Information Security Incidents Research Articles

Genetic Algorithm-Based Power System Information Security Risk Assessment Method

With the innovation and application of new-generation information technologies such as cloud computing, Internet of Things, and mobile Internet, the importance of information security issues has become more prominent. As an important industry linking people’s livelihood, the electric power industry will affect the safe operation of electric power once an information security incident occurs, and even lead to a large-scale blackout. Therefore, studying the information security risk assessment model of electric power enterprises has important theoretical value and practical significance. The purpose of this paper is to study the method of power system information security risk assessment based on genetic algorithm. This paper establishes a security risk quantification model, determines the operating parameters of the genetic algorithm in specific operations based on some literature cases, and compares the results in the literature with those in this paper. Based on a large number of investigations and interviews, this paper conducts research on information security risks, comprehensively considers the threats and vulnerabilities of the system, and analyzes the important impact of information security risks from the internal management, personnel, technology, and systems of electric power enterprises. Factors, the establishment of a power enterprise information security risk evaluation index system, this paper obtains data from actual system evaluation cases, uses multiplication, matrix method, and the genetic algorithm proposed in this paper to calculate the risk quantification model calculation results, and verifies the genetic algorithm the rationality and feasibility of combining with risk assessment, this method has practical application value. Experimental research shows that the risk value calculated by the genetic algorithm based on the risk quantification model proposed in this paper is more than 70% similar to the results calculated by the multiplication method and the matrix method, which proves that the model and calculation method established in this paper can be used. Applied to the specific evaluation implementation process.

МОДЕЛЬ ОЦЕНКИ УЩЕРБА ОТ ИНЦИДЕНТОВ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ

Любая информационная система в процессе эксплуатации требует резервирования определённого объёма средств на ликвидацию последствий инцидентов информационной безопасности в случае их возникновения. Для оценки величины ущерба использовались многомодальные законы распределения плотностей вероятностей ущерба в единичном инциденте информационной безопасности, а инциденты информационной безопасности рассматриваются как события пуассоновского потока. В работе определены зависимости между интенсивностью возникновения событий информационной безопасности, характеристиками распределения плотностей вероятностей ущерба и необходимой величиной резервируемых средств. Представленная модель оценки ущерба от инцидентов информационной безопасности позволяет более точно подходить к оценке требуемого объем резервируемых средств. Показано, что экономия средств достигает 40-50% в сравнении с подходом, основанным на оценке ущерба исходя только из среднего числа инцидентов и среднего ущерба от единичного инцидента информационной безопасности.

An overview of regulatory sources and practices of information security incidents management

Any organization should take into account the threats to information assets to ensure information environment security. It is impossible to identify an entire field of all possible threats for each specific business: appearance of new threats may be caused by changes in the internal or external working conditions of an organization as well as the development of new technologies and other changes. Using time-tested standards and best international practices is highly recommended for managing incidents.

The dependence of the performance of imaging tasks on the forensic imager interface type

Forensic research in the investigation of information security incidents, the production of forensic examinations and many other areas of activity related to computer forensics require the maximum possible preservation of the integrity of the investigated data. To do this, write blockers are used - programs or devices that do not allow writing anything to the drive under investigation. The need to use such means comes both from the requirements of procedural legislation (for example, the Criminal Procedure Code of the Russian Federation), and from various recommendations of a methodological and other nature, as well as from standards (for example, STO BR IBBS-1.3-2016). Some aspects of the functioning of write blockers will be discussed in this article. And on the example of the criminalistic lock the question of influence of the used interface for data transmission in tasks of creation of images of data carriers will be considered.

General approach to automating the process of responding to computer security incidents

The article considers the process of responding to information security incidents as a cyclical process divided into several stages. The main approaches to automating response processes are presented, as well as cases in which automation is not effective.

Методы разработки рекомендаций для повышения защищенности информационных систем

With the advent of information technologies, information systems have been widely used in organizations and enterprises. The use of information systems allows optimizing the workforce, automating all or part of business processes. However, the use of information systems requires the development of an information security system to minimize malicious attacks. To reduce the likelihood of malicious attacks, there are a large number of software and hardware-based information security tools. The complexity of computing the distribution of the components of information systems complicates the process of creating and configuring protection systems, the number of threats to security are increasing every year. For a timely response to information security incidents, including attacks, it is necessary to use information system security assessment tools to reduce the risks of security breaches. InfoWath statistics show the growth trend of various types of attacks, both from an external attacker and from an internal one. Therefore, one of the most important tasks is to correctly determine the security of information systems. The paper implements a mathematical model for assessing the security of an information system based on the selected methods. The architecture of the software package for assessing the security of the information system is formed.

