Implementing Information Security Research Articles

MARITIME SECURITY REGULATION CONCERNING INTERNATIONAL SHIP AND PORT FACILITY SECURITY CODE 2002 AND ITS IMPLEMENTATION IN INDONESIA

Ministerial Regulation Number 134 of 2016 is a form of ratification of the International Ship and Port Facility Security Code 2002 (ISPS Code, 2002), the objective of which is to establish a consistent standard framework for evaluating risk and enabling the government to compensate for changes in threats through measures appropriate safety measures. In its development, there are several regulations related to implementing the 2002 ISPS Code in Indonesia. These regulations were formed by adjusting the standard regulations in the 2002 ISPS Code with the safety conditions of ships and ports in Indonesia. The problem is, Indonesia has several large ports that operate as international ports in international trade. The type of research used is normative legal research sourced from primary, secondary, and tertiary legal materials whose data collection is carried out by literature study. The results of the study show two things: (1) Maritime security arrangements relating to shipping safety standards and port facilities in the 2002 ISPS Code are divided into two parts, namely part A (Part A) containing systematic arrangements and implementation of the ISPS Code for signatory countries including and Definition, Purpose, Scope of Ship Safety Standards and Port facilities and ISPS Code Compliance Procedure. And part B (Part B) contains further explanation about part A including Determination of Security Level, Implementation of Ship Security, Implementation of Port Facility, and Information and Communication Security. (2) The implementation of the maritime security regulation related to security standards ships and port facilities in the ISPS Code in 2002 in Indonesia contained in via Law No. 17 the Year 2008 on the voyage, Ministerial Regulation Number 134 the Year 2016 concerning Management of Ship Safety and Port Facilities.

ОСНОВНЫЕ НАПРАВЛЕНИЯ СОЗДАНИЯ ИНФОРМАЦИОННОЙ СИСТЕМЫ ДЛЯ ИДЕНТИФИКАЦИИ ЛИЧНОСТИ ПО ФЕНОТИПИЧЕСКИМ ПРИЗНАКАМ ЧЕЛОВЕКА

The tempestuous and rapid development of biometric technologies based on both the static and dynamic identification signs of a person could not bypass one of the important spheres of life in modern society – the fight against crime. Most of the solutions related to personal identification by papillary patterns, iris and retina of the eye, drawing of veins on the arm and thermographic face cards are widely used in the access control and management systems, systems for protecting the automated information systems from unauthorized access to information. At the same time, the use of those signs in the investigation and disclosure of crimes is just beginning to be introduced into the activities of the law enforcement agencies of the Russian Federation. The use of the information systems in that area can significantly increase the effectiveness of the fight against crime, especially crimes against the person. Of particular interest is the use of data on the phenotypic signs of the suspect in the investigation of crimes, i.e. information about his height, weight, hair color, eyes, skin tone, and blood group. The article discusses the basic principles of creating an automated information system for identifying a person based on biological material left by persons who were present at the crime scene. It defines the complex of organizational and scientific issues that need to be solved when creating a system, ensuring its information security and software implementation. Also it proposes an algorithm for two-stage searching the information stored in the databases of the ISOD (UDS) services, based on modern data processing methods.

METHODS OF SYSTEM ANALYSIS IN THE FORMATION OF INFORMATION SECURITY POLICY ON TRANSPORT

Approaches to the application of methods of system analysis to solve problems related to information security of enterprises in transport, which have a complex IT structure with a large number of components. It is shown that the active expansion of the areas of informatization of the transport industry, especially in the segment of mobile, distributed and wireless technologies, is accompanied by the emergence of new threats to information security. It is shown that in order to build an effective information security system, the selection and implementation of adequate technical means of protection should be preceded by a stage of description, analysis and modeling of threats, vulnerabilities, followed by calculation of risks for IS and determining the optimal strategy for information security system. After evaluating the different NIB options according to several criteria, a decision is made: if the recommendations coincide, the optimal solution is chosen with greater confidence. If there is a contradiction of recommendations, the final decision is made taking into account its advantages and disadvantages, for example, the strategy of information security system development is chosen, which turned out to be optimal for at least two criteria. If different NIB development strategies are obtained for all three criteria, it is necessary to vary the values of pessimism-optimism in the Hurwitz criterion or change the data, for example, about possible threats to IP or automated enterprise management system. An algorithm for modeling the decision-making process for selecting the optimal strategy for managing investment design components of the information security system for the transport business entity is proposed.

