Information Systems Security Research Articles

Modifications of the Formal Risk Analysis and Assessment for the Information System Security

Modifications of the Formal Risk Analysis and Assessment for the Information System Security

GOVERNANCE EVALUATION ELECTRONIC SECURITY SYSTEM (ESS) (Case Study: ABC Central Bank)

As we know, the role of the security system has a very important role for a state institution to provide security and comfort in carrying out its functions, such as the ABC central bank. A good security system is a security system that is supported by a reliable electronic security system and is composed of several components such as a CCTV monitoring system, Access Control System (ACS), Security Alarm System (SAS), and Fire Alarm System (FAS). This system is very necessary to provide support for the duties of these state institutions to protect devices, data and electronic infrastructure from potential threats and security risks. The main functions of electronic security systems include prevention, detection, response to incidents, and recovery after disturbances/disasters. For this reason, efforts are needed to provide an evaluation of the system maturity level and information security management as a form of risk management to maintain the continuity of system use. This research uses the INDEKS KAMI 4.1 to map ESS governance maturity and the OCTAVE Allegro method to analyze information security management. From the analysis carried out, it has been concluded that the ESS implementation has been operated well in accordance with the security system requirements and has reached a good level of governance maturity. Information security management analysis carried out using the OCTAVE Allegro method has succeeded in identifying information security management with the result that information security management has been implemented well. This is proven by the existence of indicators, namely CCTV recording data, log systems as information assets that have been managed and distributed according to authority

RatHole: Authentication Algorithm for Controling Access to Mobile Phone File Management System

Millions of Naira are being laundered by criminals through internet fraud, which deceives the victim with a false presentation, or hacking, which involves breaking information system security to steal financial information or data. Cybercrime, more specifically internet fraud, has become a common problem facing the world. In any case, this only occurred if the attacker was able to obtain the victim's account privileges (bank account, credit card information, or login credentials). This work presented an authentication technique that can be inexpensively implemented and used to create a secure architecture that is hard to breach. It can also reduce the amount of overhead that is placed on the authentication server during an attempt at authentication. The possibility of breaking the authentication technique was calculated using probability theory, and the mobile-based authentication algorithm was implemented using Android Studio. The result of this research shows the implementations of RatHole algorithm using android operating system which is file management android app that is being protected with RatHole algorithm and the probability of breaking down the algorithm for 1 to 10 authentication method keeps reducing by averagely 0.12. The implemented Rat-Hole on android devices also consumed 20 to 30 megabytes of data very less than memory consumption of recent research based on block chain solution which consumed 1 gigabyte to 50 gigabyte of memory.

METHODOLOGY FOR REDUCING THE RISKS OF CYBERSECURITY BREACHES AND PROTECTING INFORMATION FROM CYBER ATTACKS

The scientific article examines the problems associated with the risks of cybersecurity violations and information protection from cyber attacks. Given the dramatically increased amounts of information transmitted over networks, the number of cyber attacks is simultaneously increasing, with the aim of stealing various kinds of secret and confidential information. At the same time, the role of specialists involved in the development and implementation of information system security technologies has increased.
 The article analyzes vulnerabilities in corporate systems and suggests methods for improving encryption protocols for users' personal data. Special attention is paid to the technologies for implementing protection mechanisms at the software development stage.

Analysis of Fundamental Algebraic Concepts and Information Security System

Cryptography plays a crucial role in protecting the data from unauthorized access. Nowadays, various cryptographic algorithms are used. It is not meant for information technology to secure the proposed work's primary target to achieve these tasks and goals. Using a literature review, we study security information systems using S-Boxes. In the research, we discuss two different techniques to generate the new S-boxes and then discuss their other properties to improve the strength of encryption. This chapter is further divided into sections that comprehensively explain the various concepts.

