Privileged Access Research Articles

Zero Trust Architecture in Cloud Computing: A Paradigm Shift in Platform Engineering Security

This article explores the paradigm shift in platform engineering security brought about by Zero Trust Architecture (ZTA) in cloud computing environments. As organizations increasingly adopt cloud-native architectures and microservices, traditional perimeter-based security models prove inadequate for protecting complex, distributed systems. The article examines the core principles of ZTA, including robust identity and access management, least privilege access, micro-segmentation, continuous monitoring, and secure communication. It delves into the implementation strategies of ZTA in platform engineering, highlighting its benefits such as enhanced security, improved compliance, increased resilience against threats, adaptability to dynamic environments, and improved visibility. The article also addresses the challenges of implementing ZTA, including complexity, potential performance concerns, user experience considerations, cost implications, and the risk of vendor lock-in. Through an analysis of industry trends, adoption rates, and quantified benefits, the article demonstrates how ZTA addresses critical security challenges in modern cloud environments, ultimately enabling organizations to create more resilient, compliant, and adaptable platforms in the face of evolving cyber threats.

Zero Trust Cybersecurity: Procedures and Considerations in Context

In response to the increasing complexity and sophistication of cyber threats, particularly those enhanced by advancements in artificial intelligence, traditional security methods are proving insufficient. This paper provides an overview of the zero-trust cybersecurity framework, which operates on the principle of “never trust, always verify” to mitigate vulnerabilities within organizations. Specifically, this paper examines the applicability of zero-trust principles in environments where large volumes of information are exchanged, such as schools and libraries, highlighting the importance of continuous authentication (proving who users are within the network), least privilege access (providing only access to what users specifically need), and breach assumption (assuming a breach has or will occur and thus operating to limit the spread through the use of multiple checkpoints throughout the network). The analysis highlights avenues for future research that may help preserve the security of vulnerable organizations.

Horizontal face information is the main gateway to the shape and surface cues to familiar face identity.

Humans preferentially rely on horizontal cues when recognizing face identity. The reasons for this preference are largely elusive. Past research has proposed the existence of two main sources of face identity information: shape and surface reflectance. The access to surface and shape is disrupted by picture-plane inversion while contrast negation selectively impedes access to surface cues. Our objective was to characterize the shape versus surface nature of the face information conveyed by the horizontal range. To do this, we tracked the effects of inversion and negation in the orientation domain. Participants performed an identity recognition task using orientation-filtered (0° to 150°, 30° steps) pictures of familiar male actors presented either in a natural upright position and contrast polarity, inverted, or negated. We modelled the inversion and negation effects across orientations with a Gaussian function using a Bayesian nonlinear mixed-effects modelling approach. The effects of inversion and negation showed strikingly similar orientation tuning profiles, both peaking in the horizontal range, with a comparable tuning strength. These results suggest that the horizontal preference of human face recognition is due to this range yielding a privileged access to shape and surface cues, i.e. the two main sources of face identity information.

Resisting technological solutionism in open universities in the time of global digital convergence

PurposeThis purpose of this paper is to explore the future of open universities (OUs), particularly in developing Asia, focusing on the potential risks associated with technological solutionism, or the popular belief that educational problems can be readily solved through technological means. This exploration is pertinent as the initial advantages that OUs once held have significantly diminished and competing higher education institutions worldwide are converging on a digital future.Design/methodology/approachThe qualitative method of empathy-based stories (MEBS) was employed as the primary research method for drawing data from sampled OU teachers. The obtained data were parsed via textual analysis and the lens of critical discourses on technology and higher education.FindingsThe study shows that, in the future envisioned by the sampled OU teachers, students’ lack of privileged access to frontier technologies is no barrier to learning success. It also emphasises that learning outcomes have causality beyond technological determinism, and that educational problems, which OUs may deem as requiring technological solutions, are often non-technological in nature and require no technological fixes.Originality/valueCritiques of techno-solutionism, such as the present study, are virtually absent in the context of OUs in developing Asia. For this very reason, this study is vital and serves as a guardrail while these OUs seek to reformulate their respective value propositions in the time of global digital convergence.