Deterrence and leadership factors: Which are important for information security policy compliance in the hotel industry

Hotels have developed information security policies to deal with information security incidents, and managers are interested in how to enhance employees' compliance with these policies. This study examines how deterrence perception and managers' leadership influence employees' intention to comply with information security policies. Two rounds of surveys were conducted to collect data from Chinese hotel employees. The results show that perceived deterrent certainty has a positive effect. On the other hand, ethical leadership has a significant indirect effect with the second-round compliance intention. Abusive supervision does not have positive effects, even when managers' intent is motivational. Our study is among the first to examine the effect of managers' leadership on information security compliance intentions in the hotel industry. Our study also provides important strategic guidelines for by informing hotel managers that ethical leadership should be practiced as a means of enhancing employees' information security policy compliance.

Selected Aspects of Information Security Management in Entities Performing Medical Activity

The article is devoted to the issues related to an information security management in medical entities. The healthcare entities have been amongst the prime targets for hackers for several years. According to the IBM report “The 2016 X-Force Cyber Security Intelligence Index” in 2015 most of the attacks were carried out against these entities. The years 2016 and 2017 also witnessed spectacular cyberattacks, for example: medical records breach of 3.3 million people because of an unauthorized access to a server in the US, some WannaCry ransomware attacks on the UK hospitals, some MongoDB Database Leaks in the US or NotPetya ransomware attacks in the US hospitals. Entities performing medical activity are processing personal data concerning health that is classified as a “sensitive data” and needs a special protection. The article presents the results of the survey – interviews with IT managers (or designated persons) in entities performing medical activity in Lodz Voivodeship in Poland. The aim of the research was analysis and evaluation of information security management in these entities. The interviews had been performed between December, 2017 and January, 2018. As the results of the research, the ways of information security management were identified (in particular such aspects as: characteristics of the information security teams, information security management system auditing, risk management, information security incidents, budgets for information security, training and the General Data Protection Regulation implementation). The paper also describes the types of information that should be protected in healthcare entities and characteristic of surveyed entities that subordinate to the local government of Lodz Voivodeship in Poland.

Social engineering attacks life cycle and types

Today, social engineering attacks are one of the most common methods for hackers to hack computer networks and information systems of organizations, steal credentials and other confidential information of users, and commit various cybercrimes. Socio-engineering attacks pose a particular threat to companies with large numbers of employees. Without proper training and education of staff, an attack on an employee who is not related to information security is more likely to be successful, but even such an employee may not be the main cause of a company's information security incident, but become one of the links in the attack chain. which the attacker created to achieve his ultimate goal. Given this, the need to raise awareness about socio-engineering attacks, namely how they are implemented and what types of them exist. This article describes the life cycle of social engineering attacks and the main methods that are used by attackers to implement such attacks. Company employees should be familiar with the signs and examples of various types of social engineering attacks in practice, the principles and rules for working with information, as well as the responsibility for violating these rules. To ensure data security, regulations and instructions should be created and communicated to the personnel, which should clearly spell out the rules for storing, processing, distributing and transferring information to third parties. Raising the awareness of the company's employees about the types of social engineering attacks will reduce the number of incidents implemented as a result of their occurrence.

TECHNOLOGIES OF USER ACTIVITIES MONITORING AND ANALYSIS IN PREVENTING INSIDER THREATS OF INFORMATION SECURITY OF AN ORGANIZATION

The increase in the number of information security incidents related to personnel activities, the frequency of which has almost doubled in the last two years, has led organizations to use effective technologies that prevent and counteract internal threats to information security. An important role in this context belongs to the tools of monitoring and analysis of user activity. According to experts, in the coming years, such technologies will be implemented in 80% of solutions to identify threats and prioritize information security incidents. The article reveals the essence and analyzes the functionality of several systems that monitor and analyze employee behavior, including Data Loss Prevention (DLP), Access Control, Analysis of User Behavior and IT objects (UBA / UEBA). The authors establish that the DLP system monitors and reports on user attempts to transmit confidential information by monitoring mail and web traffic, wireless access, external storage, input/output devices, user workstation software, audio and video surveillance of its activities, etc. Access control tools perform, in particular, the functions of monitoring access and movement of a person in protected areas of the object, collecting information from surveillance cameras, keeping records of working time. In the context of a pandemic, solutions have been developed that allow identifying a person in a mask on the face, to perform the functions of monitoring health. Analysis of the functional characteristics of UBA / UEBA behavioral analytics systems showed that they not only solve the problem of collecting data from all possible available sources (software and hardware, logs, user correspondence, etc.), but also analyze the collected data and report atypical user behavior in case of its detection. The article notes that behavioral analytics is used in a number of security technologies, such as Security Information and Event Management system, Intrusion Detection and Prevention System, and others, complementing and expanding their capabilities, helping to create comprehensive information security solutions. The authors recommend organizations to use tools for monitoring and analyzing the user activities in different combinations or as part of integrated Information Security Management solutions to achieve the appropriate information security level in the face of growing threats from personnel.

