Information Infrastructure Protection Research Articles

БАЗОВІ АСПЕКТИ ЗАХИСТУ КОНФІДЕНЦІЙНОЇ ІНФОРМАЦІЇ НА ОБ’ЄКТАХ КРИТИЧНОЇ ІНФОРМАЦІЙНОЇ ІНФРАСТРУКТУРИ

The rapid development of information and communication technologies has increased the vulnerabilities of various networks, systems and objects as well as made it much more difficult to ensure their reliable protection and security. All these factors have led to the fact that the world's leading countries have begun to pay considerable attention to cybersecurity and critical information infrastructure protection. However, the protection of various types of information with restricted access (in particular, confidential information) at critical infrastructure objects remains unexplored. With this in mind, the paper analyzes the existing approaches of the world's leading countries to the confidential information protection at critical infrastructure. The analysis revealed that today there are no comprehensive, multifunctional methods of protecting confidential information at critical information infrastructure. In addition, the classification of critical information infrastructure objects according to information security requirements is developed. This classification by determining the type of processing information, possible access modes and criticality category, allows to ensure unity of approaches to protection of these objects belonging to different types, including information systems, automated control systems and information-telecommunication networks.

АНАЛІЗ КРАЩИХ СВІТОВИХ ПРАКТИК ЩОДО ЗАХИСТУ КРИТИЧНОЇ ІНФОРМАЦІЙНОЇ ІНФРАСТРУКТУРИ

According to the large number of cyber incidents that occur every day, the process of critical infrastructure protection is an important not only technical but also scientific task. However, not all states in the world have an opportunity to provide high-quality protection of such infrastructure at a high level. Based on the fact that the critical information infrastructure protection should be managed at the state level, states need to develop a regulatory framework to address the above issue. Considering the legal framework of Ukraine, as in most post-Soviet countries, there is no effective approach to the protection of critical information infrastructure, such as in the USA or in the EU. The legislation of Ukraine identifies only certain objects of the socio-economic sphere, emergencies where they can lead to socially dangerous consequences, while a single procedure for identification and classification of critical infrastructure is not developed. A number of basic terms in the field of critical infrastructure protection from cyber threats, including “critical infrastructure” term, remain normatively vague. The mechanism of organization of activity and interaction of state and private structures in the process of critical infrastructure protection needs scientific substantiation. In this paper, the analysis of the world’s best practices concerning critical information infrastructure protection was carried out, that allows to improve qualitatively, at the state legislative level and practice, process of critical information infrastructure protection of Ukraine.

Efficient Analysis of IT Facility Security Vulnerability Topics by Utilizing R Programming

The recent development of domestic information and communications technologies (ICT) has made it possible to use the Internet anywhere in society, consequently exposing various security threats. Specifically, there is frequent leakage of personal information as well as system infringements, which are mainly caused by either internal or external security weaknesses. Besides, there is no exception for private companies or public corporations that have well-equipped security systems. In order to adequately prepare countermeasures against infringement incidents, security officers have been concerned every year. Hence, the government has designated information and communications infrastructures for major national facilities as a measure against the security threats and, since 2001, has enacted and promulgated the Information and Communication Infrastructure Protection Act. In this paper, we attempt to analyze the trends associated with the vulnerability status of information technology (IT) facilities, and to evaluate the weak points in IT facilities. And finally, we derive the most-mentioned vulnerabilities by effectively utilizing the R program to obtain statistical calculation and visualization, and thus, a common denominator for IT environments.

Stationary systems of cyberattacks detection and prevention for cyberprotection and cybercounterintelli-gence (by example USA)

Several state institutions deal with the providing of national cybersecurity. Each of them solvs its own number of tasks on critical information infrastructure protection from cyberattacks and cyberincidents. For example, the State Service of Special Communication and Information Protection, units of technical protection are responsible for cyberprotection of information resources and data processing infrastructure from cyberattacks of any origin. The Security Service of Ukraine defends national critical information infrastructure from cyberattacks of foreign intelligence services and cyberterrorists, and the National Police protects legal rights and interests of cityzens and society from cybercrimes. For solving their tasks, all of them use cyberattacks detection and prevention instruments. But these specific tasks, solved by both institutions, have to be affected on functional possibilities and characteristics of these means. Taking this into account, the article contains results of studying the foreign experience of creation the cyberattacks detection and prevention systems for cyberprotection and cybercounterintelligence, is determined key characteristics of the mentioned systems of different functions, which we need to conside in practical activity of building national cybersecurity system.