Overview of Security Information and Event Management Systems

Overview of Security Information and Event Management Systems

DEF: Deep Ensemble Neural Network Classifier for Android Malware Detection

Malware is one of the threats to security of computer networks and information systems. Since malware instances are available sufficiently, there is increased interest among researchers on usage of Artificial Intelligence (AI). Of late AI-enabled methods such as machine learning (ML) and deep learning paved way for solving many real-world problems. As it is a learning-based approach, accumulated training samples help in improving thequality of training and thus leveraging malware detection accuracy. Existing deep learning methods are focusing on learning-based malware detection systems. However, there is need for improving the state of the art through ensemble approach. Towards this end, in this paper we proposed a framework known as Deep Ensemble Framework (DEF) for automatic malware detection. The framework obtains features from training samples. From given malware instance a grayscale image is generated. There is another process to extract the opcode sequences. Convolutional Neural Network (CNN) and Long Short Term Memory (LSTM) techniques are used to obtain grayscale image and opcode sequence respectively. Afterwards, a stacking ensemble is employed in order to achieve efficient malware detection and classification. Malware samples collected from the Internet sources and Microsoft are used for the empirical study. An algorithm known as Ensemble Learning for Automatic Malware Detection (EL-AML) is proposed to realize our framework. Another algorithm named Pre-Process is proposed to assist the ELAML algorithm for obtaining intermediate features required by CNN and LSTM. Empirical study reveals that our framework outperforms many existing methods in terms of speed-up and accuracy.

SECURITY AND PROTECTION OF EDUCATIONAL LMC SYSTEMS

Information technologies play a significant role in the educational process and ensuring quality learning outcomes in the context of distance education. A modern trend is the development of interactive systems, which include elements of audio and video materials, graphics, presentations, internet links, materials from various sources, and in different formats. The addition of interactive content to educational systems increases the risks of information security in modern LMC systems. Emphasis is placed on the need to ensure the protection of software in systems, educational content hosted within them, learning outcomes, and participants' personal data. When building protection, attention should be paid to potential threats such as unauthorized access, flawed software, poor plugin updates, material copying, fraud, and cyber-attacks. Vulnerabilities of the most widespread modern LMC systems are analyzed. Attention is given to the possibilities of using cloud technologies to host system modules, educational materials, or learning outcomes on cloud services. Cloud application guarantees constant access to the learning system, reliable storage of materials, additional protection of confidential and personal information. Therefore, to ensure effective and safe learning considering modern interactive approaches to presenting educational materials, it is important to develop systems and implement technologies that provide constant access to educational content, reliable data protection (including personal data), information integrity, and compliance with confidentiality principles.

Cybersecurity on a budget: Evaluating security and performance of open-source SIEM solutions for SMEs.

The proliferation of cyber threats necessitates robust security measures to safeguard critical assets and data in today's evolving digital landscape. Small and Medium Enterprises (SMEs), which are the backbone of the global economy are particularly vulnerable to these threats due to inadequate protection for critical and sensitive information, budgetary constraints, and lack of cybersecurity expertise and personnel. Security Information and Event Management (SIEM) systems have emerged as pivotal tools for monitoring, detecting, and responding to security incidents. While proprietary SIEM solutions have historically dominated the market, open-source SIEM systems have gained prominence for their accessibility and cost-effectiveness for SMEs. This article presents a comprehensive study focusing on the evaluation of open-source SIEM systems. The research investigates the capabilities of these open-source solutions in addressing modern security challenges and compliance with regulatory requirements. Performance aspects are explored through empirical testing in simulated enterprise-grade SME network environments to assess resource utilization, and real-time data processing capabilities. By providing a rigorous assessment of the security and performance features of open-source SIEM systems, this research offers valuable insights to cybersecurity practitioners, organizations seeking cost-effective security solutions, and the broader academic community. The findings shed light on the strengths and limitations of these systems, aiding decision-makers in selecting the most suitable SIEM solution for their specific requirements while enhancing the cybersecurity posture of SMEs.

