International Information Security Research Articles

Information security: international legal aspects of its provision

The relevance of the topic under consideration is due to the globalization of the information space, which arises in connection with the intensive development of information technologies, which implies the need to develop new approaches to ensuring information security. Based on the principles of sovereign equality and international cooperation, States interact with each other in the common interest (including in the legal field), develop basic principles and norms on which the legal foundation for the legal provision of international information security is based. The author states that the importance of implementing coordinated measures by participants in international legal interaction in this area is due to the fact that if information security is an integral part of national security, then international information security is an immanent element of international security, without which it is impossible to build a system of secure interstate cooperation in modern realities. The author applied the method of theoretical analysis in the process of research, the conclusions are based on a formally logical method. The main conclusion of the author of the study is the following position: the goals of maintaining the state of security of the global information space may be unattainable without proper cooperation (in particular, organizational and legal in nature) in solving problems related to ensuring international information security at several levels of interaction: bilateral, regional, global. The high level of interdependence of countries and the need to ensure the principle of indivisibility of security form the global need to find compromises and common approaches in ensuring international information security. The definition of a single conceptual framework that does not allow ambiguity, contradictions and terminological uncertainty, as well as the basic principles that are the legal foundation of the legal regulation of international information security, should be implemented by developing a single international treaty. This conclusion is due to the ineffectiveness of the norms of "soft law" and international morality based on the principles of voluntary fulfillment of obligations implemented in the process of interstate interaction.

Information security in the Union State: the universal legal dimension

The subject of the study forms a set of legal norms of normative legal acts of the Russian Federation, the Republic of Belarus and the interstate association of the Union State of the Russian Federation and the Republic of Belarus, international treaties(agreements) regulating public relations in the field of information security, law enforcement practice, foreign experience of legal regulation, as well as provisions theoretical interdisciplinary research in this field. The object of the study is public relations related to the legal provision of information security in the Union State. The Russian Federation and the Republic of Belarus in the context of new challenges and threats, as well as digital transformation and geopolitical changes. The analysis indicates a certain experience of scientific research in this field. At the same time, in the context of significant changes in socio-economic and foreign policy conditions, new challenges and threats, multi-vector scientific research in the information and legal sphere is necessary. The methodological basis of this study is a system of modern general scientific and private law methods. The study of the formation, development, place and role of the legal provision of information security of the Union State of the Russian Federation and the Republic of Belarus was conducted using the following general scientific methods: analysis and synthesis, abstraction and modeling, generalization, description, etc. The main conclusions of this study were the following proposals, it is necessary to develop and approve the conceptual framework for the legal provision of information security for the development of regional interstate cooperation within the framework of the Union State of the Republic of Belarus and the Russian Federation. This is important for solving the tasks of ensuring national and international information security, implementing agreements within the framework of regional interstate associations and further forming a system of universal public law mechanisms for ensuring information security. At the same time, the strategic legal acts of the Union State in the field of information security are dynamic in nature due to changes in social and political relations, including at the international level. There is a growing tendency to perceive the information space not only as an area requiring the use of exclusively protective measures of influence, but also involving active offensive measures to the extent necessary to protect national interests.

Multi-language IoT information security standard item matching based on deep learning

In the realm of IoT information security and other domains, various information security standards exist, such as the IEC 62443 series standards published by the International Electrotechnical Commission and ISO/IEC 27001 by the International Organization for Standardization. Business organizations are striving to improve and protect their operations through the implementation and study of these information security standards. However, comparing or pinpointing applicable control measures is becoming increasingly labor-intensive and prone to errors or deviations, especially given the plethora of information standards available. Identifying specific control measures scattered across different information security standards is gradually becoming an important issue. In this research, we utilise a range of domestic and international information security standards as the foundation, employing text mining and deep learning methods to map the similar parts of control measures between standards, thereby enhancing the efficiency of comparison tasks and allowing human resources to be allocated to more pertinent issues.

