Information Security World Research Articles

TRANSAKSI CRYPTOCURRENCY DITINJAU DALAM PERSPEKTIF HUKUM POSITIF DAN HUKUM ISLAM

The Globalization system has had a huge impact on modern society, especially in the fields of science, technology, information and communication, all of which are developing rapidly. The most famous currency is Bitcoin or cryptocurrency. Because there are now no clear boundaries and no recognition of the existence of cryptocurrencies in Indonesia, these cryptocurrencies are facing a number of polemics regarding their use throughout the world, including in that country. The debate over whether Bitcoin is halal or haram in Islam continues among scholars who study the Koran, hadith, ijma and other Islamic books. One important area of expertise in the world of information security is cryptography. Today, professionals in the fields of computer science and mathematics discovered a new application of encryption that could improve the quality of life of local communities: the buying and selling of digital currencies known as cryptocurrencies. Digital currencies that are not subject to government regulation are known as cryptocurrencies; this does not include official cash. This cryptocurrency is the forerunner to the creation of digital currency which is now known as Bitcoin currency, which can be used like other types of money. And the result of the discussion is that whether scholars allow cryptocurrency or not. This research uses a qualitative method where this method focuses on in-depth observation. Therefore, the use of qualitative methods in this research can produce a study of a phenomenon that is more comprehensive with literature research. Based on the background information provided previously, the author identifies problems that require further investigation. Among other things, what is the meaning of cryptocurrency in the current understanding and context and what is Islamic law regarding the use of cryptocurrency as a transaction tool.

2F-Authsys: A hyperlocal two-factor authentication system using Near Sound Data Transfer

Two-Factor Authentication (2FA) is a new buzzword in the Information Security world. Big companies that used passwords as an authentication mechanism now have started transitioning to 2FA. One form of two factor authentication is known as One-Time Password (OTP). In today’s time, there is a lack of a secure multi-factor authentication platform which is also user friendly. In all the major 2FA platforms that exist today, the user has to manually enter the OTP from their phone or email. This problem is further amplified by delays in transmission of OTP via email or SMS. There has also been an increase in the number of botnets that scan large networks and try to an open and vulnerable ports on cloud hosting networks. An easy-to-use port security solution is not available. This research work aims to create a secure, proof-of-concept implementation of a modern and opinionated two factor authentication system based on Near Sound Data Transfer (NSDT) technology enabling contactless secure transmission of Time-Based One-Time Password (TOTP).

A Novel Hardware Architecture for Enhancing the Keccak Hash Function in FPGA Devices

Hash functions are an essential mechanism in today’s world of information security. It is common practice to utilize them for storing and verifying passwords, developing pseudo-random sequences, and deriving keys for various applications, including military, online commerce, banking, healthcare management, and the Internet of Things (IoT). Among the cryptographic hash algorithms, the Keccak hash function (also known as SHA-3) stands out for its excellent hardware performance and resistance to current cryptanalysis approaches compared to algorithms such as SHA-1 and SHA-2. However, there is always a need for hardware enhancements to increase the throughput rate and decrease area consumption. This study specifically focuses on enhancing the throughput rate of the Keccak hash algorithm by presenting a novel architecture that supplies efficient outcomes. This novel architecture achieved impressive throughput rates on Field-Programmable Gate Array (FPGA) devices with the Virtex-5, Virtex-6, and Virtex-7 models. The highest throughput rates obtained were 26.151 Gbps, 33.084 Gbps, and 38.043 Gbps, respectively. Additionally, the research paper includes a comparative analysis of the proposed approach with recently published methods and shows a throughput rate above 11.37% Gbps in Virtex-5, 10.49% Gbps in Virtex-6 and 11.47% Gbps in Virtex-7. This comparison allows for a comprehensive evaluation of the novel architecture’s performance and effectiveness in relation to existing methodologies.

BLOSOM: BLOckchain technology for Security Of Medical records

Today, information security world is witnessing frequent attacks on electronic records by the naive and professional hackers and crackers. Security of Patient’s Electronic Medical Record (EMR) in Hospital Management System is of paramount importance and so warrants immediate attention. In this research work, BlockChain containers running on multiple ports are proposed to be used for holding patient’s medical records. To perform this task effectively, a BlockChain framework named as “Medichain” was developed from scratch that contains all basic functionalities of a BlockChain to secure patient’s data. Each block of the BlockChain keeps a list of records of patient details. Users would be provided with an option of uploading the file containing the list of records as a JSON file, in a decisive, distributed and decentralized network. The proposed BlockChain Algorithm, consisting of cryptographic hash of the records, proof of work and a Merkle tree formulation, were simulated in Python. Results have been positive and encouraging.