A designated private set based trapdoor authentication scheme for privacy preserving trust management in decentralized systems

Authentication is crucial for network system security, relying on methods such as passwords, ID cards, biometrics, and behavioral characteristics. The conventional centralized authentication may lead to potential performance bottlenecks and privacy risks such as key exposure, single point of failure. Decentralized authentication systems using cryptographic techniques aim to address these issues but often tradeoff between flexibility and communication efficiency. In this paper we propose a new cryptographic concept called designated private set-based trapdoor authentication (DPSBTA) for flexible and efficient trust management in decentralized systems. DPSBTA eliminates the need for a trusted authority, with users’ access privileges defined by their private sets. During the authentication process, each server can designate an element set and only if a user holds adequate elements which are contained in the designated set can he obtains a credential from the server. The key features of DPSBTA include: decentralized trapdoor authentication management, without a trusted authority, conducted in a double threshold manner; privacy preservation, as servers do not know users’ element holdings or credential generation; round-optimal communication, with only two rounds of interaction between users and servers. We present the generic construction, security models, and concrete algorithms with correctness proof. The theoretical proof and the performance evaluations demonstrate the tangible security and high efficacy of the proposed DPSBTA.

ORR-CP-ABE: A secure and efficient outsourced attribute-based encryption scheme with decryption results reuse

Attribute-based encryption that supports computation outsourcing has been a promising approach to implement fine-grained access control in the Internet of Things (IoT). However, existing outsourcing schemes only focus on minimizing computation on user terminals while overlooking the significant computational burden faced by outsourcing devices. In IoT scenarios with a large volume of concurrent outsourcing requests, such burden can overwhelm outsourcing devices, leading to inefficient decryption execution. This paper, for the first time, proposes ORR-CP-ABE, an outsourced attribute-based encryption scheme with decryption results reuse. In ORR-CP-ABE, users with equivalent access privileges are grouped and issued group-oriented translation keys. Through translation, outsourcing devices can directly reuse previously calculated decryption results of other group members, eliminating redundant outsourced task execution. To further alleviate the burden on outsourcing devices, we use Named Data Networking as the underlying network layer to deploy translation functions and distributed caching for results reuse in the edge network. Furthermore, the reuse behavior in our scheme is configured to be under the control of both the data owner and the initial invoker of results. The security analysis proves the security of ORR-CP-ABE. Performance analysis indicates that it significantly reduces the burden on outsourcing devices and improves decryption efficiency by up to 90% compared to the baseline.

The epistemic power of the police

This article uses movements against police brutality as a starting point to rethink our theorizations of police power, asking how the police maintain their dominance over oppressed groups, and what it takes to challenge it. I argue that an important, but undertheorized dimension of police power is epistemic power, the ability to control what is known and what remains unknown about policing practices. Epistemic power derives from (1) the police's control over the production and non-production of data about crime and policing; (2) the assumption that police officers are more credible than their targets; and (3) their privileged access to the media. Using France as a case study, I show how the police draw on epistemic power to produce ‘truth’ and manufacture ignorance about their practices, and I examine activist strategies to challenge and disrupt this power.

InvesTEE: A TEE-supported Framework for Lawful Remote Forensic Investigations

Remote forensic investigations, i.e., the covert lawful infiltration of computing devices, are a generic method to acquire evidence in the presence of strong defensive security. A precondition for such investigations is the ability to execute software with sufficient privileges on target devices. The standard way to achieve such remote access is by exploiting yet unpatched software vulnerabilities. This in turn puts other users at risk, resulting in a dilemma for state authorities that aim to protect the general public (by patching such vulnerabilities) and those that need remote access in criminal investigations. As a partial solution, we present a framework that enables privileged remote forensic access without using privileged exploits. The idea is to separate the remote forensic software into two parts: a Forensic Software, designed by law enforcement agencies to execute investigative actions, and a (privileged) Control Software, provided by the device vendor to selectively grant privileges to the Forensic Software based on a court warrant within the rules of criminal procedure. By leveraging trusted execution environments for running the Control Software in a tamper-proof manner, we enable trustful deployment and operation of remote forensic software. We provide a proof-of-concept implementation of InvesTEE that is based on ARMv8-A TrustZone.

