Enterprise Information Security Research Articles

METHODOLOGY FOR IMPROVING THE CYBER THREAT PROTECTION SYSTEM

The article presents the results of a study of the enterprise information security system and the development of proposals for its implementation. The article considers security as a system that includes tools and processes used by organizations to protect information. This includes policy settings that prevent unauthorized persons from accessing business or personal information. Information security is positioned as a growing and developing industry, covering a wide range from network and infrastructure protection to testing and auditing. The article analyzed IT products designed to ensure information security that are used in small and medium-sized businesses, explored problem areas and current applications that entrepreneurs use. One of the most pressing problems in the IT industry today, in the era of big data, is the rapid growth of the volume of unstructured content. Virtually every corporate data center (Docs) has file servers, corporate portals, Microsoft Exchange folders, network and cloud storage locations that contain many documents, including the content of important information. In addition, the repeated increase in volume and the growing variety of information stored and processed significantly complicates the task of managing this data.

METHODOLOGY FOR IMPROVING THE CYBER THREAT PROTECTION SYSTEM

The article presents the results of a study of the enterprise information security system and the development of proposals for its implementation. The article considers security as a system that includes tools and processes used by organizations to protect information. This includes policy settings that prevent unauthorized persons from accessing business or personal information. Information security is positioned as a growing and developing industry, covering a wide range from network and infrastructure protection to testing and auditing. The article analyzed IT products designed to ensure information security that are used in small and medium-sized businesses, explored problem areas and current applications that entrepreneurs use. One of the most pressing problems in the IT industry today, in the era of big data, is the rapid growth of the volume of unstructured content. Virtually every corporate data center (Docs) has file servers, corporate portals, Microsoft Exchange folders, network and cloud storage locations that contain many documents, including the content of important information. In addition, the repeated increase in volume and the growing variety of information stored and processed significantly complicates the task of managing this data.

Organizational and legal principles of information security of enterprises in the conditions of martial law in Ukraine

Purpose. To investigate the peculiarities of organizational and legal provision of information security (IS) in the conditions of martial law (ML). To propose changes to legislative provisions to improve legal regulation in this area. To develop systematic measures to balance the rights and obligations of individuals and legal entities in the field of IS in the conditions of ML. Methodology. The general scientific and special legal methods of cognition are used: hermeneutic method allowed us to substantiate expansion of IS field; content analysis – to determine organizational principles of IS of enterprises in conditions of ML; structural and legal – to propose indicator conditions for legal norms; special-legal – to propose system of local regulatory acts for the legal provision of IS; comparative legal – to propose special legal regime for IS of enterprises. Findings. It is indicated that during the state of war, the IS field of enterprise expands significantly and becomes an element of the national security system. The peculiarities of organizational and legal support and the basic organizational principles of IS of enterprises in the conditions of ML are determined. It is proposed to introduce a special legal regime for implementation of IS of enterprises in conditions of ML and use of the state’s capabilities in this area under specified legal regime. Amendments to the articles of Special Part of Code of Ukraine on administrative offenses are proposed for effective regulatory support of the special legal regime for implementation of IS of enterprises Originality. A legal tool is proposed to limit dissemination of information about a company’s activities – the introduction of local law documents to classify information about the company’s activities during ML into category “with limited access”. Indicator conditions and additions to legislative norms are proposed. Practical value. The developed proposals, indicator conditions and additions to legislative norms will contribute to strengthening the IS of enterprises.

Building an effective network security system of the enterprise based on the method of analyzing hierarchies of quality indicators

The article is devoted to the analysis of the optimal choice of network security systems for enterprises based on the method of pairwise comparison of criteria. The reaction speed, level of protection, integration and reliability of the systems were studied. Considered general requirements for quality and cost. The conclusion is made about the need for a comprehensive approach to system selection and careful consideration of all aspects to ensure effective information protection. The article analyzes the importance of a balanced approach between efficiency and cost when choosing a network security system. The importance of integration with existing systems and taking into account requirements for compliance with security standards is emphasized. The results of the study indicate the need for careful analysis before deciding on the choice of a network security system for the enterprise. Additionally, the article examines the influence of each of the considered criteria on the overall level of enterprise network security and the reliability of information protection. The proposed recommendations on the optimal choice of network security systems can be useful for enterprise management and information security specialists, contributing to the improvement of the overall level of cyber protection. In conclusion, the article offers a comprehensive approach to the selection of network security systems based on an objective comparison of various criteria. Taking into account the speed of response, the level of protection, integration and cost helps enterprises to ensure effective and economical protection of their information resources. The study can be useful both for management deciding on investment in security, and for information security specialists looking for optimal solutions for the specific needs of the enterprise.