Designing An Information Security Framework For The Indonesia Water Industry Sector

The majority of Indonesia's water industry sectors have implemented smart water management systems as part of their business development, which has an indirect impact on enterprise information security. However, in general, water sector enterprises continue to place a low priority on information security, and the development of information system frameworks is based on generic norms employed by financial firms. There has been no research on information security frameworks especially built for water firms in Indonesia that use information security standards in the utilities sector. This article proposes a solution in the form of a new framework for Indonesian water firms that combines international information security requirements in the utilities sector with Indonesian government rules. This approach of development combines worldwide standards with national rules. The Cybersecurity Capability Maturity Model (C2M2) and ISO 27019 are two international standards commonly used by utility businesses globally. Government Regulation or Peraturan Pemerintah (PP) Number 71 of 2019 on the Implementation of Electronic Systems and Transactions is the relevant national regulation. The framework addresses information technology, telecommunications, and operational technology, with four approach categories: governance and ecosystem, protection, defense, and resilience. According to the research findings, the newly integrated framework can be applied and is worthy of recommendation. This framework also meets the standards for information security and can be used by Indonesian water corporations.

International cooperation on information security: experience and prospects for development

The development of information and communication technologies plays a crucial role for the economic and socio-political development of each country individually and of humanity as a whole. The paper cancels the experience of interstate cooperation, provides the main directions of development in the field under study. Effective cooperation between States based on mutual respect in the field of information security and the development of digital technologies on various international and regional platforms within the framework of various unions and associations is aimed at ensuring national and international interests in order to protect information technologies, as well as ensuring the inadmissibility of vulnerability of information systems and deterrence of information threats. This article concludes that it is necessary to develop and approve the conceptual framework for the legal provision of information security for the development of regional interstate cooperation within the framework of the Union State of the Republic of Belarus and the Russian Federation, the EAEU, CSTO, CIS, SCO and BRICS. This is important for solving the tasks of ensuring national and international information security, implementing agreements within the framework of these regional interstate associations and further forming a system of universal public-legal mechanisms for ensuring information security. We believe that interstate cooperation determines the vector of development of interaction between states in the field of international information security, which is aimed at strengthening the potential of the States participating in the interstate association with effective prevention and neutralization of threats to collective security arising in this area.

Current problems of international information security

The problems and areas of ensuring effective international information security are considered, which are based on the analysis of the current state of global cybercrime, the existing main directions of global cyberattacks and the development of possible methods and means of countering them, with the use of current research and reporting materials of specialized international companies specializing in the problems of international information security security and the development of appropriate comprehensive tools for its provision. The subject of research in the article is the issue of ensuring international information security, cyber protection and combating cybercrime. The goal is to analyze the current state and current problems of international information security to ensure its effective management at the state and corporate levels in various countries and regions of the world. Tasks: processing and analysis of the latest reports and conclusions concerning the current state of international information security in various countries and regions of the world; research of the main information threats, their types, current directions and sources; analysis of existing and promising directions and means of countering information threats to ensure effective international information security. The general scientific method of system analysis is used - to identify existing information and cyber threats and analyze their features, as well as to research existing and promising ways of combating them. The following results were obtained: based on the results of processing reports and the conclusions of the Microsoft Digital Defense Report concerning the current state of international information security in various countries and regions of the world, the main information threats, their types, current directions, goals and sources were investigated. Current issues of international cybercrime based on the use of ransomware, as well as the main target areas of relevant cyberattacks, have been determined. Existing and promising directions and means of countering information threats to ensure effective international information security are analyzed. The main trends in increasing the level of cyber protection and information security in the world have been determined. Conclusions: It is shown that as the number, sophistication and impact of online threats increase, to counter them, international organizations, companies and individuals must take measures to strengthen the so-called first line of defense, in particular, use strong multi-factor authentication. It was determined that at the moment there are three main trends in increasing the level of cyber protection and information security in the world: the implementation of unprecedented steps by the leading countries of the world to solve the problem of cyber security using already existing laws and powers; the adoption and introduction by governments around the world of new laws that require organizations to report on the detection of cyber attacks; voluntary notification by governments and international companies to the public when they become victims of attacks. The trend is also a further increase in the number and scope of cyber-attacks for any political purpose, be it espionage, subversion or destruction. At the same time, it is expected that more countries will join the list of those participating in offensive cyber operations, and that these operations will become more daring, persistent and disruptive, with more serious consequences. At the same time, in order to counter this, governments and international companies are making more and more efforts to counter these informational dangers.

