Information Security Evaluation Research Articles

Construction Method of Information Security Detection based on Clustering Algorithm

A method for K-prototype clustering, which can process mixed data types, is proposed first. An algorithm for information security evaluation of hybrid clusters based on K-prototypes was constructed. This method makes full use of the excellent global optimization performance of PSO and effectively solves the defect that the K-protection function quickly falls into local optimization. Simulation results show that the proposed method can effectively prevent local extreme values and improve overall performance.

Research on Evaluating Information Security Level Protection by Data Mining Method

Information technology’s continuous development and progress can bring great changes to society, which is also born in the hierarchical protection of information systems. Among them, grade protection evaluation is the key part, and methods to find useful information from its complicated evaluation data to assist decision-making have become an important content of research. Aiming at the evaluation process of data mining, this article intends to analyze the classical algorithms of association rules. The Apriori algorithm and FP-growth, two common and representative algorithms, are chosen as a comparison. Finally, it is found that the performance of the latter is better than that of the former. The rationality of association rules is proved by analysis to better assist the evaluators in the evaluation work and reduce the misjudgment of the evaluation results.

Evaluasi Keamanan Teknologi Informasi Menggunakan Indeks Keamanan Informasi 5.0 dan ISO/EIC 27001:2022

In the era of digital transformation, data has become something valuable but vulnerable to leaks. According to Lanskap Keamanan SIber Indonesia 2022, there were 311 data leakage incidents that occurred in Indonesia. Many tools can be used to evaluate information security, one of which is the Information Security Index (ISI). KAMI is a tool to assess the level of information security readiness of an organization based on the SNI ISO / IEC 27001 standard. PT Kano Teknologi Utama is a company that uses information technology in its daily operations. Therefore, researchers conducted an information technology security evaluation to determine the condition of information security and can evaluate it so that security becomes better. The evaluation is carried out by conducting observations and interviews at the company. The data that has been obtained will then be assessed according to OUR Index. Based on the results of the Our Index assessment, the electronic system category score obtained is 19 and is included in the high category. While the final evaluation result is "Good Enough" with a final score of 674 and the level of completeness of implementation based on the ISO 27001 standard is at levels II to IV.

Reliability Evaluation of Clean Energy Internet Information Security Based on Statistical Learning Methods

Reliability Evaluation of Clean Energy Internet Information Security Based on Statistical Learning Methods

DESIGN OF APPLICATION INFORMATION SECURITY SELF-ASSESSMENT USING VBA AND MSXML2.XMLHTTP CASE STUDY: DISKOMINFO KABUPATEN KAMPAR

Information security includes the issues that may threaten accountability, reliability, trustworthiness, privacy, authenticity, and trustworthiness of information in an agency. Data and information are very risky things in Information Security, and therefore it is important to do information security governance. The process of evaluating information security using the Index KAMI and ISO 27001: 2013 will be carried out in this study by recording data using Microsoft Excel which has been provided by the National Cyber and Crypto Agency (BSSN). To make it easier to conduct information security assessments and simplify the Excel display, Visual Basic for Applications (VBA) will be utilized as a medium for adding ISO 27001: 2013, then it will be connected using MSXML2.XMLHTTP. The results of the self-assessment carried out show that the Communication, Information, and Signaling Service of Kampar Regency has a level of completeness in implementing the ISO 27001 standard at the "Inadequate" level with a score of 151 only reaching level I+. Meanwhile, the results of the ISO 27001: 2013 Annex control evaluation show that there are still clauses that have not been fulfilled. Therefore, the Communication, Informatics, and Coding Office of Kampar Regency urgently needs improvement in order to fulfill the clauses of ISO 27001: 2013.

Design of network information visualization security cognition system based on QSOFM network and FR algorithm

ABSTRACT Network information is complex, there is no lack of hidden risks of information to the user caused by bad effects. But analyzing and evaluating them is complex and requires more diverse and powerful techniques. This research will combine Fruchterman-Reingold (FR) information visualization algorithm and information security risk assessment method based on Quantum self-organizing feature map (QSOFM) network to build information visualization security cognitive system. By introducing quantum neurons into self-organizing feature mapping network (SOFM), a network information security evaluation model is constructed. The system can evaluate the security level of network information and visualize the evaluation results. The experimental results show that the system has fast response speed and strong interactivity. The accuracy of QSOFM algorithm is 86%, 12% higher than the traditional algorithm, which can provide more powerful technical support for the visual security cognition of network information.

