Information Security Perspective Research Articles

Relation between cybernetics and information security: from Norbert Wiener’s perspectives

PurposeNowadays, to design the information security mechanism for computing and communication systems, there are various approaches available like cryptographic approach, game-theoretic approach, quantitative–qualitative analysis-based approach, cognitive-behavioral approach, digital forensic-based approach and swarm computing-based approach. The contemporary research in these various fields is independent in nature. The purpose of this paper is to investigate the relationship between these various approaches to information security and cybernetics.Design/methodology/approachTo investigate the relationship between information security mechanisms and cybernetics, Norbert Wiener’s concepts and philosophy of the cybernetics have been used in the present work. For a detailed study, concepts, techniques and philosophy of the cybernetics have been extracted from the books of Norbert Wiener titled “The human use of human beings” and “Cybernetics or control and communication in the animal and the machine”.FindingsBy revisiting the concepts of the cybernetics from the information security perspectives, it has been found that the aspects of information security and the aspects of cybernetics have great bonding.Originality/valueThe present paper demonstrates how bonding between cybernetics and information security can be used to solve some of the complex research challenges in information security area.

IoT applications in the ecological industry chain from information security and smart city perspectives

Innovation holds the guarantee of opening new doors for enhancing the nature of our lives. Likewise, a worldwide data and correspondence system superstructure is developing as the Internet transforms into the Internet of Things. The Internet of Things will address an impressive number of current difficulties in all application spaces, and will add to economic development. The most critical application spaces of the pervasiveness of Internet of Things-based innovations are exhibited, including the case of the shrewd urban communities presently being studied, which will improve the standard of ordinary lives. As a prologue to this issue of general economic systems research, which is themed around mechanical biology, the paper intends to discuss the foundation of modern nature, while highlighting the role of, and commitments from, financial matters from the point of view of information security. The performance is verified by experiment.

A Policy-Based Framework for Preserving Confidentiality in BYOD Environments: A Review of Information Security Perspectives

Today, many organizations allow their employees to bring their own smartphones or tablets to work and to access the corporate network, which is known as a bring your own device (BYOD). However, many such companies overlook potential security risks concerning privacy and confidentiality. This paper provides a review of existing literature concerning the preservation of privacy and confidentiality, with a focus on recent trends in the use of BYOD. This review spans a large spectrum of information security research, ranging from management (risk and policy) to technical aspects of privacy and confidentiality in BYOD. Furthermore, this study proposes a policy-based framework for preserving data confidentiality in BYOD. This framework considers a number of aspects of information security and corresponding techniques, such as policy, location privacy, centralized control, cryptography, and operating system level security, which have been omitted in previous studies. The main contribution is to investigate recent trends concerning the preservation of confidentiality in BYOD from the perspective of information security and to analyze the critical and comprehensive factors needed to strengthen data privacy in BYOD. Finally, this paper provides a foundation for developing the concept of preserving confidentiality in BYOD and describes the key technical and organizational challenges faced by BYOD-friendly organizations.

Study on Development of Framework of Company Classification in Information Security Perspective

Study on Development of Framework of Company Classification in Information Security Perspective

Developing Secure Systems: A Comparative Study of Existing Methodologies

With the increasing demand for developing high-quality and more reliable systems, the process of developing trustworthy computer software is a challenging one. In this paper, we review various approaches to producing more secure systems. This includes established general principles for designing secure systems. It also provides an introduction to general software quality measurements including existing software security metrics. This paper also includes a comparison of the various security metrics for developing secure systems (i.e., architectural, design, and code-level metrics). Lastly, the paper examines the approach of refactoring, illustrates its objectives, and shows how refactoring is generally used for enhancing the quality of existing programs from the perspective of information security. At the end of this paper, we provide a discussion of these three approaches and how they can be used to provide guidance for future secure software development processes.

Exploring the Role of Contextual Integrity in Electronic Medical Record (EMR) System Workaround Decisions: An Information Security and Privacy Perspective

Many healthcare providers in the US are seeking increased efficiency and effectiveness by rapidly adopting information technology (IT) solutions such as electronic medical record (EMR) systems. Legislation such as the Health Information Technology for Economic and Clinical Health Act (HITECH), which codified the adoption and “meaningful use” of electronic records in the US, has further spurred the industry-wide adoption of EMR. However, despite what are often large investments in EMR, studies indicate that the healthcare industry maintains a culture of system workarounds. Though perhaps not uncommon, the creation of informal workflows among healthcare workers is problematic for assuring information security and patient privacy, particularly when involving decisions of information management (e.g., information storage, retrieval, and/or transmission). Drawing on the framework of contextual integrity, we assert that one can often explain workarounds involving information transmissions in terms of trade-offs informed by context-specific informational norms. We surveyed healthcare workers and analyzed their willingness to engage in a series of EMR workaround scenarios. Our results indicate that contextual integrity provides a useful framework for understanding information transmission and workaround decisions in the health sector. Armed with these findings, managers and system designers should be better able to anticipate healthcare workers’ information transmission principles (e.g., privacy norms) and workaround patterns (e.g., usage norms). We present our findings and discuss their significance for research and practice.