Information security as a special state

The article is devoted to the study of the problem of national and international information security. It is part of general international security and, at the corresponding level, a branch of national security. The latest threats led to the fact that regional international organizations, such as the EU and military-political organizations - NATO, began to take care of the mentioned issue.Information sovereignty is the supremacy of the state in the information sphere on its own territory. As well as the opportunity to freely and independently provide objective information about the peculiarities of internal and external policy and events within the state to the outside world.The supremacy of the state in the information sphere means the regulation of information activities aimed at ensuring the security and protection of the economic and social interests of the state, society, rights and legitimate interests, human life and health. This is done through the legislative establishment and control of licensing or other conditions of such activity. The implementation of conditions for information activity must ensure compliance with the principles of freedom of expression of views and beliefs, freedom of distribution, exchange and receipt of information, right to information, openness and availability of information, reliability and completeness of information, protection of a person from interference in his personal and family life.Ensuring information security in the state directly affects the economic, military and political spheres of its life. Legal uncertainty at the global level and the lack of unified positions forces state governments to form digital security policies at the national level.The informational component is a part of modern hybrid wars – both as a cover and as a means of direct influence on the enemy.Information security should be understood as a state in which, with the help of national and international resources, protection against informational influence on the consciousness of individuals and society is ensured, and informational influence on decision-making by state institutions is prevented. As well as the inviolability of private and state digital databases, the possibility of their quick recovery in the event of illegal encroachment and ensuring the punishment of perpetrators is guaranteed.At the international level, the state of information security involves protection against informational influence on public consciousness and decision-making by states and international organizations. As well as the inviolability of private, state and international digital databases, the possibility of their quick recovery in case of illegal encroachment and ensuring the punishment of the subjects of illegal encroachments.

The International Legal Regime of Control over Cyber Weapons in the Future World Order: Threats and Prospects

The article is devoted to the analysis of the growing number of problems in the global environment of information and communication technologies (ICT), which characterize the current crisis military-political situation. Until recently, experts from different countries spoke about many of them purely theoretically, and possible scenarios of using ICT for malicious infl uence on military critical infrastructure were sometimes even denied. Now this problem is not only recognized by the scientific and expert community, but we are already talking about the voiced facts of the practical use of cyber weapons, other information and cyber means in the conditions of the crisis. Thus, the malicious use of ICT can provoke the outbreak of an interstate military confl ict. First of all, because of the disproportionate use of methods of responding to threats and attacks, when the aff ected party can use real weapons in response. In addition, a confl ict may arise by mistake, since there is currently no universal methodology for identifying violators, criteria for classifying cyberattacks as an armed attack have not been worked out, universal principles for investigating incidents have not been formed. The issues of coordination of measures taken in response to information operations recognized as acts of use of force have not yet been resolved. As a result, information wars and the use of new technologies can become the detonator of an interstate military confl ict with the use of even nuclear weapons. Therefore, the question of the need for active actions of the "great powers" to prevent confl icts in the global information space, which in the conditions of military operations can develop into a global confl ict, is as relevant as possible. The article provides a factual analysis of ICT threats during the special military operation of Russia, explores the possibilities of creating an international regime for the prohibition of information (including cybernetic) weapons, the relevance and increasing importance of studying these processes by the scientific community. The article substantiates the formulation of the problem of international information security as part of a broader topic of international security against the background of global challenges.

The specificity of the so-called digital sovereignity in Russia on the example of the Russian segment of the Internet the RuNet.

