Information Security Requirements Research Articles

Ensuring Information Security of Information Systems to be Integrated Based on Trust

Relevance. Information systems are integrated with each other, which leads to the need to ensure the protection of the integrated system. The level of trust requires formalizing the concept of trust and studying its nature and structure.The purpose of the article is to remove the contradiction between the needs to provide access to the resources of the resulting integrated system and ensure compliance with the information security requirements of each of the integrated systems by formulating the concept of trust from the information security perspective. Methods used: systems analysis, risk management theory, resolutions, iSoft operator equation synthesis method.Results. Main shortcomings of existing approaches to the formalization of the concept of “trust” are identified. Based on the FIST information system model, a functional trust structure has been developed and formalized in IDEF0 notation for all levels of integrated information systems: supporting level, personnel level, hardware and software levels. Examples of violation of trust and examples of tools for creating trust for each level of the information system are given. The adequacy of the model is illustrated by the example of real integration of information systems. Application of the proposed trust model made it possible to identify features that increase information security risks for the integrated information system from the example. Novelty. An interpretation of trust as a measure of information security is proposed, in contrast to “risk” as a measure of danger. A tool for quantitative assessment of trust is proposed. A necessary and sufficient condition for creating maximum trust in an information system is formulated and proven by the resolution method Practical significance. The proposed trust model can be used in the development of guidance documents regulating the process of integration of information systems, in setting requirements for service personnel and creating training programs for them, for developing information security tools and methods for their application.

Operational Technology resilience in the 2023 draft delegated act on cybersecurity for the power sector—An EU policy process analysis

The EU’s 2020 Cybersecurity Strategy promotes cybersecurity as essential for building a resilient, green, and digital Europe. Cleaner energy sources such as wind and solar are more volatile and thus need digital integration with Industrial Control Systems (ICS) for grid balancing. However, the digitization and the properties of cyberspace provide the ability to coordinate disruptive cyberattacks against power grid infrastructures. Digital weapons may be launched against ICS to start multiple cascading outages with a keystroke, causing large-scale blackouts we have never seen before. To reduce risk, the EU’s Strategy describes three objectives for ICS: Secure-by-design, resilient, and timely patched. In the strategy, the European Commission suggests a ”network code,” i.e. a delegated act for the electric power sector, setting rules for cybersecurity in cross-border electricity flows. The draft delegated act of November 2023 presents security requirements for Information and Communication Technology (ICT) and Network and Information Systems (NIS). Although ICS systems are used directly to manage electricity flows, ICS is only mentioned in one of the delegated act’s recitals as a subcategory of ICT products. Suppose Information Technology (IT) rather than Operational Technology (OT) is the focus of the delegated act. In that case, policymakers may not fulfill the EU cybersecurity strategy’s ICS objectives, thus failing to improve the resilience of power grid infrastructures and cross-border electricity flows. This study is a policy process analysis, and its contribution is threefold. First, a literature review is conducted to understand the extent to which the delegated act covers OT. Second, a framework condition analysis is applied to understand why the delegated act lacks OT-specific security requirements. Third, the analysis is extended to understand whether OT is sufficiently covered to achieve the EU strategy’s ICS objectives. In conclusion, our analysis shows a strong intention to include OT-specific security in the preparatory work of the delegated act, but that a stronger position of the IT communities forced OT onto the sideline. Further, the study shows weak fulfillment of general secure-by-design principles and security patch management. These results indicate that OT coverage in the delegated act is not in line with the expectations of the EU’s cybersecurity strategy and the delegated act’s early preparatory work. Therefore, we have suggested three measures to increase OT resilience focus in the act: (a) Define the expressions NIS, ICT services, ICT processes, and ICT in general as umbrella terms that include OT, (b) The foreseen minimum and advanced cybersecurity controls should require OT-specific measures, including holistic secure-by-design principles and patch management covering all patching phases, (c) Develop an OT implementation guide for the delegated act. Our work can be used by policymakers to optimize cybersecurity policy processes and by researchers studying socio-technical gaps in the cybersecurity domain.