APT Attack Detection Based on Graph Convolutional Neural Networks

Advanced persistent threat (APT) attacks are malicious and targeted forms of cyberattacks that pose significant challenges to the information security of governments and enterprises. Traditional detection methods struggle to extract long-term relationships within these attacks effectively. This paper proposes an APT attack detection model based on graph convolutional neural networks (GCNs) to address this issue. The aim is to detect known attacks based on vulnerabilities and attack contexts. We extract organization-vulnerability relationships from publicly available APT threat intelligence, along with the names and relationships of software security entities from CVE, CWE, and CAPEC, to generate triple data and construct a knowledge graph of APT attack behaviors. This knowledge graph is transformed into a homogeneous graph, and GCNs are employed to process graph features, enabling effective APT attack detection. We evaluate the proposed method on the dataset constructed in this paper. The results show that the detection accuracy of the GCN method reaches 95.9%, improving by approximately 2.1% compared to the GraphSage method. This approach proves to be effective in real-world APT attack detection scenarios.

The impact of information security management guide utilization on technological and institutional information security measures in university libraries in Türkiye

The study examined whether the levels of technological and institutional information security measures implemented in university libraries in Türkiye differ based on the usage of a corporate information security management guide. The study was conducted through a literature review and survey method in a total of 199 university libraries in Turkey actively operating in 2023, comprising 124 state universities and 75 private universities. To ensure the contributions of all university libraries population was obtained in a homogeneous manner, a purposive sampling method was used, collecting data from one staff member from each university library.The findings reveal that there are significant differences (p < 0.05) in the levels of both technological and institutional information security measures, depending on the presence and utilization of a corporate information security management guide in university libraries. These findings demonstrated that an enterprise information security management tool is effective in influencing information security practices in university libraries. This result confirmed the hypothesis that there are significant differences in the implementation levels of technological and institutional information security measures based on the presence and usage of an enterprise information security management tool in university libraries in Turkey.Considering the lack of comprehensive studies on information security management in university libraries in Turkey, this research demonstrates its uniqueness by approaching the topic with a holistic approach.

Enterprise information security risks: a systematic review of the literature

Currently, computer security or cybersecurity is a relevant aspect in the area of networks and communications of a company, therefore, it is important to know the risks and computer security policies that allow a unified management of cyber threats that only seek to affect the reputation or profit from the confidential information of organizations in the business sector. The objective of the research is to conduct a systematic review of the literature through articles published in databases such as Scopus and Dimension. Thus, in order to perform a complete documentary analysis, inclusion and exclusion criteria were applied to evaluate the quality of each article. Then, using a quantitative scale, articles were filtered according to author, period and country of publication, leaving a total of 86 articles from both databases. The methodology used was the one proposed by Kitchenham, and the conclusion reached was that the vast majority of companies do not make a major investment in the purchase of equipment and improvement of information technology (IT) infrastructure, exposing themselves to cyber-attacks that continue to grow every day. This research provides an opportunity for researchers, companies and entrepreneurs to consult so that they can protect their organization's most important assets.

The Application of Big Data and Artificial Intelligence Technology in Enterprise Information Security Management and Risk Assessment

With the development of digitalization and Internet technology, enterprise information security is facing more and more challenges. Many enterprises have begun to adopt big data (BD) and artificial intelligence (AI) technology for risk assessment (RA) and prediction to effectively manage information security risks. This article discusses the application of BD and AI technology in enterprise information security management (ISM) and RA from two aspects. Firstly, the mobile payment signature scheme based on number theory research unit is used to improve the security of the mobile payment system. This scheme uses lattice algorithms to achieve fast key generation, signing, and verification and can resist traditional cryptographic attacks. Secondly, a set of enterprise ISM and RA system is established, including risk identification, RA, monitoring and early warning, emergency response, and other links. BD and AI technology is used to analyze internal and external data to provide accurate RA results to achieve automated RA.

