Security Control Research Articles

Resilient consensus of heterogeneous multi-agent systems under asynchronous optimal DoS attack schedules

This study aims to address the challenge of achieving resilient consensus in heterogeneous multi-agent systems (MASs) under asynchronous optimal Denial of Service (DoS) attack schedules. Considering the start and duration of adversaries vary from different communication channels of MASs, we mainly focus on how adversaries with limited energy choose channels to launch attacks to cause the greatest damage to system performance. Based on dynamic programming, an asynchronous optimal DoS attack schedules generation algorithm is obtained. Optimal DoS attack schedules provides a basis for designing more effective secure control methods. Then, a distributed resilient control strategy that utilizes an observer-based approach to achieve output consensus in heterogeneous MASs under asynchronous optimal DoS attack schedules is proposed. Additionally, we establish conditions regarding the durations and frequencies of DoS attacks as well. Finally, two simulations are performed to showcase the efficacy of our proposed method.

Railway security checks at the border: between intrusive security technologies and fundamental traveller rights.

European railway borders are facing a particular exposure to security threats and need a delicate balance between securitization and free movement, especially amid globalisation, the current geopolitical landscape and increased migrant flows. For example, the war in Ukraine illustrated the challenges experienced at the Eastern EU borders by the refugee migration surge in early 2022. This exploratory focuses on the European border security control process from the rail border perspective. It encompasses a descriptive synthesis of the lessons learned from the UIC Refugee Task Force as well as insights from the ongoing EU-funded Horizon Europe project ODYSSEUS (Unobtrusive Technologies for Secure and Seamless Border Crossing for Travel Facilitation). Project ODYSSEUS aims to support the security and integrity of the European space, reduce illegal movements of people and goods across EU borders, facilitate travelling for citizens all while protecting fundamental rights of travellers. The project will test a combination of multi-behavioural and General Data Protection Regulation (GDPR) compliant biometric user identity verification tools, allowing, when possible, citizens to cross EU border without any interruption or queue. Further, novel luggage and baggage checks will allow citizens' vehicles and cargos to be remotely checked at land borders to speed up the border check processes in a secure and reliable manner. The project will run three pilot tests at road, rail and water borders. In this paper, we analyse the implementation of project's technologies in the rail border crossing pilot test and discuss the implications for the actors involved in the process of railway border crossing (e.g., border authorities, railway operators and railway travellers).

Event‐Triggered Secure Control of Positive Networked Control Systems Under Multi‐Channels Attacks

ABSTRACTThis paper focuses on the secure control of positive networked control systems under multi‐channel attacks characterized by a Bernoulli distribution. Specifically, the sensor‐to‐controller channel suffers from false data injection (FDI) attacks, whereas the controller‐to‐actuator channel suffers from denial of service (DoS) attacks. The objective is to design a static output feedback controller that guarantees the positivity and stochastic stability of the closed‐loop system in the presence of DoS and FDI attacks. To conserve communication resources, we employ an event‐triggered scheme to reduce the frequency of information transmission. Due to the positivity of the system, the proposed event‐triggering mechanism employs the 1‐norm form instead of the 2‐norm form, which allows that the controller parameter is determined via linear programming rather than LMI technique. Finally, two simulation examples are provided to verify the effectiveness of our methods.

Exploring attachment and couple relationships in endometriosis: A pilot study

Introduction: Endometriosis is the therapeutic and clinical complexity extends beyond its effects on the body’s organic system, with psychological and social impacts. However, studies analyzing the quality of attachment and couple adjustment, beyond the effects on sexuality and fertility, are currently lacking. Methods: The main objective of this study was to investigate the quality of past attachment by means of the Parental Bonding Instrument, current attachment through the Relationship Questionnaire, and the perception of couple quality and satisfaction by means of the Dyadic Adjustment Scale, in a sample of 68 women aged between 23 and 54 years. Results: The analysis revealed that women with endometriosis reported experiencing greater paternal and maternal control, and less paternal care compared to those in the control group. Moreover, women in the endometriosis group exhibited a higher degree of insecure attachment in adult intimate relationships when compared to the predominantly secure control group. Regarding the DAS, women with endometriosis reported lower scores than the control group. Conclusion: Despite the limitations of a pilot study, it provides a foundational basis for future research aiming to explore endometriosis within the context of women’s relationships. It also contributes to the planning of prevention and support programs for significant figures in women’s lives.