Analysis of Relationships between Non-conformities, Process Maturity and Continual Improvement in Information Security Management Systems

Abstract In the current global context, companies need a defined minimum level of information security to recognize and deal with related threats and risks. Due to market, customer or legal requirements, specifications and requirements for information security are implemented uniformly according to standards such as the information security management standard ISO/IEC 27001 or industry-specific standards such as Trusted Information Security Assessment Exchange - TISAX, ISO IEC 27019 Energy Utility Information Security Standard. The conformity to these standard requirements within the established management system is checked during periodically required audits. However, there are various reasons for which, even after many years of audits in companies, there are still insufficient process implementations for information security requirements. The aim of the paper is to analyze the status of conformity and thus also the process maturity in selected samples of companies that have already had information security management systems (ISMS) implemented for several years. In detail, the reasons for deviations from the minimum requirements with associated risks for the security of information in companies were analyzed, which allow conclusions to be drawn about possible process improvements. The paper also analyzes why, despite established measures and existing expertise, only a limited level of process maturity is achieved on average. Other possible approaches to the implementation procedure for dealing with non-conformities in information security are also considered. The results of this research show that there is a need for an adjusted continuous improvement process, which makes risks resulting from insufficient process maturity more visible. Proposals for such improvements are listed.

Criterion of construction and strategy of functioning of information and telecommunication system with protection against destructive effects

The creation of information and telecommunication systems with the integration of information transmission, reception and processing functions determines the need to find technical solutions to ensure its security and protection while increasing the intensity of information processes, improving technologies for unauthorized access to information areas and creating destructive effects. Joint fulfillment of requirements for information security and maintaining operational properties of the system, which regulate efficiency, efficiency and resource intensity of information exchange, is achieved in accordance with a minimum-margin rule, the essence of which is to find the maximum possible information losses and determine a strategy for achieving minimum values of these losses. Within the framework of the used approach, the best solution is to establish a set of parameters of transmitting and receiving devices and information processing means with the lowest loss value of the target function of information exchange under the most dangerous and effective destructive effects. Goal – justification of the criterion for construction and strategy of functioning of the information and telecommunication system with protection against destructive effects. The criterion of construction and strategy of operation of the information and telecommunication system are justified in order to achieve the best probabilistic-time indicators of information exchange with a balanced set of measures to ensure security and information protection in case of destructive impacts. Due to the variety and variability of the conditions for the manifestation of destabilizing factors, the parameters and reconfiguration schemes of telecommunication channels, as well as the operating modes of information processing devices, were established while achieving the effectiveness of meeting the information needs of subscribers according to the optimality criterion and setting indicators of the efficiency and resource consumption of the system according to the suitability criterion. Possibilities and options for adaptive, situational and reflective control of the information and telecommunication system in the interests of rational distribution of the information resource to achieve target functions and the use of technologies for ensuring security and protecting information from destructive influences are investigated. Automatic control of the system is at the stage of prohibiting destructive effects on the information area by maintaining components in states that most fully correspond to the goals and objectives of information exchange. Situational control of information security during transmission and reception, used, as a rule, at an early stage of implementation of the conflict component in the information process, is based on the identification of destabilizing factors based on the results of classification of current states and neutralization of threats due to the restructuring of the system operation regulations carried out. Reflexive control, the strategy of which is based on prediction and evaluation of changes in the parameters of information processes under destructive effects, is in the form of transferring components of the information and telecommunication system to the state of its own information equilibrium, which helps to maximize the target function of information exchange while minimizing the performance indicators of destructive effects carried out. Due to the expediency of consistent implementation of the above control strategies in assessing the degree of occurrence of threats to the information process, the vector of parameters of information objects and telecommunication channels must from the conditions for neutralizing the full set of predicted destabilizing factors be determined. A reasonable criterion for building an information and telecommunication system makes it possible to jointly search for technical solutions for creating receiving and transmitting devices and information processing means in order to achieve maximum performance indicators of information exchange under established limitations of efficiency and resource intensity. The developed rule for selecting the strategy for controlling components of the information and telecommunication system establishes time-frequency and space-energy distributions of information processes necessary to meet the information needs of subscribers when transmitting, receiving and processing information in different conditions for the manifestation of destructive threats. The obtained results form a methodological basis for building information and telecommunication systems with protection of information coming through their channels with increasing requirements for target functions of information exchange and strengthening system restrictions due to improvement of technologies for unauthorized access to information areas and creation of destructive effects.