Due to the activity of the Russian Federation in the digital information space, it seems necessary to examine the role (identity) of Russia in the sphere of international information security and the process of shaping Russian national interests in this field. One of the steps leading to the achievement of the above research objective is an attempt to analyse the specificity of the Russian segment of the Internet the RuNet, which functions according to internal regulations and is becoming more and more independent of the global network. The main hypothesis of the article is the assumption that the nature of the Russian segment of the Internet the RuNet, deeply embedded in the Russian culture, is an excellent space for implementing the so-called digital sovereignty, which is on a par with digital authoritarianism in Russia. During the considerations, reference was made to Russia's geopolitical and cultural issues concerning the conceptualisation of Russian national interests in the changed international information space. The article briefly presents the Russian legislation related to the process of implementing the so-called digital sovereignty.

Experience of international cooperation in the field of information security: problems and prospects

The article discusses the international experience of legal provision of information security. The relevance of the study is due to the fact that the totality of problems of legal provision of information security are of priority importance for the legal doctrine and legislation of each state having its own national interests and interested in maintaining peace, international and national information security. An overview of the existing international agreements that contribute to the development of legal regulation of international cooperation in the field of information security is given. Particular attention is paid to the processes of formation of international experience in the field of information security within the framework of the functioning of international organizations regulating these issues. The novelty of the research lies in the fact that, given the lack of a coherent system of international information security, the inconsistency of the models currently formed, it is advisable to develop international legal cooperation based on the convergence of the Eurasian and Euro-Atlantic systems of international information security with the active participation of Russia, taking into account the generally recognized principles and norms of international law, while a significant place should be given to issues of personal security in the information sphere, including countering undesirable information and psychological effects. The conclusion is made about increasing cooperation, strengthening allied and partnership relations with foreign countries, while a tendency should be formed to conclude agreements on mutual protection of classified information in the field of information security with a more detailed description of the list of such information, as well as a mechanism for resolving disputes related to violations of the provisions of these agreements.

Malicious Disinformation Campaigns as a Destabilizing Factor in Maintaining International Information Security

Malicious Disinformation Campaigns as a Destabilizing Factor in Maintaining International Information Security

Malicious Disinformation Campaigns as a Destabilizing Factor in Maintaining International Information Security

Malicious Disinformation Campaigns as a Destabilizing Factor in Maintaining International Information Security

Effectiveness of banking card security in the Ethiopian financial sector: PCI-DSS security standard as a lens

PurposeThis study is aimed at assessing the information security management practice with a focus on banking card security in selected financial institutions in Ethiopia, using an international information security standard as a benchmark. It is to identify the gaps and recommend best security practices to help financial institutions meet the required security compliance.Design/methodology/approachTwo financial sectors were purposively selected. A total of twenty-five respondents (IT executives and IT staff) were included in the study. Quantitative data was collected using the PCI-DSS (Payment Card Industry Data Security Standard) security standard questionnaire. In addition, observation and document analysis were made.FindingsThe result shows that most of the essential security management activities in the financial sectors do not comply with the international security standard. Similarly, the level of most of the indispensable security requirements that should be in place is found to be below the acceptable level. The study also revealed major security factors that prohibit the financial sectors from PCI-DSS security standard compliance.Originality/valueThis study assessed the information security management practice with a focus on banking card security and tried to figure out the limitations of security practices of the organizations surveyed based on the standard adopted. The topic has not been well explored especially in the Ethiopia context. Hence, the result can positively influence security policies, particularly in the banking sector.