Designing An Information Security Framework For The Indonesia Water Industry Sector

The majority of Indonesia's water industry sectors have implemented smart water management systems as part of their business development, which has an indirect impact on enterprise information security. However, in general, water sector enterprises continue to place a low priority on information security, and the development of information system frameworks is based on generic norms employed by financial firms. There has been no research on information security frameworks especially built for water firms in Indonesia that use information security standards in the utilities sector. This article proposes a solution in the form of a new framework for Indonesian water firms that combines international information security requirements in the utilities sector with Indonesian government rules. This approach of development combines worldwide standards with national rules. The Cybersecurity Capability Maturity Model (C2M2) and ISO 27019 are two international standards commonly used by utility businesses globally. Government Regulation or Peraturan Pemerintah (PP) Number 71 of 2019 on the Implementation of Electronic Systems and Transactions is the relevant national regulation. The framework addresses information technology, telecommunications, and operational technology, with four approach categories: governance and ecosystem, protection, defense, and resilience. According to the research findings, the newly integrated framework can be applied and is worthy of recommendation. This framework also meets the standards for information security and can be used by Indonesian water corporations.

Application of Big Data Technology in Enterprise Information Security Management and Risk Assessment

Nowadays, the application of enterprise management information has been deeply rooted in daily business activities, and the management risk of enterprise information security (EIS) has also increased. The use of advanced means to provide security protection for it has become the top priority. To optimize the EIS management system, and carry on the risk assessment (RA), firstly, this study analyzes the current situation of the enterprise's internal information management and summarizes the shortcomings and security risks faced by the system. In the era of big data (BD), the security risks of database information systems show a diversified trend. Secondly, to explore the application of BD technology in EIS management, the characteristics of this technology and security control measures for risks are summarized to strengthen the enterprise's information management innovation and implement the application of data security technology.

АУДИТ ІНФОРМАЦІЙНОЇ БЕЗПЕКИ ДЛЯ ЗАХИСТУ ІНФОРМАЦІЙНИХ АКТИВІВ ПІДПРИЄМСТВ В УМОВАХ ГЛОБАЛЬНИХ ВИКЛИКІВ

In the modern conditions of global challenges, along with climate action failure, extreme weather, human environmental damage, there are cyberattacks and data fraud or theft, the spread of infectious diseases (pandemics), which resulted in the activation of digitalization processes of social, economic and political processes in general and business entities financial and economic activity in particular. Modern business processes cannot be imagined without the use of information assets, because today they are becoming the most valuable resource for business development. However, in the conditions of modern global challenges and the state of war, there are more and more threats associated with the loss of access by business entities to the information assets of their own business, therefore the topic of enterprise information protection is an urgent issue that requires research and practical recommendations development. The aim of the research is analysis the enterprise's information security audit process and the development of practical recommendations for securing the enterprise's information assets in the global challenges conditions. The methods of the research: logical and meaningful method, methods of comparison, systematization, induction and deduction, analysis and synthesis, coefficient method. The hypothesis of the research was assumptions about the possibility of determining the state of information security of business assets through the enterprise vulnerability indicator and securing its information assets by conducting an information security audit. The statement of basic materials. The place of Ukraine in the World Digital Competitiveness Ranking was analyzed and the main weak points are identified. The model of building an information security system is presented. The enterprise information security indicators are considered. It is proposed to identify the state of security of the enterprise's information assets using the company's vulnerability indicator. It is proposed to conduct an audit of the enterprise's information security in four interrelated stages, which will make it possible to protect the company's information assets from potential threats and attacks by intruders. The originality and practical significance of the research confirmed by research and substantiation of the importance of the enterprises information assets protecting in the conditions of martial law and recommendations for the information assets securing from potential threats using the enterprise vulnerability indicator and conducting regular information security audit. Conclusions and perspectives of further research. It was determined that the company's information threats can be identified using a vulnerability indicator, and the company's information assets can be secured by applying an information security audit of its assets. Further research will be aimed at a more extensive analysis of factors that can influence the determination of the enterprise's vulnerability and the emergence of potential costs from cyber attacks and data theft.

