Level Of Information Security Research Articles

Internet of Medical Things Security Frameworks for Risk Assessment and Management: A Scoping Review

Internet of Medical Things Security Frameworks for Risk Assessment and Management: A Scoping Review

Thinking about the application of commercial cryptography in intelligent connected vehicles

As an important part of intelligent transportation, the information security of connected vehicles has become increasingly prominent. As a key technology to ensure the information security of networked vehicles, commercial cryptography plays an important role in vehicle identity authentication, data encryption and secure communication. In this paper, the status quo, challenges and future development trend of commercial cryptography application in connected vehicles are discussed, and some suggestions are put forward to strengthen technology research and development, standardization and industry cooperation. By continuously optimizing the application strategy of commercial cryptography, the information security level of connected vehicles can be effectively improved, providing strong support for the security development of the industry.

Обеспечение информационной безопасности в системе здравоохранения

The introduction of digital technologies into the healthcare system of the Russian Federation is analyzed. At the same time, the emergence of a new rental product is considered - information, the price of which increases every year. In this regard, the volume of information leakage from healthcare institutions and the damage caused to them is growing every year. A statistical analysis of information leakage was carried out by the nature of the incidents, by the type of information stolen, and by leakage channels. The content of information related to personal data has been established and numerous examples of leakage of personal data in Russia and abroad from medical institutions have been given. A comparative analysis of data leakage by industry is given. Objects for protecting information in medical institutions have been established. Reputational damage from information leakage in the healthcare system is analyzed. Security problems in the pharmaceutical field are considered. Some recommendations are proposed to improve the level of information security in the healthcare system.

Development of the sociocyberphysical systems` multi-contour security methodology

The constant increase in the number of threats to the security of critical infrastructure objects, which include socio-cyberphysical systems, leads to a decrease in the quality of security services and the level of security of infrastructure elements. The object of research is the process of building a complex system of protection in socio-cyberphysical systems. The imperfection of the mechanisms for ensuring the security of critical infrastructure objects, which include socio-cyberphysical systems, the technological complexity of identifying new security threats necessitates an urgent need for a radical revision of the current approaches to its provision. So, it becomes clear that the development of a new approach to ensuring the security of information resources in socio-cyberphysical systems is needed. The article proposes a new approach to the methodological foundations of building multi-contour information protection systems with internal and external circuits on each of the platforms of socio-cyberphysical systems. This approach is based on a universal classifier of threats, which takes into account not the technical aspect of threats, but also their integration with social engineering methods, their synergy of hybridity. The sociopolitical influence on the realization of threats is taken into account, and practical mechanisms for providing basic security services based on post-quantum algorithms are also proposed. To provide basic security services in the proposed multi-contour protection system, it is proposed to use post-quantum algorithms – McEliece crypto-code constructions, which provide Perr=10-9–10-12, safe time Tsec=1025–1035 group operations. Within the framework of the proposed approach, the problem of increasing the level of information security has been formalized and further ways of solving it have been determined