МІЖНАРОДНО-ПРАВОВЕ РЕГУЛЮВАННЯ ЗАБЕЗПЕЧЕННЯ ІНФОРМАЦІЙНОЇ БЕЗПЕКИ В РАМКАХ ООН

As a result of the active implementation of digital technologies in all spheres of social life, both international and national legal mechanisms aiming at ensuring the support for the security of the information space stand out in the foreground. The existing legal mechanisms provide for the improvement and harmonization of the legal framework in the field of information security at the national and international levels. In this context, the idea of digital sovereignty determines the use of legal mechanisms that ensure the protection of information security. Due to this faction, a comprehensive study of the general patterns of functioning and development of international legal mechanisms for ensuring information security within the framework of the UN is particularly appropriate, relevant and requires a detailed analysis. The article addresses the analysis and study of UN legal mechanisms in the field of ensuring information security. The purpose of the scientific work is a comprehensive study of the general patterns of functioning and development of international legal mechanisms for ensuring information security within the framework of the UN and the development of scientifically based proposals and recommendations regarding the effective operation of these mechanisms in international and national legal orders (legal systems). The methodological basis of scientific research is general scientific and special legal methods. In particular, a systematic approach, a generalization method, and a systematic analysis were used in the process of scientific research. In the course of the study, there were analyzed: the peculiarities of the functioning of the institutional and legal mechanism of information protection within the framework of UN coordination in the context of the multi-vector system of international security and legal regulation of international cooperation. The article substantiates the expediency of developing an integrated, coordinated information policy of international organizations and institutions with the aim of unifying approaches to ensuring information security. Also, the work summarizes the main problems arising in the international legal regulation of the fight in the field of ensuring information security, and the main threats to international peace and security in the information space, and suggests as well ways to solve them. In this context, the work summarizes the principles of international information security, highlights the main trends in the development of cyber threats in the modern information space and measures necessary for their neutralization. The article analyzes the peculiarities of the functioning of the institutional and legal mechanism of cyber protection in the context of the legislative regulation of international cooperation between international organizations and institutions. In particular, an analysis of the main mechanisms of legal support for cyber protection of the information space was carried out with the aim of their integration into a unified international system of the legal information field. As a result of the study, recommendations were formed. In the field of ensuring information security at the national and international levels, it is necessary to continue and expand activities to create conditions for the formation of an international information security system based on generally recognized principles and norms of international law. In particular, at the UN level, it is necessary to prepare and adopt international legal acts regulating the application of the principles and norms of international law in the field of the use of information and communication technologies. Since there is no single global act that regulates the procedure for combating information threats, in this context, the task of developing the UN Convention on International Information Security is very important. The document should: identify the main threats to international peace and security in the information space; determine the main principles of ensuring international information security; prescribe in detail the principles of international cooperation in the fight against crimes in the information sphere; determine effective and efficient mechanisms of legal responsibility in the information space up to the creation of a special international body for the investigation of crimes in the information sphere.

How will the conflict in Ukraine affect the system of international information security?

The article is devoted to the consideration of the main changes taking place in the system of ensuring international information security after the start of a special military operation in Ukraine. An attempt is made to predict the challenges and risks that the IIS system will face in the future. The priority transformations are connected with the negotiation process within the UN, which, in the context of increasing political antagonism between the key subjects of the dialogue, is becoming increasingly politicized and is beginning to experience some difficulties. It is assumed that in the conditions of the new political reality, the issue of “comprehensive” counteraction to international cybercrime will remain unresolved. There is some fragmentation of the international information security system itself, which is experiencing centrifugal tendencies in terms of promoting alternative approaches to solving key issues in this sphere. Finally, it can be expected that the United States, in interaction with Russia, will more actively engage in a proactive strategy of so-called defend forward, which should be implemented through the concept of persistent engagement. The preliminary conclusions demonstrated by the actions in Ukraine regarding the role and place of cyber attacks directly within the framework of the armed conflict are also considered. It is assumed that in the near future cyber attacks will not be considered as a means of achieving real strategic effects on the battlefield, where conventional weapons play a dominant role. An attempt is made to give some recommendations on maintaining a certain dynamic of the development of the IIS system.