The principle of operation of a decentralized money transfer information system

The article is devoted to reviewing the concept of blockchain in the implementation of a decentralized money transfer system. The concept of fault tolerance of cryptocurrency technology is considered and some aspects of the fault tolerance solution are given. The analysis of information security of enterprises was carried out. The questions of anonymity of banking systems are touched upon. The dependence of the anonymity of the banking system on the quality of the software and on the security policy is shown. Recommendations are given for solving the problem of anonymity, in particular, generating a private key or embedding an algorithm for connecting transactions. Approaches to creating transactions are considered. Examples of algorithms that allow protecting user transactions are given. The description of the blockchain structure and the consensus algorithm has been carried out. The issues of generating a chain of blocks of an honest user and a chain of blocks of an attacker are considered. Formalization of the estimate of the probability of transaction break-even has been carried out. Binomial random walk was used for estimation. The end of the transaction process is just as justified as waiting for new blocks to be added to the chain of an honest user. A digital signature is used to identify whether a transaction belongs to a public key. The processes of signing a transaction and verifying a signature are considered. Separately, the approaches used in the design of cryptocurrencies are highlighted. The network stores the entire history of transactions, it is possible to calculate the balance of the total amount of incoming funds and spending money. These approaches are software solutions based on game theory and cryptography. The main attention is drawn to the business values of cryptocurrencies and ways to achieve them. As a result, the necessary functionality of the software client is formulated. The article provides a thorough analysis of a new financial and settlement instrument - electronic money. The task of developing a virtual payment system has recently received much attention.

Peculiarities of the Functional Approach to the Management of Information Security of Enterprises in Crisis Conditions

The paper identifies the relevance of the problem under study with regard to the development of information security management systems for enterprises and organizations. This issue is of particular importance in the context of economic crisis. With the active development of the latest information and communication technologies, general computerization, information security is becoming a key characteristic of enterprise information systems The problems of using a functional approach in the formation of information security management systems for enterprises in crisis conditions are considered. The essence of the information danger of enterprises in crisis conditions is analyzed. It is proposed that the process of forming an integrated information security management system should be carried out on the basis of a comprehensive functional approach. A conceptual model of enterprise information security management in crisis conditions based on the functional approach is built. This model will help to increase the level of information and economic security of enterprise. This model will help to increase the level of information and economic security of an enterprise. The proposed methodology for building enterprise information security management systems, which is formed on the basis of a functional approach, should provide a reliable level of protection of information and communications of an enterprise. This will be achieved through continuous monitoring of the information environment (threats, dangers, challenges, etc.), constant monitoring of the information and communication activities of an enterprise, forecasting of information security (in particular, the risks that will affect it), etc. The result of the formation and application of the enterprise information security management system based on the functional approach is the formation of a comprehensive, balanced, effective and flexible information security system that will take into account all the features of the application of measures to protect the enterprise from negative information and communication influences, protect information arrays (data), information and intellectual rights, and provide open access to information resources of employees.

СТРАТЕГІЧНЕ УПРАВЛІННЯ ІНФОРМАЦІЙНОЮ БЕЗПЕКОЮ ПІДПРИЄМСТВА: СУЧАСНІ ПІДХОДИ ТА ВИКЛИКИ

The article deals with the peculiarities of ensuring strategic management of information security of modern enterprises. Nowadays, information security systems are designed to ensure the full function-ing of an enterprise's information infrastructure using various types of information services, automation of financial and production activities, as well as its business processes.The basic provisions of information security are formalized and enshrined in the Information Security Strategy of Ukraine. Other regulatory documents and standards of enterprises must comply with the laws and regulatory framework of Ukraine, international law, industry standards and EU and NATO directives.The article considers the need to form an information security management system, which is caused by the existence of internal and external threats, their destructive consequences for the activities and image of an enterprise. The tasks of information security are analyzed: data confidentiality, integ-rity, availability, ensuring the reliability of information, ensuring the legal significance of information, ensuring the untraceability of user actions. Information security management involves identifying po-tential risks to an enterprise, assessing the potential impact, developing and implementing strategies to eliminate problems designed to minimize risks with the available resources.The main stages of developing an information security policy are identified: complete registration of all information resources that require protection; formation of a list of possible threats to each re-source from the list; assessment of the probability of occurrence of each threat; application of actions for the effective protection of each resource. The basic principles of an information security management system for an enterprise are outlined: ease of use, full control, open architecture, access limits, least privileges, sufficient stability, and minimization of duplication. It is also about storing and processing significant amounts of information of varying degrees of confidentiality, so the issue of protecting im-portant enterprise information data from various internal and external threats is relevant