Milestones Related to the Development of Organizational Aspects of Cybersecurity and Protection against Cyber-Threats in the Czech Republic

Although the Czech Republic belongs to the most “internetised” countries in the world, its information and communication security policy (as well as the protection of the critical information infrastructure) lagged behind for a relatively long time, when compared to most of the remaining European countries. Building the hierarchy regarding the umbrella teams of the Cybernetic Emergency Response Teams (CERT) and Computer Security Incident Response Teams (CSIRT) type (regardless of whether we call them governmental, national or otherwise) was unthinkable without the contribution of the private sector that substituted many functions of the state in this field. The whole process can be understood as an interaction of international and national pressures appealing to the solution of the situation.

МЕТОДОЛОГІЧНІ ЗАСАДИ ОЦІНЮВАННЯ ТА ЗАБЕЗПЕЧЕННЯ БЕЗПЕКИ КРИТИЧНИХ ІНФОРМАЦІЙНИХ ІНФРАСТРУКТУР

The world trends in increasing of threats of natural and man-made nature, a level of terrorist threats, the number and complexity of cyberattacks have caused the actualization of needs for critical information infrastructure protection and improvement it's informational security and functional safety. A critical information infrastructure is considered as a set of information and telecommunication systems, improper operation of which may lead to the occurrence of an accident of critical infrastructure (energy, transport, etc.), as well as to decrease in quality of its services. The subject of paper’s study is the mechanisms for ensuring the safety (protection) of critical information infrastructures. The purpose of the paper is to substantiate the approach to the development of methodological foundations and technologies for assessing and ensuring the safety (protection) of critical information infrastructures taking into account the state and capabilities of modern information technologies. The methods used are: systems analysis methods, mathematical optimization methods, safety, and risk theory methods. The following results were obtained. The main tasks of the critical infrastructure protection system are formulated. The necessity of using the system of protection of critical information infrastructure as part of the system of protection of critical infrastructure is substantiated. The concept and principles of the methodology for assessing and ensuring the safety (protection) of critical information infrastructures are developed, working hypotheses, methods and models necessary for their implementation are suggested. The way of interaction of the elements of the proposed methodology, tasks and elements of the critical infrastructure protection system is shown. The results obtained are aimed at solving of one fundamental problem such as the existence of a contradiction between the intensive development of critical information infrastructures, negative influences and threats of various nature and the lack of methodological foundations, models, methods and information technologies for assessment and assurance of critical information infrastructure security and safety. The results obtained should be used to create elements of informational and analytical support for the decision maker in solving tasks related to the assessment and security (protection) of critical infrastructure

Contributors

Previous article FreeContributorsPDFPDF PLUSFull Text Add to favoritesDownload CitationTrack CitationsPermissionsReprints Share onFacebookTwitterLinked InRedditEmailQR Code SectionsMoreYuqing Feng (冯煜清) is associate professor of law at the School of Law, Southeast University, Nanjing, China. His current research centers on legal consciousness and judicial reforms in China.Ivan Franceschini is a Marie Skłodowska-Curie Fellow at the Australian National University’s Australian Center on China in the World and at Ca’ Foscari University of Venice. His research focuses on labor and civil society in China and Cambodia. He is coeditor of the open access journal Made in China: A Quarterly on Chinese Labour, Civil Society, and Rights.Xin He (贺欣) is visiting professor of law (2017–18) at Southwestern University of Finance and Economics, China, and professor of law at University of Hong Kong. His recent articles have appeared in American Journal of Sociology, Law & Society Review, China Quarterly, and American Journal of Comparative Law. His book Embedded Courts: Judicial Decision Making in China (with Kwai Ng) was published by Cambridge University Press (2017). His research interests include judicial reforms in China and Chinese family law.Shu Keng (耿曙) is University Research Fellow in the Department of Sociology and the Center for Local Government and Social Governance Studies, both at Zhejiang University. His research interests range from comparative political economy to organizational sociology, especially Chinese local governments, government-business relations, and cross-Strait trade relations.Xingmiu Liao (廖幸谬) is a PhD candidate in the Department of Political Science, Tsinghua University, Beijing. His main research is on Chinese politics and society, Chinese ethnic minorities, and the Chinese Communist Party’s United Front organization.Elisa Nesossi is an Australian Research Council Early Career Research Fellow at the Australian National University’s Australian Centre on China in the World. Her scholarship focuses on Chinese law, criminal justice, human rights, and civil society in contemporary China.Lynette H. Ong is an associate professor of political science at the University of Toronto. She is the author of Prosper or Perish: Credit and Fiscal Systems in Rural China (Cornell University Press, 2012) and of papers in Perspectives on Politics, Comparative Politics, The China Quarterly, Journal of Contemporary Asia, and Foreign Affairs, among others.Baoqing Pang (庞保庆) is assistant professor in the School of Sociology and Political Science and the Center for Social Governance and Public Policy, both at Shanghai University. His main research focuses on Chinese politics, especially the behavior of local governments.Edward Schwarck is a visiting research fellow at the Japan Institute of International Affairs in Tokyo. His research interests include political-military affairs in China.Munish Sharma is a consultant at the Institute for Defence Studies and Analyses, New Delhi, and a doctoral candidate at the Centre for East Asian Studies, Jawaharlal Nehru University, New Delhi. His research interests include cybersecurity, critical information infrastructure protection, space security, and defense technologies. He is the author of the monograph Securing Critical Information Infrastructure: Global Perspectives and Practices (2017) and coeditor of the book Securing Cyberspace: International and Asian Perspectives (2016).Wen-Hsuan Tsai (蔡文轩) is an associate research fellow at the Institute of Political Science, Academia Sinica, Taiwan. His main research is on Chinese political development, comparative politics, and comparative authoritarian regimes. He has recently published in China Journal, China Quarterly, Journal of Contemporary China, Modern China, Asian Survey, and Problems of Post-Communism.Lingna Zhong (钟灵娜) is assistant professor in the School of Politics and International Studies and a Fellow at the Centre for Reforms in Rural China at Central China Normal University, Hubei. Her main research interests are China’s cadre management system and studies of Chinese local government. Previous article DetailsFiguresReferencesCited by The China Journal Volume 80July 2018 Published on behalf of the Australian Centre on China in the World at the Australian National University Article DOIhttps://doi.org/10.1086/697399 Copyright 2018 by The Australian National University. All rights reserved.PDF download Crossref reports no articles citing this article.