ПРОПАГАНДИСТСЬКІ СТРАТЕГІЇ В СУЧАСНОМУ МЕДІАДИСКУРСІ: АНАЛІЗ ПРИКЛАДІВ ЗІ СВІТОВОЇ ПРАКТИКИ

<pre><strong><em>The purpose of the study </em></strong><em>is to identify propaganda strategies in foreign media. Conducting the research is due to the fact that in the context of significant changes in the military and political situation in the world in general and around Ukraine, with the beginning of full-scale Russian aggression, propaganda, which is an effective tool for manipulating public opinion, is becoming widely spread in the media space. The media use different propaganda strategies, forming an irrelevant picture of reality. This leads to a decrease in the level of information security of the state, the result of which is the destabilization of the social and political situation, opposition to the adoption of certain state decisions, etc.</em></pre><p><strong><em>Research methodology</em></strong><em>. The study of propaganda strategies in modern media was based on the media manipulative approach, methods of manipulation of mass consciousness and content analysis. Their application made it possible to identify the main principles of consideration of the problems of propaganda strategies.</em></p><p><strong><em>The results</em></strong><em>. In the process of work, it was found that propaganda is the purposeful dissemination of unreliable information with a specific goal. Propaganda is aimed precisely at the human consciousness, because it allows to form clear concepts and images in it. Depending on the orientation, propaganda is divided into external and internal; according to the sphere of distribution – cultural, personal, informational, political; according to the degree of reliability of the information – true, partially true, false; according to the stage of spread – preparatory, active, latent.</em></p><p><em>Propaganda strategies include lies, decontextualization, disinformation, demonization of the enemy, obfuscation, deliberate obscurity, confusion, labelling, half-truths, repetition, join the crowd, commoners, stereotypes, fear, uncertainty, and doubt. The study states that the main propaganda strategies used in the analyzed media are «common people» and «stereotypes», less so – «join the crowd» and «half-truth».</em></p><p><strong><em>Novelty.</em></strong><em> The novelty of the study is that propaganda strategies in foreign media were investigated for the first time. The understanding of the concept of «propaganda» has also been improved, the peculiarities of the functioning of propaganda strategies in foreign media have been investigated.</em></p><p><strong><em>Practical significance</em></strong><em>. The practical significance of the research lies in the fact that the obtained results can be applied to journalists, diplomats and politicians when promoting certain ideas and opinions.</em></p><pre><strong><em>Key words:</em></strong><em> information space, media discourse, mass manipulation, media, propaganda, propaganda strategies.</em></pre>

Exploring the level of information security in the South African banking industry

The purpose of this study is to explore the level of information security among South African banks with the aim of determining the level of their resilience to cyberattacks and intrusions. The study employs a mixed approach that involves both quantitative and qualitative analyses of the responses obtained from a structured questionnaire used as the survey instrument. The questionnaire was distributed to some selected members of staff of the 17 licensed banks in South Africa saddled with the responsibilities of operation, customer service, management, and administration. In addition, non-parametric statistical analyses such as Fischer’s Exact and Chi-square tests, as well as Spearman’s correlation, were carried out. The outcome of this study indicated that the effectiveness of information security on customers’ service in the South African banking industry is assumed to be high. South African banks are deploying different anti-fraud technologies to strengthen the level of information security; however, there are still substantial cases of cyberfraud and unauthorised intrusions. The findings also indicate that the integration of forensic accounting and management control systems may promote information security in the banking industry. This study provided an insight into the impact of information security framework development to reduce systems’ vulnerability and intrusions.

Типология показателей региональных программ цифровизации управления

The subject of the study is the transition to a new level of solving managerial tasks through the use of indicators of management digitalization programs. The objectives of the work are to build a model for evaluating the processes and results of digitalization in the region based on the proposed typology of relevant indicators of regional programs, to develop an approach to assessing the quality of indicator formulations for their ability to adequately reflect the process of digital development. The concepts of digitalization and digital transformation are differentiated. The assessment of regional strategies and programs in the field under consideration is given. The role of the indicator as an instrument of indirect regulation is emphasized. The approaches to the formation of indicators of regional programs "from above" and "from below" are analyzed. Based on the analysis of 17 digitalization programs of the Central Federal District, eight types of indicators are identified and correlated with each other, reflecting the material and technical conditions of digitalization of the region; the level of information security; the degree of implementation of digital systems and services; stimulating the development of digital technologies in the region; staffing; the demand for public digital services; the convenience of using digital technologies to meet social needs; satisfaction with various aspects of digitalization. The problems have been identified, the solution of which will improve the assessment of the effectiveness of digitalization at the regional level, avoiding formalism and orienting managers to achieve socially significant results.