Organisational Information Security Management Maturity Model

Information Security Management (ISM) is a systematic initiative in managing the organisation’s information security. ISM can also be defined as a strategic approach to addressing information security (IS) risks, breaches, and incidents that could threaten the confidentiality, integrity, and availability of information. Although organisations have complied with ISM requirements, security incidents are still afflicting numerous organisations. This issue shows that the current implementation of ISM is still ineffective. The ineffective ISM implementation illustrates the low maturity level. To achieve a higher level of maturity, organisations should always evaluate their ISM practices. Several maturity models have been developed by international organisations, consultants, and researchers to assist organisations in assessing their ISM practices. However, the current models do not evaluate ISM practices holistically. The measurement dimensions in current models are more focused on assessing certain factors only. This caused the maturity assessment to be not executed comprehensively. Therefore, this study aims to address this shortcoming by proposing a comprehensive maturity assessment model that takes into account ISM success factors to evaluate the effectiveness of the implementation. This study adopted a mixed-method approach, which comprises qualitative and quantitative studies to strengthen the research finding. The qualitative study analyses the existing literature and conducts interviews with nine industry practitioners and six experts while the quantitative study involves a questionnaire survey. The data obtained from the qualitative study were analysed using content analysis while the quantitative data employed statistics analysis. The study identified fourteen success factors and fifty-seven maturity dimensions, which each contains five maturity levels. The proposed model was evaluated through experts’ reviews to ensure its accuracy and suitability. The evaluation shows that the model can identify the ISM maturity level systematically and comprehensively. This model will ultimately help the organisations to improve the weaknesses in the implementations thus diminishing security incidents.

Моделювання роботи групи реагування на інциденти інформаційної безпеки в умовах зростання інтенсивності кібератак

Modeling of the Information Security Incident Response Team (ISIRT) functioning and decision-making in the process cyberattacks requires the simultaneous use of parameters and characteristics at, on the one hand, directly characterize cyberattacks and their deployment over time, and, on the other hand, require taking into account the parameters and indicators that characterize the activities of specialists in a stressful situation. ISIRT’s activities are to counter cyberattacks aimed at destabilizing the social state of society by disseminating harmful information. The paper builds a model to describe the features of the ISIRT, taking into account the impact of the parameter of increasing the intensity of information security incidents on the quality of analysis of the system in real time, using the functions of responding to information security violations. The peculiarity of the constructed model is that for the first time the overload mode is taken into account, i.e. the influence of the introduced parameter of increasing the intensity of information security event identification is taken into account. The conditions under which the ISIRT is transitioning to a regime that does not meet the sufficient criterion of ergodicity, when the group will not be able to effectively cope with the deployment of cyber attacks in time. Simulation modeling of ISIRT activity is carried out and the presence of transition to the mode, which is caused by the lack of ergodic property of the system functioning, when changing the parameter of increasing the intensity of information security event identification, is shown. The obtained results allow predicting the appearance of the overload mode caused by the lack of ergodic properties of the system operation, in the conditions of which the activity of this ISIRT ceases to be effective. This allows you to set certain thresholds for the time of effective operation of this ISIRT during a cyber attack. As a result, the existing set of ISIRT can be characterized by certain quantitative indicators that characterize the time of effective operation of this ISIRT, depending on the identified characteristics of the cyber attack. Based on the developed model, new methods of countering cyberattacks can be developed, which will be based on identifying the required characteristics of the temporal deployment of cybersecurity incidents and on their basis redirecting control from one ISIRT to another during the incident. This will require the creation of a database with the necessary characteristics for those ISIRTs that may be involved in the process of countering cyberattacks.