European Union information security practice: a ukrainian prospect

Information technologies are developing at a rapid pace, bringing great benefits to mankind, but at the same time provoking huge dangers. Access to personal information, the impact of negative content on children, the modification and stealing of information, damage to information systems, cybercrime, etc. are signs of the use of information and communication technologies to undermine information security. Naturally, both states and organizations develop a number of mechanisms to prevent/overcome destructive information influences. The purpose of the article is to analyze how the EU experience in the field of information/cybersecurity has been/could be applicable in Ukraine. Since the early 21st century the EU has adopted a number of regulations, has created necessary empowered bodies and has developed strategies to eliminate threats in the information sphere. Legislation of the EU is being constantly improved. EU legal framework regulates access to personal data, public information, counterfeit payment issues, issues of online sexual exploitation of children, protection of classified information, prevention of attacks on information systems, protection of national information infrastructures. Trying to adapt its legal frameworks to the norms of the EU legislation, Ukraine adopted the law on “Processing personal data”, the law on “Access to public information”, “the Cybersecurity Strategy of Ukraine”, and the law on “Basic principles of providing cybersecurity of Ukraine”; established respective cybersecurity structures, specifically the National Coordination Center for Cyber Security, Cyberpolice, CERT-UA. In the article the author considers some challenges provoked by the mentioned legislation and offers personal ideas concerning the improvement of some cybersecurity aspects in Ukraine.

Network-Centric Monitoring for Cyber Incidents in Sectors of Critical State Infrastructure

Information and communication technologies implementation in most areas of human life is aimed at improving the efficiency of business processes, but the emergence of new vulnerabilities and cyberthreats generates cybersecurity incidents. To localize and neutralize incidents effective management techniques are necessary. These processes are very actual for critical information infrastructure of the state, because destructive influences on objects of critical information infrastructure can cause big losses for the state (human life, material and status losses). Known methods for incidents management are not oriented on some special components and parameters of the cyberspace. It complicates implementation of these methods in real information and communication systems. From this viewpoint, in this paper the concept of network-centric incident management was developed. It allows to identify the most important (real) objects of critical information infrastructure protection and cybersecurity incidents to predict the categories that arise as a result of specific cyberattacks and their risk level. Further research study consists in instrumental tools based on mentioned concept. These tools can be useful for incidents prediction (character and level of losses) in information and communication systems of state critical infrastructure objects.

