-754-1985 32-bit floating-point number format. For ANN-based CCS design, a multilayer feed forward neural network (FFNN) structure with three inputs and three outputs was created. This structure consists of one hidden layer with four neurons, each of which has a Tangent Sigmoid activation function. The training of ANN-based CCS yielded a 3.602e-13 mean square error (MSE) value. After successfully training the ANN-based CCS, the design was carried out on FPGA, utilizing the ANN structure's bias and weight values as a reference. The xilinx vivado (2017.4) design suite was used to synthesis and test the ANN-based CCS on the FPGA. The histogram, correlation coefficient, and entropy are used to perform security analysis on various images. Finally, FPGA hardware co-simulation using a Xilinx Artix7 xc7a100t-1csg324 chip was utilized to verify that the encryption and decryption of the images were successful.</span>

Factors Affecting the Security of Information Systems in Africa: A Literature Review

This study determined factors affecting the security of Information Systems in Africa. Also, it established the quality of publications in the area of Information Security. The study is based on peer-reviewed publications conducted in Africa. The study adopted the mixed research approach. The study used a systematic literature review, with part of the analysis using descriptive analysis. In total, 70 papers formed the population of publications extracted in the area of Information Security. In addition, 37 papers had the quality to be included in the analysis of factors affecting Information Security. The study found that information Security factors are in four key categories: human factors, policy-related issues, work environment, and demographic factors. Overall, the work environment is the most reported category affecting the security of Information Systems in Africa. In addition, gender is the highest reported individual factor associated with the insecurity of Information Systems; female is the highly affected gender. Other factors include the lack of Information Security training, the unchecked level of trust, carelessness and poor security policies. The study recommends training programs, policy improvement and promoting behaviours that minimise exposure to attacks.

СИСТЕМЫ ИСКУССТВЕННОГО ИНТЕЛЛЕКТА И ВОПРОСЫ КИБЕРБЕЗОПАСНОСТИ

With the development of modern technologies and various programs, as well as due to the increase in the number of cyber attacks, issues related to cybersecurity and the use of artificial intelligence systems are particularly acute. Technologies for improving artificial intelligence do not stand still, but continue to develop rapidly, thanks to which the use of artificial intelligence is an integral part in solving problems and issues in cybersecurity. Thus, artificial intelligence is expanding its scope of application every year and is actively used in information systems to solve many problems, but its use in protecting against cyber attacks serves as one of the key areas in information security. Many users and organizations have changed their approach to providing a high level of protection, using artificial intelligence and using it to organize database protection. Thus, it is necessary to continue to actively work on the creation of more effective artificial intelligence systems, as it is necessary to stop the spread of malicious viruses of various kinds, various programs and try to minimize the number of cyber attacks.

Performance Analysis of Encryption Capabilities of ARM-based Single Board Microcomputers

In the few years since the Raspberry Pi was released in 2012, countless microcomputers based on the ARM architecture have been introduced.Their small size, high performance relative to their power consumption, and the ability to run the popular Linux operating system make them ideal for a wide range of tasks. Information security is an area of particular importance. Different encryption and encoding algorithms play an important role in almost all areas of information security. However, these algorithms are very computationally intensive, so it is important to investigate which microcomputers can be used for these tasks, and under which trade-offs. The performance of ten different microcomputers is investigated and presented for the application of common symmetric and public-key encryption and decryption, digest creation and message authentication protocols, such as RSA, AES, HMAC, MD5, SHA. Reliable encryption requires the generation of reliable (pseudo)random numbers (Cryptographically Secure Random Numbers, CSRN), and microcomputers based on ARM SoCs usually have hardware implemented (pseudo)random number generators. The applicability of the random number generat er generators. The applicability of the random number generators of different microcomputers are investigated and presented; test methoods are described , and recommendations are made.

