Information Security Assessment Research Articles

The Construction of Financial Information Security Assessment Indicators based on Hierarchical Analysis Methods and Legal Regulation

The Construction of Financial Information Security Assessment Indicators based on Hierarchical Analysis Methods and Legal Regulation

ЭФФЕКТИВНОСТЬ АВТОМАТИЗИРОВАННОГО УПРАВЛЕНИЯ ТРАНСПОРТНЫМИ СРЕДСТВАМИ В ТРАМВАЙНЫХ СИСТЕМАХ

The intellectualization of water transport is accompanied by an expansion of the landscape of threats to transport security, caused by the characteristics and weaknesses of the technologies being introduced, which are the convergence of information and telecommunication technologies, automated and automatic control technologies and artificial intelligence. The peculiarity of these technologies is working with large volumes of information. Violation of the security of information processed in intelligent systems of water transport (illegal access, modification, deletion and similar unauthorized influence) causes a violation of transport security and, as a consequence, the security of critical information infrastructure and the country’s critical infrastructure, national security. Convergent technologies used in intelligent transport systems are characterized by multiple and poorly formalized manifestations of the consequences of threats. The article presents a model for assessing the risks of information security of intelligent water transport systems, based on the methods of the theory of fuzzy sets and fuzzy logic, the use of which makes it possible to take into account the above-mentioned features of the technologies being implemented. The hierarchical structure of the model and the use of fuzzy set theory and fuzzy logic methods make it possible to adapt the model to various risk criteria, types of input data and the level of detail of risk analysis. For the presented model, a methodology for assessing information security risks has been developed and an example of risk calculation is given. The developed model and methodology are intended to build an information security risk management system for autonomous shipping, implementing technologies of hybrid (augmented, extended) intelligence, providing for the use of artificial intelligence controlled by people.

НЕЧЕТКАЯ СИСТЕМА ОЦЕНКИ РИСКОВ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ ИНТЕЛЛЕКТУАЛЬНЫХ СИСТЕМ ВОДНОГО ТРАНСПОРТА

The intellectualization of water transport is accompanied by an expansion of the landscape of threats to transport security, caused by the characteristics and weaknesses of the technologies being introduced, which are the convergence of information and telecommunication technologies, automated and automatic control technologies and artificial intelligence. The peculiarity of these technologies is working with large volumes of information. Violation of the security of information processed in intelligent systems of water transport (illegal access, modification, deletion and similar unauthorized influence) causes a violation of transport security and, as a consequence, the security of critical information infrastructure and the country’s critical infrastructure, national security. Convergent technologies used in intelligent transport systems are characterized by multiple and poorly formalized manifestations of the consequences of threats. The article presents a model for assessing the risks of information security of intelligent water transport systems, based on the methods of the theory of fuzzy sets and fuzzy logic, the use of which makes it possible to take into account the above-mentioned features of the technologies being implemented. The hierarchical structure of the model and the use of fuzzy set theory and fuzzy logic methods make it possible to adapt the model to various risk criteria, types of input data and the level of detail of risk analysis. For the presented model, a methodology for assessing information security risks has been developed and an example of risk calculation is given. The developed model and methodology are intended to build an information security risk management system for autonomous shipping, implementing technologies of hybrid (augmented, extended) intelligence, providing for the use of artificial intelligence controlled by people.

Використання методу верифікації FMEDA/FIT для оцінювання кібербезпеки програмованого логічного контролера: нова інтерпретація принципу SIS

The object of this study is a programmable logic controller (safety PLC), which is part of an information and control system designed for safe management of important technological processes. The subject of this study is the substantiation of the legality of reusing the results obtained during the development of the safety PLC in accordance with the requirements of functional safety to assess the level of its cyber security. The purpose of this work is to investigate the possibility of "cross" evaluation of the safety characteristics of the safety PLC, namely, the possibility of evaluating the level of cyber security of the programmable logic controller based on known data regarding its level of functional safety, in order to optimize the use of available resources in the project. The study tasks are following: to provide a theoretical basis for the relationship between safety PLC characteristics such as functional safety and cybersecurity. Determine the metrics by which it will be possible to assess the degree of reuse of existing results. Perform an analysis of potential cyberattacks depending on the architecture of the information and control system, which performs security functions, as well as on the possible modes of its use. Determine and evaluate the degree of "cross" influence of critical characteristics of the research object. To perform a calculation analysis of the potential financial and time gain from the reuse of already known results for the minimum configuration of the safety PLC. Conclusions. The study demonstrated the relevance of the question of assessing the cybersecurity of a programmable logic controller based on the use of existing data, regarding its level of functional security (SIL). The proposed approach provides opportunities to significantly optimize the use of resources in safety PLC certification projects. However, the main methodological conclusion is that the well-known principle of Security Informed Safety can be developed and used in practice in the opposite direction, as Security supported/assessed by Safety. That is, to the principle of "assessment of functional safety taking into account/on information (cyber) security" the principle of "assessment of information (cyber) security with the support of/taking into account the results of the assessment of functional security" is added.