\u2018Dialogue, partnership and empowerment for network and information security\u2019: the changing role of the private sector from objects of regulation to regulation shapers

The protection of cyberspace has become one of the highest security priorities of governments worldwide. The EU is not an exception in this context, given its rapidly developing cyber security policy. Since the 1990s, we could observe the creation of three broad areas of policy interest: cyber-crime, critical information infrastructures and cyber-defence. One of the main trends transversal to these areas is the importance that the private sector has come to assume within them. In particular in the area of critical information infrastructure protection, the private sector is seen as a key stakeholder, given that it currently operates most infrastructures in this area. As a result of this operative capacity, the private sector has come to be understood as the expert in network and information systems security, whose knowledge is crucial for the regulation of the field. Adopting a Regulatory Capitalism framework, complemented by insights from Network Governance, we can identify the shifting role of the private sector in this field from one of a victim in need of protection in the first phase, to a commercial actor bearing responsibility for ensuring network resilience in the second, to an active policy shaper in the third, participating in the regulation of NIS by providing technical expertise. By drawing insights from the above-mentioned frameworks, we can better understand how private actors are involved in shaping regulatory responses, as well as why they have been incorporated into these regulatory networks.

Auditing Community Software Development

Abstract In accordance with European efforts related to Critical Information Infrastructure Protection, in Hungary a special department called LRL-IBEK has been formed which is designated under the Disaster Management. While specific security issues of commercial applications are well understood and regulated by widely applied standards, increasing share of information systems are developed partly or entirely in a different way, by the community. In this paper different issues of the open development style will be discussed regarding the high requirements of Critical Information Infrastructures, and possible countermeasures will be suggested for the identified problems.

An immune-inspired multi-agent system for improved critical information infrastructure protection

No abstract available

Information infrastructure risk prediction through platform vulnerability analysis

The protection of information infrastructures is important for the function of other infrastructure sectors. As vital parts for the information infrastructure operation, software-based platforms, face a series of vulnerabilities and threats. This paper aims to provide a complementary approach to existing vulnerability prediction solutions and launch the measurement of zero-day risk by introducing a risk prediction methodology for an information infrastructure. The proposed methodology consists of four steps and utilizes the outcomes of a proper analysis of security measurements provided by specifications from the Security Content Automation Protocol. First, we identify software platform assets that support an information infrastructure and second we measure the historical rate of vulnerability occurrences. Third, we use a distribution fitting procedure to estimate the statistical correlation between empirical and reference probability distributions and verify the statistical significance of the distribution fitting results with the Kolmogorov–-Smirnov test. Fourth, we develop conditional probability tables that constitute a Bayesian Belief Network topology as means to enable risk prediction and estimation on security properties. The practicality of the risk prediction methodology is demonstrated with an implementation example from the electronic banking sector. The contribution of the proposed methodology is to provide auditors with a proactive approach about zero-day risks.

The Post-9/11 Federal Homeland Security Paradigm and the Adoptive Capacity of Public Administration Theory and Practice

THE POST-9/11 FEDERAL HOMELAND SECURITY PARADIGM AND THE ADOPTIVE CAPACITY OF PUBLIC ADMINISTRATION THEORY AND PRACTICE By Chaya R. Jain, Ph.D. A dissertation submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy at Virginia Commonwealth University. Virginia Commonwealth University, 2006. Major Director: William W. Newmann, Ph.D., Committee Chairman Associate Professor and Director, Undergraduate Programs L. Douglas Wilder School of Government and Public Affairs Virginia Commonwealth University The September 11, 2001 terrorist attacks redefined the federal approach to disaster planning. Prior to 9/11, disaster and emergency management meant preparedness for and response to natural and man-made emergencies such as floods, hurricanes, fires, and civil discord. The post-9/11 paradigm shift, a multi-pronged approach called “homeland security” strategy, now incorporates a multitude of manand nature-made disasters to include border and transportation security; emergency preparedness, response and recovery against chemical, biological, radiological and nuclear threats; as well as information analysis and infrastructure protection. These new priorities were communicated to the state and local governments. The purpose of this descriptive, cross-sectional study is two-fold: to analyze the post-9/11 federal homeland security (FHS) priorities’ acceptance among the Virginia’s

Public-Private Partnerships: A Softt Approach to Cybersecurity? Views from the European Union

This chapter addresses public-private partnerships (PPPs) in cybersecurity. PPPs allow the government and key Information and Communications Technology operators to pool their resources and know-how to tackle several aspects of cybersecurity, such as critical information infrastructure protection and the fight against cybercrime. The nature and functioning of these partnerships raise a number of questions. What are PPPs in practice and what is their rationale? Are they keeping up with their promise of increased security? Do PPPs have any adverse impact on society? This chapter offers answers to these three questions from a European Union (EU) perspective. Accordingly, I define the rationale for PPPs, and then, building on the taxonomy developed by the European Network and Information Security Agency (ENISA), I investigate examples of existing regional and international/transnational partnerships. As for the question as to whether PPPs are keeping up with their promise of better addressing cyber-challenges, I argue that it is necessary to analyse the complex landscape of the PPPs as a whole, taking into account the risk of ‘societal collateral damage’ and the partnerships’ contrasting objectives.