Information Security Evaluation of Data Centre Architecture Using COBIT 5

Pusat Teknologi Informasi dan Pangkalan Data (Pustipanda) UIN Jakarta is an institution in charge of managing all information systems and data management for UIN Jakarta. However, security issues are still one of the problems faced by Pustipanda today, such as data leaks, and websites that are often problematic. This research aims to assess the level of information security at the UIN Jakarta Pustipanda data centre using the COBIT 5 framework. Information security is very important in supporting organizational operations, especially facing cyber threats in the data centre environment. The research approach included document analysis, observation, and interviews with stakeholders at Pustipanda UIN Jakarta. Identification of information security weaknesses, assessment of compliance with security standards, and design of appropriate solutions are the subject of the research. It is hoped that the results will provide a comprehensive picture of information security in the data centre as well as concrete recommendations for improvement. The results of the research include an understanding of the status of information security at Pustipanda UIN Jakarta, as well as guidelines for improving information security in accordance with COBIT 5 principles. These efforts aim to reduce risk and protect the integrity, confidentiality, and availability of data in the data centre environment

Implementation of Public Affairs in the interests of military operations: NATO standards and Ukrainian Armed Forces experience

The research relevance is determined by the need for a deep understanding of Public Affairs strategies in modern military conflicts, where the information space becomes an arena of struggle no less important than the battlefield itself. In the context of the growing role of media and information technology, the effective implementation of Public Affairs can determine the success of military operations and the formation of public opinion. The study aims to analyse current approaches to Public Affairs in the military sphere, with a focus on the experience of the Armed Forces of Ukraine and the implementation of NATO standards, to identify effective strategies and methodologies in this area. The methodological basis of the study is based on the following methods: analysis, synthesis, comparison, generalisation, classification, and systematisation. The results of the study include a review of regulations, organisational structure, means and methods of Public Affairs used in the Armed Forces of Ukraine and NATO countries. Analysis of the challenges and problems faced by Public Affairs professionals in the current conditions of hybrid warfare, as well as the prospects for the development of this area of activity in the context of strengthening the information security of the state, is given special attention. The author emphasises the importance of integrating Public Affairs into the overall system of Strategic Communications in the structure of military command and the need to ensure the active participation of Public Affairs Officers in the planning and implementation of military operations. The importance of developing the professional skills of Public Affairs professionals and using the latest information and communication technologies to improve the effectiveness of Strategic Communications is emphasised. The practical significance of the study is due to its contribution to the development of approaches and standards for the implementation of effective Public Affairs in the context of military operations, identification of problems and challenges in this area, recommendations for developing the skills of specialists and improving the level of information security of the state

On the construction of data protection algorithms in cyberphysical systems

Technology is playing an increasingly important role in our lives, and at the same time, data protection is becoming a critical issue. The article considers a particularly important sector - ensuring data security in cyberphysical systems of adaptive type, which combine physical and informational components. This paper proposes an approach presented in the form of a sequence of actions to adjust (optimize) the protection mechanisms by analyzing the state of the complex of automated systems involved in the processing of restricted access information obtained during the operation of cyber-physical systems for compliance with the required level of information security. Each subsystem processing the target information is assigned a specific security class. Optional barriers can be installed between subsystems of the same class, which ensures blocking of uncontrolled access to restricted data; management of components of all protected data. The results of approbation, representing the evaluation of using the proposed algorithm to modernize the subsystem of CPS protection against malware introduction, indicate its high efficiency.

Three-dimensional spatial orbital angular momentum holography

The degree of freedom of orbital angular momentum of light has been used as a new information carrier in optical holographic information processing technology. However, current research on orbital angular momentum holography mainly focuses on two-dimensional orbital angular momentum holography, where the reconstructed two-dimensional holographic image is located in a certain plane in three-dimensional space. How to further implement three-dimensional spatial orbital angular momentum holographic technology and use it to increase the information capacity of holographic communication is still a blank. Here, we implement three-dimensional spatial orbital angular momentum holographic technology based on the degrees of freedom of orbital angular momentum and the positional degrees of freedom of reconstructed two-dimensional images in three-dimensional space. In other words, in the three-dimensional spatial orbital angular momentum holography, the acquisition of the target object image requires not only the correct orbital angular momentum state used for decoding, but also the correct spatial position where the object’s image is detected. In addition, we further investigate the three-dimensional spatial orbit angular momentum holographic multiplexing technology and point out that this multiplexing technology can be used for information encryption. Compared with traditional two-dimensional orbital angular momentum holography, three-dimensional spatial orbital angular momentum holography uses an additional degree of freedom. Therefore, the encryption scheme based on three-dimensional spatial orbital angular momentum holographic technology can further improve the security level of information. Our simulation results and experimental results have verified the feasibility of three-dimensional spatial orbit angular momentum holographic technology and three-dimensional spatial orbit angular momentum holographic encryption technology.

