Level Of Data Protection Research Articles

How has the level of data protection of Russian enterprises changed with the introduction of sanctions?

Information security is one of the most critical areas of any business. The operability and security of information systems, as well as the reliability and safety of confidential information depend on it. The issues related to the state of the domestic information security market, the level of cybersecurity of industrial enterprises, cyber attacks, the problem of "brain drain" of IT specialists, the current landscape of cyber threats, the risks most dangerous for enterprises in 2023, as well as the practice of protection against cyber threats on the example of the industrial company "Vekprom" are considered.

A Survey on Network Security Monitoring: Tools and Functionalities

Recently, cybersecurity breaches have become more common, with varying levels of impact ranging from simple to major losses of financial resources or data. The network infrastructures are the main goal of the malicious activity to compromise confidentiality, integrity, and availability (CIA) of information security. The network devices produce a large number of logs, making the handling of these logs very important because they serve to record all activities and events that take place on the network’s devices and applications to detect and prevent abnormal behaviors. Network security monitoring is a process used to monitor network devices and their traffic to detect security vulnerabilities, threats, and suspicious activities. Organizations are using network security monitoring to quickly detect and respond to cybersecurity threats. Various methods are used to protect network devices, like antivirus, firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS), which typically operate independently. For that reason, attacks cannot be identified unless logs and events from different devices and applications are correlated and managed from a centralized location. Security information and event management (SIEM) addresses this issue by offering the capability to increase the level of information security and data protection through centralized log management for network devices. This paper presents a survey of network security monitoring techniques, encompassing their functionality, contents, and tools. Traditional tools, intrusion detection and prevention systems, and SIEM are some of these tools. In addition, the paper introduces SIEM as the most common and advanced security tool, highlighting its functionalities and capabilities.

Development of Electronic Governance to a Digital Ecosystem

Problem setting. The scientific work is devoted to the study of the economic and legal aspects of the modernization of e-government in Ukraine into a digital ecosystem to achieve the Sustainable Development Goals. Analysis of recent researches and publications. Aspects of the functioning and development of e-government and the problems of transforming governance into digital attract the attention of researchers from Ukraine. However, the topic of e-government as an ecosystem is not analyzed at all in the publications of domestic scientists. Theoretical and practical aspects of the ecosystem approach as a direction of digitalization of public administration are revealed in the works of foreign authors and public documents of international organizations. Purpose of the research is to analyze the state of e-governance in Ukraine and develop recommendations for improving the regulatory framework for the digital transformation of national governance to an ecosystem model. Article’s main body. The expediency of the ecosystem approach in digital governance is due to the need for state regulation of digital ecosystems. The ecosystem model of governance is based on digital technologies, and the electronic model is based on information and communication technologies. An e-government ecosystem is a complex sociotechnical system that unites citizens, businesses, organizations and authorities and uses electronic platforms to create value and distribute it among its participants. Electronic governance in Ukraine is gradually moving towards its organization as an ecosystem. Today, several dozen digital transformation projects are being developed in Ukraine to automate relations in the government system. However, cyber security experts identified significant problems in the Diya digital project, in particular problems with personal data protection, openness and transparency of digital transformations. Сitizens play a key role in digital public administration, so the goal of human development and protection of their rights should be enshrined in legislation as a priority during digital transformations. Innovative management technologies provide significant opportunities in management, but are risky. The need for thorough research and legal regulation of innovative solutions before their introduction into government processes is emphasized. It is proposed to establish responsibility for the security of data and processes in the digital ecosystem of governance. Conclusions and prospects for development. Legislation and legal acts related to the informatization and digitization of government, economy and society in Ukraine need to be updated taking into account the priority goals of human development and the protection of their rights, the need to increase the level of cyber security and data protection, the development of competitive programs for the automation of the will of citizens, the implementation of the principles of openness and transparency state bodies, monitoring the effectiveness of governance digitization. The prospect of further research is the legal provision of data protection in digital ecosystems.