International information security: universal legal dimension

The article is devoted to the development of the system of legal support of international information security. A scientific understanding of the concept of international information security and the main threats in this area has been carried out. The strategic objectives and main directions of the state policy of the Russian Federation in the field of international information security are analyzed. The current state of the system of legal support of international information security and the main problems in this area are investigated. A systematic analysis of various approaches of states regarding the applicability of the norms and principles of current International Law to the ICT environment, the development and adoption of new rules, principles and norms related to security in the ICT environment. Of particular interest from the standpoint of International and national Law is the problem of voluntary and non-binding norms of responsible behavior of states in the ICT environment. The research conducted by the authors made it possible to scientifically substantiate conclusions from interdisciplinary positions regarding the priority vectors of the development of the system of legal support for international information security at the universal, regional and bilateral levels in the conditions of geopolitical confrontation of the leading world powers.

Transformations in economic relations impacted by tokenized assets implementing

The paper examines the economic nature of tokenized assets, defines their essence and types, as well as the features of their use. The analysis focuses on their impact on the contemporary system of financial and economic relations. The research explores the issues and prospects of implementing and utilizing tokenized assets in the current stage of global economic development. Tokenized assets have gained strength in today's development stage as a new significant element in international payments and information security. The importance of tokenized assets lies in improving liquidity, reducing transaction costs, enhancing security, and making investment more accessible. Tokenization creates more accessible and liquid opportunities for investing and circulating various assets, facilitating their processing and contributing to the globalization of financial markets. Key directions for the use of tokenized assets in the contemporary economic system are identified. The opinions of various economists regarding the theoretical basis of asset tokenization are disclosed. The author's perspective is provided concerning practical implementation issues of tokenized assets in real and financial sectors. The main perspectives in the field of implementing and utilizing tokenized assets are determined in accordance with the current characteristics of asset market development. It is concluded that the widespread use of tokenized assets can be expected in approximately 3-4 years. Progress in this direction has been significantly positive, as governments, major institutions, and corporations have shifted from studying the benefits of tokenization to conducting experiments and providing practical evidence. Furthermore, tokenized assets may play a key role in modernizing market infrastructure and addressing wealth inequality.

Norms and normalization in cyberspace: post-conventionality or lawlessness? (“Melian Dialogue” on Cyber Law)

Since the end of the 20th century, the Russian Federation has proclaimed the creation of an international information security system based on a global agreements under the auspices of the UN as one of the general directions of its policy in the field of international security. In turn, the United States put forward its own initiative to develop and adopt norms and rules for the conduct of states in the cyber sphere. The article notes that official Washington, with the support of a number of Western countries, managed to standardize its system of rules without international legitimation, using the peculiarities of the political situation and the willingness of Russia and the SCO countries to compromise, as well as replacing the global problem of information security for the post-industrial society with a question based on national interest. cybersecurity. The article concludes that, despite the fact that the issues of norms and normalization have been worked out quite deeply within world science, the argument put forward by the American expert community ignores generally accepted scientific results and promotes the ideas of post-democracy, interpreted in a specific way.

A methodology for mapping cybersecurity standards into governance guidelines for SME in Portugal

The digitalization of companies and the implantation of Industry 4.0 concepts are emerging and challenging for micro and Small and Medium Enterprises (SME). The benefits are evident for the companies, as their business processes become simplified, and the internationalization and global market penetration turn out to be improved.However, information security and cybersecurity concerns have been raised on SME, as best practices and regulations compliance should be applied. The wide set of these regulations and their broad scope has put constraints on their overall direct mapping and adoption into SME.This paper describes an original methodology to map the Roadmap for Minimum Cybersecurity Capabilities (RMCSC) delivered by the Portuguese Cybersecurity Centre, into the well-adopted international information security ISO 27001:2013 standard. The proposed mapping is oriented toward the characteristics of SME and allows these companies to assess their cybersecurity risk to further mitigate potential identified flaws.The main deliverable of this paper is the developed methodology, which correlates the actions of the cybersecurity capabilities roadmap and the security controls enclosed in the ISO 27001:2013 standard. A questionnaire was developed to support the cybersecurity risk self-diagnosis, and the actions were justified and detailed in this paper. Further developments include the submission of the questionnaire to a case study of SME in the centre region of Portugal.

Legal regulation of international information security

Legal regulation of international information security