Information Security Standards Research Articles

Cyber Security and Compliance Management through a Single Integrated Platform

Abstract: These days, any information security product or service used in an organization is a stand-alone solution. Examples include information risk management, data security, auditing, and incident management. Since different organizations use different services from different providers, there is currently no single platform or architecture that can address all of an organization's fundamental information security procedures in one easy step. Because of this, businesses must spend a significant amount of money on separate services in order to meet the information security standards that are necessary for their businesses. These dispersed services lead to an increase in physical and manual labor, disorganized processes, and a lack of clarity regarding all information security-related business issues. To solve these issues, the approach covered in this article combines information security as a service with end-to-end platform/framework to give organizations a single framework for all information security-related organizational aspects. A single service that can handle every information security-related work for the company, including risk assessment, mitigation, vulnerability assessment, incident management, threat analytics, risk response management, and auditing. This will assist the company in spending less money on a wider range of security-related services.

Multi-language IoT information security standard item matching based on deep learning

In the realm of IoT information security and other domains, various information security standards exist, such as the IEC 62443 series standards published by the International Electrotechnical Commission and ISO/IEC 27001 by the International Organization for Standardization. Business organizations are striving to improve and protect their operations through the implementation and study of these information security standards. However, comparing or pinpointing applicable control measures is becoming increasingly labor-intensive and prone to errors or deviations, especially given the plethora of information standards available. Identifying specific control measures scattered across different information security standards is gradually becoming an important issue. In this research, we utilise a range of domestic and international information security standards as the foundation, employing text mining and deep learning methods to map the similar parts of control measures between standards, thereby enhancing the efficiency of comparison tasks and allowing human resources to be allocated to more pertinent issues.

A PROFESSIONAL APPROACH AS A METHOD OF PROTECTING INFORMATION AT THE STAGES OF DEVELOPMENT OF RELATIONAL DATABASES AND SOFTWARE FOR WORKING WITH THEM

The design of relational databases and software (software) for working with them is analyzed from the point of view of design components affecting data security. Named the internal threats that arise due to imperfect design. Positive practices are described that allow designing databases and developing software to work with them in the aspect of secure code. It is justified why the stage of relational database design, when relation normalization is applied, relationships between tables are formed, and integrity constraints are formed, is a step to ensure data protection, which is not emphasized in the database security literature. In particular, it is proposed to create external relationships between tables so that the Database Management System (DBMS) protects data from integrity violations. Some points in the development of software are highlighted, which are responsible for the safety of working with the database from the point of view of creating a reliable and safe code and stem from the practical experience of the programmer. The secure code approach, which is widely used in software development and at the software audit level, has been shown to prevent internal security threats, which are the most common cause of data loss. The requirements for using this approach are included in the updated information security standards, so they should be considered by professional database and software developers.

JURIDICAL ANALYSIS OF PUBLIC INFORMATION DISCLOSURE IN GOVERNMENT SYSTEMS IN THE DIGITAL ERA

This article conducts a juridical analysis of public information disclosure in government systems in the digital era. The purpose of compiling this article is to identify legal issues related to public information disclosure in the digital era and provide appropriate legal solutions to overcome these problems. The research method used is a literature study by analyzing laws and regulations related to public information disclosure, as well as collecting the latest data and information about the use of information technology in government in a descriptive-analytical manner. The study results show that public information disclosure is a basic principle in a democratic government system that is fundamental for strengthening government accountability and encouraging public participation in policy-making. In the digital era, public information disclosure is becoming increasingly important, but it also requires the protection of information security and privacy because public information disclosure in the digital era has complex legal implications, such as issues of information security, personal data protection, and copyright issues. This article suggests that the government strengthen regulations regarding public information disclosure in the digital era, including developing strict information security standards and protecting intellectual property rights. In addition, the government also needs to increase public awareness about their right to obtain public information and develop an effective and efficient information system to facilitate access to public information.