Dynamic encryption method for MQTT communication

Internet of vehicles (IoV) system is mixed-criticality, and different functions have different requirements for information security and real-time performance. Thesis aims to design a comprehensive dynamic encryption algorithm to ensure the function of the IoV system while taking into account the security level required by different critical functions. The algorithm can flexibly coordinate the security requirements between different functions, improve the efficiency and reliability of the system to the greatest extent, and ensure information security. In order to verify the performance of the algorithm, thesis uses Pycharm platform to carry out simulation experiments through python programming and verifies the feasibility of the algorithm.

Model of current threats to security of confiden-tial data in divisional information systems

The paper proposes a model for determining actual threats to the information security of distributed information systems, based on algorithms of fuzzy inference and the theory of fuzzy neural systems, unlike known ones, uses sufficient and necessary indicators, excludes expert errors, increases the detection of the number of actual threats to information security of distributed systems by 5 %, reduces the cost of purchasing information protection equipment from 15 to 30%. It takes into account the following factors: the IT infrastructure of the distributed information system, the capabilities of attackers and their level of motivation in the distributed information system, the list of existing protection tools in the distributed information system.
 The proposed approach differs from existing ones in the following: lack of involvement of highly qualified specialists in the field of information security; the process is automated, has a low computational complexity; absence of deficiencies in expert assessments; allows you to determine the list of current information security threats in information systems of various classes and types.
 The task of ensuring the security of confidential information becomes the most urgent, which is due to the growth of computer attacks and leaks of information, which are reflected in the statistical data on the commission of crimes in the field of high technologies, the growth of criminal activity using modern communication devices and the Internet.
 Existing methods of modeling current threats to information security and assessing the effectiveness of the information protection system cannot be used at all stages of the life cycle of distributed information systems - they do not take into account the following indicators in the complex: IT infrastructure of distributed information systems, current threats to information security, security requirements for confidential information, a list of means of protecting confidential information and their value as important indicators when solving these problems.
 In order to achieve the goals of ensuring the security of confidential information, it is necessary to: organize the effective creation of an information protection system (information security system), effective modeling (identification of the list) of current threats to information security, identification of the current violator, and also provide the opportunity to conduct a qualitative assessment of the effectiveness of the information security (protection) system.
 One of the most important tasks of ensuring the security of confidential information is the assessment of the effectiveness of the protection (security) system. In this regard, the goal of the work (research) is to improve the quality of the evaluation of the effectiveness of the protection (security) systems of distributed information systems by determining sufficient and necessary evaluation indicators using modern (promising) information technologies that allow the most effective solution of the following tasks: determination operating parameters of adaptive production fuzzy neural systems, which are most suitable for solving the tasks, application of Data Science technologies in data processing, fuzzy output algorithms.

A Model of an Automated Electronic Document Management System Operating under Conditions of Probable Compromise of Signature Keys, Based on a Hierarchical Decomposition of Trusted Storage Environments

The results of an analysis of the functioning of the electronic document management system in the context of the development of methods and means of cryptanalysis and an avalanche increase in the number of processed documents are presented. A conceptual model and method for decomposing the storage subsystem into contours of operational and long-term storage of electronic documents are proposed. A mathematical model of hierarchical control of the integrity of electronic documents is presented, which takes into account the integrative properties of electronic documents, as well as requirements for storage periods and information security. The methodology and results of assessing the advantages of the developed technical solution based on the logical-probabilistic method are presented.

