International Organization For Standardization/International Electrotechnical Commission Research Articles

Data De-identification Framework

As technology develops, the amount of information being used has increased a lot. Every company learns big data to provide customized services with its customers. Accordingly, collecting and analyzing data of the data subject has become one of the core competencies of the companies. However, when collecting and using it, the authority of the data subject may be violated. The data often identifies its subject by itself, and even if it is not a personal information that infringes on an individual’s authority, the moment it is connected, it becomes important and sensitive personal information that we have never thought of. Therefore, recent privacy regulations such as GDPR (General Data Protection Regulation) are changing to guarantee more rights of the data subjects. To use data effectively without infringing on the rights of the data subject, the concept of de-identification has been created. Researchers and companies can make personal information less identifiable through appropriate de-identification/pseudonymization and use the data for the purpose of statistical research. De-identification/pseudonymization techniques have been studied a lot, but it is difficult for companies and researchers to know how to de-identify/pseudonymize data. It is difficult to clearly understand how and to what extent each organization should take de-identification measures. Currently, each organization does not systematically analyze and conduct the situation but only takes minimal action while looking at the guidelines distributed by each country. We solved this problem from the perspective of risk management. Several steps are required to secure the dataset starting from pre-processing to releasing the dataset. We can analyze the dataset, analyze the risk, evaluate the risk, and treat the risk appropriately. The outcomes of each step can then be used to take appropriate action on the dataset to eliminate or reduce its risk. Then, we can release the dataset under its own purpose. These series of processes were reconstructed to fit the current situation by analyzing various standards such as ISO/IEC (International Organization for Standardization/International Electrotechnical Commission) 20889, NIST IR (National Institute of Standards and Technology Interagency Reports) 8053, NIST SP (National Institute of Standards and Technology Special Publications) 800-188, and ITU-T (International Telecommunications Union-Telecommunication) X.1148. We propose an integrated framework based on situational awareness model and risk management model. We found that this framework can be specialized for multiple domains, and it is useful because it is based on a variety of case and utility-based ROI calculations.

An Open-Source, Standard-Compliant, and Mobile Electronic Data Capture System for Medical Research (OpenEDC): Design and Evaluation Study.

BackgroundMedical research and machine learning for health care depend on high-quality data. Electronic data capture (EDC) systems have been widely adopted for metadata-driven digital data collection. However, many systems use proprietary and incompatible formats that inhibit clinical data exchange and metadata reuse. In addition, the configuration and financial requirements of typical EDC systems frequently prevent small-scale studies from benefiting from their inherent advantages.ObjectiveThe aim of this study is to develop and publish an open-source EDC system that addresses these issues. We aim to plan a system that is applicable to a wide range of research projects.MethodsWe conducted a literature-based requirements analysis to identify the academic and regulatory demands for digital data collection. After designing and implementing OpenEDC, we performed a usability evaluation to obtain feedback from users.ResultsWe identified 20 frequently stated requirements for EDC. According to the International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 25010 norm, we categorized the requirements into functional suitability, availability, compatibility, usability, and security. We developed OpenEDC based on the regulatory-compliant Clinical Data Interchange Standards Consortium Operational Data Model (CDISC ODM) standard. Mobile device support enables the collection of patient-reported outcomes. OpenEDC is publicly available and released under the MIT open-source license.ConclusionsAdopting an established standard without modifications supports metadata reuse and clinical data exchange, but it limits item layouts. OpenEDC is a stand-alone web app that can be used without a setup or configuration. This should foster compatibility between medical research and open science. OpenEDC is targeted at observational and translational research studies by clinicians.

The development of the data science capability maturity model: a survey-based research

PurposeThe purpose of this paper is to investigate social and technical drivers of data science practices and develop a standard model for assisting organizations in their digital transformation by providing data science capability/maturity level assessment, deriving a gap analysis, and creating a comprehensive roadmap for improvement in a standardized way.Design/methodology/approachThis paper systematically reviews and synthesizes the existing literature-related to data science and 183 practitioners' considerations by employing a survey-based research method. By blending the findings of this research with a well-established process capability maturity model standard, International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 330xx, and following a methodological maturity development framework, a theoretically grounded model, entitled as the data science capability maturity model (DSCMM) was developed.FindingsIt was found that organizations seek a capability/maturity model standard to evaluate and improve their current data science capabilities. To close this research gap, the DSCMM is developed. It consists of six capability maturity levels and twenty-seven processes categorized under five process areas: organization, strategy management, data analytics, data governance and technology management.Originality/valueThis paper validates the need for a process capability maturity model for the data science domain and develops the DSCMM by integrating literature findings and practitioners' considerations into a well-accepted process capability maturity model standard to continuously assess and improve the maturity of data science capabilities of organizations.