Factorial invariance of an information security culture assessment instrument for multinational organisations with operations across data protection jurisdictions

An information security culture is influenced by various factors, one being regulatory requirements. The United Kingdom (UK) has been regulated through the UK Data Protection Act since 1995, whereas South Africa (SA) only promulgated the Protection of Personal Information Act (PoPI) in 2013. Both laws stipulate requirements from an information security perspective with regard to the processing of personal information, however in the UK this has been regulated for a longer period. Consequently, it is to be expected that the information security culture for organisations in the UK will be significantly different from that of SA. This raises the question as to whether the same information security culture assessment (ISCA) instrument could be used in an organisation with offices in both jurisdictions, and whether it might be necessary to customise it according the particular country’s enforcement of information security and privacy-related conditions. This is reviewed, firstly from a theoretical perspective, and secondly a factorial invariance analysis was conducted in a multinational organisation with offices in both the UK and SA, using data from an ISCA questionnaire, to determine possible factorial invariances in terms of the ISCA.

Cyber-Attacks – Trends, Patterns and Security Countermeasures

Technology is rapidly evolving in a world driven by social networks, online transactions, cloud computing, and automated processes. But with the technological evolution comes the progress of cybercrime, which continually develops new attack types, tools and techniques that allow attackers to penetrate more complex or well-controlled environments, and produce increased damage and even remain untraceable. The present article aims to get an overview of the cyber-crime as it is defined and revealed by specialized literature, international legislation and historical facts, and perform an analysis of attacks reported all around the world over the last three years in order to determine patterns and trends in cyber-crime. Based on the results of the analysis, the article presents countermeasures that companies may undertake in order to ensure improved security that would support in defending their business from attackers from an information security perspective.

RTECA: Real time episode correlation algorithm for multi-step attack scenarios detection

Today, from information security perspective, prevention methods are not enough solely. Early Warning Systems (EWSs) are in the category of reactive methods. These systems are complementing Intrusion Detection Systems (IDSs) where their main goals include early detection of potential malicious behavior in large scale environments such as national level. An important process in EWSs is the analysis and correlation of alerts aggregated from the installed sensors (e.g., IDSs, IP telescopes, and botnet detection systems). In this paper, an efficient framework for alert correlation in EWSs is proposed. The framework includes a correlation scheme based on a combination of statistical and stream mining techniques. The method works real-time by extracting critical episodes from sequences of alerts, which could be part of multi-step attack scenarios. A Causal Correlation Matrix (CCM) is used for encoding correlation strength between the alert types in attack scenarios. Experimental results show that the framework is efficient enough in detecting known attack scenarios and new attack strategies. The results also show that the system is able to predict the next steps of running attack scenaris up to 95% of accuracy under special circumstances.

Literature Review of Mobile Applications Testing on Cloud from Information Security Perspective

adoption of mobile application is increasing at enormous rate due to their improved functionality and features. Increased storage and computing power has augmented its utility. However, these mobile applications are still intrinsically limited by a relative lack of bandwidth, computing power, storage and energy compared to desktops. To overcome these limitations, the concept of Mobile Cloud Computing (MCC) providing abundant computing power and sufficient storage space besides large infrastructure has evolved. Cloud computing has its impact on all the stages of Software life cycle, including testing of mobile devices. In this paper we have reviewed Testing as a Service (TaaS) provided by Cloud computing. Testing of mobile application is more complex and time consuming as compared to traditional desktop applications. This paper reviews some published results in two major research fields ie cloud computing and TaaS and discusses architecture of cloud computing and TaaS in terms of necessity, features, emerging trends, benefits and gaps while focussing on security and privacy issues for mobile application. When we run our applications on the cloud, we are sharing our critical data with cloud and, therefore, security and privacy of data is a very serious issue to be considered. KeywordsComputing, Mobile Cloud Computing (MCC), TaaS,