Security Professionals Must Reinforce Detect Attacks to Avoid Unauthorized Data Exposure

Organizations face the probability of being hacked because of weak and inadequate cybersecurity implementations. Hackers are still able to breach a system when security tools such as firewalls, SIEM, anti-virus software, encryption, and IDPS are readily in place within an organization. Digital criminals are responsible for increased network breaches using elusive security tools to penetrate secure environments with sophistication. Cyberattacks are continually increasing due to the sophistication and innovation of cyber attackers. Many vulnerable areas must be reinforced against cybercriminals, Insider threats, inadequate employee training, and negligence. Monetary investment in cybersecurity and management support plays a significant role in assuring the implementation of information security throughout any organizational processes. The implication for practice can provide organizations with approaches on how to mitigate cyber exploits and safeguard the confidentiality, integrity, and availability of information by bridging the gap between incident detection and response.

Review on methods of imrpoving information security posture of the company by increasing end user awareness

Employees can potentially expose their organizations to huge amount of cyber risk. This may happen through falling for phishing attacks, careless handling of sensitive data, or poor password management, many data breaches are directly or indirectly caused by user awareness issues. To tackle this, mature companies have implemented security awareness program initiatives. However, without fostering feelings of responsibility and accountability for cybersecurity among employees, these programs will not necessarily make an organization any safer or less vulnerable. This article provides general review on different ways of establishing robust security culture within companies and building effective security programs. The report also discusses current approaches and challenges of implementing information security awareness programs.

Information Security Management Systems - Evolving Landscape & ISO 27001: An Empirical Study

ABSTRACT In order to strengthen the partnership both economically and politically among countries in the region, the Belt and Road Initiative (BRI) was introduced and implemented since 2013 by the People Republic of China. Information technology has become an integral part of all business activities. Managing information security has been a key aspect in ensuring that increased information security risks (due to reliance on IT) are managed effectively. The reliance on digital and technology platforms has increased even further due to pandemic driven changes. This has led to higher information security risk exposure of organizations and their employees and their customers. Organizations use various frameworks to design and implement information security management systems, with ISO 27001 standard being the leading framework. Past researches in ISMS and leveraging ISO 27001 have had limitation of single country focus, Further there is limited research on relevance of ISO 27001 in evolving paradigm of computing shift. This global research presents an empirical study, based on inputs from industry practitioners, reflecting the key drivers for ISO 27001 implementation and certification, investigates pattern in those drivers based on size of the organization and examines the relevance of ISO 27001 both as framework and / or certification in the evolving scenario of cloud. Findings of the research indicate that the top reason for ISO 27001 implementation and certification is “compliance”, followed by “business value”, “competitive edge”, and “breach reduction” in that order. Findings also indicate that focus on information security is increasing and ISO 27001 implementation provides an effective ISMS and ISO 27001 certification helps organizations in improving their trustworthiness in keeping information secure. Keywords: Information system, security, management system, information technology

Development of the Library and Information Science Students’ Digital Competencies

The article is devoted to the existing tasks in the field of improving the quality of higher library education in the digitalization era. The purpose of the article is to focus on challenges and possibilities concerning digital competence of students in library and information education. The librarians’ digital competence is growing importance in classrooms, now that digital resources and digital media are becoming important parts of librarians’ everyday practice. The starting point of the study is the need to identify the key components of students’ digital competence in terms of knowledge and skills necessary for successful professional implementation and increase competitiveness in the labor market. Predictive-analytical method, the conceptualization method and mental modeling method have been used in the key components of digital competencies study. The authors propose to supplement the set of competencies for Library and information science students taking into account features of the modern information environment development. The main digital competencies of library students and library professionals should be considered: the ability to work with digital information; ability to communicate in a digital media environment; ability to create and manage digital content; implement information security measures; ability to solve the problems of digital modernization, identify and analyze society’s information needs based on the study of trends in the digital media space. A librarian should have a combination of technological and librarianship competences. A new area in digital competence of librarians was revealed. Recommendations for librarians training in the areas of digital competence have been suggested.