Role of Management and Policy Issues in Computer Security: Rand Report R-609 within Organization

The need to provide strengthened Security for Information Systems within organization increases day after day seeing the large development of interconnection of the World Wide Web and the clear effect that results by the frequent and multiple productions of attacks and threats. This feebleness and gap in current information technologies urge researcher to face by developing more secure systems of Sharing Resources. The history of securing Information Systems began with the concept of Computer Security in its Global meaning Physical and Non-Physical. Thus, by 1967 the Department of Defense of USA published the R-609 which is considered as the first step in the wide world of Information security including Securing the data, Limiting random and unauthorized access to that data and Involving personnel from multiple levels of the organization in information security. The purpose of this paper is to analyze and evaluate the role of management and policy issues in computer security that proposes Rand Report R-609 within organization.

Threat hunting: assuming the worst to strengthen resilience

There's a popular truism in the information security world that has become a cliché – that it's not a matter of if your organisation will be breached but when. As trite as this axiom sounds – and it is trotted out now with regularity – there's no getting away from the underlying reality, which is that it's true. And as Peter Cohen, strategic director for Countercept at MWR InfoSecurity, explains in this interview, there are good reasons for assuming that the ‘when’ is now and that the breach has already happened.1

The imitation game: how business email compromise scams are robbing organisations

Business email compromise (BEC) is rapidly increasing, defrauding organisations out of millions of dollars worth of funds every year and requiring little in the way of technical expertise. Also known as CEO fraud, the technical component of such attacks is often no more than a tool with which we're all familiar – email. In this interview with Oliver Fay, lead analyst at Context Information Security and his colleague Gareth Grindal, head of analysis, we examine why BEC is so prevalent, why it works and what organisations can do to protect themselves. While the information security world focuses much of its attention on technical vulnerabilities and exploits, with much of the discussion being around topics such as malware and hacking, there's one kind of attack that is rapidly increasing, defrauds organisations out of millions of dollars worth of funds every year and requires little in the way of technical expertise. In fact, the technical component of such attacks is often no more than a tool with which we're all familiar – email. In this interview with Oliver Fay, lead analyst at Context Information Security and his colleague Gareth Grindal, head of analysis, we look at the menace of business email compromise (BEC).

Information doesn’t always want to be free

Purpose Information professionals are increasing called upon to provide access and services for information that, by its nature, must be restricted to certain uses or classes of individuals. This paper aims to explore the six major compliance regulations in the USA that information professionals should have a basic understanding of to manage a restricted information environment effectively. Design/methodology/approach This paper is a general review of laws and requirements in the USA related to information security that may affect information professionals in their work. Findings The world of information security is complex and there are multiple laws, guidelines and standards that apply. For information professionals managing or deploying digital repositories or information archives, all of these need to be considered because plans and systems are being developed. Information professionals will increasingly be called upon to lend their expertise to emerging preservation problems related to restricted data, so understanding the basics of information security law is a requirement to successful information practice. Originality/value This is the first general overview of this area of information practice.

Should the dark net be taken out?

Although the dark net is not necessarily something that many people outside the tight world of information security are hugely familiar with, its profile has been rising steadily over recent months. For example, it hit headlines around the world towards the end of last year, following the high-profile Operation Onymous, which was conducted by a mixture of US and EU international law enforcement agencies.1 Cybercrime in general appears to be on the rise, but despite the apparent success of the Operation Onymous sting at the end of 2014, law enforcement agencies still face problems when going after hidden websites on the dark net. There are no international cyber-security laws, even though cybercrime tends to be global in nature. And the dark net is employed for both good and bad by criminals, journalists and political dissidents alike. So the big question in both ethical and privacy terms is would it really make sense to try and shut it down? Cath Everett finds out.

The privacy dilemma

We often encounter the law of unintended consequences in the information security world. For example, tools intended to allow security professionals to test, stress or explore networks and servers in order to improve security are also frequently exploited by malicious hackers intent on theft or damage. And we're seeing the same thing happening now in the realm of privacy, where conflict has arisen between those who wish to use technologies such as encryption to keep their communications private, for whatever reason, and others who believe they must be able to intercept and collect these same messages and conversations.In the wake of recent terrorist attacks, the debate about whether individuals and organisations have the right to protect their communications with encryption has heated up.Law enforcement and intelligence agencies insist they cannot protect us without the ability to intercept any and all communications. But human rights advocates believe that privacy is a fundamental right. Steve Mansfield-Devine explores the issue and asks if we have enough information for a reasoned debate.