Bezbednost informacija u automobilskoj industriji - mehanizam TISAX

With the development of information technologies and their application in all spheres of activity, information security has become an actual problem. A significant step towards solving that problem was the adoption of the ISO/IEC 27000 family of standards for information security management systems (ISMS). The practical application of these standards showed that the generic standard cannot satisfy all specific requirements for information security in certain areas, so the adoption of sector standards in areas such as telecommunications, electric power systems, cloud computing, etc. At the same time, in some branches of industry, special standards were adopted to express their specificities. One of those areas is the automotive industry, where the TISAX mechanism has been established to ensure that suppliers comply with information security requirements, especially when it comes to information related to prototypes. This paper provides a summary of the TISAX mechanism, its structure and constituent elements, as well as its relationship with the ISO/IEC 27000 family of standards.

Selection of best cipher system using fuzzy soft decision methodology

Selection of a most suitable cipher system among several such systems is an important problem of the customers which help to acquire a right cipher system for meeting the requirements of information security to safeguard the vital data. Any mistake in the selection of a right cipher system is very harmful as it may lead to compromise the security of vital information. In the paper, we propose a multi-criterion fuzzy soft decision making methodology to select one of the most suitable cipher system. Proposed methodology uses fuzzy soft set, fuzzy soft matrix, dominancy matrix and S-fuzzy set to compute score values and take a right decision. It exhibits out performance over existing methods as shown by explaining some examples. We apply proposed methodology in selecting a most suitable cipher system from a set of systems with respect to the choice of desired security attributes required by the customers.

К ВОПРОСУ О ФОРМАЛИЗАЦИИ ЗАДАЧИ РАНЖИРОВАНИЯ ТРЕБОВАНИЙ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ

The article is devoted to the issue of requirements fulfillment aimed at ensuring information security in an organization. The main contradiction of the subject area concerned is pointed out, which consists in the presence of a huge number of different variants of requirements fulfillment in the absence of a possibility to choose their correct and optimal order. The task of requirements ranking is set and the idea of the proposed solution is described in the form of seven provisions aimed at coordinated recording of heterogeneous requirements in a single notation, and an intuitive scheme of the idea is synthesized (with all seven provisions indicated on it).
 To represent the idea, the following entities are introduced: an object-organization and its elements to which requirements are imposed; generalized conditions for satisfying requirements that do not depend on the specifics of the organization; variations of sets of conditions that take into account a particular organization; basic conditions that check the presence/absence of elements 
 of the object and the values of their parameters; algorithms of activities in the organization to satisfy the conditions; priorities of requirements and resources needed by the algorithms. It is concluded that such formalization will lead organically to the algorithmic solution of the ranking problem and, eventually, to automation.
 The most suitable automated ways of solving the problem of ranking information security requirements – algorithmic application of combinatorial optimization and machine learning methods – are specified. Their high efficiency in comparison with «manual» methods used in modern information protection practice is predicted.
 The novelty, theoretical and practical significance of the obtained results are noted, as well as the prospect of further research – the construction of an analytical model of requirements fulfillment, which could be the basis of an appropriate method, followed by its program implementation and conducting of necessary experiments.

АВТОМАТИЗАЦИЯ ПРОЦЕССОВ ОБЕСПЕЧЕНИЯ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ НА ОСНОВЕ РАЗРАБОТКИ МОДЕЛИ МИНИМИЗАЦИИ РИСКОВ КОНСТРУКТОРСКО-ТЕХНОЛОГИЧЕСКОГО ПРОЕКТА

Minimizing risks in developing intellectually intensive products, connected with the exclusion of unauthorized entry into the design and technological project security system, is the most important task of preserving the development of Russian creative potential. The research method is to identify and analyse the application of engineering and psychological aspects of the design activities of intellectual-intensive products. Clearly formed and documented requirements for information and technological security, supplemented by research in the field of engineering psychology, make it possible to minimise the risks of threats to enter the system along the entire chain of the design and production process. Building a model for minimising the risks of a design and technological project, which makes it possible to fulfil technological safety requirements based on developing quality assessment criteria, considering the use of engineering and psychological knowledge, is the solution to a very urgent problem.