Analisis Resiko Keamanan Informasi Website Repository Digital Library Menggunakan Framework ISO/IEC 27001 & 27002: Studi Kasus Perguruan tinggi X

The continuous evolution of digital repositories in the era of globalization, especially in context of higher education digital libraries, poses security risks that raise concerns among users. Existence of sensitive user data that requires protection by universities adds to this concern. This research aims to conduct comprehensive analysis of information security risks associated with digital library repository websites. This research seeks to identify potential vulnerabilities, threats that could compromise the confidentiality, integrity and availability of digital assets stored in repositories. Through detailed risk analysis, this research provides actionable insights and recommendations to improve the information security posture of digital libraries using the ISO/IEC 27001 and 27002 IT governance framework specifically tailored to information security standards. This research uses a literature review and interviews with responsible parties at the University of X's digital library repository. Findings show that the use of tools such as Acunetix helps identify vulnerabilities in web repositories. Risk mitigation in digital library web repositories involves the application of ISO/IEC 27001, 27002 standards, which results in specific risk mitigation actions. For example, universities should create policies to monitor information technology assets, ensuring regular monitoring to protect technology assets. In addition, for Database Management System (DBMS) management (e.g., MySQL, PostgreSQL, Oracle, Ms SQL Server), colleges must facilitate easy access and storage of information. By implementing the recommendations obtained from this research, higher education institutions can ensure safe environment for users accessing digital library web repositories, thereby reducing concerns about the security of their information.

ASSESSMENT OF COMPLIANCE WITH INFORMATION SECURITY REQUIREMENTS VIA SECUBE

This article focuses on the assessment of compliance with information security requirements using SeCube, a comprehensive information security management system. It explores howSeCube facilitates organizations in meeting various information security standards and regulations. Key features of SeCube, such as risk assessment, policy management, incident tracking, and compliance reporting are examined. The article also highlights the benefits and challenges of using SeCube for compliance purposes, providing insights into its effectiveness in maintaining high information security standards.

Digital Competence Profiles in Education

Purpose of research. The trend of personalization of learning forms a demand for the development and implementation of software tools for processing the digital footprint of the learner, to manage his/her educational trajectory. In combination with decentralized identification technologies, such software tools assume a more active role of the learner in the creation of his/her personal learning trajectory. Additional challenges for the developed software tools are the functional requirement to ensure the independence of learner profile data from individual educational services, while at the same time complying with the standards of information security of working with data. The purpose of this research is to expand the understanding of the possibility of modifying online learning by including distributed solutions in the field of information technology application in education.Materials and methods. The paper describes in detail the solutions developed by the authors for software implementation of a digital profile of learner's competencies - a decentralized application designed to store data of learning activity and confirmed qualifications aggregated from various external educational platforms and services. When forming these solutions, the authors proceeded from the advantages of using a decentralized approach to software development. The methodological basis of the research is represented by a set of approaches and technologies that support the logic of the software development process - distributed registry technology, digital identification approach, credentials storage standard.Results. The authors substantiate the choice of solution for software implementation of digital competence profile: SSI approach will provide decentralized identification of digital footprint data beyond the boundaries of individual educational platforms and services; application of the standard of verifiable VC credentials will create conditions for decentralized storage of learning activity data. The results of the study may be of practical interest for the administration of domestic educational organizations, administration of educational platforms and educational services implementing online learning programs for effective and secure management of each individual student's digital footprint data, creating an individual educational trajectory in his/her interests and confirming competencies.Conclusion. Implementation and scaling of the digital competence profile are aimed at ensuring the identification, safe storage, and effective management of the learner's digital footprint data, which can be used to create an individual learning trajectory. The digital competence profile will allow to realize the function of confirming any forms of activity, the nature of interaction of the learner with the functions of the educational service, as well as allow the learner to control and manage the use of the information placed in the digital profile. As part of the whole, the digital profile is considered in the overall architecture of the information system, which implies the interaction of the software application with other subsystems, including in the structure of the educational platform. The scheme of interaction demonstrated for the digital educational platform “Digital Tutor” developed at the Plekhanov Russian University of Economics. Additional research requires tools for controlling the activity and motivation of the learner to formalize his/her active role in the issues of personal learning trajectory management.

Dynamic Risk Assessment in Cybersecurity: A Systematic Literature Review

Traditional information security risk assessment (RA) methodologies and standards, adopted by information security management systems and frameworks as a foundation stone towards robust environments, face many difficulties in modern environments where the threat landscape changes rapidly and new vulnerabilities are being discovered. In order to overcome this problem, dynamic risk assessment (DRA) models have been proposed to continuously and dynamically assess risks to organisational operations in (near) real time. The aim of this work is to analyse the current state of DRA models that have been proposed for cybersecurity, through a systematic literature review. The screening process led us to study 50 DRA models, categorised based on the respective primary analysis methods they used. The study provides insights into the key characteristics of these models, including the maturity level of the examined models, the domain or application area in which these models flourish, and the information they utilise in order to produce results. The aim of this work is to answer critical research questions regarding the development of dynamic risk assessment methodologies and provide insights on the already developed methods as well as future research directions.