Does personal data protection matter for ISO 9001 certification and firm performance?

PurposeThis study explores the link between ISO 9001 certification, personal data protection and firm performance using financial balance sheet and survey data. The security aspect of data protection is analyzed based on the major requirements of the General Data Protection Regulation and mapped to the relevant controls of the ISO/IEC 27001/27002 standards.Design/methodology/approachThe research analysis is based on 96 ISO 9001–certified and non-certified publicly traded manufacturing and service firms that responded to a structured questionnaire. The authors develop and empirically test their theoretical model using the structural equation modeling technique and follow a difference-in-differences econometric modeling approach to estimate financial performance differences between certified and non-certified firms accounting for the level of data protection.FindingsThe estimates indicate three core dimensions in the areas of “policies, procedures and responsibilities,” “access control management” and “risk-reduction techniques” as desirable components in establishing the concept of data security. The estimates also suggest that the data protection level has significantly impacted the performance of certified firms relative to the non-certified. Controlling for the effect of industry-level factors reveals a positive relationship between data security and high-technological intensity.Practical implicationsThe results imply that improving the level of compliance to data protection enhances the link between certification and firm performance.Originality/valueThis study fills a gap in the literature by empirically testing the influence of data protection on the relationship between quality certification and firm performance.

Cloud based ERP systems and Data Security for Cloud based ERP Applications - SAP S/4HANA

In this research, we will talk about data security in cloud-based ERP. We utilized SAP S/4HANA cloud (Public edition) in this research. It is an analysis of security issues connected to cloud data and associated topics. The paper will examine data in detail. Worldwide protection techniques and strategies are employed to guarantee the highest level of data protection by lowering risks and threats in Cloud ERP. Although many apps benefit from having access to data on the cloud ERP, doing so exposes data to applications that may already have security flaws. Now-a-days many Organizations preferring Cloud based ERPs than on premises ERP so, we decided to Explore the Cloud based ERP. The paper will also discuss data security issues for Data-at-Rest and Data-in- Transit. All tiers of SaaS (Software as a Service), PaaS (Platform as a Service) are used in the study. In this research we also explore the solutions for different security issues in Cloud ERP. Key Words: Data Security, Cloud Computing, SAP S/4HANA, Cloud ERP

Time-Based Steganography Image with Dynamic Encryption Key Generation

The rapid advancement of technology has necessitated stronger protection measures for data exchange. Encryption, coupled with robust keys, is an effective method to safeguard sensitive information. This study aims to improve the security of key levels by implementing a combination of steganography and encryption. The approach involves using two keys, one in the form of a normal string and the other based on the insertion time. These keys are combined to create a new, stronger encryption key. The secret messages are then encrypted using this new key and inserted using the Least Significant Bit method in steganography. This integrated approach aims to provide a higher level of protection for data during transmission and storage.

Improving the systemic approach to information security management in the context of increasing the level of data protection in local government entities

Improving the systemic approach to information security management in the context of increasing the level of data protection in local government entities

Uncertain future of transatlantic data flows: Will the United States ever achieve the ‘adequate level’ of data protection?

AbstractPersonal data can be transferred to third countries without any additional measures by achieving the European Commission's adequacy decisions if the third country's data protection level is deemed essentially equal. Only a few countries have obtained this decision, and the United States is no longer one of them, since the European Court of Justice ruled in the Schrems II case that the Privacy Shield Decision could not provide ‘essentially equivalent’ protection for personal data to that provided by European Union legislation, and hence was invalid. This article will discuss what the term ‘essentially equivalent’ means and what it covers. Finally, it will examine and attempt to answer the question of whether the United States will ever reach the mentioned adequate level by comparing the examples of two adequate countries, the United Kingdom and Japan.