Features of practical training of IT - specialists for the agro-industrial complex

The article is devoted to the methodology of conducting for future specialists in the field of applied informatics at the Krasnoyarsk State Agrarian University. Its relevance is due to the fact that the training of such specialists should be accompanied by the preparation of a number of course projects and complex course work for agricultural enterprise. In our opinion, when completing course projects, students should rely on real data on the object of study. According to the method of organization, the practice should be of a mixed nature, both stationary and in the form of excursions. In the stationary phase of the practice, students, together with the teacher, analyze theoretical issues on building databases and computer networks, on presenting an enterprise on the Internet, on developing websites and general issues related to the information security of an agro-industrial enterprise. At the visiting stage of the practice, students collect real data about the enterprise, which will then be used in course projects. This approach greatly increases students' understanding of the essence and specifics of their future specialty and understanding of the development of information systems for a particular agricultural enterprise.

Особливості формування системи інформаційної безпеки українських підприємств за високо динамічних умов цифровізації

The paper determines the relevance of the problem under study with regard to the development of information security systems of Ukrainian enterprises under highly dynamic conditions of digitalization. After all, in the context of the rapid development of the digital economy (its digitalization), the economic development of enterprises will increasingly depend not on material but on information resources. The aims of the study were to investigate the issues of information security of Ukrainian enterprises in the context of digitalization, to develop recommendations and proposals for solving existing problems. Issues related to ensuring the necessary (sufficient) level of economic security of enterprises and organizations are becoming increasingly relevant, as the information environment is characterized by an increasingly high level of dynamism. In the face of rapid changes due to the digitalization of the economy, domestic businesses need to timely develop systems to identify, assess, avoid or minimize potential risks and threats. The authors uses the following research methods: comparison, observation, analysis and synthesis. It is critical to form and use a digital security system by domestic enterprises in a highly dynamic economic environment. That is why the paper proposes a comprehensive system of digital security of domestic enterprises in highly dynamic economic conditions. The level of efficiency of the enterprise information security system determines the degree of achievement of the goals of digital transformation. The intensification of digital transformation processes necessitates the formation, application, and improvement of information security tools by enterprises. The practical significance of the recommendations is that the economic security of an enterprise depends on the level of information security of digital transformation. To ensure the necessary (permissible) degree of information security of digital transformation, enterprises need to take actions of the management system aimed at optimizing the management system, functions, methods of activity, management decisions, etc. through the use of information (digital) technologies.

MODERN PERSPECTIVES OF APPLYING THE CONCEPT OF ZERO TRUST IN BUILDING A CORPORATE INFORMATION SECURITY POLICY

Modern businesses have undergone significant changes as a result of digital advances and the recent COVID-19 pandemic. In particular, there has been an increase in the number of employees working remotely, using personal digital devices alongside corporate devices, and the enterprise itself moving business processes to the cloud or using hybrid environments that combine both cloud and on-premises services. Taken together, this leads to increased interaction between devices and services over open networks, creating new risks of cyber-attack. It is this situation that has led to the relevance and direction of this research. The paper analyzes the current state of effectiveness of the application of enterprise information security policy, in particular, identifies the main limitations associated with the difficulty, and sometimes impossibility, to control the behavioral aspects of enterprise employees to comply with the basic provisions of security policy and general information security. The basic principles of the Zero Trust conceptual approach are analyzed and the main advantages of its application in the formation of the security policy as a strategic approach to ensuring the information security of the enterprise in the conditions of dynamic growth of new threats and transformation of modern business are determined. At the same time, it is established that one of the key components of the Zero Trust architecture is the access control system. As a result, forming the prospects of applying the concept of Zero Trust in the construction and implementation of the information security policy, the necessity of conducting an accompanying study of the effectiveness of modern mechanisms of identification/authentication of access subjects was determined.