Designing An Information Security Framework For The Indonesia Water Industry Sector

The majority of Indonesia's water industry sectors have implemented smart water management systems as part of their business development, which has an indirect impact on enterprise information security. However, in general, water sector enterprises continue to place a low priority on information security, and the development of information system frameworks is based on generic norms employed by financial firms. There has been no research on information security frameworks especially built for water firms in Indonesia that use information security standards in the utilities sector. This article proposes a solution in the form of a new framework for Indonesian water firms that combines international information security requirements in the utilities sector with Indonesian government rules. This approach of development combines worldwide standards with national rules. The Cybersecurity Capability Maturity Model (C2M2) and ISO 27019 are two international standards commonly used by utility businesses globally. Government Regulation or Peraturan Pemerintah (PP) Number 71 of 2019 on the Implementation of Electronic Systems and Transactions is the relevant national regulation. The framework addresses information technology, telecommunications, and operational technology, with four approach categories: governance and ecosystem, protection, defense, and resilience. According to the research findings, the newly integrated framework can be applied and is worthy of recommendation. This framework also meets the standards for information security and can be used by Indonesian water corporations.

Audit Keamanan Sistem Informasi Manajemen Rumah Sakit Dengan Framework COBIT 2019 Pada RSUD Palembang BARI

This study examines the implementation of information system at RSUD Palembang BARI with the aim of enhancing information system security. In this context, a security audit is conducted using the COBIT 2019 framework. The COBIT 2019 domains and processes utilizing include EDM03, APO12, APO13, APO14, and DSS05. The research involves the identification and evaluation of information security risks, determination of necessary security controls, and ensuring compliance with the information security standards established by COBIT 2019. The findings indicate that the level of information system security at RSUD Palembang BARI is at level 3 (Defined), with a gap analysis difference of 1 level below the expected target. Based on the above results, efforts to improve and enhance the information system security at RSUD Palembang BARI are still needed. The use of information system security techniques such as vulnerability scanning, penetration testing, WAF, IDS and IPS, and data encryption, as well as improving security in terms of server physical aspects such as installing CCTV and restricting user access with access cards or fingerprints, can be implemented to ensure compliance with relevant information security standards. Consideration for obtaining security certifications, like ISO 27001, should also be taken. Additionally, the quality of human resources in terms of policy-making and the ability of employees to address threats and attacks on information system security should be improved through training and strengthening coordination among employees.

Application of Multicriteria Methods for Improvement of Information Security Metrics

Metrics are a set of numbers that are used to obtain information about the operation of a process or system. In our case, metrics are used to assess the level of information security of information and communication infrastructure facilities. Metrics in the field of information security are used to quantify the possibility of damage due to unauthorized hacking of an information system, which make it possible to assess the cyber sustainability of the system. The purpose of the paper is to improve information security metrics using multicriteria decision–making methods (MCDM). This is achieved by proposing aggregated information security metrics and evaluating the effectiveness of their application. Classical information security metrics consist of one size or one variable. We obtained the total value by adding at least two different metrics and evaluating the weighting factors that determine their importance. This is what we call aggregated or multicriteria metrics of information security. Consequently, MCDM methods are applied to compile aggregated metrics of information security. These are derived from expert judgement and are proposed for the three management domains of the ISO/IEC 27001 information security standard. The proposed methods for improving cyber sustainability metrics are also relevant to information security metrics. Using AHP, WASPAS and Fuzzy TOPSIS methods to solve the problem, the weights of classical metrics are calculated and three aggregated metrics are proposed. As a result, to confirm the fulfilment of the task of improving information security metrics, a verification experiment is conducted, during which aggregated and classical information security metrics are compared. The experiment shows that the use of aggregated metrics can be a more convenient and faster process and higher intelligibility is also achieved.

Administrative and Legal Aspects Related to CombatGambling and Computer Addiction in Young People

The objective of the study is to determine the forms, types and factors of computer addiction and gambling in young people, as well as propose ways to counteract their negative impact. The methodological basis of the study is sociological research, analysis of state policy and regulations; methods of classification and generalization. Results: the authors have proven that Government policy should be aimed to improve the information culture of users of the global network, the formation of skills for safe work in cyberspace and mastering the rules and norms of behaviour in cyber reality. The main ways to counteract the negative impact of computer addiction on young people are suggested, in particular, encouraging public organizations to identify people addicted to gambling and provide them with information on rehabilitation centers and forms of rehabilitation; limiting the time minors spend in play areas; establish information security standards in the activities of the organizers of games for money, and promote the principles of responsible gambling.