Ian Glover, CREST – a professional approach to information assurance

The information security world is awash with certifications and accreditations, created, sold and managed by a confusing array of bodies. Some of these bodies, such as CREST, ISACA, and (ISC)2, have solid reputations and offer highly respected qualifications. But there are also qualifications that require little more than a bit of self-study. In between are courses and certifications that have varying degrees of validity in various domains. How do we make sense of all this? Ian Glover, president of the Council for Registered Ethical Security Testers (CREST), talked to Computer Fraud & Security about a need for real professionalism in the infosecurity world.1

Interview: Mick Ebsworth – a matter of trust

In the information security world, our attention is often given over to the technicalities and technologies of threats and defences. Organisations invest small fortunes in equipment, software and specialist skills. Yet there is a critical element to security that is often overlooked – trust. And it's not just the trust that's inherent in many of our solutions, such as signing keys or whitelists – it's the trust that ordinary people place in systems and services. Organisations invest small fortunes in equipment, software and specialist skills. Yet there is a critical element to security that is often overlooked – trust. A recent survey suggested that, while people continue to shop and bank online, they are cynical about the ability of the firms with which they're doing business to protect their personal data. We spoke with Mick Ebsworth, information security consulting director at Integralis about this paradox.

A Hybrid DNA Algorithm for DES using Central Dogma of Molecular Biology (CDMB)

DNA cryptography is an emerging field of DNA computing research in information security world. Still this field is in theoretical stage and not in active practice. To overcome this lacuna the present study proposed a fast and secured hybrid algorithm using DES (Data Encryption Standard) with biological concept CDMB (Central Dogma of Molecular biology) developed and implemented in high level programming language. This edifice has enabled to do computations digitally and gave the high level of security, effectiveness and applicability.

Automated Control System Security

Automated control systems (ACSs) lie at the heart of industrial and infrastructure systems and, as such, are one of the most critical parts of critical infrastructures. Yet the information security world has largely ignored these systems, and most information security folks seem to think that the protective processes, measures, and mechanisms that apply to general-purpose enterprise computers also apply to ACSs. At the same time, most control systems engineers know almost nothing about information protection and don't recognize even the potential for the sorts of things that information security professionals consider standard. This mismatch must be addressed, or we'll be paying the price for it for at least one generation.

New attacks on the block

While the information security world has had its attention well and truly fixed on data loss prevention since the HMRC breach in late 2007, it has failed to acknowledge the rising issue of data integrity attacks. Sarb Sembhi investigates the threat that he predicts will soon take the industry by storm

New Hurdles for Vulnerability Disclosure

In the information security world, vulnerabilities and exploit tools and techniques are effectively open source - they're just accessible to malicious attackers as they are to security vendors, administrators, and the public at large. In this article vulnerability disclosure is the phenomenon of openness and transparency among security researchers, security vendors, product vendors, and other stakeholders. It carries costs to stakeholders by disrupting release schedules or otherwise straining their development resources. It can also negatively affect a vendor's security reputation and brand, which ultimately becomes a major PR and sales issue.

Letter from the EICAR Chairman

The EICAR Annual Conference is an event that has had its place in the Information Security world for quite a long time with an ambitious program and a long standing reputation for quality and top class presentations on the edge of research and technology. The preparations for the 2007 program have reached the final stage with the support of a great number of volunteers, all well recognised experts in the world of IT security and dedicated to the success of this year’s conference. Unfortunately, due to internal administrative issues affecting EICAR’s financial liquidity, EICAR was forced to cancel the 2007 conference to avoid further financial commitments that would be necessary for successful conference.

Be Happy? Share Information??

The world of Information Security is rife with rumour and misinformation. Why? Well, those in the know, more or less, are reluctant to share information with other individuals or organizations.

Introduction

This issue of the Information Security Technical Report provides a Technical Cryptography Update , and covers current hot topics dealing with a technology that is having more and more impact in the world of information security. Chez Ciechanwicz, assisted by other members of Information Security Group at Rpyal Hollowayy (University of London), has provided a great deal of support in producing this issue.