The Implementation of Multiple Information Security Governance (ISG) Frameworks Strategy and Critical Success Factors in Indonesia’s Oil and Gas Industry: Case Study of PT X

Oil and gas industry are among the largest contributor to the Indonesia’s foreign exchange. Many believe that information technology will be major driver for economic wealth in the oil and gas Industry. However, implementing information technology to support corporate business process brings vast information security risks. There is a need of comprehensive information security governance that can comply to information security standards and regulations. This research is conducted to evaluate the use of multiple ISG frameworks for implementing information security governance in a multinational oil and gas company. In detail, we evaluate the effectiveness of such framework, assess its implementation maturity level, and identify the success and inhibiting factors for implementing ISG frameworks. This study shows that framework XYZ, as a multiple ISG framework, is effective to cover the controls of ISO 17799, COSO, and IT Risk Framework at once. Meanwhile, the observed case study indicated lack of compliancy of Framework XYZ followed by the invention of gap between current ISG implementation efforts and company visions. Lastly, several success and inhibiting factors are identified in the ISG framework implementation at PT X.

Requirements for computerized tools to design information security policies

Information security is a hot topic nowadays, and while top-class technology exists to safeguard information assets, organizations cannot rely on technical controls alone. Information security policy (ISP) is one of the most important formal controls when organizations work with implementing information security. However, designing ISPs is a challenging task for information security managers and to ease the burden, computerized tools have been suggested to support this design task. One important prerequisite for developing such tools is the requirements. However, existing research has, to a very limited extent, synthesized existing requirements. Against this backdrop, this study aims to elicit a set of requirements, anchored in existing ISP research, for computerized tools that support ISP design. First, we summarize existing ISP research into 14 requirement themes. Second, we suggest a set of user stories that operationalize these requirement themes from an information security manager's perspective. Third, we suggest another set of user stories that operationalize the same requirement themes from an ISP user's perspective. In total, we suggest 28 user stories that can act as a starting point for both researchers and practitioners when developing computerized tools that provide ISP design support for information security managers.

Implementation of Information Security System in Service and Trade

Usage of information technologies in service and trade industry is increasing daily which is accompanied by information leakage risks. Information security system can prevent threats from employee’s lack of skills and detect vulnerabilities on early stages. To implement information security system, general steps are to build conceptual model of the subject area, build a semantic network to follow decision making process, adept current situation in company to ISO 27001 requirements and choose information system to atomize business processes. EPC diagram given in this paper shows the steps that service and trade companies can follow to get ISO 27001 certificate. The article describes such security information and event management systems as IBM QRadar security intelligence platform, Splunk Enterprise Security and RSA NetWitness Suite. The results of the research show how implementation of information security policy impact company’s indicators and reputation. Cyber security system’s implementation can lead to low expenses caused by interruption in service or data leakage, increased reliability and security of systems and improved business processes’ optimization.