"TechnoMIG" — the project for the formation of media information literacy

The article discusses the possibilities of using technoparks of universal pedagogical competencies and "Quantoriums" of pedagogical universities to create conditions for the formation of media information literacy of students, parents and teachers. Media information literacy implies the ability to work with information using information and communication technologies in solving cognitive, communicative and organizational problems in compliance with the requirements of ergonomics, safety, hygiene, resource conservation, legal and ethical standards, and information security standards. The article describes the comprehensive project "TechnoMIG" on the formation of media information literacy, implemented at three levels of training: "TechnoMIG START" — for students of 1–6th grades, "TechnoMIG MASTER" — for students of 7–11th grades, "TechnoMIG EXPERT" — for parents and teachers. Examples of possible educational activities carried out within the framework of the project are given in the article.

The Study of Intelligent Control Elements of a Mobile Robot and Ensuring Information Security of the Process of Its Functioning in a Dynamic Environment

Purpose of research. The study presented in this article is aimed at establishing and substantiating the principles of effective incorporation of intelligent elements of the control system of a mobile robot operating in a dynamic environment. The subject of the study was the procedure of simultaneous localization and mapping involved in the control. Indicators related to ensuring the information security of the process of robot functioning in real operating conditions were used as the performance criterion.Methods. A methodology for the experimental study of the software procedure execution for simultaneous localization and mapping within the framework of the task of controlling a mobile robot has been developed and implemented. The main focus of the study is a computer model of an abstract mobile robot performing reconnaissance functions in a virtual dynamic environment. The incorporated elements of intelligent information processing into the procedure of simultaneous localization and mapping are convolutional and fully connected neural network layers that provide filtering of dynamic objects.Results. When conducting this experimental study, a simulation of the process of functioning of a computer model of a reconnaissance mobile robot in a virtual environment has been performed. Similar experiments have been reproduced with various structural and functional configurations of the procedure for simultaneous localization and mapping. Quantitative results have been obtained, demonstrating the accuracy of positioning the subject of the study for each of the methods of organizing this procedure. A comparative analysis of the options for using the elements of intelligent information processing within this procedure has been carried out.Conclusion. It has been established that incorporation of the elements of intelligent information processing into the procedure of simultaneous localization and mapping has an impact on the positioning accuracy of a mobile robot and the reliability of its functioning in a dynamic environment. This contributes to the compliance with information security standards when using mobile robots in real operating conditions. It is also determined that there is their excessive use, which leads to a deviation from the optimal qualities necessary for effective autonomous control of a mobile robot and information security provision.

Keamanan Informasi Menggunakan iso27002 Pada Data Organisasi Paskibra Kopral15 di SMPN 15 Medan

The type of audit used in this study is an internal audit using the Iso 27002 information security standard. KOPRAL or Garuda Lima Belas Soldier Command is an Extracurricular Paskibra in SMP N 15 Medan, this extracurricular is quite popular with many existing students, the initial purpose of its formation This Paskibra is to raise the red and white flag on national days, such as independence, youth oath, and teacher's day, currently KOPRAL has 29 batches.

Protective shields: the drivers of adopting information security standards and complementarity with different security standards

Protective shields: the drivers of adopting information security standards and complementarity with different security standards

АВТОМАТИЗАЦІЯ МАРКЕТИНГОВОЇ ДІЯЛЬНОСТІ ЯК НАСЛІДОК ІНФОРМАТИЗАЦІЇ СУСПІЛЬСТВА

The article is devoted to a modern problem - the development of marketing under the conditions of informatization of the economy. The conducted analysis showed that the automation of marketing activity became possible, including thanks to the large-scale system program for the development of the economy of the new technological generation, the so-called digital economy. The use of automation tools in marketing activities allows you to significantly reduce transaction costs associated with the search, exchange and storage of information, optimize the processes associated with the creation of goods and services, and also allows you to provide constant feedback and the development of individual offers. Іncrease consumer interest in marketing programs and reduce the number of contacts with consumers, which radically improves marketing results, increases profitability. However, the transition to digital rails is not possible without leveling up digital literacy of the population, elimination of the lack of modern technologies and equipment, development of e-commerce platforms, modernization of information security standards at the state level and introduction of monitoring of their implementation. Therefore, the development of the era of automated marketing involves the development of digitalization of the economy in general, and the improvement of marketing tools. Thanks to this, companies can effectively monitor and analyze consumer data, develop more accurate and personalized marketing strategies, increase customer loyalty and increase profitability. However, companies should also be careful not to rely too heavily on automation and maintain a personal touch with their customers. The main disadvantages of marketing automation are cost, marketing automation requires large financial investments, especially for small businesses. The costs of acquiring, installing, configuring, and maintaining this technology can be high. And the risk of errors is also very high: marketing automation can lead to errors. Conclusions are drawn and prospects for further research are defined.