ASSESSMENT OF COMPLIANCE WITH INFORMATION SECURITY REQUIREMENTS VIA SECUBE

This article focuses on the assessment of compliance with information security requirements using SeCube, a comprehensive information security management system. It explores howSeCube facilitates organizations in meeting various information security standards and regulations. Key features of SeCube, such as risk assessment, policy management, incident tracking, and compliance reporting are examined. The article also highlights the benefits and challenges of using SeCube for compliance purposes, providing insights into its effectiveness in maintaining high information security standards.

Energy Consumption Minimization in Secure Multi-Antenna UAV-Assisted MEC Networks With Channel Uncertainty

This paper investigates the robust and secure task transmission and computation scheme in multi-antenna unmanned aerial vehicle (UAV)-assisted mobile edge computing (MEC) networks, where the UAV is dual-function, i.e., aerial MEC and aerial relay. The channel uncertainty is considered during information offloading and downloading. An energy consumption minimization problem is formulated under some constraints including users’ quality of service and information security requirements and the UAV’s trajectory’s causality, by jointly optimizing the CPU frequency, the offloading time, the beamforming vectors, the artificial noise and the trajectory of the UAV, as well as the CPU frequency, the offloading time and the transmit power of each user. To solve the non-convex problem, a reformulated problem is first derived by a series of convex reformation methods, i.e., semi-definite relaxation, S-Procedure and first-order approximation, and then, solved by a proposed successive convex approximation (SCA)-based algorithm. The convergence performance and computational complexity of the proposed algorithm are analyzed. Numerical results demonstrate that the proposed scheme outperforms existing benchmark schemes. Besides, the proposed SCA-based algorithm is superior to traditional alternative optimization-based algorithm.

Security label and attribute-based access control in service-oriented environments

Compared with traditional systems, service-oriented environments are more dynamic and distributed. Although traditional access control is able to fulfill the security of requirements of closed systems on the whole, it can no longer meet the requirements of service-oriented environments. To deal with the issues that access control in the service-oriented environment needs to cross the boundary of the security domain, the high distribution, and heterogeneity of environmental characteristics, and how to establish efficient and guaranteed access to resources, access control based on security label and attribute is proposed for fine-grained resource information and rich policy security requirements. By using a CP-ABE mechanism, distributed fine-grained access control can be realized in the company of solving the issue of policy privacy leakage; By using the security label technology, the multi-level security mandatory access control is realized, and the security flow of information is achieved, thus protecting the service and its methods from unauthorized users. Finally, the proposed scheme has been verified to have reliable security through security analysis. The experimental outcomes indicate this proposed scheme is available and effective in terms of performance.

АЛГОРИТМ МНОГОКРИТЕРИАЛЬНОГО АНАЛИЗА ТЕКСТОВОЙ ИНФОРМАЦИИ

The article is devoted to the problem of formalization of requirements for various objects and systems. Such a rigorous recording of requirements will allow not only to form their necessary and sufficient set, but also to choose the optimal order of their fulfillment – that is, to solve the problem of ranking. For this purpose, a review of relevant scientific publications of Russian scientists is carried out, in which the point of view on the formal form of recording such requirements is presented. The results of the review are systematized in tabular form. All years of publications have a range of 15 years, the field of application of requirements presents a great variety from design of information systems and mechanical devices in spacecraft to educational planning, and the proposed forms of recording consist of separate formulas and text descriptions to full-fledged models and programming languages.
 According to the results of the review, appropriate conclusions are drawn, namely the following: the relevance of the problem (at least for the last 15 years), the lack of quality solutions, a multitude of proposed forms of record with a small predominance of analytical models and programming languages, poor automation of work with requirements. It is concluded that there are no solutions, even potentially applicable for the formation of a system of requirements for information security of information systems in a unified notation. The necessity of creation of own mathematical toolkit is substantiated both for unified formalization of all requirements of various types and purposes, and for carrying out optimization measures over them on the choice of the list and order of execution. In conclusion the novelty of the conducted research, theoretical and practical significance of the work are indicated.