An efficient security data-driven approach for implementing risk assessment

Information security implementation in an organization regardless of its business processes will not be effective. Current approaches to risk assessment have moved towards business process-oriented ones. Thus, in new approaches, assets are got attention based on the business processes involved. But existing approaches that are based on business processes have their drawbacks. For example, we need to detail processes to know what security data is produced or used in tasks, and what are their importance from the organization’s point of view. Security data certainly has different meanings. How security data moves in an organization’s network environment is another important point. Therefore, the main task in information security would be protecting security data, from the point of creation location to storage.In this paper, several improvements over other solutions are presented. The business processes of the organization are categorized according to security concerns (called fear stories). In the next improvement, we have gone one step further in the business processes, which is extracting the organization’s security data. Therefore, security data plays a key role in our model. The next improvement is the introduction of the security data life cycle (creation, edit, display, process, transfer, store), and its adaptation to the asset layers (logical, physical, and human) through a series of predefined patterns. Thus, in this model, a multi-organization pyramid of security needs will be formed, each pyramid being a hierarchical multi-layer, involving security concerns, related business processes, extracted security data, assets involved, identified risks and optimal combination of security controls. At the end of the paper, we will show how the model presented in this paper will effectively improve the popular risk assessment methods such as CVSS (Common Vulnerability Scoring System) and OWASP (Open Web Application Security Project).

The Information Security Cultures of Journalism

This article is an exploratory study of the influence of beat and employment status on the information security culture of journalism (security-related values, mental models, and practices that are shared across the profession). The study is based on semi-structured interviews with 16 journalists based in Canada in staff or freelance positions working on investigative or non-investigative beats. We find that journalism has a multitude of security cultures that are influenced by beat and employment status. The perceived need for information security is tied to perceptions of sensitivity for a particular story or source. Beat affects how journalists perceive and experience information security threats. Investigative journalists are concerned with surveillance and legal threats from state actors including law enforcement and intelligence agencies. Non-investigative journalists are more concerned with surveillance, harassment, and legal actions from companies or individuals. Employment status influences the perceived ability of journalists to effectively implement information security. Based on these results we discuss how journalists and news organisations can develop effective security cultures and raise information security standards.

Optimum spending on cybersecurity measures

PurposeThis purpose of this paper is to provide insight through analysis of the data collected from a pilot study, into the decision-making process used by organizations in cybersecurity investments. Leveraging the review of literature, this paper aims to explore the strategic decisions made by organizations when implementing cybersecurity controls, and identifies economic models and theories from the economics of information security, and information security investment decision-making process. Using a survey study method, this paper explores the feasibility for development of a strategic decision-making framework that may be used when evaluating and implementing cybersecurity measures.Design/methodology/approachA pilot study was conducted to evaluate the ways in which decisions are made as it relates to cybersecurity spending. The purpose of the pilot study was to determine the feasibility for developing a strategic framework to minimize cybersecurity risks. Phase 1 – Interview Study: The qualitative approach focused on seven participants who provided input to refine the survey study questionnaire. Phase 2 – Survey Study: The qualitative approach focused on information gathered through an online descriptive survey study using a five-point Likert scale.FindingsThe literature review identified that there is limited research in the area of information security decision making. One paper was identified within this area, focusing on the research completed by Dor and Elovici [22]. This exploratory research demonstrates that although organizations have actively implemented cybersecurity frameworks, there is a need to enhance the decision-making process to reduce the number and type of breaches, along with strengthening the cybersecurity framework to facilitate a preventative approach.Research limitations/implicationsThe partnership research design could be expanded to facilitate quantitative and qualitative techniques in parallel with equal weight, leveraging qualitative techniques, an interview study, case study and grounded theory. In-depth data collection and analysis can be completed to facilitate a broader data collection which will provide a representative sample and achieve saturation to ensure that adequate and quality data are collected to support the study. Quantitative analysis through statistical techniques (i.e. regression analysis) taking into account, the effectiveness of cybersecurity frameworks, and the effectiveness of decisions made by stakeholders on implementing cybersecurity measures.Practical implicationsThis exploratory research demonstrates that organizations have actively implemented cybersecurity measure; however, there is a need to reduce the number and type of breaches, along with strengthening the cybersecurity framework to facilitate a preventative approach. In addition, factors that are used by an organization when investing in cybersecurity controls are heavily focused on compliance with government and industry regulations along with opportunity cost. Lastly, the decision-making process used when evaluating, implementing and investing in cybersecurity controls is weighted towards the technology organization and, therefore, may be biased based on competing priorities.Social implicationsThe outcome of this study provides greater insight into how an organization makes decisions when implementing cybersecurity controls. This exploratory research shows that most organizations are diligently implementing security measures to effectively monitor and detect cyber security attacks. The pilot study revealed that the importance given to the decisions made by the CIO and Head of the Business Line have similar priorities with regard to funding the investment cost, implementing information security measures and reviewing the risk appetite statement. This parallel decision-making process may potentially have an adverse impact on the decision to fund cybersecurity measures, especially in circumstances where the viewpoints are vastly different .Originality/valueCybersecurity spend is discussed across the literature, and various approaches, methodologies and models are used. The aim of this paper is to explore the strategic decision-making approach that is used by organizations when evaluating and implementing cybersecurity measures. Using a survey study method, this paper explores the feasibility for development of a strategic decision-making framework that may be used when evaluating and implementing cybersecurity measures.