고출력 전자기파 방호 제도 도입에 관한 연구

Nowadays, national critical infrastructures have been known to be highly vulnerable to the EMP threats which are internationally growing. But their realistic solutions have been not made by the lack of detailed rules and regulations in current laws, however, which cover most of cyber threats. This paper takes a look at the domestic and overseas trends on the EMP protections, and proposes the revision directives of relevant laws and the contents included into the proposed legislation. Among them, the amendment of the current Information Infrastructure Protection Act is considered to be the most effective, including provisions on protected informations, industrial promotions, R&D su- pports, education, etc. Anyway, this paper is expected to be helpful for introducing an effective legal scheme on the CIP against EMP threats. domestic rule.

Response to the Commonwealth of Australia Attorney General's Discussion Paper on Mandatory Data Breach Notification (October, 2012)

This submission contends that a mandatory data breach notification scheme should be implemented in Australia, initially via the Privacy Act, as suggested by the ALRC and outlined in the Discussion Paper. However, whilst mandatory data breach notification schemes are extremely useful at highlighting the extent of problems, these schemes do not have the regulatory tools to remedy the problems that they uncover. Moreover, the utility of implementing a data breach notification scheme via the Privacy Act is likely to diminish over the medium to long term given the limits of notification as a consumer remedy and the conceptual conflict at the heart of data breach notification regimes. In order to maximise the potential outcomes of a mandatory data breach notification scheme, the purpose of data breach notification should be considered within a much wider ambit – the protection of critical information infrastructure protection. This requires a revisioning of the purpose of notification in conjunction with the development and implementation of new regulatory structures to coordinate remedial responses. An Australian mandatory data breach notification should therefore be viewed in a comprehensively different perspective that regards different levels of social activity and a re-evaluation of the scheme’s role. The revision moves beyond the limited application of individual rights and shifts regulatory focus to the societal interests that pertain to the protection of personal information and the infrastructures of information exchange. An Australian mandatory data breach notification scheme could therefore provide a transitory passage that attempts to take regulation from the identification of a significant problem (e.g. inadequate information security of personal information that requires notification) eventually to a potential solution (e.g. the implementation of effective security measures and competent monitoring).

The European cooperative approach to securing critical information infrastructure

This paper provides an overview of the EU approach to securing critical information infrastructure, as defined in the Action Plan contained in the Commission Communication of March 2009, entitled ‘Protecting Europe from large-scale cyber-attacks and disruptions: enhancing preparedness, security and resilience’ and further elaborated by the Communication of May 2011 on critical Information infrastructure protection ‘Achievements and next steps: towards global cyber-security’. After explaining the need for pan-European cooperation in this area, the CIIP Action Plan is explained in detail. Finally, the current state of progress is summarised together with the proposed next steps.

Protecting Critical Infrastructure in the EU

Critical infrastructures such as energy, communications, banking, transportation, public government services, information technology etc., are more vital to industrialized economies and now than ever before. At the same time, these infrastructures are becoming increasingly dependent on each other, such that failure of one of them can often propagate and result in domino effects.The emerging challenge of Critical (information) Infrastructure Protection (C(I)IP) has been recognized by nearly all member states of the European Union: politicians are increasingly aware of the threats posed by radical political movements and terrorist attacks, as well as the need to develop better response capacity in case of natural disasters. Responses to these facts have been in line with the available resources and possibilities of each country, so that certain countries are already quite advanced in translating the C(I)IP challenge into measures, whereas others are lagging behind. In the international arena of this policy domain, Europe is still in search of a role to play. Recently, CIIP policy has been integrated in the EU Digital Agenda, which testifies to the growing importance of securing resilient infrastructures for the future.This important and most topical Task Force Report is the result of in-depth discussions between experts from different backgrounds and offers a number of observations and recommendations for a more effective and joined-up European policy response to the protection of critical infrastructure.

An Achilles heel: denial of service attacks on Australian critical information infrastructures

Critical, or national, information infrastructure protection, referred to as either CIIP or NIIP, has been highlighted as a critical factor in overall national security by the United States, the United Kingdom, India and the European Community. As nations move inexorably towards so-called ‘digital economies’, critical infrastructure depends on information systems to process, transfer, store and exchange information through the Internet. Electronic attacks such as denial of service attacks on critical information infrastructures challenge the law and raise concerns. A myriad of issues potentially plague the protection of critical information infrastructures owing to the lack of legal regulation aimed at ensuring the protection of critical information infrastructures. This paper will highlight the legal concerns that relate to the denial of service attacks on critical information infrastructures and provide an introductory overview of the law as it relates to CIIP in Australia.