Balancing software and training requirements for information security

Information security is one of the key areas of consideration to assure reliable and dependable information systems (IS). Achieving an appropriate level of IS security requires concurrent consideration of the technical aspects of IS and the human aspects related to the end users of IS. These aspects can be described in the form of information security requirements. We propose an approach that helps select and balance information security software requirements (iSSR) and information security training requirements (iSTR) according to the information security performance of end users. The approach was tested in an experiment involving 128 IS professionals. The results showed that using the proposed approach helps IS professionals with limited experience in information security make significantly better decisions regarding iSSR and iSTR.

Designing An Information Security Framework For The Indonesia Water Industry Sector

The majority of Indonesia's water industry sectors have implemented smart water management systems as part of their business development, which has an indirect impact on enterprise information security. However, in general, water sector enterprises continue to place a low priority on information security, and the development of information system frameworks is based on generic norms employed by financial firms. There has been no research on information security frameworks especially built for water firms in Indonesia that use information security standards in the utilities sector. This article proposes a solution in the form of a new framework for Indonesian water firms that combines international information security requirements in the utilities sector with Indonesian government rules. This approach of development combines worldwide standards with national rules. The Cybersecurity Capability Maturity Model (C2M2) and ISO 27019 are two international standards commonly used by utility businesses globally. Government Regulation or Peraturan Pemerintah (PP) Number 71 of 2019 on the Implementation of Electronic Systems and Transactions is the relevant national regulation. The framework addresses information technology, telecommunications, and operational technology, with four approach categories: governance and ecosystem, protection, defense, and resilience. According to the research findings, the newly integrated framework can be applied and is worthy of recommendation. This framework also meets the standards for information security and can be used by Indonesian water corporations.

Дистанционный мониторинг состояния заземляющего устройства

In connection with the rapid development of technologies, increasing the volume of data exchange and increasing requirements for information security, there is a need to pay special attention to the causes of possible data loss. One of the most common reasons is the quality of power supply of telecommunications networks. Since the density of elements on the microcircuit crystals has increased many times over, the breakdown voltage of these elements has significantly decreased. Therefore, with a slight overvoltage or electromagnetic influence, electronic components may fail, or errors may occur in the transmission of information, and even data destruction in memory devices may occur. The quality of power supply is significantly affected by the state of the grounding device, the main parameter of which is the resistance to the flow of electric current. In order to timely detect a malfunction of the grounding device, it is necessary to provide remote monitoring of its condition. The article presents the main provisions of the method of remote monitoring of the condition of the grounding device.

Secure Rate-Splitting Multiple Access for Maritime Cognitive Radio Network: Power Allocation and UAV’s Location Optimization

This paper investigates the secure rate-splitting multiple access (RSMA) cooperation for the maritime cognitive unmanned aerial vehicle (UAV) network. Specifically, we first take into account the primary privacy information and the secondary maritime UAV’s quality of service. Then, we formulate an optimization problem to maximize UAV’s transmission rate according to the RSMA decoding principle and primary information security requirements. To solve this non-convex problem, we design a CPFS algorithm to allocate the transmit power and adjust the UAV’s location. In addition, the worst case is analyzed, which is the lower-bound secondary transmission rate. Finally, simulation results indicate that the proposed scheme improves the UAV’s transmission rate compared with the traditional schemes.

УЗЛУКСИЗ ҲАРАКАТДАГИ АХБОРОТТИЗИМЛАРИ УЧУН АНАЛИТИК МОДЕЛ

Requirements for information security and reliable operation of systems do not become obsolete. On the contrary, the demand for them has increased and has become a problem that does not lose its relevance. It's no secret that the fault tolerance of large software systems is of great importance, especially when they are online. The presented article is devoted to these issues and a model is proposed for evaluating software quality indicators under failure conditions.