The Fundraiser's Transfer of Personal Data from the European Union to the United States in Context of Crowdfunding Activities

European start-up companies must overcome more ‘transfer hurdles’ when personal data is transferred from the European Union to the US (United States of America) as part of crowdfunding campaign activities. Transfer of personal data is commonly not associated with (small scale) crowdfunding activities. However, the strict rules of the EU GDPR (European General Data Protection Regulation) on safeguarding personal data apply to all companies when data is transferred from the EU to the US - regardless the size of the business.
 This article identifies exchange of personal data that takes place between primarily fundraiser and crowdfunding service provider in different steps of fundraising campaigns. The framework for rewardbased crowdfunding for goods production that is provided by the US based Indiegogo platform is used as example and context. The article highlights by way of example the obligations that must be met by European fundraisers as "data controllers" when personal data is transferred to Indiegogo. No easy solutions are provided by either European Union or national data protection authorities on how to establish an adequate level of personal data protection. Paradigms on how to secure transfer of personal data to third countries are available in form of so-called standard contractual clauses, but still conditions for transfer of personal data from Europe to the US are hard to comply with. Apart from entering into an inter partes agreement on use of standard contractual clauses with the crowdfunding platform provider, a European fundraiser must furthermore make a so-called "transfer impact assessment" to ensure that third party access to personal data is avoided. In the case of transfer of personal data from the EU to the US the fundraiser must consider using encryption of data as a "supplementary measure" to block third party access. Encryption of data is however not suitable for exchange of data in a dynamic crowdfunding campaign so other means for protection of data must be found and applied.
 The reason and explanation for making data transfers from the EU to the US that hard for e.g., fundraisers are thus to be found at interstate level in the relation between the EU and the US. According to EU law, more specifically the GDPR and several of the provision of the Charter of Fundamental Rights of the European Union, US security legislation authorises a disproportionate access for US intelligence services to citizens' personal data. A solution on manageable transfer of personal data from the EU to the US may be found before the end of 2022, since a new TADP (Trans-Atlantic Data Privacy Framework) is currently being negotiated between EU and US at top politician level. However, the implementation of the TADP may take som time since the EU legislative framework needs adjustments to make the new transfer possibilities operational.

AUTOMATED REAL-TIME TRAFFIC FORECASTING SYSTEM

Based on the analysis of the vehicles total number growth rates, which exceed the rates of expansion and optimization of the transport infrastructure, the need for the introduction of real-time traffic forecasting and control systems is shown. The factors that make it possible to detect the probability of potentially dangerous situations on the road, such as traffic jams, accidents and lack of parking spaces, respectively, in certain urban areas, based on the data of sensor networks and surveillance cameras combined within the global system of the Internet of Things, have been determined. It is proposed to build a sensor network based on magnetic sensors, which allows for high-precision geolocation with refinement of the received data by using ultrasonic sensors and optical monitoring tools, while identification is carried out by reading RFID tags. It is shown that the task of optimal organization of the relay system includes the determination of the features of the city infrastructure and statistical indicators of the city's traffic flows, and for a multi-level communication system, protocols are determined depending on the distance between nodes, requirements for the level of data protection, data transmission speed, minimum radio signal amplitude, as well as restrictions on the power supply of a separate node. The presented topology of the relay network includes the organization of sensor nodes into clusters, transmission from the main node of the cluster to the gateway node, and from the gateway nodes to the base station. On the basis of the specified model, a scheme for building cluster self-organization algorithms can be presented by forming clusters in real time according to the topology of the cluster tree, which allows simplifying the data transfer subsystem and reducing the time of processing input data. The developed scheme for analyzing the traffic flow at the intersection and the availability of parking spaces can be used in the development of methodological recommendations for the implementation of the "Smart City" concept and the creation of software applications that provide drivers with information about the state of traffic and predicted changes within a certain time interval. Keywords: automaticregulation of auto-traffic, controlled intersection, sensor network, Internet of Things, geolocation, identification, self-organization of clusters.

Indonesia’s personal data protection bill, 2020: does it meet the needs of the new digital economy?