The Role of Libraries in Creating a Safer Cyberspace: Awareness of Estonian Library Employees in Information Security

The purpose of the study was to find out the knowledge, attitude and behavior of library employees related to information security in seven areas of the information security policy involving employees: password management, use of email, use of the Internet, use of social media, use of mobile devices, handling of information and reporting of cyber incidents. The theoretical part provides an overview of the importance of the topic in the context of libraries, the reasons why information security and cyber security must be at the same high level in libraries as, for example, in banks or healthcare institutions – we can only imagine what would happen if the digitized cultural memory of Estonia disappears or user data is leaked. The HAIS-Q (Human Aspects of Information Security Questionnaire) developed by Parsons et al. was used to collect data in order to assess information security awareness (ISA) within the organization. The method is based on three factors developed by the same authors: the Knowledge-Attitude-Behavior (KAB) model, which determines the security awareness of employees. The target group of the online questionnaire was Estonian librarians. A total of 388 librarians from public, research, school and specialist libraries responded to the survey. The mean and standard deviation of each focus area, descriptive statistics, Cronbach’s coefficient and Pearson correlation analysis were used to achieve the research objective. The results revealed that the chosen methodology is well suited for assessing the cyber literacy of not only library staff, but also the staff of all memory institutions (archives, museums) and identifying training needs.

DESIGN OF APPLICATION INFORMATION SECURITY SELF-ASSESSMENT USING VBA AND MSXML2.XMLHTTP CASE STUDY: DISKOMINFO KABUPATEN KAMPAR

Information security includes the issues that may threaten accountability, reliability, trustworthiness, privacy, authenticity, and trustworthiness of information in an agency. Data and information are very risky things in Information Security, and therefore it is important to do information security governance. The process of evaluating information security using the Index KAMI and ISO 27001: 2013 will be carried out in this study by recording data using Microsoft Excel which has been provided by the National Cyber and Crypto Agency (BSSN). To make it easier to conduct information security assessments and simplify the Excel display, Visual Basic for Applications (VBA) will be utilized as a medium for adding ISO 27001: 2013, then it will be connected using MSXML2.XMLHTTP. The results of the self-assessment carried out show that the Communication, Information, and Signaling Service of Kampar Regency has a level of completeness in implementing the ISO 27001 standard at the "Inadequate" level with a score of 151 only reaching level I+. Meanwhile, the results of the ISO 27001: 2013 Annex control evaluation show that there are still clauses that have not been fulfilled. Therefore, the Communication, Informatics, and Coding Office of Kampar Regency urgently needs improvement in order to fulfill the clauses of ISO 27001: 2013.

Research Review on Measuring Information Security Awareness

One of the factors that contributes to unauthorized parties releasing confidential company information, including employee personal information, is a lack of awareness of employee information security. This is a critical concern that needs to be addressed immediately by strengthening the company's information security culture and raising employee awareness of security. To enhance the clarity and emphasis of the reform policy, it is crucial to evaluate employee awareness of information security. This paper discusses several approaches that have been employed, either as models or frameworks, to evaluate an organization's level of information security awareness. With the aid of inclusion and exclusion criteria, we chose 16 papers out of the 842 that were included in the systematic literature review. Three components are commonly used to assess information security awareness: knowledge (what is already known), attitude (what is thought to be appropriate to do), and habit (what is usually done). Measurements that encompass these three aspects employ the Knowledge, Attitude, and Behavior (KAB) paradigm. This study might be a reference for organizations to measure their employees’ security awareness. Several findings are also discussed in this paper.