A Review of Protection Mechanisms and Examination of Security and Access Control Measures in Java Packages

A Review of Protection Mechanisms and Examination of Security and Access Control Measures in Java Packages

Influence of the Configuration of Airport Security Control Systems on the Implementation of Assumptions of the Sustainable Development Policy

Influence of the Configuration of Airport Security Control Systems on the Implementation of Assumptions of the Sustainable Development Policy

Sampled‐data‐driven event‐triggered secure control of uncertain nonlinear cyber‐physical systems against multiple attacks

AbstractIn this paper, the sampled‐data‐driven event‐triggered secure control is discussed for a class of uncertain nonlinear cyber‐physical systems under multiple attacks containing deception attacks and replay attacks. Compared with exisiting research, the studied systems take into account the uncertainty and coupling that may occur in practical situations. Notably, deception attacks impede the application of a gain design approach in control design. To address this issue, an artful state transformation is presented to convert the considered system into an auxiliary system. Based on this, a novel sampled‐data‐driven attack compensation scheme is devised via the gain design approach, and an event‐triggered mechanism is further introduced into the scheme to cancel needless control updates, which successfully ensures state convergence meanwhile resisting the impact of multiple attacks. Particularly, the designed control scheme not only utilizes data efficiently but also avoids Zeno behaviour automatically by judging triggering conditions in sampled points. Finally, the validity of the results is verified through two simulation examples.

Cyber Security Controls and Countermeasures

Today's digital economy encompasses a conglomeration of devices, data, applications, and complex networks that can be hosted on-premises, in data centers or in cloud environments to support business functions. As a cybersecurity professional, you will be tasked to manage risks like cyber threats and data breaches in the workplace. The risks may emanate from the data that resides in the systems, like servers, computers or external drives and the physical assets themselves, like routers and switches. The onus is on preventing security events and limiting the damage or consequences of any event that might happen. Managing these risks in an organization can be achieved by implementing cyber security controls and countermeasures. Cyber security controls can be categorized into three distinct major groups: administrative control, physical control, and technological control. The administrative controls focus on security policies, guidelines, rules, procedures and standards designed by management to control access and utilization of confidential information. Physical control refers to a set of IT security controls deployed at the physical premise to prevent unauthorized physical access to data centres. Technical controls involve the use of systems and technical solutions to prevent security events in networks and cloud platforms. Additionally, when implementing security controls, the function of cyber security controls can be broadly divided into seven groups: directive, deterrent, preventive, compensating, corrective, detective, and recovery controls. Furthermore, security frameworks such as NIST, CIS controls COBIT, and ISO/IEC series form the cornerstone of cyber security controls and countermeasures. The aforementioned aspects will be discussed further in the later sections. For now, it is to provide a general picture of the cyber security controls and countermeasures. Keywords – Security Controls, Countermeasures, Frameworks, Information Systems, Risk

Minimizing Business Disruption During Enterprise End-Point OS Upgrade while Maintaining a Robust Security Posture

The deployment of a major end-point operating system (OS) upgrade presents significant challenges for enterprise organizations, requiring a comprehensive strategy to minimize business disruption and maintain a robust security posture. Beyond the operational complexities of managing user productivity and application compatibility, organizations must also proactively address the critical security risks associated with such large-scale technology transitions. Cybercriminals often target organizations undergoing major IT changes, seeking to exploit vulnerabilities that may arise due to shifts in the OS architecture, user workflows, and security controls. This paper outlines practical strategies for executing successful OS upgrade projects that balance operational resilience and cyber risk management. Key focus areas include proactive management of end-point security, comprehensive contingency planning and rollback procedures, strategies to sustain productivity and business continuity, effective end-user training and communication, and valuable insights into the next- generation OS deployment. By focusing on these critical aspects, organizations can navigate major OS upgrade initiatives while preserving vigorous business operations, enhancing end-user experience, and safeguarding sensitive data and systems from costly security incidents.

Holistic Information Security Management and Compliance Framework

The growing complexity of cybersecurity threats demands a robust framework that integrates various security domains, addressing the issue of disjointed security practices that fail to comply with evolving regulations. This paper introduces a novel information security management and compliance framework that integrates operational, technical, human, and physical security domains. The aim of this framework is to enable organizations to identify the requisite information security controls and legislative compliance needs effectively. Unlike traditional approaches, this framework systematically aligns with both current and emerging security legislation, including GDPR, NIS2 Directive, and the Artificial Intelligence Act, offering a unified approach to comprehensive security management. The experimental methodology involves evaluating the framework against five distinct risk scenarios to test its effectiveness and adaptability. Each scenario assesses the framework’s capability to manage and ensure compliance with specific security controls and regulations. The results demonstrate that the proposed framework not only meets compliance requirements across multiple security domains but also provides a scalable solution for adapting to new threats and regulations efficiently. These findings represent a significant step forward in holistic security management, indicating that organizations can enhance their security posture and legislative compliance simultaneously through this integrated framework.