ABSTRACT Privacy and protection of personal data on the Internet have become issues of public concern in Indonesia. There is growing public distrust of institutions that manage personal data. Poor management of personal data provides a fertile ground for cybercrime and lack of accountability, especially in the context of the new digital economy. In response, the Indonesian Communication Ministry drafted the Personal Data Protection Bill, which has been submitted to the parliament. This paper analyzes the PDP Bill to determine whether it meets international data privacy standards. The EU GDPR is selected as the benchmark for assessment as it is regarded as the toughest privacy law worldwide. The study finds that Indonesian citizens do not have the same level of protection as their European counterparts. Nonetheless, the implementation of this bill when it becomes law will lead to a high level of personal data protection in the new digital economy.

The GDPR and the DGA Proposal: are They in Controversial Relationship?

Summary At the end of 2020, the European Commission published a new European data strategy, which aims to create a new legal framework to promote the development of a single European data market. In the scope of the new strategy the European Commission has already proposed the Data Governance Act proposal (hereinafter – the “DGA”), which aims to strengthen the mechanism to facilitate data exchange. The proposal of the new legislative act has raised the question about the right balance between it and the existing EU legislative acts, which were adopted in the key of personal data protection, especially with the General Data Protection Regulation (hereinafter – the “GDPR”). We argue that there are a number of inconsistencies between the DGA proposal and the GDPR that may prevent the full implementation of mechanisms that allow achieving the EU’s intended goals in this field within the framework of the new European strategy. The interaction of the DGA with the GDPR is characterized by conflict of laws and legal uncertainty, which can jeopardize the achievement of the objectives of the DGA itself and can reduce the level of personal data protection in the EU, compared to the GDPR. Besides, the examination of the relevant case-law of the Court of Justice of the European Union (hereinafter – the “CJEU” or the “Court”) regarding the implementation of the GDPR identifies approaches that prevent the opening of data exchange as the DGA proposal requires.

Security and Reliability Performance of Noise-Loop Modulation: Theoretical Analysis and Experimentation

Security is a crucial feature of current (5G) and even more for future (6G) communication networks. While the innate nature of the wireless channel is an issue for guaranteeing security, its physical characteristics can be exploited for protecting condential data. Physical-layer Security (PLS) mechanisms take advantage of unique features of the transmission media or of the user equipment to introduce an additional level of data protection. The physical-layer security (PLS) can be seen as the rst level of defense. The noise-loop (NL) modulation is a PLS technique that intrinsically provides condentiality. In this paper, we rst provide the theoretical analysis to evaluate the reliability and security in multipath fading channels, and then the theoretical results are evaluated by experimentation. A Software Dened Radio (SDR) testbed that exploits the NL secure modulation was implemented and a measurement campaign has been carried out in an indoor environment, with passive and active malicious nodes. An evaluation of the complexity of the proposed system is also reported, showing that the NL has low hardware resource occupancy and low computational cost. These fundamental characteristics make the NL modulation a valid PLS technique for providing a security solution for beyond 5G and 6G networks.

Researching the Ethics of Data Collection in Post-conflict Acholiland (Northern Uganda): The Good, the Bad, and the Ugly

This research aims to contribute to debates on the decolonization of research in an African context with a focus on Gulu City in Northern Uganda. It seeks to investigate the key emerging contemporary ethical concerns in relation to researching post-conflict Northern Uganda, that is, before (clearance processes), during (conducting fieldwork alongside research collaborators) and after (information dissemination and data protection) research; examined with power relations as a denominator. The paper draws secondary sources, and primary data obtained through a set of qualitative research methodologies from research collaborators who have worked with foreign (Western) researchers. This study reveals the ethical issues and dilemmas that often precipitate the exploitation of research participants in the region. It also illustrates the dynamics of Uganda’s research industry and burgeoning research assistant culture and sub-economy. Finally, the research revealed the high levels of problematic data protection and storage issues in the region and the weaknesses of enforcement of data protection laws in the region and country. This points to the inconspicuous persistence of colonialism, oppression, and domination in systems of western research training and seek to include such an ethical understanding in their research practice.