Mapping the variations for implementing information security controls to their operational research solutions

Mapping the variations for implementing information security controls to their operational research solutions

Research and implementation of information security for intelligent distribution network

The intelligent distribution network is an important hub for connecting power generation and users, and the security of its information is closely related to the stable operation of the power grid. In order to solve the contradiction between the security and real-time of information in intelligent distribution network according to Supplementary Provisions for Safety Protection of Medium and Low Voltage Distribution Network Automation System, an information security model of intelligent distribution network is proposed, after deeply studying AES encryption algorithm and SHA-256 authentication algorithm, using OPNET as simulation software for smart distribution network information to carryout transmission delay curve. FPGA is used as information security processing platform. We obtain the total delay, analyze the integrity and availability. The experiment proves that the intelligent distribution network information security processing solution satisfies the three elements of CIA information security, and has good confidentiality, integrity and availability.

State and enterprise information security management: legal and organizational aspects

The components of the state information policy on information security and the basic activities of public authorities in this field are reviewed in the article. The internal and external information challenges facing Ukraine and ways of ensuring information security are analyzed. Information security is seen as a component of national security, as well as a global problem of information security, information space, information sovereignty and information support decision-making. The article is devoted to the review of approaches to the essence of threats to information security and politico-juridical analysis of threats to information security of Ukraine at the present stage. The threats of information security are analysed in the context of the system of threats of national security. On base of the analysis of the condition normative-legal regulation to information safety of the Ukraine are determined main value and defect in normative field state on provision of information security. The definition of information security of the enterprise is given. The basic goals, objectives, principles and types of threats. At their core formed methodical approach to developing the information security systems of industrial enterprises. The proposed enterprise information security system is regarded as a model of information warfare with the factors of internal and external environment, based on the analysis of modern approaches to the definition of information security, and on a synthesis of theoretical positions and experience of functioning of the organizations. The use of the developed approach the Holy Practice of management of industrial enterprises will help to increase the efficiency of development, implementation and use of information security and prevent system or methodological errors at each stage.

Integration of Information Security and Artificial Intelligence Implementation

The application of artificial intelligence will inevitably lead to a leap in the production, transmission and storage of information and changes in its characteristics. Information security will also have new characteristics. Artificial intelligence plays an increasingly important role in the field of information security, especially in defense and attack. From the series of legislation and planning in Europe and the United States, we can see how to make use of the characteristics of artificial intelligence to better protect and enhance information security has become a hot topic in the industry.

Design and Implementation of Marine Information Security Early-Warning System Based on Attack Behavior Pattern Analysis

Zhao, J.; Zhang. K., and Duan, T., 2019. Design and implementation of marine information security early-warning system based on attack behavior pattern analysis. In: Li, L.; Wan, X.; and Huang, X. (eds.), Recent Developments in Practices and Research in Coastal Regions: Transportation, Environment, and Economy, Journal of Coastal Research, Special Issue No. 98, pp. 175–178. Coconut Creek (Florida), ISSN 0749-0208.The offshore platform structure is major infrastructure for the development of offshore petroleum resources and a base for offshore production operations and life. The environment of the offshore platform structure is very complicated and bad, and under environmental influence, the resistance of the offshore platform structure may below. The failure of the offshore platform structure not only causes direct major economic losses and casualties, but also may cause serious environmental pollution and social and political impacts. This paper describes the establishment and modification of a real-time calculation model of the offshore platform structure, determines the real-time environmental load of the system based on marine environment monitoring, proposes a real-time safety assessment method of the offshore platform structure, and develops a Windows application using the Delphi development tool. The system was commissioned twice in the Bohai JZ20-2MUO platform during the winter of 1998–99 and 1999–2000 and the security status of the JZ20-2MUO platform in the winter was monitored in real time.