MPEG-5 Part 1: Essential Video Coding

<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">The Motion Picture Experts Group (MPEG) standardization group has produced a large number of standards for video compression over the last three decades. Traditionally, the MPEG standards have either focused on highest available compression efficiency [e.g., MPEG-2, advanced video coding (AVC), and high-efficiency video coding (HEVC)] or a desire to produce a royalty-free standard [e.g., Internet video coding (IVC) and web video coding (WebVC)]. In January 2019, MPEG embarked on a new standardization project that can be seen as a hybrid of the two: MPEG-5 part 1 and essential video coding (EVC) [International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 23094-1]. The EVC standard was developed with a royalty-free baseline profile at its base and a royalty bearing main profile that provides excellent compression performance. The main profile adds, on top of the baseline profile, 21 different coding tools that each can be individually turned off and, when necessary, replaced by a corresponding baseline profile tool. This structure makes it easy to fall back to a smaller set of tools in the future, if, for example, licensing complications occur around a specific tool, without breaking compatibility with already deployed decoders</i> .

The Challenge: From MPEG Intellectual Property Rights Ontologies to Smart Contracts and Blockchains [Standards in a Nutshell

The Moving Picture Experts Group (MPEG) is an International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) working group that develops media coding standards. These standards include a set of ontologies for the codification of intellectual property rights (IPR) information related to media. The Media Value Chain Ontology (MVCO) facilitates rights tracking for fair, timely, and transparent payment of royalties by capturing user roles and their permissible actions on a particular IP entity. The Audio Value Chain Ontology (AVCO) extends MVCO functionality related to the description of IP entities in the audio domain, e.g., multitrack audio and time segments. The Media Contract Ontology (MCO) facilitates the conversion of narrative contracts to digital ones. Furthermore, the axioms in these ontologies can drive the execution of rights-related workflows in controlled environments, e.g., blockchains, where transparency and interoperability is favored toward fair trade of music and media. Thus, the aim of this article is to create awareness of the MPEG IPR ontologies developed in the last few years and the work currently taking place addressing the challenge identified toward the execution of such ontologies as smart contracts on blockchain environments.

Progress in the Accreditation of Anthropology Laboratories.

While crime laboratories are commonly accredited under programs utilizing international standards, options for forensic anthropologists to do the same were limited, until recently. The American National Standards Institute-American Society for Quality (ANSI-ASQ) National Accreditation Board (ANAB) and the American Association for Laboratory Accreditation (A2LA) both offer accreditation programs for forensic anthropology services using either the International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 17025 or ISO/IEC 17020 standard. The significant efforts made to specifically include forensic anthropology, and also forensic pathology, in these national programs demonstrate the importance for all practitioners in the field of forensic science to develop and maintain quality assurance programs consistent with international standards. Among the requirements for quality assurance is validation of methods, a practice that was previously identified as needing improvement within the forensic anthropology community.

Update of ISO/IEC Technical Reports on the Use of the Ada Programming Language in High Integrity Systems

The Ada programming language has been designed for use in high integrity, safety critical, and secure software systems. Several International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) technical reports have been developed to provide guidance on the appropriate use of Ada to achieve the largest benefit in the verification and security of high integrity systems. While the Ada programming language has been evolving over time, these technical reports were written utilizing the Ada 2005 version of the programming language standard. In this brief paper, we pose that the International Real-Time Ada Workshop membership assume the responsibility for updating the technical reports to be in alignment with the current Ada programming language standard, known as Ada 2012.

Evaluating the Perceived Impact of Collaborative Exchange and Formalization on Information Security