Trust coercion in the name of usable public key infrastructure

ABSTRACTWe are currently witnessing an alarmingly increasing array of attacks on secure infrastructures used for industrial and commercial purposes. The success of these attacks has relied heavily on an innovative stratagem. This stratagem makes use of digital certificates to devise malicious code or servers as trustworthy, ultimately deceiving end users. This has led to an escalating demand for forged or stolen valid digital certificates on the electronic black market. Certification authorities (CAs) themselves are now coming under fire. Virus reports have surfaced on malicious software whose sole purpose was to grab certificates from within certain CAs' infrastructures. The growing popularity of these attacks is putting in doubt the effectiveness of one of the pillars upon which security in the digital world is built, cryptography and digital signatures. What is to blame? In a phrase, “Trust by default”. To increase the usability of public key infrastructure interactions, a number of CAs are pre‐included in users' browsers and operating systems. These entities are trusted by default, and this trust is now being exploited. In this paper, we shall try to shed light on the true dimensions and implications of “trust by default” in public key infrastructure environments. We attempt to raise awareness about the severity of this kind of attacks, demystify the security challenges and identify unique security threats. We need to ring the alarm about trust‐related issues in online communications. We analyze the issue from an information and communication security perspective and explore the notion of trust relations in this context. We support the doctrine that trust should be built on informed judgment, and this can only be achieved through increased openness. Following this, we put forward for consideration a number of proposals that attempt to overcome the issue at hand, by increasing user‐side awareness and thus solution effectiveness, regarding digital certificate transactions. We present an experimental mechanism that is able to provide users with customized digital certificate repositories based on an open crowd sourcing method. Copyright © 2013 John Wiley & Sons, Ltd.

Information Security Engineering: a Framework for Research and Practices

Information security is not a new topic in academics and industry. However, through a comprehensive literature review, we found that most research in information security focus on technical perspectives including evaluation methods and mathematical approaches for securities, risk mitigation algorithms, with some research focus on economic perspective of information security and even a few talked about social engineering of information security. There is not a unique framework to integrate different types of research in information security. We believe that information security research apply the theories and methodologies in systems engineering to investigate the problems, that is, information security engineering. In this paper, we propose a conceptual framework of information security engineering. This framework explicitly illustrates the methodological system, content system, procedures and strategies for information security engineering research and practices. *Corresponding author: Mincong Tang, E-mail mincong@bjtu.edu.cn

A provable secure sealed‐bid multi‐attribute auction scheme under semi‐honest model

SUMMARYSecure electronic auction protocol attracts increasing attention in the field of information security research. A variety of secure electronic auction protocols have achieved a lot. However, those studies mainly focus on price‐based auction model. There are few literatures involving security issues of multi‐attribute e‐auction. In recent years, the existing literatures mainly focus on the winner determination problem of multi‐attribute auction, but research of multi‐attribute e‐auction just begin from the perspective of information security. The proposal intends to start with the multi‐attribute e‐auction protocol, explores the different results in the multi‐attribute auction model because of different bid structures, focuses on qualitative attribute‐based winner determination auction model, proposes a new qualitative attribute‐based sealed‐bid multi‐attribute auction scheme under semi‐honest model for the first time. According to the security analysis and computation comparison, it provides strong bid privacy, public verifiability, and reasonable computational cost. Copyright © 2013 John Wiley & Sons, Ltd.

Information Security Perspective of a Learning Management System

The advancement of information technology has changed the education landscape. The process of teaching is no longer the same. Information technology has made e-learning possible and available on a large scale. The main component of an e-learning is a learning management system (LMS). LMS has been widely used and are accessible through the Internet. By connected and accessed to the Internet, LMS are exposed to various threats. Proper understanding of these threats combined with strategy and best practices countermeasures will ensure a safe learning environment. Therefore this study will look into the information security aspect of LMS. There are two main purpose of this study. First, this study provides a review of information security in e-learning environments and explains the important of information security. Confidentiality, integrity and availability are considered to be the primary pillars of information security. In addition to these pillars, the International Information Systems Security Certification Consortium introduced a common body of knowledge (CBK) comprised of ten domains relating to specific information security topics. These domains are the foundation of security practices for those involved in information security. In this article, each of these is explained within an e-learning context. It is recommended that institutions employing e-learning adhere to these domains. By applying the principles and practices associated with each domain, e-learning institutions should be able to provide an e-learning system with high confidentiality, integrity and availability. The second purpose of this study is to understand student perception of an information security perspective of an e-learning management system. To achieve this purpose, a survey was conducted targeted at undergraduate students in a distance learning program. 497 students responded to a survey questionnaires. Apart from demographics information, the survey asked the respondent to rate six statements related to how they perceived security of the learning management system which they are currently using. All six statements are rated using a five point Likert scale anchored at 1 (Not at all) to 5 (Very much). Frequencies analysis was conducted to show the profile of the respondent. Overall, respondent has strong positive perceptions towards security of their LMS. This study provides an overall picture of information security elements of a learning management system. It can serve as an introduction which help LMS administrator to understand the issues and possibilities related to the safety of LMS.