Обзор основных компонентов, особенностей и решений безопасности автоматизированных систем управления технологическими процессами

The structure, main components and tasks of typical automated process control systems (ACS) are described. The main distinctive features of automated systems and their impact on the design of an information security system (ISMS) are determined. A brief overview of the problems of information security of automated process control systems is given. The basic principles that must be taken into account when creating.

Analysis of Risk Management Information System Applications Using Iso/Iec 27001:2022

The rapid development of information technology can make it easier for anyone to obtain, process, and disseminate various information systems. Information system security is an important aspect in maintaining information confidentiality. One way to maintain the security of information systems is by conducting risk management. The goal of risk management is to control and lessen the likelihood of risks that could jeopardize information system security. This research aims to carry out a risk management process in one of the government agencies in Indonesia by controlling mitigation that refers to ISO / IEC 27001: 2022. Data collection in this study was carried out by means of observation, interviews, and Forum Group Discussion (FGD). The results of this study were the discovery of 15 risks, 50 risk threats, and 15 impacts caused by the risk. This research resulted in 42% of the risks falling into a moderate impact.

Organizational and Social Factor Analysis: The Role of Human Resources in the Success of Information Security Systems in the Digital Business Context

Organizational and Social Factor Analysis: The Role of Human Resources in the Success of Information Security Systems in the Digital Business Context

Electrically‐Reconfigurable Extremely‐High Density Physical Unclonable Cryptographic Keys Based on Aurivillius Ferroelectrics

AbstractIn the era of information, emerging hardware security primitives, i.e., hardware random number generators and physically unclonable functions, hold profound promise for the establishment of exceptionally secure network information systems. Nonetheless, these potential solutions are constrained by inherent drawbacks, including the need for additional error correction circuits or algorithms, heightened susceptibility to environmental interference, and limited data density. This paper demonstrates the extremely high‐density, physical‐unclonable cryptographic keys by harnessing stochastically ferroelectric domain polarizations in Aurivillius ferroelectric material CaBi2Nb2O9 (CBNO). Ferroelectric polarization of CBNO nanodomains can serve as a robust source of physical unclonable entropy. Through the application of high‐speed voltage pulses, the inherent randomness of ferroelectric polarizations can be enhanced, thereby yielding cryptographic keys characterized by remarkable uniformity, uniqueness, and negligible environmental sensitivity. More importantly, the voltage pulse operations facilitate the configurability of the ferroelectric cryptographic keys with no correlation. An unprecedented data density of 435 Gbit µm−2 is therefore achievable with a miniaturized CBNO of less than 1 um2. Notably, the reconfigured keys successfully pass the National Institute of Standards and Technology random number tests without requiring additional post‐processing steps. Emanating from the inherent attributes of the material, these high‐density ferroelectric keys confer intrinsic advantages to information security, evincing substantial resistance to duplication or cloning.

Model of current threats to security of confiden-tial data in divisional information systems

The paper proposes a model for determining actual threats to the information security of distributed information systems, based on algorithms of fuzzy inference and the theory of fuzzy neural systems, unlike known ones, uses sufficient and necessary indicators, excludes expert errors, increases the detection of the number of actual threats to information security of distributed systems by 5 %, reduces the cost of purchasing information protection equipment from 15 to 30%. It takes into account the following factors: the IT infrastructure of the distributed information system, the capabilities of attackers and their level of motivation in the distributed information system, the list of existing protection tools in the distributed information system.
 The proposed approach differs from existing ones in the following: lack of involvement of highly qualified specialists in the field of information security; the process is automated, has a low computational complexity; absence of deficiencies in expert assessments; allows you to determine the list of current information security threats in information systems of various classes and types.
 The task of ensuring the security of confidential information becomes the most urgent, which is due to the growth of computer attacks and leaks of information, which are reflected in the statistical data on the commission of crimes in the field of high technologies, the growth of criminal activity using modern communication devices and the Internet.
 Existing methods of modeling current threats to information security and assessing the effectiveness of the information protection system cannot be used at all stages of the life cycle of distributed information systems - they do not take into account the following indicators in the complex: IT infrastructure of distributed information systems, current threats to information security, security requirements for confidential information, a list of means of protecting confidential information and their value as important indicators when solving these problems.
 In order to achieve the goals of ensuring the security of confidential information, it is necessary to: organize the effective creation of an information protection system (information security system), effective modeling (identification of the list) of current threats to information security, identification of the current violator, and also provide the opportunity to conduct a qualitative assessment of the effectiveness of the information security (protection) system.
 One of the most important tasks of ensuring the security of confidential information is the assessment of the effectiveness of the protection (security) system. In this regard, the goal of the work (research) is to improve the quality of the evaluation of the effectiveness of the protection (security) systems of distributed information systems by determining sufficient and necessary evaluation indicators using modern (promising) information technologies that allow the most effective solution of the following tasks: determination operating parameters of adaptive production fuzzy neural systems, which are most suitable for solving the tasks, application of Data Science technologies in data processing, fuzzy output algorithms.