Water-sensitive fluorescent microgel inks to produce verifiable information for highly secured anti-counterfeiting.

The decryption and verification of encrypted information via a simple and efficient method is always difficult and challenging in the field of information security. Herein, a series of water-sensitive fluorescent microgels are fabricated for highly secured anti-counterfeiting with authenticity identification. The initial negatively charged microgels (MG) are made up of N-isopropylacrylamide (NIPAM), acrylic acid (AAc) and anthracen-9-yl acrylate (9-ANA, blue fluorescent monomer). The prepared MGs can bind cationic fluorescent dyes such as 5-aminofluorescein (FITC, green fluorescent dye) and rhodamine B (Rh B, red fluorescent dye) via electrostatic interaction, emitting multi-fluorescent colors based on the fluorescence resonance energy transfer (FRET) process. Furthermore, the fluorescence colors of MG-derived systems can be rapidly changed by swelling in water, which can block the FRET process and change the aggregation state of dyes. With the assistance of inkjet printing, multi-color security patterns can be designed and encoded, which can be revealed by UV irradiation and further verified by water stimulation. This study has pioneered a novel strategy to verify the authenticity of decrypted information, which greatly improves the security level of information.

МЕТОДИ ТА ЗАСОБИ ЗАХИСТУ РЕСУРСІВ В КОМП’ЮТЕРНІЙ SDN-МЕРЕЖІ

The work is dedicated to the analysis and improvement of methods and tools for building the architecture of software-defined networks (SDNs). A crucial aspect involves comparing the differences between network management using traditional methods and utilizing an SDN controller. Primary attention is given to the development of security models based on software-defined networks.The research is grounded in the analysis of specific cases involving the use of such networks, including gathering opinions and expert assessments from professionals in the field. It leverages publicly available information on methods and tools for securing the architecture of software-defined networks. SDN technology provides greater flexibility and speed in implementing security measures, allowing real-time responses to threats. In contemporary conditions, where cyber threats are becoming more complex and pronounced, SDN networks enable the detection of attacks, blocking malicious actions, and applying security policies in real-time. However, the increasing complexity of cyber threats and constant technological changes necessitate further development and enhancement of the information security of SDN network resources for companies. There is a need for further analysis and improvement of methods and tools for protecting information and other resources in computer-based SDN networks. The necessity for further analysis and improvement of methods and tools for protecting information and other resources in computer-based SDN networks serves as the foundation for this research. As a result, an enhancement in the level of information security for SDN network resources has been achieved by: 1) reducing the intervention time in the network; 2) applying an improved method of traffic processing based on network security of packet flows, allowing desired network applications to efficiently manage forwarding.

Determining the patterns of using information protection systems at financial institutions in order to improve the level of financial security

This paper reports a study aimed at determining the features of using information protection systems at financial institutions in order to improve the level of financial security. It has been proven that under the conditions of digitization of the business environment, information provision is the basis of financial security at both the macro and micro levels. Information has become a strategic resource that needs protection due to the spread of cybercrime. The level of efficiency of information provision and the level of financial security of Ukraine was determined, and the relationship between them was confirmed. Attention is focused on the need to improve these indicators. It has been proven that an effective information protection system enables economic entities to resist dangers and threats. It was substantiated that the intensification of the processes of digitalization of economic activity had created prerequisites for the growth of risks and threats to the integral, uninterrupted, protected circulation of information resources of financial institutions, which leads to huge financial losses. This requires improvement of existing information protection systems. A topology of information protection systems has been presented. An algorithm for building effective information protection systems of financial institutions was proposed, which includes system vulnerability assessment, system assessment for compliance with security standards, penetration testing, and application assessment. Its application would allow financial market entities to promptly respond to real and potential threats, increase the level of information security, and ensure financial stability. The results of the study could also be used by state and local authorities to devise the principles of financial security management at the macro level under the conditions of the digital economy