HUMAN RESOURCES MANAGEMENT AS A COMPONENT OF ORGANIZATION INFORMATION SECURITY

The cyber threat landscape has undergone major changes in recent years. Compared to any period since the beginning of the information age, it is more diverse and broad. First, the Covid-19 pandemic, namely the resulting transition of organizations to remote work and then the full-scale invasion of Ukraine by the Russian Federation, made adjustments to the information security strategy. Today, most organizations are aware of security threats and the need to create a reliable information security management system to ensure their effective operation in an information environment that is aggressive both technically and socially. An important area of information security in an organization is human resource management since, according to statistics from a number of reputable analytical centers, employees are the weakest link in any data security system. The organization's human resources management includes a thorough recruitment process, fostering a responsible attitude to work in compliance with the requirements for protecting restricted information, developing a corporate culture of information security and dismissal procedures. The article provides a list of documents of the regulatory framework, namely, international security standards, regulatory documents of public authorities, and internal documents of an organization regulating the rules and methods of work with personnel. The main motives for the unlawful behavior of an internal attacker are highlighted, and the organizational measures recommended in the context of ensuring information security at all three stages of interaction between a person and an organization: employment, employment, and dismissal are described. There is also indicated the expediency of using psychoanalysis, psychology, management ethics and conflictology methods in the field of personnel management for forecasting and prevention of informational threats.

Detecting and Rectifying the Non-Malicious Insider Threat in a Healthcare Setting

This paper aims to apply habit-based research to the domain of information security. It proposes a new training paradigm in which a user “automatically” does the right thing without being an expert in the area of information security. The authors used a multiphased approach in which a new security training program was created and assessed for three groups: administrators (mostly managers), medical professionals (included physicians, physician assistants etc.) and staff (appointment coordinators, billing specialists etc.). The authors were able to find strong correlations between habit creation and security threats such as phishing, unauthorized cloud computing use, and password sharing. The authors were also able to ascertain that traditional security training and awareness programs need to move away from the “one-size” fits all technique to custom models that need to look at employee groups. This study supports the idea of training programs that are focused on changing habits, which is an area that has not yet been extensively researched in this context.

The Problem of Choosing a Steganographic Container in Conditions of Attacks against an Embedded Message

Steganography is the perspective area of information security. The reliability of the stegano- graphic system, its stability is affected by the carrier – a container, which is considered in the paper as a digital image. The aim of the work is to increase the resistance of a steganographic system to attacks against an embedded message by developing a method for choosing a contain-er from a finite set of available digital images that ensures the transmitted message the minimum (close to the minimum) possible sensitivity of the generated steganographic message to disturb-ing influences under consideration with the selected steganographic algorithm. The goal was achieved using a theoretical study of perturbations of the formal parameters of the container ma-trix, as a result of steganographic transformation and active attacks, which made it possible to introduce a new formal representation for information protected from perturbing influence E, as the difference of low-rank approximations of container matrices and steganographic messages. The most important result of the work is the development of a container selection method ready for practical implementation. The efficiency of the developed method exceeds the efficiency of analogs, it remains high, regardless of the used steganographic method, which allows increasing the overall resistance of the steganographic system to attacks against the embedded message. The significance of the obtained result lies in the use of the developed method of increasing the stability of the steganographic system to attacks against the embedded message.

AUDIT KEAMANAN SISTEM INFORMASI PERPUSTAKAAN: STUDI KASUS DI UNIVERSITAS NAHDLATUL ULAMA AL GHAZALI CILACAP

Nahdlatul Ulama University Al Ghazali Cilacap began to utilize Information and Communication Technology (ICT) to support existing processes so as to produce accurate and fast information. In the implementation of Information and Communication Technology (ICT) governance, information is a very important asset for a company, both information related to management, finance, reports and other information. Leaks, damage, inaccuracies. The aim is to find out the extent of the completeness and maturity of Information Technology at Nahdlatul Ulama Al Ghazali University, Cilacap. However, they do not yet know whether their framework has met the requirements for the level of completeness and maturity of the application of the ISO 27001 standard. For this reason, it is necessary to carry out an information system security audit to determine the current condition compared to the expected condition. In the process, the audit is carried out based on the ISO 27001 Standard which is applied in the form of an evaluation of the KAMI Index. A thorough assessment was carried out on five areas of information security using the US Index version 2.3 template from the Ministry of Communications and Information Technology (Kominfo). The audit results are in the form of recommendations for evaluating the completeness and maturity of the information security framework based on the ISO 27001 standard.