An overview of information systems and data handling of Hungarian living communities from the perspective of General Data Protection Regulation requirements and information security

There are multiple challenges present in the daily lives of living communities regarding legal and organizational matters, as well as issues concerning information technology and informational security, which demand a constant search for appropriate solutions. Reviewing these issues is especially important in Hungary, where one-fifth of the population lives in facilities that are maintained by the community itself. Moreover, the trends of the current real estate market point towards a rise in these numbers. Throughout our research, we have examined current Hungarian legal practices regarding data handling and information security. The central focus of our inquiry was to determine the typical behaviour of Hungarian officials working with, handling, storing and processing data of the country’s living communities. This study analyses market solutions for these condominium buildings to comply with the legal requirements and also reviews the legal and economic limitations of such practices. Special attention is devoted to the handling and processing of personal data, with an emphasis on forecasted trends of cyber threat in 2018.
 The central subjects of our study, then, are legislative practices relevant for living communities, the protection of personal data, and information security issues in general. Thus, we examine the typical and most widespread software solutions deployed by resident managers, while also shedding light, with empirical research methods, on the level of data protection in such software packages. Since barrier-free access to information on condominium resident managers and communities themselves, as well as annual financial reports will be mandatory from January 1, 2019, resulting in the creation of a national register for resident managers, we extend our inquiry to the relationship between public administration bureaus and such living communities in the predictive section of our study.

Are iPhones Really Better for Privacy? A Comparative Study of iOS and Android Apps

Abstract While many studies have looked at privacy properties of the Android and Google Play app ecosystem, comparatively much less is known about iOS and the Apple App Store, the most widely used ecosystem in the US. At the same time, there is increasing competition around privacy between these smartphone operating system providers. In this paper, we present a study of 24k Android and iOS apps from 2020 along several dimensions relating to user privacy. We find that third-party tracking and the sharing of unique user identifiers was widespread in apps from both ecosystems, even in apps aimed at children. In the children’s category, iOS apps tended to use fewer advertising-related tracking than their Android counterparts, but could more often access children’s location. Across all studied apps, our study highlights widespread potential violations of US, EU and UK privacy law, including 1) the use of third-party tracking without user consent, 2) the lack of parental consent before sharing personally identifiable information (PII) with third-parties in children’s apps, 3) the non-data-minimising configuration of tracking libraries, 4) the sending of personal data to countries without an adequate level of data protection, and 5) the continued absence of transparency around tracking, partly due to design decisions by Apple and Google. Overall, we find that neither platform is clearly better than the other for privacy across the dimensions we studied.

Developing the algorithm and software for access token protection using request signing with temporary secret

This paper proposes a method for protecting the access tokens in client-server data exchange without saving the state based on the formation of the signature of the request using a temporary secret. The devised method allows one not to transfer access tokens with each request, which would make it possible for the attacker to authenticate as a valid user when compromising the connection, for example, when using a «person in the middle» attack. Two variants of the method have been proposed and substantiated – simplified and improved, the scope of which depends on the needs for protection and technical capabilities of their implementation. The robustness of both variants is ensured by the practical inability to select the initial input data of the hash function used to form the signature. The improved version also makes it possible to protect access tokens at the stage of receiving them and provides protection against the attack of the recurrence of the request. Initial user authentication protection is achieved by using the Diffie-Hellman protocol to exchange a secret and access token. Using query IDs and time labels prevents the query from being reused. Advanced security for access tokens is important because having an attacker’s access token gives the attacker full control over the user account. The use of SSL/TLS may not produce the desired level of protection for such important data. It was established that the use of the proposed method does not add significant time costs. The SHA-256 hash function example shows that the relationship between message size and extra time to send and receive a message is linear. When using the proposed method in the browser, the absolute value of additional time spent for messages from 100 bytes to 2,048 KB ranges from 0.4 ms to 142 ms. Given this, the proposed method could be used without significant impact on the experience of use.