ИССЛЕДОВАНИЕ IRP-СИСТЕМ НА ОСНОВЕ АНАЛИЗА МЕХАНИЗМОВ РЕАГИРОВАНИЯ НА ИНЦИДЕНТЫ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ

The article discusses the features and functions of information security incident response systems. The analysis of modern IRP solutions is presented and the process of responding to typical incidents in systems of this class is described. Based on expert opinions, a list of criteria was formed, which were divided into groups by areas of functional responsibility for further comparison of the work of IRP systems. The assessment of the main and additional characteristics of IRP-systems was carried out using the formed criterion groups. The analysis of the comparison results showed that the most promising solutions are R-Vision IRP, IBM Resilient IRP and open-source solution - The Hive. The algorithm of the module for preventing phishing attacks was developed and presented, the software implementation of which was made using the Python language. As part of the integration capabilities of The Hive, a custom response function was implemented that not only potentially improved the system's performance in preventing phishing attacks, but also increased employee awareness of this threat. The result is an IRP system with personal flexible customization of individual elements and is the basis for the formation of the Security Center (SOC), which will bring the information security of organizations to a new level.

Tools of awareness and training on information security in the context of digitalization

The article examines modern software tools for awareness and training personnel in the field of information security and identifies the main trends in their development. It is noted that the best ways to prevent information security incidents are to form personnel understanding the basic problems of information security and skills to overcome them, as well as the formation of safe behavior of each employee in the workplace. The study was based on the publication of the Forrester research company on the market of software solutions for Security Awareness and Training (SA&T). Forrester experts identified the best world-class SA&T software vendors in the following categories: leaders, strong performers, contenders and challengers, and analyzed their software products in detail. It was found that the vast majority of companies mentioned in the study are Western. Based on the SA&T software market research, the article identifies the following trends in this area: the focus of these programs on the formation of safety behavior and culture of personnel, not just knowledge and skills; individual approach to training for each company; quality content and a variety of methods, including gamification, microlearning and virtual reality; practical direction of training, which is carried out in conditions as close as possible to real; measuring the quality of training by further tracking changes in personnel behavior in the workplace; use of training and awareness tools for personnel as an integral part of the effective implementation of the corporate information security program.

THE PLACE OF SOCIAL ENGINEERING IN THE PROBLEM OF DATA LEAKS AND ORGANIZATIONAL ASPECTS OF CORPORATE ENVIRONMENT PROTECTION AGAINST FISHING E-MAIL ATTACKS

As the number and percentage of phishing attacks on company employees and regular users have tended to increase rapidly over the last two years, it is necessary to cover the issue of protection against this type of social engineering attacks. Throughout the pandemic, intruders are finding more and more new ways to cheat, so even experienced Internet users can become a victim to their scams. Due to the fact that e-mail is used in almost all companies, most fishing attacks use e-mail to send malicious messages. The article discusses the main methods used by attackers to conduct phishing attacks using e-mail, signs that the user has become a victim to social engineers, and provides recommendations how to increase the resilience of the corporate environment to such attacks using organizational methods. Because the user is the target of phishing attacks, and the tools built into the browser and email clients in most cases do not provide reliable protection against phishing, it is the user who poses the greatest danger to the company, because he, having become a victim of a fishing attack, can cause significant damage to the company due to his lack of competence and experience. That is why it is necessary to conduct training and periodic testing of personnel to provide resistance to targeted phishing attacks. Company employees should be familiar with the signs of phishing, examples of such attacks, the principles of working with corporate data and their responsibility. The company's management must create and communicate to the staff regulations and instructions that describe storage, processing, dissemination and transfer processes of information to third parties. Employees should also report suspicious emails, messages, calls, or people who have tried to find out valuable information to the company's security service. Raising general awareness through hands-on training will reduce the number of information security incidents caused by phishing attacks.

Approach of the information properties destruction risks assessing based on the color scale

One of the urgent tasks of today is information protection as defined by the regulations of our state in the field of information security and cybersecurity. The protection of information is to ensure the preservation of its properties such as confidentiality, integrity, and accessibility. In the process of assessing the information security, the priorities of its protection are determined, taking into account the degree of restriction of access to it. Information security risks are assessed to select effective measures and remedies. The existing assessment methods are analyzed, based on estimates of the magnitude of possible damage from the occurrence of an information security incident and the probability or probability of its occurrence. However, none of the forms of formalizing the risk level reflects which properties may be violated within the incident. That is, the general presentation of the risk does not allow its prompt processing. With the use of modern computer technology, it has become possible to create dynamic images of the level of risk. The basis of computer graphics is an additive model of the transfer of red, green, and blue. With this in mind, a method has been developed to assess the risks of violating the properties of information. Its use will distinguish the properties of information by the set color. With the advent of information about new vulnerabilities in information and telecommunications systems, the color may change, which will signal a change in the level of risk for a particular property of information. This approach to information security risk management facilitates prompt decision-making on risk management and maintains the information security process at the appropriate level. At the same time, the use of the proposed method will allow to record changes in the numerical values of colors and, as a consequence, to find the rate of change of the level of information security risk. Its average value can be used to predict the resilience of the protection system to information security incidents. Therefore, the speed of change in the level of information security risk can expand the list of parameters for determining the index of information system development and the basis for updating the planned costs of the organization to ensure information security.