Information security investment prioritization using best-worst method for small and medium enterprises

In recent years, cyber security has become an increasingly important aspect of the decision-making process of corporations. It is essential to make investments in cybersecurity at this point to guard against the frequent disruption of business operations posed by cyberattacks. In the context of small and medium-sized organizations, this study recommends using a multicriteria decision-making technique to evaluate information security aspects. The information security index is derived as the foundation for every one of these features. The best-worst method is carried out to establish the best and worst possible security investments. In order to validate these findings, a survey was distributed to a variety of professionals and business decisionmakers. The criteria for selection are laid forth in the form of categories labeled technology and organization, respectively. The findings are presented in a rating system with three tiers, with the highest level representing the absolute best of the results. In the final section of the study, we will examine potential future possibilities for research and policy.

Qualitative and Quantitative Risk Assessment through IISRA Framework

Abstract: Information and communications technology (ICT) has expanded commercial potential beyond comprehension and has merged completely with organizations. In addition to its many advantages, ICT has disadvantages, such as cybersecurity risks, vulnerabilities, and a lack of adequate administrative access control that cybercriminals might take advantage of. Organizations are becoming more dependent on information security as a result of potential hazards brought on by advances in information technology, each of which has a different critical level based on its likelihood of happening and potential consequences. Methodologies for evaluating information security threats can be either quantitative or qualitative, depending on the Information outcome of their assessment. It is clear that both of the aforementioned choices have a number of fundamental flaws. In order to overcome them, this research paper focused on developing an Integrated Information Security Risk Assessment (IISRA) Framework that would be both more accurate and adaptable because existing approaches are frequently inappropriate and ineffectual due to the ongoing appearance of new sources of risks.

Construction of a Smart City Network Information Security Evaluation Model Based on GRA-BPNN

In this study, we propose an optimized network information security evaluation GRA-BPNN model based on gray correlation analysis method combined with BP neural network model, and make corresponding optimization for network information security evaluation index. Simulation experiments are conducted to analyze the experimental model, and the simulation results show that the test sample values reach the best training performance at the 7th iteration after 13 iterations, and the R-values in the regression of training results all reach above 0.99, and the data are well-fitted. When the number of training iterations reaches 13, the training gradient is 0.00067928, the value of Mu is 0.001, and the validity test value is 6. The GRA-BPNN model scores 0.028 higher than the GRA method, which is in line with the expected error, and the higher score also proves that the GRA-BPNN model is more comprehensive and specific in its scoring consideration.

Problems of evaluating the organization’s information security culture

Nowadays, digitization of all areas of human activity leads to an increase in the number of information security incidents in organizations. From this point of view, the problem of information security culture in organizations becomes very relevant in modern times. Obviously, the majority of incidents related to information security violations in organizations are associated to the human factor. To overcome this problem, the research in the field of the evaluation of information security culture is urgent. Measuring and evaluating information security culture can enable an organization to identify its weaknesses in this area and take measures to eliminate them. This article examines various approaches to the concept of information security culture, and analyzes the affecting factors within the organization (management’s attitude towards information security, information security policy, information security awareness and employee’s behaviors). It also studies the documents adopted in the field of development and evaluation of information security culture in the European Union countries and the United States, and implemented projects. It analyzes proposed methods for measuring the information security culture in the organization using various methods. Moreover, the article reveals existing problems in this field and provides certain recommendations for their elimination. The methods of analysis and synthesis, comparison, generalization and systematic approach are used in this research.

An Interdisciplinary Study of Cybersecurity Investment in the Nonprofit Sector

Cybersecurity is becoming a worldwide priority. It is critical for organizations to quantify losses from cybercrimes and make informed decisions on cybersecurity investments. This paper expands the body of knowledge in cybersecurity of nonprofit organizations (NPOs)—a less-researched area—by examining investment in NPOs’ cybersecurity from the business and economics perspectives. The authors combine two economics and risk management models to quantify the potential loss caused by a cyberattack. The paper provides a hypothetical example of applying the insights from the GL and FAIR risk models to assess the information assets of an NPO and calculating the optimal level of cybersecurity investment. Developing cybersecurity measures for NPOs is equally important as developing cybersecurity strategies, tools, and policies for large corporations or small businesses. Therefore, the findings of this paper can serve as decision-making tools for NPOs to evaluate information security assets, estimate the potential loss caused by cyberattacks, and determine the optimal investment value in cybersecurity measures.

EVALUASI KEMANANAN SISTEM INFORMASI PASDEAL BERDASARKAN INDEKS KEAMANAN INFORMASI (KAMI) ISO/IEC 27001:2013

Information systems are a valuable asset for business actors, one of which is engaged in e-commerce. Pasdeal is a credit distributor and server service that implements an e-commerce information system. The use of information systems in the field of sales or electronic commerce is considered efficient because it has become a platform for media and services and new and unique capabilities that are not found in the physical world. Information security factor is a very important aspect to consider considering the performance of ICT governance. For this reason, information systems need an information security evaluation in order to find out the gaps and deficiencies in information security in the information system. The KAMI index is a reference tool to evaluate the level of readiness of information system security in an organization. Evaluation is carried out on various areas that are the target of information security implementation based on the ISO/IEC 27001:2013 standard. Based on the results of the KAMI index assessment, it was found that Pasdeal got a score of 591 points from the application of the ISO 27001 standard with a pretty good predicate.