ПРОЕКТИРОВАНИЕ ВСПОМОГАТЕЛЬНОЙ АВТОМАТИЗИРОВАННОЙ СИСТЕМЫ ПРИНЯТИЯ УПРАВЛЕНЧЕСКИХ РЕШЕНИЙ НА ОСНОВЕ АНАЛИЗА УРОВНЯ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ

The aim of the scientific work is to create a methodology for designing an auxiliary automated management decision making system based on analysing information security level of intellectual resources of a large industrial enterprise. The methodology is based on the principle of comprehensive information security. The article is devoted to solving the problem of creating a convenient auxiliary tool for auditing information security events. The novelty of the work is the proposed creative concept of using the maximum amount of data on information security events to make a management decision (including a personnel management decision). The study results are recommendations for building an auxiliary automated system for auditing and analysing the information security level of intellectual resources of a large industrial enterprise.

MEASUREMENT OF INFORMATION SECURITY AND PRIVACY AWARENESS USING THE MULTIPLE CRITERIA DECISION ANALYSIS (MCDA) METHOD

Information security is an asset that has value so it must be protected, along with increasing assets it is undeniable that many people wish to gain access and control it so that behind the convenience in the digital world there are many risks to information assets. There are several cases that occur related to information security such as data theft, illegal access, information leakage and vandalism where this becomes the privacy of the user. So it is necessary to do research from the user's perspective to measure the level of information security and privacy awareness of students and lecturers as well as recommendations that will be suggested based on the results of measuring information security and privacy awareness. The objects in this research are students and lecturers at the XYZ University. The method used is Multiple Criteria Decision Analysis (MCDA) by measuring the dimensions of knowledge, attitude, behavior in six areas of information security and three areas of privacy. Data were obtained by distributing questionnaires using a Likert scale of 5. Based on the questionnaire from the respondents, it can be seen students and lecturers have awareness that is at a "good" level of 85% in information security while privacy is at a "good" level with a result of 89% but in the behavior dimension there are several areas that are included in the "average" level including the area passwords by 62%, mobile equipment area by 77% incident area by 70% and on privacy security on the behavior dimension there is one area namely the login activity area by 78% so this needs to be given recommendations for improvement in order to reach a "good" level by providing socialization/ training for students and lecturers

EVALUASI KEAMANAN INFORMASI PADA SMAN 1 XYZ MENGGUNAKAN INDEKS KAMI VERSI 4.2


 The importance of the process of evaluating information system security for a company, organization, or government agency whose goal is to carry out early detection of information leaks and even disruption of information systems. In this research conducted at SMAN 1 XYZ. The research being conducted was to determine the level of readiness and governance of information security based on ISO/IEC 27001:2013 standardization by using tools, namely the KAMI Information Security Index Version 4.2. In this research the method used to carry out the data collection process is to make direct observations on the objects used as research and questions and answers with the IT department that handles related information systems. Based on the research conducted, it was found that the maturity level of information security is that at the level of need for electronic devices, a score of 20 points is in line with the high KAMI index and is still Level I to Level II. Even though the result of the readiness assessment has a value of 245, this is a safety level of 1 which applies to SMAN 1 XYZ. To achieve a qualification level in accordance with the ISO/IEC 27001: 2013 standard, SMAN 1 XYZ must improve information security internally and externally, in this case external parties, and carry out security assessments on an ongoing and continuous basis.