The Validity of Information Security Risk Assessment Methods for Organizations

Based on statistical data, a contradiction is shown between an increase in financial investments in the information security (IS) of organizations and a steady increase in the number of IS incidents caused by internal users. A conclusion is made about the cognitive vulnerability and low degree of validity of modern IS risk assessment methods. Stereotypes have been identified, the result of which are cognitive errors in assessing IS risks: the priority of technical protection of information from external threats of IS over organizational and technical protection from internal threats; distrust of the internal client, perception of it exclusively as an object of tough managerial influence, ignoring its subjective role in IS management; restriction of work with personnel within the IS management system with one-time measures and static criteria for assessing human risks and inattention to systemic measures and dynamic, situational criteria. The necessity of updating standards for IS risk management, as well as the development of new methods and tools for assessing, IS risks based on rejecting outdated stereotypes, is substantiated.

Construction of a Security Vulnerability Identification System Based on Machine Learning

In recent years, the frequent outbreak of information security incidents caused by information security vulnerabilities has brought huge losses to countries and enterprises. Therefore, the research related to information security vulnerability has attracted many scholars, especially the research on the identification of information security vulnerabilities. Although some organizations have established information description databases for information security vulnerabilities, the differences in their descriptions and understandings of vulnerabilities have increased the difficulty of information security precautions. This paper studies the construction of a security vulnerability identification system, summarizes the system requirements, and establishes a vulnerability text classifier based on machine learning. It introduces the word segmentation, feature extraction, classification, and verification processing of vulnerability description text. The contribution of this paper is mainly in two aspects: One is to standardize the unified description of vulnerability information, which lays a solid foundation for vulnerability analysis. The other is to explore the research methods of a vulnerability identification system for information security and establish a vulnerability text classifier based on machine learning, which can provide reference for the research of similar systems in the future.

Examining the side effects of organizational Internet monitoring on employees

PurposeInternet monitoring in organizations can be used to monitor risks associated with Internet usage and information systems in organizations, such as employees' cyberloafing behavior and information security incidents. Extant research has mainly discussed the effect of Internet monitoring in achieving the targeted goals (e.g. mitigating cyberloafing behavior and information security incidents), but little attention has been paid to the possible side effects of Internet monitoring. Drawing on affective events theory, the authors attempt to reveal that Internet monitoring may cause side effects on employees' Internet usage policy satisfaction, intrinsic work motivation and affective organizational commitment.Design/methodology/approachThe authors conducted a field experiment in a software development company. In total, 70 employees participated in the study. Mann–WhitneyUtest was employed to analyze the data.FindingsThe results suggest that Internet monitoring decreased employees' satisfaction with the Internet usage policy, intrinsic work motivation, as well as affective organizational commitment.Originality/valueThis study contributes to the literature by examining the side effects of Internet monitoring on employees. It also has implications for organizations to make appropriate decisions regarding whether to implement Internet monitoring.

IoTBlockSIEM for information security incident management in the internet of things ecosystem

The Internet unfolded enormous opportunities to the modern computing world where not only humans but also computers and machines, as well as any tiny sensing devices, can communicate and collaborate. The Internet of Things (IoT) is still a new concept in its early stages after 20 years of successful usage in various application domains. Nowadays, the "Internet of Things Ecosystem" term is being used more often that emphasizes its complex internal structure and functionality. Based on the available standards on the IoT’s generalized architecture and reference model, the IoT ecosystem is presented as a security object to be protected. Numerous security controls, collecting raw data for complex and multi-stage processing and further detection of events related to information security (IS), are located on its layers. The IS incident management process with different routine actions for the IoT ecosystems needs automation, for which Security Information and Event Management (SIEM) systems are the best applicable solutions. But modern challenges require modifying two previously known generations of these systems, especially for the IoT ecosystems. A new blockchain-based system called the IoTBlockSIEM is proposed to solve this problem. An example of constructing transactions in the IoTBlockSIEM for the case of its use in managing IS incidents in the IoT ecosystem is provided. Further research concludes the article.