Differentiated Protection and Hot/Cold-Aware Data Placement Policies through k-Means Clustering Analysis for 3D-NAND SSDs

3D-NAND flash memory provides high capacity per unit area by stacking 2D-NAND cells having a planar structure. However, because of the nature of the lamination process, the frequency of error occurrence varies depending on each layer or physical cell location. This phenomenon becomes more pronounced as the number of flash memory write/erase (Program/Erasure) operations increases. Error correction code (ECC) is used for error correction in the majority of flash-based storage devices, such as SSDs (Solid State Drive). As this method provides a constant level of data protection for all-flash memory pages, there is a limitation in 3D-NAND flash memory, where the error rate varies depending on physical location. Consequently, in this paper, pages and layers with varying error rates are classified into clusters using the k-means machine-learning algorithm, and each cluster is assigned a different level of data protection strength. We classify pages and layers based on the number of error occurrences measured at the end of the endurance test, and for areas vulnerable to errors, it is shown as an example of providing differentiated data protection strength by adding parity data to the stripe. Furthermore, areas vulnerable to retention errors are identified based on retention error rates, and bit error rates are significantly reduced through our hot/cold-aware data placement policy. We show that the proposed differential data protection and hot/cold-aware data placement policies improve the reliability and lifespan of 3D-NAND flash memory compared with the existing ECC- or RAID-type data protection scheme.

'We Take Your Word For It' — A Review of Methods of Age Verification and Parental Consent in Digital Services

The GDPR provides a high level of protection for children's personal data. This protection is reflected in various recitals and provisions in the GDPR and results in two practical challenges. First, the (implicit) need for age verification, or at least determining whether someone is not a child. This obligation would apply as soon as personal data are processed and there is no evidence to the contrary that the personal data of children are processed. Secondly, in the more specific case that consent is one of the lawful grounds, there is a need to verify that consent has been given by a parent (or guardian) when a data subject has not reached the age of digital consent. In our research, we studied whether apps popular among children have implemented adequate methods to meet both verification obligations by analysing the registration process of these apps. No apps that we investigated met the requirements of the GDPR at the time of our research. The level of assurance of age was too low or the method not privacy-friendly or inclusive. Parental consent mechanisms were generally lacking - while consent was a lawful ground in all apps we investigated. If a parent was involved in the registration process, the actual verification of that status was mostly missing. Keywords: Data Protection | Age Verification | Parental Consent

Personal Data Protection in Ukraine: Realities and Prospects for Implementing the European Experience

The purpose of the article is to study the theoretical and methodological foundations of the process of adaptation of Ukrainian legislation to EU norms and standards through the development of specific proposals for modernization of the theoretical and applied model of the personal data protection mechanism in Ukraine, through the creation of a system of specialized state bodies, and also in the formulation of reasonable proposals and methods for addressing the issues raised. The main elements and effectiveness of the process of adaptation of Ukrainian legislation to EU norms and standards are studied based on the concept of contextual integrity and comparative analysis of EU legislation in the field of personal data protection. Sociological research was also conducted by surveying Ukrainian citizens on the effectiveness of personal data protection legislation. In the course of the research, it was concluded that the future update of the UkrDPR should take into account: modern regulatory requirements necessary to ensure an appropriate level of mass processing of personal data (especially in the field of social networks); a rapidly changing data processing environment at the International and European levels; a higher level of personal data protection of children and minors is needed; updating industry standards for personal data protection as an important condition for the development of Ukrainian society. Based on the empirical research, the author proves that when processing personal data, it is necessary to adhere to the following data processing principles: legality, good faith and transparency; limitation of purpose; minimization of personal data; accuracy of personal data; limitation of storage periods; integrity and confidentiality; personal data may be processed only on the grounds provided for by law.