A robust multi-key authority system for privacy-preserving distribution and access control of healthcare data

Innovation in medical technology and communication has rapidly empowered the development of smart healthcare devices. This has led to privacy breaches, threats and vulnerabilities to sensitive patient data that result in unwanted or targeted advertising. Previous research has focused on protecting access to sensitive patient data from unauthorized entities, especially by defining roles of healthcare entities in the overall system with their access privileges. However, such efforts need to be further robust due to the involvement of a single key authority that may lead to a critical point of failure. In this paper, this vulnerability has been addressed by developing a novel approach to crucially increase the number of key authorities using homomorphic encryption. The proposed approach ensures genuine access to the verified entity by forming a subsystem of t key authorities from a total of n authorities (t<n). This creates rigorous challenge to a malicious attacker, obfuscating the selection and functioning of key access packets in a multi-key authority setup. The results of the proposed approach achieve medical data confidentiality, entity authentication, and strategic data sharing. The security of the proposed approach is assessed for different vulnerabilities of the overall system using a challenge–response game model. Moreover, the proposed approach is found to be better and secure as compared to existing schemes.

The true self in reflections? Visual self‐recognition and the Big Five

AbstractTypically, individuals are motivated to see themselves in a flattering light regarding their physical and personality characteristics. We suggest that visual self‐perception is anchored in the true self which is largely the self‐enhancing self, and may also reflect the privileged access to one's traits and internal states. Here, we examine the impact and limits of self‐enhancement motivation and egocentric bias on individuals’ recognition of variations of their portraits in terms of the Big Five personality dimensions. We predict that individuals recognise themselves better in positively altered portraits, namely, portraits looking more agreeable, conscientious and open. We also predict that self‐enhancement is anchored in reality: Individuals recognise themselves less in strongly altered than in slightly or non‐altered portraits. In Study 1, we measure the directions of self‐recognition distortions by investigating in which random variations of their portraits individuals recognise themselves. In Study 2, relying on a mouse tracking paradigm, we additionally measure the degree of distortion, and the conflict individuals experience during the self‐recognition task. Results of both studies mainly demonstrate self‐recognition distortions towards agreeableness, conscientiousness, openness and neuroticism. Moreover, results from Study 2 reveal that self‐recognition is anchored in reality. Findings of two studies applying different methods convergently show systematic biases in self‐recognition regarding the Big Five dimensions, both enriching understanding of the self‐enhancement processes and demonstrating that the methods applied might be useful for future research focusing on self‐recognition.

Dependency in the Digital Age? The Experience of Mercado Libre in Latin America

ABSTRACTThis article uses Mercado Libre, the leading digital platform company in Latin America, as an illustrative case to analyse the effect of regional platforms on development, by considering their interplay with both global leaders and local actors. Building on dependency theory, the article identifies the company's structural dependence on algorithms and computing power provided by the largest information technology (Big Tech) companies in the United States. Nonetheless, it also finds that Mercado Libre is at the frontier in applied data analysis solutions tailored for its businesses. Together with a privileged access to personalized and cross‐fertilized market and financial datasets, the company's internal and purchassed technologies are the source of asymmetric relationships with its platforms’ users. The article conceptualizes Mercado Libre's place in digital capitalism as extractivist with local actors and, just like local elites when dependency theory was first formulated, it is complicit with global powers. But, unlike those elite firms, it is not technologically laggard, and its value capture is underpinned by its technological advantage. Thus, this article conceptualizes (digital) dependency as multiple layers of economic power in which leading firms from the peripheries occupy intermediate and interconnecting positions. It shows that, while these regional leaders operate at the technological frontier, economic power relations based on technological asymmetries remain crucial for studying underdevelopment.