A sealed‐bid multi‐attribute auction protocol with strong bid privacy and bidder privacy

ABSTRACTIn this paper, a sealed‐bid multi‐attribute auction protocol that mainly focuses on security issues (i.e., bid privacy, bidder anonymity, and fairness problem) is presented. In recent years, existing literatures mainly focus on the multi‐attribute winner determination problem and other issues, but research of multi‐attribute e‐auction just begin from the perspective of information security. The new proposal is motivated by the conflict between bidder anonymity and denial‐of‐service attack from an insider. It utilizes private set intersection method to solve the privacy problem of winner determination of sealed‐bid multi‐attribute auction. The proposed sealed‐bid auction scheme preserves the strong privacy of the bids and provides verifiable correctness. According to the security analysis, it satisfies the security requirements of an e‐auction. Copyright © 2013 John Wiley & Sons, Ltd.

Hack Tivism

Over the last two or so years, organisations have had to meet a new and highly specific online threat. That threat is hacktivism and Adrian Davis, Principal Research Analyst at the Information Security Forum, takes a look at the threat from an information security perspective, based on research conducted by the Information Security Forum and the experiences of its 300 global member organisations.

Cyber-Physical-Social Based Security Architecture for Future Internet of Things

As the Internet of Things (IoT) is emerging as an attractive paradigm, a typical IoT architecture that U2IoT (Unit IoT and Ubiquitous IoT) model has been presented for the future IoT. Based on the U2IoT model, this paper proposes a cyber-physical-social based security architecture (IPM) to deal with Information, Physical, and Management security perspectives, and presents how the architectural abstractions support U2IoT model. In particular, 1) an information security model is established to describe the mapping relations among U2IoT, security layer, and security requirement, in which social layer and additional intelligence and compatibility properties are infused into IPM; 2) physical security referring to the external context and inherent infrastructure are inspired by artificial immune algorithms; 3) recommended security strategies are suggested for social management control. The proposed IPM combining the cyber world, physical world and human social provides constructive proposal towards the future IoT security and privacy protection.

A Business Process-Based Risk Evaluation Framework

To present the essence of information system risk evaluation and improve the effect of evaluation, the paper puts forward a business process-based information system risk evaluation after analyzing the current risk evaluation methods. The framework begins with the description of business process in perspective of information security and then analyzes and assesses the business activities. The risk-control evaluation of business activities is brought forward and the optional security control measures are comprehensively evaluated so as to ensure security of business activities. The framework focuses on business process activities so that information system assets, their vulnerabilities and threats are associated and evaluation of isolated and meaningless assets is avoided.

Securing e-Government and e-Voting with an open cloud computing architecture

Abstract The idea, the concept, and the term, that is cloud computing, has recently passed into common currency and the academic lexicon in an ambiguous manner, as cloud dust is being sprinkled on an excess of emerging products. Exorcising complexity and protecting against the caprice of the moment, this paper explores the notion behind the hype of cloud computing and evaluates its relevance to electronic government and electronic voting information systems. This paper explores increasing participation and sophistication of electronic government services, through implementing a cloud computing architecture. From an Information and Communication Security perspective, a structured analysis is adopted to identify vulnerabilities, involved in the digitalization of government transactions and the electoral process, exploring the notion of trust and transparency within this context. In turn, adopting a cloud computing approach for electronic government and electronic voting solutions is investigated, reviewing the architecture within the previously described context. Taking a step further, this paper proposes a high level electronic governance and electronic voting solution, supported by cloud computing architecture and cryptographic technologies, additionally identifying issues that require further research.

Managing third parties – an information security perspective

Organisations work with many third party service providers, from bankers to cleaners, and IT auditors to facility managers. A common and pressing problem is how to share information, in many formats, between the organisation and its service providers. What are some of the major issues associated with working with service providers from an information security perspective and how do you address them?