Assessing Information Security Culture from an Individual's Viewpoint: A Quantitative Measurement Approach

In the increasingly advanced digital era, information security has become a highly important aspect for organizations across various sectors. Therefore, organizations need to adopt a comprehensive approach to managing information security, which encompasses technological aspects, policies and procedures, as well as information security culture. Information security culture refers to the values, norms, and attitudes related to information security within an organization. This research aims to fill the knowledge gap by developing a quantitative measurement approach that can assess individuals' perspectives on information security culture in Sukowono District. This study is a quantitative research using the dimensions of awareness, knowledge, compliance, and behavior as questionnaire variables. The questionnaire was developed after determining the variables and tested for validity and reliability. The research was conducted in one of the districts in Jember Regency. The results of this study show that the average total score for Awareness is 11.9117647 with an average dimension score of 3.9705882, Knowledge has an average total score of 12 with an average dimension score of 4, Compliance has an average total score of 11.76470588 with an average dimension score of 3.92156863, and Behavior has an average total score of 11.882353 with an average dimension score of 3.960784. The dimensions are ranked from lowest to highest as follows: compliance, behavior, awareness, and knowledge. Therefore, knowledge of information security holds the highest position among the four dimensions, while the compliance dimension holds the lowest position.

MODELS OF TEAM STRUCTURE IN INFORMATION SECURITY INCIDENT INVESTIGATION

This article discusses the models of the group structure in the investigation of information security incidents, contradictions in the investigation of information security incidents, methods for assessing information security incidents at the enterprise, processes for assessing information security incidents based on its factors.

Алгоритм выявления угроз информационной безопасности в распределенных мультисервисных сетях органов государственного управления

The results of studies are presented, the purpose of which was to develop an algorithm for identifying information security threats in distributed multiservice networks that provide information interaction of regional government bodies, as well as their communication with the population of the region. The relevance of the research topic is due to a significant increase in various types of cyber attacks on the computer networks of public authorities and the need to increase the level of security of these networks by intellectualizing methods for combating information security threats. The algorithm is based on the use of machine learning methods to analyze incoming traffic in order to identify events that affect the state of information security of public authorities. The algorithm provides for input traffic preprocessing, as a result of which a set of images (signatures) obtained from Wasm binary files is formed, and then the image classifier is launched. It contains a sequential inclusion of deep neural networks – a convolutional neural network for signature classification and a recurrent network that processes the sequences obtained at the output of the convolutional network. Features of the formation of signatures in the proposed algorithm, as well as sequences at the input to the recurrent network, make it possible to obtain the resulting assessment of information security, taking into account the history of its current state. The output of the recurrent network is aggregated with the result of comparing the actual signatures with those available in the database. The aggregation is performed by the fuzzy inference system of the second type, using the implication according to the Mamdani algorithm, which generates the final assessment of information security threats. Software was developed that implements the proposed algorithm, experiments were carried out on a synthetic data set, which showed the efficiency of the algorithm, confirmed the feasibility of its further improvement.

A systematic literature review of cybersecurity scales assessing information security awareness

Information Security Awareness (ISA) is a significant concept that got considerable attention recently and can assist in minimizing the risks associated with information security breaches. Several measurement scales have been developed in this regard, as measuring users’ ISA is paramount. Although ISA specific scales are very important, yet what methodological rigor they use in terms of initial conceptualization of ISA, data collection and analysis during the development, and scale validation of such scales are some unknown aspects. Therefore, we provide a comprehensive review of the existing ISA specific scales to address all the above concerns. A popular method, PRISMA, is utilized, and a total of 24 articles that match with criteria of this research are included for the final in-depth analysis. Also, a holistic evaluation framework is developed containing three phases and 19 criteria. Findings revealed that most studies treat ISA as a multi-dimensional construct, and ISA researchers rarely conduct both pilot testing and pre-text evaluation while validating and refining the initial scales. Additionally, several articles did not report some of the essential elements used for checking the rigor of factor analysis, and evidence for validities of the identified scales is inadequate. Consequently, existing ISA specific scales must be improved both in terms of the methodological thoroughness of the scale development procedure and their validities. Moreover, not only justifying why the development of a new scale is necessary, but also improving the quality of the existing scales by doing multiple iterations is significant in the future. Likewise, the inclusion of all the dimensions of ISA, while generating the initial items pool is an important aspect to be considered. A thorough discussion, recommendations for future research, conclusions, and study limitations are provided.