Policy-Based Contextual Access Control Mechanism for Smart IoT Devices

Access control remained an important aspect of computer security, and it has been the focus of extensive research over the past several decades. Access control mechanisms generally composed of two fundamental components: authentication and authorization. Authentication refers to verifying the identity of an entity, and authorization guarantees that only authenticated entity or devices can access the permitted devices or other resources. Various traditional access control schemes, such as Access Control Lists (ACLs), Role-Based Access Control (RBAC), and Attribute-Based Access Control (ABAC) exist, but these have certain limitations that hinder their direct implementation in the Internet of Things (IoT). For instance, ACLs maintain user-specific access privilege lists, which are feasible for environments with limited users and devices, but impractical for large scale systems like IoT. RBAC assigns devices access through roles associated with permissions, however role management in dynamic IoT environments poses significant challenges. ABAC grants access based on user and devices attributes that requires certain attribute criteria for authorization. We advocate that IoT environments are dynamic in nature and consist of very large volumes of smart IoT devices (such as smart sensors, smart phones and gadgets) that which introduce unique access control challenges. One significant challenge is providing dynamic access to smart IoT devices, as opposed to relying on static rules, roles, or attributes. Considering these challenges, this research advocates for a novel access control scheme tailored for accessing smart IoT devices in internet of things environments. The prototype implementation of the proposed approach is carried out along with conducting the usability study to evaluate the performance and suitability of the proposed system for real world internet of things (IoT) scenarios.

Continuous Integration for New Service Deployment and Service Validation Script for Vault

Modern cloud-native applications demand robust security measures to safeguard sensitive data such as passwords, API keys, and encryption keys. Managing these secrets securely within Kubernetes clusters presents a significant challenge. In response, this project proposes a comprehensive solution leverag- ing HashiCorp Vault, Kubernetes, and Docker to enhance secret management and strengthen overall security posture.HashiCorp Vault serves as a centralized secrets management tool, provid- ing encryption, access control, and auditing functionalities. By integrating Vault with Kubernetes, secrets can be dynamically generated, securely stored, and automatically injected into ap- plication pods at runtime. This approach reduces the exposure of sensitive information within containerized environments and mitigates the risk of unauthorized access. The project architecture involves deploying Vault within the Kubernetes cluster, utilizing Docker containers for seamless encapsulation and portability. Kubernetes’ native integrations with Vault, such as the Kubernetes Auth method and the Vault Agent Injector, streamline the authentication and authorization processes, ensuring secure communication between applications and Vault. The project involves deploying Vault in Kubernetes for secrets management, ensuring High Availability. It focuses on generating, storing, and managing secrets securely, leveraging Vault’s dynamic secrets engine for automatic rotation. Integration with Kubernetes employs authentication methods like Service Accounts and RBAC for granular access control. Dockerization ensures application consistency and portability, with Vault Agent containers enabling seamless secret injection. Security best practices, including least privilege access and encryption, are prioritized, along with regular auditing and monitoring. Overall, the project aims to establish a robust secrets management solution within Kubernetes while empha- sizing resilience, security, and compliance in handling sensitive information. Index Terms—Docker, DevOps, CI/CD, Automation, Secrets, Kubernetes, Vault, Security

Self-calibration strategies for reducing systematic slope measurement errors of autocollimators in deflectometric profilometry.

Deflectometric profilometers are used to precisely measure the form of beam shaping optics of synchrotrons and X-ray free-electron lasers. They often utilize autocollimators which measure slope by evaluating the displacement of a reticle image on a detector. Based on our privileged access to the raw image data of an autocollimator, novel strategies to reduce the systematic measurement errors by using a set of overlapping images of the reticle obtained at different positions on the detector are discussed. It is demonstrated that imaging properties such as, for example, geometrical distortions and vignetting, can be extracted from this redundant set of images without recourse to external calibration facilities. This approach is based on the fact that the properties of the reticle itself do not change - all changes in the reticle image are due to the imaging process. Firstly, by combining interpolation and correlation, it is possible to determine the shift of a reticle image relative to a reference image with minimal error propagation. Secondly, the intensity of the reticle image is analysed as a function of its position on the CCD and a vignetting correction is calculated. Thirdly, the size ofthe reticle image is analysed as a function of its position and an imaging distortion correction is derived. It is demonstrated that, for different measurement ranges and aperture diameters of the autocollimator, reductions in the systematic errors of up to a factor of four to five can be achieved without recourse to external measurements.