Гібридна війна Росії проти України: інформаційний наступ та механізми протидії

У статті детально розглянуто проблему інформаційної війни Росії проти Україні. Розкрито суть інформаційної війни, її трактування в межах різних підходів. На основі використання історичного, системного та структурно-функціональних методів з’ясовано основні недоліки інформаційної сфери України; виокремлено головні механізми її захисту. Серед механізмів протидії інформаційній війні Росії проти України виокремлено дві групи – нормативно-правові та інституційні. До першої групи відносяться законодавчі акти України, серед яких провідну роль у протидії інформаційній агресії Росії відіграє Доктрина інформаційної безпеки України. Серед другої групи механізмів виділяються державні й недержавні інституції, діяльність яких спрямовано на формування та реалізацію інформаційної безпеки України, а також міжнародні структури, діяльність яких націлено на нейтралізацію інформаційного впливу з боку Росії. Серед вітчизняних інституційних механізмів протидії російському інформаційному наступу важливе місце відведено Міністерству інформаційної політики України, Раді національної безпеки та оборони України, кіберполіції й ін.Значну увагу звернуто на такі механізми протидії інформаційній війні Росії проти України, як заборона російських сайтів та соціальних мереж, а також запровадження квот на українську мову у мас-медіа. Зазначено, що дії України щодо нейтралізації інформаційних загроз з боку Росії потрібно здійснювати на різних рівнях – геополітичному, ресурсному, громадськості.У ході проведеного дослідження сформовано рекомендації щодо протистояння інформаційній війні. Проведено аналіз факторів інформаційних впливів і протидії інформаційній зброї, у результаті чого вказано низку можливих дій для реалізації протидії російській інформаційній ескалації в Україні з метою створення гідної й адекватної відповіді на інформаційні виклики сучасності.Зараз уже зрозуміло, що інформаційна боротьба стає тим фактором, що впливає на саму війну, її початок, хід і результат. Це підтверджується агресією Росії проти України. Тому досить актуальною проблемою безпеки України є розробка концепції захисту системи інформаційно-аналітичного забезпечення завдань інформаційної боротьби.

Analysis of the Information Security Arrangement in Russia and Other Countries

Purpose of research. This article discusses various techniques for information security implementation used in certain countries; presents analysis and comparison of the degree of information security development in the Russian Federation. A brief history of the origin and subsequent dynamics of the development of this area in different countries is given. The objectives of this article are to analyze the legislation basis of different countries, namely the laws, regulations, decrees related to the sphere of information and personal data security and to develop a technique to increase the share of prevented attacks against information systems. Methods. The peculiarities of forms of information security implementations in the Russian Federation, the United States of America, Germany,and Francewas studied. The article analizes the current global international standards for standardization of security measures and systems related to the ISO / IEC 27000system, and the level of their implementation in Russia. The method of Saati hierarchies was chosen as the research method. Results. Theconducted research allowed us to reveal possible shortcomings of information security implementation in Russia by means of drawing an analogy with other countries with a more developed information security systems. Russian legislative framework contains many laws and regulations that affect personal data protection and processing, but their number and arrangement clarity is not sufficient and needs to be enhanced. Conclusion. As a result of the analysis it can be concluded that Russia pays considerable attention to information security implementation; different measures have been taken to its ensurance; a number of Federal laws have been enacted. However, the regulatory framework of the Russian Federation, the purpose of which is to protect information and personal data, has a relatively short history of development and needs enhancement.