Assessing Information Security Risks in Clinical Laboratory in Accordance With ISO/IEC 27001 Standard

Purpose This study aims to assess the information security risks that still arise in a clinical laboratory accredited to ISO 15189 and certified to ISO 9001, as a preparation for digital-based services. Design/methodology/approach Using the ISO/IEC 27001 approach which is embedded in the qualitative method in this study, risk assessment is carried out by identification, analysis and evaluation through interviews with process owners at clinical laboratories in Jakarta. Findings As a result, it was found that the Busdev&IT Department had the most information security risks (35 risks out of 384 total risks), which required further treatment based on the established risk appetite. Therefore, vigilance on the use of information systems in the laboratory needs to be increased in terms of information security. Research limitations/implications The research object was in the preparation stage for ISO 27001 certification, but the risk assessment is not only to comply with requirements, that also to have effective information security control among their process to ensure the sensitive information is secured. Originality/value This study answers the need for establishment of information security risk control in clinical laboratory.

DEVELOPING A METHODOLOGICAL APPROACH TO ASSESSING STATE INFORMATION SECURITY

The article proposes a methodology for assessing the information security of the state. The object of the study is the information security system of the state. The subject of the study is the development of a methodical approach to the assessment of information security of the state. Scope of practical use of research results: It is advisable to use the proposed scientific results in conducting research and development works on the creation of intelligent systems for collecting, processing and analyzing information about the state of information security of the state and developing requirements for hardware and software of this type of systems. The difference between the proposed method and the known ones, which determines its novelty, lies in the possibility of: – identification and qualitative interpretation of threats to information security; – simulation of scenarios of extreme situations caused by the realization of threats to information security; – assessment of risks that have characteristics of several classes and ranking of assets of the information security system of the state according to their degree of criticality; - carry out an assessment of the number of critically vulnerable assets of the state information security system; - to substantiate the composition and probability of realization of threats to the information security of the state, capable of causing extreme situations in the information and telecommunications system; - conducting an assessment of risks from their implementation in systems of information collection, processing and transmission. The application of the proposed methodology allows to automate the process of analyzing threats to information security and assessing the risks of breaching information security in information collection, processing and transmission systems.

Меры доверия и правдоподобия при оценке рисков информационной безопасности

Purpose of the research: to develop methods for assessing information security risks under uncertainty, to describe the mechanism of propagating belief and plausibility in the attack graph.Research method: application of soft computing techniques, including the combination of Dempster-Shafer evidence theory, integration with respect to non-additive measures of belief and plausibility.Research result: risk assessment methods and methods for assessing expected losses have been developed in the case when risk factors are characterized by high uncertainty and do not allow sufficiently justified applying objective (probabilistic) assessment methods. The initial information is the upper and lower estimates of the probability of risk realization. Using the methods of the Dempster-Shafer evidence theory, belief and plausibility measures are built on the attack graph. An approach is described that allows building belief and plausibility measures in the space of attack scenarios based on probabilistic estimates of typical information security events. It is shown how the expected damage (severity) can be estimated by the expectation of damage with respect to to these measures using the Choquet integral. Scientific novelty: a method of propagation belief along the attack graph has been developed. The method is based on an original approach to evaluating logical combinations of evidence given on binary frames and represented by disjunctive normal forms.

Assessing Information Security Governance in Public Sector Banks of India

Purpose of the study: This study aims to investigate and analyze the Information Security governance practices within banks. Design/methodology/approach: This is a Survey-based study. Employees of State Bank of India in Delhi region were the participants of the study. Findings: The findings of the study will contribute to the existing body of knowledge on information security governance in the banking sector. Research limitations: Small sample size and lack of funds for performing comprehensive quantitative study are the limitations of the study. Practical implications: Regulatory compliance, incident response, and data recovery are all a part of this process, as well as risk assessment and management, policy and procedure creation, security awareness and training, security controls and technology, and more. Public sector organizations may improve their security posture and better secure their information assets by adopting a systematic approach to information security governance. Social implications: Data protection, service protection, privacy, fighting cybercrime, public trust, and economic impact are only few of the societal effects of researching information security governance in public sector organizations. Organizations in the public sector can reduce the risk of financial and reputational damage as well as secure sensitive information by employing best practices in information security. Originality/value: The research outcomes will help identify areas of improvement, highlight effective practices, and provide recommendations for enhancing information security governance within banks. Ultimately, this study contributes to the development of robust Information Security governance frameworks that can protect sensitive data, mitigate risks, ensure regulatory compliance, and maintain the trust and confidence of customers and stakeholders in the banking industry.