Information self-destruction module design based on micro thermoelectric power generation and energetic materials

Information self-destruction modules (ISDMs) play a vital role in the information security area. In this paper, an ISDM based on the integration of a micro-thermoelectric generation mechanism (M-TEGM) with energetic materials (EMs) is proposed. On the basis of energy conversion relationship, an open-loop electromotive force is induced, and this energy will drive the EMs to release the detonation wave and realize information storage module self-destruction. During the tests, under the temperature difference (100 K), the open-loop electromotive force (3.86 V) is induced by the M-TEGM and can drive the EMs (0.37 mg copper azide) to generate a detonation wave (GPa) in 3.4 μs, which can physically destroy the information storage modules. This ISDM has advantages that include rapid response times, low drive energy compared with traditional information security technology.

Minimum Adversarial Examples.

Deep neural networks in the area of information security are facing a severe threat from adversarial examples (AEs). Existing methods of AE generation use two optimization models: (1) taking the successful attack as the objective function and limiting perturbations as the constraint; (2) taking the minimum of adversarial perturbations as the target and the successful attack as the constraint. These all involve two fundamental problems of AEs: the minimum boundary of constructing the AEs and whether that boundary is reachable. The reachability means whether the AEs of successful attack models exist equal to that boundary. Previous optimization models have no complete answer to the problems. Therefore, in this paper, for the first problem, we propose the definition of the minimum AEs and give the theoretical lower bound of the amplitude of the minimum AEs. For the second problem, we prove that solving the generation of the minimum AEs is an NPC problem, and then based on its computational inaccessibility, we establish a new third optimization model. This model is general and can adapt to any constraint. To verify the model, we devise two specific methods for generating controllable AEs under the widely used distance evaluation standard of adversarial perturbations, namely constraint and constraint (structural similarity). This model limits the amplitude of the AEs, reduces the solution space’s search cost, and is further improved in efficiency. In theory, those AEs generated by the new model which are closer to the actual minimum adversarial boundary overcome the blindness of the adversarial amplitude setting of the existing methods and further improve the attack success rate. In addition, this model can generate accurate AEs with controllable amplitude under different constraints, which is suitable for different application scenarios. In addition, through extensive experiments, they demonstrate a better attack ability under the same constraints as other baseline attacks. For all the datasets we test in the experiment, compared with other baseline methods, the attack success rate of our method is improved by approximately 10%.

Organizational Data Breach: Building Conscious Care Behavior in Incident Response

Organizational and end user data breaches are highly implicated by the role of information security conscious care behavior in respective incident responses. This research study draws upon the literature in the areas of information security, incident response, theory of planned behaviour, and protection motivation theory to expand and empirically validate a modified framework of information security conscious care behaviour formation. The applicability of the theoretical framework is shown through a case study labelled as a cyber-attack of unprecedented scale and sophistication in Singapore’s history to-date, the 2018 SingHealth data breach. The single in-depth case study observed information security awareness, policy, experience, attitude, subjective norms, perceived behavioral control, threat appraisal and self-efficacy as emerging prominently in the framework’s applicability in incident handling. The data analysis did not support threat severity relationship with conscious care behaviour. The findings from the above-mentioned observations are presented as possible key drivers in the shaping information security conscious care behaviour in real-world cyber incident management.

Secure Data Storage and Sharing Techniques for Data Protection in Cloud Environments: A Systematic Review, Analysis, and Future Directions

A large number of researchers, academia, government sectors, and business enterprises are adopting the cloud environment due to the least upfront capital investment, maximum scalability, and several other features of it. Despite the multiple features supported by the cloud environment, it also suffers several challenges. Data protection is the primary concern in the area of information security and cloud computing. Numerous solutions have been developed to address this challenge. However, there is a lack of comprehensive analysis among the existing solutions and a necessity emerges to explore, classify, and analyze the significant existing work for investigating the applicability of these solutions to meet the requirements. This article presents a comparative and systematic study, and in-depth analysis of leading techniques for secure sharing and protecting the data in the cloud environment. The discussion about each dedicated technique includes: functioning for protecting the data, potential and revolutionary solutions in the domain, the core and adequate information including workflow, achievements, scope, gaps, future directions, etc. about each solution. Furthermore, a comprehensive and comparative analysis of the discussed techniques is presented and the research gaps and future directions are reported in the field. The authors believe that this article’s contribution will operate as a catalyst for the potential researchers to carry out the research work in the area