Security on Charity Crowdfunding Services using KAMI Index 4.1

Technological developments are multiplying. The ABC charity currently has a crowdfunding service. This service helps simplify the user management process. Security is a crucial issue to support and guarantee funders. This research aims to evaluate and provide recommendations for crowdfunding services to run safely and smoothly using the KAMI Index 4.1. This research consists of several steps, starting with observations made at charitable institutions. The following process is through focus group discussion activities to assess the level of information security of crowdfunding services. The analysis of the calculation results is used as the basis for developing recommendations. Based on the assessment results, crowdfunding services at charities obtained scores of I to I+, this indicates that the charity is still in its initial condition and has not yet implemented information security standards in managing crowdfunding services. Recommendations proposed to increase the value are carried out by compiling and implementing information security at the charity.

Understanding Cybersecurity Frameworks and Information Security Standards—A Review and Comprehensive Overview

Businesses are reliant on data to survive in the competitive market, and data is constantly in danger of loss or theft. Loss of valuable data leads to negative consequences for both individuals and organizations. Cybersecurity is the process of protecting sensitive data from damage or theft. To successfully achieve the objectives of implementing cybersecurity at different levels, a range of procedures and standards should be followed. Cybersecurity standards determine the requirements that an organization should follow to achieve cybersecurity objectives and facilitate against cybercrimes. Cybersecurity standards demonstrate whether an information system can meet security requirements through a range of best practices and procedures. A range of standards has been established by various organizations to be employed in information systems of different sizes and types. However, it is challenging for businesses to adopt the standard that is the most appropriate based on their cybersecurity demands. Reviewing the experiences of other businesses in the industry helps organizations to adopt the most relevant cybersecurity standards and frameworks. This study presents a narrative review of the most frequently used cybersecurity standards and frameworks based on existing papers in the cybersecurity field and applications of these cybersecurity standards and frameworks in various fields to help organizations select the cybersecurity standard or framework that best fits their cybersecurity requirements.

Regulatory Framework for Canada's Cybersecurity Policy

The article examines the issue of regulatory regulation of cybersecurity policy in Canada, and also considers an assessment of the main stages of cyber law formation. It describes policy documents that aim to improve Canada's cybersecurity and develop directives that have a positive impact on the development of the national security system. It emphasizes the adoption of two National Cyber Security Strategies and highlights the importance of other legislative initiatives to protect the integrity of government systems, national critical assets, methods and forms of combating cybercrime and protecting Canadians in their daily use of information space. The focus is on Canada's international integration in the field of cybersecurity and cooperation in the field of national space protection with partner countries in modern conditions. The author concludes that the Canadian legislature and executive are responding quickly to information challenges and creating flexible legal legislation aimed at preventing future threats. After all, Canada was one of the first to develop a regulatory framework for cybersecurity, constantly improving legislative initiatives and allocating financial resources. Characterizing the specifics of the legal framework of Canadian cyber law, it should be noted that the authorities are making great efforts to change the law, modernize the powers of law enforcement agencies and ensure an order that prevents evasion of legal control over criminal activities online. The Canadian criteria for computer systems security are the basic standards of information security and are highly recognized by the international community. Internationally, Canada's cybersecurity is developed through the Five Eyes Alliance and is closely linked to US, UK, Australian and New Zealand policy priorities, providing access to intelligence from around the world and providing a high level of protection against cyber security. attacks. Canada has one of the world's best institutional systems for information policy, including the creation of a single information space, the functioning of e-government, free access to information, government regulation of the media, and most importantly clear regulation of all information relations and processes The positive experience is that the Canadian state has a long history of cooperation between the public and private sectors in the field of economic and national security. This joint cooperation is ensured through the mutual exchange of accurate and timely information on cyber threats, protection methods and other best practices.