Design of network information visualization security cognition system based on QSOFM network and FR algorithm

ABSTRACT Network information is complex, there is no lack of hidden risks of information to the user caused by bad effects. But analyzing and evaluating them is complex and requires more diverse and powerful techniques. This research will combine Fruchterman-Reingold (FR) information visualization algorithm and information security risk assessment method based on Quantum self-organizing feature map (QSOFM) network to build information visualization security cognitive system. By introducing quantum neurons into self-organizing feature mapping network (SOFM), a network information security evaluation model is constructed. The system can evaluate the security level of network information and visualize the evaluation results. The experimental results show that the system has fast response speed and strong interactivity. The accuracy of QSOFM algorithm is 86%, 12% higher than the traditional algorithm, which can provide more powerful technical support for the visual security cognition of network information.

MONGOLIA’S EXPERIENCE IN E-GOVERNANCE AND CURRENT CHALLENGES

Although, Mongolia carried out “E-Government Mongolia” national programme in 2005-2012, the National Programme to develop Integrated Registration System in 2008-2012, and the E-Governance National Programme in 2012-2016, the operation to separate information communication networks and services could not be successfully completed. The main reason is the inertia of mentality of the previous system to continue the state ownership of databases of all types, to monopolize of all profits for the government and to use for exercising power in implementing activities in information and communication sector resulting in ineffectiveness of political system and governance. In order to assess the digital governance issues and challenges of Mongolia, we intend to analyse policy documents, and conduct case research and make an inductive conclusion. First, we examined the implementation of the Government policy of Information and Communication Development. The Government of Mongolia prioritizes the following 6 tasks towards the development of the sector development. These include: a) legal framework, b) networks and infrastructure c) service d) innovation and research, e) production, f) investment and competition g) information security and h) e-governance. Therefore, we aimed to examine the implementation of these tasks, their stages, and their mutual dependence. Second, to evaluate the overall implementation of the E-Governance, we analyse historical development, political decisions regarding e-governance, legal framework, and negative consequences in government service and information transparency through cases. Large majority of the population (78.2%) or 2,602,000 people use internet and social networks. This indicates that there is very high internet usage among the adult population. To be more precise, individuals between the ages of 14 and 64 constitute 64.4% of the population, indicating a significantly high proportion. There are 496 government services that are provided online. Among other services, most widely used digital services include: one stop service, Electronic kiosk of government service, “Khur” government information exchange system, “Dan” recognition and access system, E-Mongolia, and E-barimt application . Our research findings suggest the following conditions for the major difference of above-mentioned quantity and percentages, slow progress of digital transformation. These are: Legal environment for digital services is not established; Open databases are not accessible, only government can use them; Although government services can be provided online, society has not yet recognized its security and still tends to demand for paper-based certification; Information security is not guaranteed; Databases are only used for government decisions, but frequency of sudden changes in the information security level sets up the various discrimination in the society. The key findings of the research indicate the difference between the above-mentioned figures is large and the digital transformation is not effective due to the following conditions.In conclusion, the lack of a legal framework for e-government is caused by the lack of a unified public management or absence of central ministry on the relevant policy. Due to the lack of coordination between the use of the database and other policies, citizens are obliged to provide in-person services by government agencies and provide additional paper documentation. The fact that the usage of digital signatures is limited, with only a small percentage used in public tenders and banking services, is becoming the main pressing issue.

DEVELOPMENT OF A SECURE LOGGING AND MANAGEMENT SYSTEM FOR PENETRATION TESTING

The sphere of information security in Kazakhstan affects an increasing number of industries every year, and penetration testing is also gaining popularity, as it is one of the key methods for assessing the security and risks of a company. This article is devoted to the research and development of a web application to provide full control over the penetration testing process: monitoring the implementation of tasks and projects, reporting on all processes, dividing tasks between employees. The management system automatically selects recommendations for eliminating vulnerabilities and generates reports on penetration testing. As a classification algorithm, a decision tree is used. Differentiation of users by access levels, structured data storage, automatic recording of test results, generation of reports and selection of recommendations for eliminating vulnerabilities make the web application more perfect and convenient compared to similar systems. The importance of this study lies in the simplification of the implementation of penetration testing and the development of this service in Kazakhstan, which will improve the level of information security in enterprises of all industries.