Evaluation of Information Security of Deep Foundation Pit Reinforcement Scheme

The purpose of deep foundation pit support is to protect the safety of the underground structure and the surrounding environment. This article introduces the reinforcement measures of the deep foundation pit supporting structure in combination with a deep foundation pit on the Huzhou-Hangzhou line; from the material and mechanical point of view, the feasibility of the safe implementation of the deep foundation pit reinforcement plan is analyzed; then the displacement monitoring data obtained confirms that the reinforcement plan can be Improve the overall stability of the deep foundation pit construction, and provide safe and effective guidance for the deep foundation pit construction.

An analysis of methods for assessing information security risks of financial institutions

The paper presents an analysis of the existing methods for assessing information security risks, their features, advantages and disadvantages, as well as determines the possibility of using such techniques for assessing information security risks in financial institutions. Criteria for comparing information security risk assessment methods have been formed, the advantages and disadvantages of the methods are described. It is shown that, despite the requirements of regulators for assessing information security risks, most of the regulatory documents deal with operational risks. The evaluation of information security risks of credit and financial institutions does not have sufficient regulation and formalization.The authors substantiate the necessity of developing a method for assessing information security risks for credit and financial organizations, taking into account the features of risk assessment inherent to the mentioned organizations. The paper considers the need to create lists of existing threats to the credit and financial sector and their linking to existing vulnerabilities to optimize the process of assessing information security risks. The development of a methodology for assessing information security risks will increase the degree of compliance of credit and financial institutions with the requirements of international, state and industry standards through an optimal set of protection measures and models for evaluating information security risks.

Collective information security behaviour: a technology-driven framework

PurposeThis paper aims to present the development of a framework for evaluating group behaviour in information security in practice.Design/methodology/approachInformation security behavioural threshold analysis is used as the theoretical foundation for the proposed framework. The suitability of the proposed framework is evaluated based on two sets of qualitative measures (general frameworks and information security frameworks) which were identified from literature. The successful evaluation of the proposed framework, guided by the identified evaluation measures, is presented in terms of positive practical applications, as well as positive peer review and publication of the underlying theory.FindingsA methodology to formalise a framework to analyse group behaviour in information security can successfully be applied in a practical environment. This application takes the framework from only a theoretical conceptualisation to an implementable solution to evaluate and positively influence information security group behaviour.Practical implicationsBehavioural threshold analysis is identified as a practical mechanism to evaluate information security group behaviour. The suggested framework, as implemented in a management decision support system (DSS), allows practitioners to assess the security behaviour and awareness in their organisation. The resulting information can be used to exert an influence for positive change in the information security of the organisation.Originality/valueA novel conceptual mapping of two sets of qualitative evaluation measures is presented and used to evaluate the proposed framework. The resulting framework is made practical through its encapsulation in a DSS.

Information Security Monitoring and Management Method Based on Big Data in the Internet of Things Environment

As an important part of the new generation of information technology, the Internet of Things (IoT), with its ubiquitous connection and service characteristics, has penetrated into various fields of application and played an important role. In this paper, based on the study of the basic technology of the environmental Internet of Things, combined with the service-oriented technology architecture SOA, J2EE, multi-level system architecture MVC, real-time database and other technologies and project practice experience, summarized and proposed a kind of environmental quality monitoring integrated management platform design and implementation feasibility scheme. Firstly, the background of the era of big data is described in detail, the urgency and necessity of information security monitoring under the background of big data is clarified, and the three elements of information security monitoring mechanism, namely network monitoring personnel, environment and technology, are proposed, and the three elements as the starting point to establish the information security monitoring mechanism; Starting from the relevant monitoring strategies and safety monitoring technologies, this paper explains the basic principles of constructing the evaluation index system, and establishes the evaluation index system according to the key influencing factors of enterprise information security level in the environment of big data. AHP fuzzy comprehensive evaluation method is chosen on the basis of analyzing various comprehensive evaluation methods, and the weight of each evaluation index is determined and the comprehensive evaluation model is constructed. The establishment of information security monitoring and evaluation system, the use of information security monitoring and evaluation system, for information security monitoring work to provide reference standards. Finally, on the basis of the foregoing, relevant strategies for information security monitoring are proposed, and necessary suggestions are provided for information security work.