INTRODUCTION Today, in large part, information security is the implementation of controls and best practices suggested by consultants, standard governing bodies (i.e. National Institute of Standards & Technology) (NIST), International Organization for Standardization / International Electrotechnical Commission (ISO/IEC), etc.), the organization's information security department and, sometimes, the organization's employees. While the use of global standards of practice, top management and the information security department within the organization to guide information security planning and implementations may be useful, existing research consistently shows a positive relationship exists between user involvement in planning and the effectiveness of the information systems function within organizations (Gottschalk, 1999; Sambamurthy et al., 1994; Segars & Grover, 1998). A deliverable of the information security planning process is the organization's information security policies and procedures. Standard governing bodies (NIST, ISO/IEC) and researchers (Bidgoli, 2003; Garrison & Posey, 2006) stress the importance of creating information security policies and provide guidance on the different types of information security policies that an organization may need. This research attempts to examine the impact of end-user involvement and formalized information security policies on the effectiveness of the information security function within organizations. Specifically, this study focuses on two antecedent variables, collaborative exchange and formalization, and how it impacts the effective utilization of the information security strategies of deterrence, detection and recovery. Collaborative exchange is an assessment of the extent of collaboration between upper-level management, end users and the information security function. Formalization is an assessment of the extent of established formal information security policies within an organization. The purpose of this research is twofold. First, this research aims to examine the individual effects of formalization and collaborative exchange on the effectiveness of information security detection, deterrence, and recovery activities. Much of the effort expended in the management of information security is in developing and enforcing information security policies. By examining formalization separately, the impact of information security policy development on effective utilization of information security strategies can be assessed. The second aim of this research is to examine the impact of collaborative exchange and formalization in concert on the effectiveness of information security detection, deterrence, and recovery activities. Evaluating complementary effect of collaborative exchange and formalization on effective utilization of information security strategies provides evidence supporting the importance of establishing information security policies with input and effort from all major constituencies within the organization. This study makes several contributions to the literature and practice. First, this research provides insight into how management choices in regards to establishing formal communication channels and developing information security policies may impact the effectiveness of the information security function. Second, the presence of the dependent variable, effectiveness of detection, deterrence and recovery activities, gives academics and practitioners a success measure which can guide more effective decision making in the information security domain. The remainder of this manuscript is organized as follows. The next section discusses the literature supporting the constructs of interest in this study. The following two sections will present the methodological approach taken in this study and the results of data collection. The next section will present the efforts in data analysis. The last section will present a discussion of the important findings and limitations of this research. …

MPEG-4 high-efficiency AAC coding [Standards in a Nutshell

The name MPEG-4 high-efficiency AAC (HE-AAC) refers to a family of recent audio coders that was developed by the International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) Moving Picture Experts Group (MPEG) by subsequent extension of the established Advanced Audio Coding (AAC) architecture. These algorithmic extensions facilitate a significant increase in coding efficiency relative to previous standards and other known systems. Thus, they provide a representation for generic audio/music signals that offers high audio quality also to applications limited in transmission bandwidth or storage capacity, such as digital audio broadcasting and wireless music access for cellular phones. This article presents a compact overview of the evolution, technology, and performance of the MPEG-4 HE-AAC coding family.

Complete Validation of a Unique Digestion Assay To Detect Trichinella Larvae in Horse Meat Demonstrates the Reliability of this Assay for Meeting Food Safety and Trade Requirements

A tissue digestion assay using a double separatory funnel procedure for the detection of Trichinella larvae in horse meat was validated for application in food safety programs and trade. The assay consisted of a pepsin-HCl digestion step to release larvae from muscle tissue and two sequential sedimentation steps in separatory funnels to recover and concentrate larvae for detection with a stereomicroscope. With defined critical control points, the assay was conducted within a quality assurance system compliant with International Organization for Standardization–International Electrotechnical Commission (ISO/IEC) 17025 guidelines. Samples used in the validation were obtained from horses experimentally infected with Trichinella spiralis to obtain a range of muscle larvae densities. One-, 5-, and 10-g samples of infected tissue were combined with 99, 95, and 90 g, respectively, of known negative horse tissue to create a 100-g sample for testing. Samples of 5 and 10 g were more likely to be positive than were 1-g samples when larval densities were less than three larvae per gram (lpg). This difference is important because ingested meat with 1 lpg is considered the threshold for clinical disease in humans. Using a 5-g sample size, all samples containing 1.3 to 2 lpg were detected, and 60 to 100% of samples with infected horse meat containing 0.1 to 0.7 lpg were detected. In this study, the double separatory funnel digestion assay was efficient and reliable for its intended use in food safety and trade. This procedure is the only digestion assay for Trichinella in horse meat that has been validated as consistent and effective at critical levels of sensitivity.