The Role of Digital Media on Students’ Management in Higher Vocational College

This study uses a combination of empirical analysis to conduct a comprehensive analysis of the role of digital media and student management in higher vocational colleges. The results show that the current application status of digital media in student management shows extensive and profound impact. With the rapid development of information technology, digital media has become an important tool for student management in higher vocational colleges, covering many aspects such as course management, attendance management, and student information inquiry, greatly improving management efficiency and convenience. By establishing a digital system, the school has achieved comprehensive coverage of student information management and online education. At the same time, digital media also plays an important role in students' social interaction and has become an indispensable part of students' daily lives. However, digital media applications also bring some problems. Information overload and distraction can make it difficult for students to focus, while security risks threaten student privacy. Solving these problems requires schools to take effective measures, such as improving information literacy and security awareness, and establishing a complete information security system. The impact of digital media on student development is complex and diverse. Its advantage lies in providing a broad learning space and diversified learning methods to promote students' communication and socialization. However, negative effects such as information overload and Internet addiction cannot be ignored. In order to better guide students to use digital media, schools and families need to strengthen digital media literacy education, pay attention to students' mental health, and strengthen network security. In student management, the advantages of digital media are mainly reflected in improving efficiency and interactivity, and promoting management innovation and development. However, the popularization of digital media needs to face issues such as technical and device support, security and privacy protection. By strengthening measures such as construction, training, supervision and management, schools can better leverage the advantages of digital media and improve management efficiency and service quality. Going forward, digital media will play an even more important role in student management. Intelligent management, expanding management fields and promoting student self-management will be the direction of future development. However, the security and popularity of digital media remain challenges that need to be addressed. By strengthening comprehensive measures such as construction, training, supervision and management, schools can better guide the future development of digital media in student management, provide students with more intelligent, personalized and efficient services, and promote their all-round development.

A Building Model for Enhancing Information Systems Security

Today, electronic systems and information have become no less important than food and water for human life. No one can deny this fact. Electronic information systems contribute to the development of life in many areas. But some electronic information systems should not be available for anyone to use, such as reading, operating, modifying or destroying without permission. This type of electronic information systems must be protected in some way based on the related situation. . Password-based authentication is the first defense for most information systems. Password security enhances the security of the entire information system. Therefore, password protection models become very important in such cases to help users improve authentication security. Researchers published various methods based on salting, hashing, symmetric encryption, and key splitting methods. The paper conducted by Saleh Al-Asali describes a method for generating a suitable secret key that is easy to memorize and remember, as he succeeded in generating a password that is strong and easy to remember. This paper improves the previous method by adding some improvements mentioned in the section described in the suggested method.