New Approach for Information Security Evaluation and Management of IT Systems in Educational Institutions

Security evaluation and management has become increasingly important for Web-based information technology (IT) systems, especially for educational institutions. For the security evaluation and management of IT systems in educational institutions, determining the security level for a single IT system has been well developed. However, it is still difficult to evaluate the information security level of the entire educational institution considering multiple IT systems, because there might be too many different IT systems in one institution, educational institutions can be very different, and there is no standard model or method to provide a justifiable information security evaluation among different educational institutions considering their differences. In light of these difficulties, a security evaluation model of educational institutions’ IT systems (SEMEIS) is proposed in this work to facilitate the information security management for the educational institutions. Firstly, a simplified educational industry information system security level protection rating (EIISSLPR) with a new weight redistribution strategy for a single IT system is proposed by choosing important evaluation questions from EIISSLPR and redistributing the weights of these questions. Then for the entire educational institution, analytic hierarchy process (AHP) is used to redistribute the weights of multiple IT systems at different security levels. Considering the risk of possible network security vulnerabilities, a risk index is formulated by weighting different factors, normalized by a utility function, and calculated with the real data collected from the institutions under the evaluation. Finally, the information security performance of educational institutions is obtained as the final score from SEMEIS. The results show that SEMEIS can evaluate the security level of the education institutions practically and provide an efficient and effective management tool for the information security management.

The Practical Dilemma and Method of Personal Information Protection in the Era of Big Data

The era of big data brings us not only an opportunity given by the development of the era, but also a challenge. To improve Chinese citizens’ quality of big data application is also an inevitable internal requirement for the social and economic development of various countries and regions in the era of big data economy. In the era of big data development, the security leakage of personal information has become more and more serious, which has aroused people’s high attention and increasing concern. The purpose of this paper is to provide countermeasures and Suggestions for the reasonable protection of personal information by deeply analyzing the practical dilemma and solutions of the reasonable protection of personal information in the era of big data. In this paper, first of all, this paper expounds the dialectical nature of the current era of big data network information search on the personal information security in our country the major risks and opportunities for development, and the in-depth analysis of the current our country network information search security risk main origin, on the basis of focus from legal ideological cultivation, inspection du regulatory legislation, application technology and so on three aspects put forward to speed up the building of the personal information security management system in our country strategic thinking. And then comb through studying related literature review of network information security evaluation index system, using the evaluation index system of comprehensive level calculation analysis method for network actual weight of each evaluation index in the relationship between level computation, the result shows that composite reliability were greater than 0.7, which eventually concluded that a more reasonable and practical index system of network weight calculation.

Information security evaluation for Android mobile operating system

One of the main directions of information systems development is to increase the efficiency of collecting, processing and exchanging information through the introduction of modern data transfer technologies, automated remote monitoring and control. The cornerstone of this concept is mobile devices that solve the issue of operational data exchange and processing. Modern mobile services used including the exchange and processing of personalized, banking and critical data are the result of the steady increase in the number of crimes in the field of information security in relation to and using mobile devices. The widespread use of these devices for access to protected information contained in information systems has given special importance to the issue of information security.The subject of this research is to assess the current state of information security mechanisms for mobile operating systems that form the basis of the structure of episodic distributed mobile networks. The Android OS (operating system) was used as an example. The article discusses the problems of the development of a mobile ecosystem and methods aimed at solving them, the main vectors of malicious impact, ways of countering the means of static and dynamic analysis and modern protection mechanisms.

Comprehensive Information Security Evaluation Model Based on Multi-Level Decomposition Feedback for IoT

The development of the Internet of Things (IoT) calls for a comprehensive information security evaluation framework to quantitatively measure the safety score and risk (S&R) value of the network urgently. In this paper, we summarize the architecture and vulnerability in IoT and propose a comprehensive information security evaluation model based on multi-level decomposition feedback. The evaluation model provides an idea for information security evaluation of IoT and guides the security decision maker for dynamic protection. Firstly, we establish an overall evaluation indicator system that includes four primary indicators of threat information, asset, vulnerability, and management, respectively. It also includes eleven secondary indicators of system protection rate, attack detection rate, confidentiality, availability, controllability, identifiability, number of vulnerabilities, vulnerability hazard level, staff organization, enterprise grading and service continuity, respectively. Then, we build the core algorithm to enable the evaluation model, wherein a novel weighting technique is developed and a quantitative method is proposed to measure the S&R value. Moreover, in order to better supervise the performance of the proposed evaluation model, we present four novel indicators includes residual risk, continuous conformity of residual risk, head-to-tail consistency and decrease ratio, respectively. Simulation results show the advantages of the proposed model in the evaluation of information security for IoT.