“For if the trumpet give an uncertain sound, who shall prepare himself to the battle?” (I Corinthians 14:8, KJV)

Frank E. Block, Jr., MD Every clinician is well aware of the problems with audible alarms: False alarms, loud alarms, difficulty determining what is alarming, and inability to quiet an alarm all create distractions that impede patient care. These problems are complicated by the different approaches to alarms among devices. Devices designed by various manufacturers may use different alarm sounds to identify similar events or, alternately, similar sounds may be produced to identify unrelated events. Over several years, the International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) Joint Working Group on Alarms (JWG) developed a standard for audible alarms that suggests the use of melodic tones to identify untoward physiologic changes (IEC 60601-1-8). In this issue of the journal, Wee and Sanderson report a study documenting the challenges in training nursing personnel to use audible alarms that conform to the IEC standard. These authors conclude that “The slow rate of learning and persistent confusions suggest that the IEC 60601-1-8 melodic alarms should be redesigned before they are adopted for clinical practice.” These findings bring the utility of the existing standard into question and, more importantly, challenge us to consider what alarm sounds might actually address the problems with audible alarms. In the 1980s, national standards writing groups began to standardize alarm signals. The British standards group approached Dr. Roy Patterson, a prominent acoustician experienced with alarm design, for assistance. The group told Dr. Patterson that there were “six ways to kill people” (oxygen, ventilation, cardiovascular, temperature/energy delivery, drug infusion, and artificial perfusion). Patterson designed a set of seven prototype alarm sounds, one for each of the six “organ systems” plus a general sound. Each sound had a high-priority form and a medium-priority form that were very similar, but the high-priority version was faster and sounded more urgent. The general alarm also included an optional low-priority alarm sound. When Patterson’s proposed eight alarm sounds were played for various clinicians, the usual reaction was one of astonishment or amusement. To the unknowing ear, they sounded like a set of random electronic noises. Many supposed authorities, including this author, set out to debunk the Patterson sounds, lest they should be adopted by the standards groups and forced upon clinicians worldwide. This author, in opposing the Patterson sounds, suggested that musical alarm sounds might be easier to learn. For instance, the cardiac alarm might be to the tune of “I Left My Heart in San Francisco.” At a dinner at the American Society of Anesthesiologists Annual Meeting in 1990, a learning exercise with possible musical alarm sounds suggested that they could be learned quickly. The United States standards committee accepted the suggestion of melodic alarms and required that medical alarms should use standard musical pitches. The International Standards Committee that wrote the ISO 9703-2 alarm standard in the 1990s abandoned the Patterson sounds and decided upon a 3-note medium priority alarm sound and a 5-note high-priority sound. The musical pitches were not specified, From the Department of Anesthesiology, University of Arkansas for Medical Sciences, Little Rock, Arkansas. Accepted for publication October 16, 2007. Conflict of Interest: Dr. Block receives compensation as a consultant to Draeger Medical Systems, Andover, Massachusetts. Address correspondence and reprint requests to Frank E. Block, Jr., MD, 4301 West Markham Street #515, Little Rock, AR 72205. Address e-mail to BlockFrankE@uams.edu. Copyright © 2008 International Anesthesia Research Society DOI: 10.1213/ane.0b013e3181606927

Using the Bell Labs security framework to enhance the ISO 17799/27001 information security management system

The global information technology (IT) industry recognizes the need for standards to improve the quality and consistency of security for IT products and services. As such, the International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27000 series is focusing on the requirements, security controls, and implementation guidance for an organization's information security management system (ISMS). This guidance establishes general principles that can be used in various industries and government; however, standardized techniques are also needed to identify, implement, and operate security controls as part of the ISMS life cycle. The Bell Labs Security Framework identifies both the minimal and differentiating security controls by decomposing an IT product or service into a layered hierarchy of equipment and facilities groupings and examining the types of activities that occur at each layer in a standardized manner. Furthermore, the Bell Labs Security Framework security dimensions provide the necessary mechanisms to implement and operate the selected controls. The Bell Labs Security Framework enhances the ISO/IEC 27000 series by providing a comprehensive end-to-end approach to implementing IT security. © 2007 Alcatel-Lucent.

Trends in the standardization of telecommunications on GII, multimedia, and other network technologies and services

Global standardization is becoming more and more important in achieving a global information infrastructure (GII). Telecommunication and information standardization organizations such as the International Telecommunications Union (ITU) and International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) Joint Technical Committee (JTC) have each set up special groups to focus on determining standards for GII. This article presents the activities of these organizations as they relate to GII. It also reviews the current status of standards for multimedia, asynchronous transfer mode (ATM)/broadband integrated services digital network (B-ISDN), Universal Personal Telecommunications (UPT), Future Public Land Mobile Telecommunication System (FPLMTS), and telecommunications management network (TMN), which are all key elements in GII.