Analysis and assessment of information security risks for sustainable development of the oil and gas industry

The problem of ever-evolving and growing risks never ceases to be an issue. Organizations in the oil and gas industry need to spend more and more money on protection, look for more qualified workers or train their staff on various innovations in this field. After many foreign vendors left the Russian market due to sanctions, threats that were minor have become more dangerous. Since even the most common risk in the form of, for example, a phishing link can become a big problem if it is partially disabled or there is no full protection of the functionality. Therefore, it is necessary to create their own software, their own methods of assessing risk events in information security, which will correspond to different areas of risk situations and at the same time have the quality of services, good functionality, not high cost and excellent quality. This article discusses a new unified method of information security containing the positive qualities of other methods and standards for assessing information security risks, but with the elimination of their shortcomings with the possibility of application in organizations of the oil and gas industry.

О ПЕРВИЧНЫХ ТЕХНИЧЕСКИХ УСТРОЙСТВАХ И ТРЕБОВАНИЯХ К КЛЮЧАМ БЕЗОПАСНОСТИ КВАНТОВЫХ СИСТЕМ

Purpose of the article: development of new methods, algorithms and models to detect unauthorized actions of an intruder/s in relation to broadcast data represented in the form of one-photon pure states of light particles, which will allow: to strengthen the secrecy of basic security keys, improve procedures for data exchange and processing by legitimate users of the telecommunications system, expand the functionality of existing technological solutions in their classic representation. Research method: system analysis, information security assessment method. The result: risks of critical system errors for procedures of basic states measurement results matching and supposed potential possibilities of attacker to realize vulnerabilities through active phase of attacks with explicit critical outcome are presented. It is established that translation of mixed single-photon states and imposition on receiving hardware is explicitly uncontrolled, unaccountable and not contained in any algorithm of quantum protocols, which, according to the authors, is the most critical vulnerability of modern cryptographic systems based on quantum mechanics. A way to solve problems of “silent” scanning and to counteract hidden active attacks on quantum channel and particle states is proposed. The essence of the solution consists in non-orthogonality of states of a random basis vector and duplication of a main communication channel containing an information path on pulse signals broadcasting, where a known number of synchro-sentences in a backup line allows to trace an attacker. Fundamental is the knowledge of the primary-natural errors occurring at each of the stages of the formation of the main security key.

System-communication aspects of the military-sociological approach to the assessment of information and psychological security of Russian army

The paper is dedicated to substantiation of the starting positions for determining the theoretical and methodological foundations for the system of information and psychological protection of the Armed Forces as an object of development and military sociological analysis. This study is the first in a planned series of articles devoted to this problem, as well as the beginning of a scientific discussion about the conceptual foundations for improving the “traditional” mechanisms for ensuring the information security of the Russian army and sociological support for the implementation of this process. As a result of the analysis, the author determines the essence and functional role of the information war as an information and psychological component of the hybrid war strategy, and reveals its structural elements as a process of implementation of communicative practices by competing subjects of world politics at various levels. Based on the analysis of modern methods and mechanisms of damaging information and psychological impact, the following are determined: (1) levels (contours) of the protection system against these threats and (2) security objects corresponding to these levels, the state of which may be the subject of military sociological analysis and evaluation of the effectiveness of protection measures.

Using Information about Influencing Factors to Split Data Samples in Machine Learning Methods for the Purposes of Assessing Information Security

Using Information about Influencing Factors to Split Data Samples in Machine Learning Methods for the Purposes of Assessing Information Security

A New Approach to Information Security Auditing in Public Administration

Due to the rapid pace of globalisation and digitalisation and the better usage of ICT technology, cybercrime is also rising. Hence, the secure operation of controlling and auditing information systems is fundamental in both the private and public sectors. It is generally accepted in the private sector that companies seek an independent third-party’s assistance to carry out information security audits. However, how do information security audits work in public administration? The article aims to characterise and assess information security auditing in public administration and define a new solution for conducting such audits. The article is considered a theoretical research paper. Theoretical research explains the basic terms related to auditing and defines conditions for efficient and effective information security auditing. Additionally, the research aims to answer whether the internal (bureaucratic, within the public administration organisational system) or external (third-party) audits prove more effective.