Testing the dominant mediator in EPPM: An empirical study on household anti-malware software users

A key research area in information systems security (ISec) is explaining or improving users’ IS security outcomes via the extended parallel process model (EPPM) lens. While the theoretical construct in emotional valence (e.g., fear) and cognitive valence (e.g., perceived efficacy) were deemed as mediators in previous EPPM-related ISec studies, existing research has ignored the value of testing and reporting the dominant mediator between the emotional valence and the cognitive valence. In this paper, we reintroduce the theoretical origins of the dominant mediator assumption in EPPM and highlight its merits using the multiple mediation method. Theoretically, we illustrate how testing and reporting the dominant mediator can help identify the dominant mechanism triggering specific behavioral outcomes. Further, this paper questions the dominant mediating role of fear on the behavioral outcome in ISec context. Methodologically, this study proposes to assess the dominant mediator via a multiple mediation model instead of using the discriminant value equation introduced by Witte (1995), Witte et al. (1996) and enhanced by Chen et al. (2021) when testing the EPPM theory in the ISec context.

The Role of Blockchain Technology in Securing Supply Chain Information Systems

This research aims to analyze the role of blockchain technology in securing supply chain information systems. The research method used involves literature study and qualitative analysis of blockchain implementation in the context of existing supply chain information systems. The research results show that blockchain technology can play an important role in strengthening the security and integrity of supply chain information systems. By using characteristics such as decentralization, transparency, and reliability, blockchain can help fight security threats such as cyberattacks, counterfeiting, and data manipulation. Through the use of blockchain, information can be secured, verified and safely accessed by stakeholders in the supply chain. Apart from that, blockchain can also increase efficiency and accountability in supply chain information systems. In conclusion, blockchain technology has significant potential in securing supply chain information systems and can contribute to increasing trust between stakeholders.

Web-based Academic Information System Security

Web-based Academic Information System (SIA) has been used by all students of the Faculty of Information Technology KH. A. Wahab Unwaha Jombang University. Because all student academic records are stored through the campus network, it is necessary to conduct research on security so that a secure system is obtained. This research was conducted with steps including analysis and testing of installed systems, analyzing needs, designing problem solutions, making repair modules, installing modules and retesting repair modules. From the results of the research conducted, it can be concluded that there are weaknesses in the login system. The weaknesses include the use of the Student Identification Number (NIM) as the default username and password, username and password data is not encrypted before being sent to the server over the network, traces of usernames and passwords left in the browser as a cache or in the password manager can be seen as unencrypted plaintext. From the security analysis results, the SIA login system can be improved by applying HMAC MD5 encryption technology and Challenge Handshake Authentication Protocol (CHAP). Challenge is generated by the server randomly and used as a key in the HMAC MD5 encryption process. With the use of challenge passwords sent in the form of hash values will always be different in each session. Javascript on the client side is used to perform encryption so that the data before being sent to the server is already in an encrypted state.

Competitiveness as a Result of Creativity and Innovation

The aim of this article is to highlight that critical thinking and creativity generate innovation that is at the core of long-term competitiveness. The creation of culture of critical thinking and creativity should start with the education system – in primary and secondary schools, then it should find its way in science and research activities of institutes and universities, and finally, it should be implemented at all business levels – with the purpose of achieving systemic innovation. It is only in the conditions of a strategic education-science-business synergy, in an environment of promoting critical thinking, creativity and innovation, that long-term competitiveness is possible, which can result in large-scale development of nations, societies and businesses. The achieved level of competitiveness should in its turn be protected against external and internal threats by introducing security measures that include the entire system of physical, technical, information and procedure security, while recognizing and protecting intellectual property and trade secrets. In terms of relevance and methodology, this article reviews existing significant challenges to innovation and competitiveness management; questions are proposed demanding further research in the field of regulations, as regards leading innovation in a global context. Conclusions are drawn about the need of strategic synergy of the priorities of state policies in the fields of science, education and business. It is stated that only coordinated long-term prioritization and planning in economy, science and education, which involves development of focused scientific research in priority sectors (industries) and creation of staff predominantly for these priority sectors of national business development, can ensure long-term competitiveness, sustainability and growth.