An Extensive Analysis on Zero Trust Architecture

Zero Trust Architecture (ZTA) addresses a change in perspective in cyber security, challenging the conventional security-based model by expecting no certain trust inside or outside the network limits. This approach exemplifies the standards of constant confirmation, strong access controls, and the idea of "never trust, always verify" (Stafford, 2020). ZTA is intended to address the weaknesses inborn in conventional security models, particularly even with dynamic IT environments, cloud services, and the rising refinement of cyber-attacks. This paper presents a top-tobottom investigation of ZTA, its main components including severe identity verification, least privilege access, micro-segmentation, and multifaceted verification, as well as its fundamental relationship with Identity and Access Management (IAM) solutions. Moreover, this paper looks at the critical job of ZTA in lowering the attack surface, strengthening an organization's security posture, and ensuring regulatory regulations are being followed. This paper’s goal is to examine the shortcomings and weaknesses of conventional perimeter-based security models in the current digital environment and to suggest Zero Trust Architecture (ZTA) as a more potent security paradigm to deal with these issues. This research attempts to give insights into how businesses might switch from traditional security techniques to ZTA to improve their security posture.

Securing the Internet of Things: A Comprehensive Review of Security Challenges and Artificial Intelligence Solutions

One of the major needs and challenges of this century is the use of cutting-edge technology considering the industry 4.0 revolution. The Internet of Things (IoT) falls in the category of a cutting-edge example of such innovation in the computing and information industry. In IoT compared to classical networking methods practically; every device we employ is accessible at any time from any location. Nevertheless, IoT continues to encounter several security challenges, and the magnitude of cyber-physical security risks is escalating alongside the widespread use of IoT technologies considering Moore’s laws expected to be 30 billion devices by 2025. IoT will continue to face vulnerabilities and risks unless there is a comprehensive understanding and proactive approach towards tackling its security concerns. To ensure both the cyber and physical security of IoT devices during data gathering and sharing, it is imperative to evaluate security considerations, identify instances of cyber-attacks, and implement effective security protocols at multiple layers for making highly secured IoT. Conventional security measures like data classification, strict access controls, monitoring privileged account access, encrypting sensitive data, security awareness training, network segregation, segmentation cloud security, application security, patch management, and physical security employed in the realm of IoT are inadequate in light of the current security difficulties posed by the proliferation of sophisticated attacks and threats. Utilization of artificial intelligence (AI) techniques, especially machine and deep learning models is becoming a compelling and effective approach to enhance security of the IoT devices. This research article presents a comprehensive review of the key aspects of IoT security, including the challenges, potential opportunities, and AI-driven solutions. The primary goal of this article is to provide technical resources for cybersecurity experts and researchers working on IoT initiatives.

Hepatitis B virus infection among illegal drug users in Enugu State, Nigeria: prevalence, immune status, and related risk factors

IntroductionHepatitis B virus infection poses a global health challenge, particularly in low- and middle-income African countries. Illicit drug use exacerbates the problem, with drug users having a higher HBV infection risk and maintaining a quiet transmission pool. This study aimed to determine HBV infection prevalence, immune status, and risk factors among illegal drug users in Enugu State, Nigeria.Materials and methodsA cross-sectional study was conducted in Enugu State, using privileged access interviewer methods to enroll drug users. Pre-tested structured questionnaires were administered after informed consent was obtained. Blood samples were tested for HBsAg, HBsAb, HBeAg, HBeAb, and HBcAb using immunochromatographic rapid test kits. Statistical analysis was performed using SPSS version 25.ResultsOne hundred drug users were recruited into the study. Overall, 7% of the drug users had HBV infection. 61% were found to be susceptible to HBV infection, 15% showed serological evidence of immunity from HBV vaccination and 1% developed natural immunity from HBV exposure. Significant risk factors for HBV infection were age less than 20 years, young age (≤ 20 years) at drug initiation, being single, injecting drugs more than or equal to 20 times per month and injecting with used syringes.ConclusionThis study shows high intermediate endemicity of HBV infection among drug users, low vaccination uptake, and high susceptibility to HBV infection. This calls for the urgent inclusion of drug users in national HBV vaccination campaigns and the adoption of the World Health Organization’s recommendations on the prevention of viral hepatitis among people who inject drugs.