ОБ ИТОГАХ VI ВСЕРОССИЙСКОЙ НАУЧНО-ПРАКТИЧЕСКОЙ КОНФЕРЕНЦИИ "ИНФОРМАЦИОННАЯ БЕЗОПАСНОСТЬ: ВЧЕРА, СЕГОДНЯ, ЗАВТРА"

The article analyzes results of the All-Russian Scientific and Practical Conference held in Moscow at the Russian State University for the Humanities (RGGU), at which more than 20 reports from various scientific and educational organizations were heard. The reports dealt with general issues of information security, software and hardware methods of the information protection; prospects for the development of various areas of the information security were also considered. The topics of the plenary reports included: trends in the development of the information warfare in the context of global informatization, the risks of outsourcing and attracting contractors to the implementation of an information security system, the import-independence of the national ICT infrastructure: an ethical and engineering view, software and algorithmic support for assessing the destructiveness of telegram channels, modeling the evaluation of the effectiveness of the information security control system of open sociotechnical systems, issues of building a reliable enterprise information security systems, etc. The reports in three sections considered: features of ensuring the information security of critical information infrastructure facilities in the field of electric power, analysis of methods of hacking and destruction of a steganographic container in an image file, analysis of the consequences of a breach of personal data security from the standpoint of the intruder’s interests, testing models of analysis and forecasting of the information warfare in society in the simulation environment of Anylogic, etc.

Risk Assessment of Insider Threats Based on IHFACS-BN

Insider threats, as one of the pressing challenges that threaten an organization’s information assets, usually result in considerable losses to the business. It is necessary to explore the key human factors that enterprise information security management should focus on preventing to reduce the probability of insider threats effectively. This paper first puts forward the improved Human Factors Analysis and Classification System (IHFACS) based on actual enterprise management. Then, the enterprise internal threat risk assessment model is constructed using the Bayesian network, expert evaluation, and fuzzy set theory. Forty-three classic insider threat cases from China, the United States, and Israel during 2009–2021 are selected as samples. Then, reasoning and sensitivity analysis recognizes the top 10 most critical human factors of the accident and the most likely causal chain of unsafe acts. The result shows that the most unsafe behavior was not assessing employees’ familiarity with the company’s internal security policies. In addition, improving the organizational impact of information security can effectively reduce internal threats and promote the sustainable development of enterprises.

An Investigation of Employees’ Intention to Comply with Information Security System—A Mixed Approach Based on Regression Analysis and fsQCA

Employee security compliance behavior has become an important safeguard to protect the security of corporate information assets. Focusing on human factors, this paper discusses how to regulate and guide employees' compliance with information security systems through effective methods. Based on protection motivation theory (PMT), a model of employees' intention to comply with the information security system was constructed. A questionnaire survey was adopted to obtain 224 valid data points, and SPSS 26.0 was applied to verify the hypotheses underlying the research model. Then, based on the results of a regression analysis, fuzzy set qualitative comparative analysis (fsQCA) was used to explore the conditional configurations that affect employees' intention to comply with the information security system from a holistic perspective. The empirical results demonstrated that perceived severity, perceived vulnerability, response efficacy, and self-efficacy all positively influenced the employees' intention to comply with the information security system; while rewards and response costs had a negative effect. Threat appraisal had a greater effect on employees' intention to comply with the information security system compared to response appraisal. The fsQCA results showed that individual antecedent conditions are not necessary to influence employees' intention to comply with an information security system. Seven pathways exist that influence an employees' intention to comply with an information security system, with reward, self-efficacy, and response cost being the core conditions having the highest probability of occurring in each configuration of pathways, and with perceived severity and self-efficacy appearing in the core conditions of configurations with an original coverage greater than 40%. Theoretically, this study discusses the influence of the elements of PMT on employees' intention to comply with an information security system, reveals the mechanism of influence of the combination of the influencing factors on the outcome variables, and identifies the core factors and auxiliary factors in the condition configurations, providing a new broader perspective for the study of information security compliance behavior and providing some theoretical support for strengthening enterprise security management. Practically, targeted suggestions are proposed based on the research results, to increase the intention of enterprise employees to comply with information security systems, thereby improving the effectiveness of enterprise information security management and the degree of information security in enterprises.