Zenith Armor : Advancing Security with Zero Trust Measures

In an era of unprecedented digital connectivity and evolving cyber threats, traditional security paradigms have proven insufficient to safeguard sensitive information. This research paper introduces "Zenith Armor," a comprehensive exploration and implementation of Zero Trust Architecture (ZTA) in the realm of cybersecurity. The paper delves into the core principles of ZTA, emphasizing the imperative shift from implicit trust to continuous verification in securing organizational assets. "Zenith Armor" stands as a testament to the evolving landscape of security frameworks, challenging conventional models by prioritizing identity verification, least privilege access, micro-segmentation, and continuous monitoring. The framework not only mitigates the risks associated with unauthorized access but also addresses the lateral movement of threats within a network, enhancing overall resilience. This paper outlines the essential components of Zenith Armor, emphasizing its dynamic risk assessment capabilities, stringent access control policies, and encryption measures for safeguarding data. Additionally, the framework's applicability to diverse devices, coupled with user education initiatives, creates a robust security ecosystem. The implementation extends beyond traditional network perimeters, incorporating adaptive security measures, and continuous updates. Furthermore, "Zenith Armor" recognizes the significance of a proactive approach to security incidents. A well-defined incident response plan, coupled with vendor and third-party access controls, ensures a swift and effective response to potential breaches. The research paper concludes with a reflection on the transformative potential of "Zenith Armor" in redefining organizational security postures. By embracing the Zero Trust paradigm, organizations can fortify their defenses against an ever-evolving threat landscape, thereby establishing a new zenith in cybersecurity resilience. Keywords—delves ,imperative, micro-segmentation,proactive, zenith.v

Scalability Performance Analysis of Blockchain Using Hierarchical Model in Healthcare.

Blockchain technology has become crucial in improving the privacy and security of enterprise applications in the cyber world. However, scalability has become a significant concern for researchers in large organizations, especially those with complex hierarchies and access privileges. As a result, the existing models and consensus algorithms suffer from various issues. Medical centers and healthcare providers are particularly affected by this problem due to the vast amount of data, making it a critical weakness of traditional database management systems. To address this issue, the authors propose a hierarchical model within the Hyperledger Fabric enterprise application, focusing on the healthcare sector as a use case. This model includes multiple organizations at different levels of the hierarchy, such as hospitals, hospital governance, and insurance companies. The initial implementation of this model includes two levels of hierarchy, demonstrating networks of hospitals joining an insurance company. The primary objective of the experiment is to test and improve the network's performance using this model. The model's performance is evaluated by manipulating and scaling environmental factors such as the number of organizations, transaction numbers, channels, block intervals, and block sizes. The benchmarking tool used for this assessment is Hyperledger Caliper, which measures indicators such as success and failure rates, throughput, and latency. Currently, the research focuses only on testing the model's scalability using patient data.

Exploring Iot Embedded Systems Along the Line of Identity Access Management for Enhanced Health Data Security

A. Overview of IoT Embedded Systems The pervasiveness of Internet of Things (IoT) embedded systems in the digital era has significantly transformed numerous industries, including healthcare. These interconnected devices, capable of collecting, transmitting, and analyzing data, offer immense potential to improve healthcare service efficiency, accessibility, and quality. However, the escalating volume of sensitive health data being generated and exchanged necessitates the implementation of robust security measures. A critical element in this regard is Identity and Access Management (IAM), which governs the control of user identities and their access privileges within a specific system [1].