Cybersecurity in a Scalable Smart City Framework Using Blockchain and Federated Learning for Internet of Things (IoT)

Smart cities increasingly rely on the Internet of Things (IoT) to enhance infrastructure and public services. However, many existing IoT frameworks face challenges related to security, privacy, scalability, efficiency, and low latency. This paper introduces the Blockchain and Federated Learning for IoT (BFLIoT) framework as a solution to these issues. In the proposed method, the framework first collects real-time data, such as traffic flow and environmental conditions, then normalizes, encrypts, and securely stores it on a blockchain to ensure tamper-proof data management. In the second phase, the Data Authorization Center (DAC) uses advanced cryptographic techniques to manage secure data access and control through key generation. Additionally, edge computing devices process data locally, reducing the load on central servers, while federated learning enables distributed model training, ensuring data privacy. This approach provides a scalable, secure, efficient, and low-latency solution for IoT applications in smart cities. A comprehensive security proof demonstrates BFLIoT’s resilience against advanced cyber threats, while performance simulations validate its effectiveness, showing significant improvements in throughput, reliability, energy efficiency, and reduced delay for smart city applications.

Iterative learning robust security predictive tracking control for small delay batch processes: Deception attacks on unreliable network channel

During the batch process, the need for security control is becoming increasingly urgent with the gradual penetration of network control technology. For small time delay batch processes subject to deception attacks, an iterative learning robust security predictive tracking control approach is developed. Reviewing previous studies for iterative learning control, the issue that the repetitive character of the batch process would mask the characteristics of deception attacks was not considered. Moreover, the gains of iterative learning control law are utilized offline, which makes large deviations for the system state as the operating time increases. This will lead to “excessive-input” conditions for control inputs, which means more consumption of energy and production resources. To address these challenges, we introduce robust security invariant sets to improve the robustness of the system by constraining the system state to be in a safe range. Also, the design of the iterative learning controller incorporates deception attack data for historical batches, which is continuously improved and optimized to withstand deception attacks. Meanwhile, by calculating stability conditions online, the real-time control law gain is obtained, which could make the control inputs adjusted online based on the real-time system’s dynamic characteristics, avoiding excessive inputs and improving the efficiency of energy and resource utilization. Additionally, the stability analysis proves that the system is input to state stability. Ultimately, simulation verifies the effectiveness and feasibility of the developed method.

Digital Certificate Management for Medical Devices

As the healthcare environment becomes increasingly digitally connected and cyber threats to healthcare technologies evolve, cybersecurity controls are necessary to ensure the safety and effectiveness of medical devices. Digital certificates are one such security control commonly utilized to secure various technologies and systems including medical devices. However, few academic resources describe the use of digital certificates in the unique context of medical devices. Additionally, digital certificate issues have the potential to impact the safety and effectiveness of medical devices and to negatively hinder the delivery of patient care. This article provides an introduction on the role of digital certificates to secure and manage access to medical devices, including potential issues and digital certificate management considerations.

Covert attack detection and secure control based on signal generator

Covert attack detection and secure control based on signal generator

Quantization-Based Adaptive Fuzzy Consensus for Multiagent Systems Under Sensor Deception Attacks: A Novel Compensation Mechanism.

This study mainly investigates the adaptive leader-following consensus tracking control problem for a class of nonlinear multiagent systems (MASs) subjected to unknown control directions, external disturbances, and sensor deception attacks. To start with, an equivalent MAS with known control directions is obtained by introducing a linear state transformation. For the purpose of estimating the unavailable system states caused by malicious attacks, a quantization-based fuzzy state observer is designed, and the fuzzy-logic system (FLS) is utilized to approximate nonlinear functions. Moreover, a dynamic uniform quantizer with scaling function is established to reduce information transmission. With the help of coordinate transformation and available compromised states, a novel compensation mechanism is designed to offset the influence of filter errors while avoiding the problem of "explosion of complexity" in the backstepping design process. In addition, the Nussbaum-type function is considered to eliminate the design obstacle of unknown control gains resulting from the attacks. Under the constructed consensus protocol, it is proved theoretically that the consensus tracking error converges to an adjustable small neighborhood of the origin, and all signals in the closed-loop system are bounded. Finally, the feasibility of the provided secure control scheme is verified through two simulation examples.

Does Cyber Insurance Promote Cyber Security Best Practice? An Analysis Based on Insurance Application Forms

The significant rise in digital threats and attacks has led to an increase in the use of cyber insurance as a cyber risk treatment method intended to support organisations in the event of a security breach. Insurance providers are set up to assume such residual risk, but they often require organisations to implement certain security controls a priori to reduce their exposure. We examine the assertion that cyber insurance promotes cyber security best practice by conducting a critical examination of cyber insurance application forms to determine how well they align with ISO 27001, the NIST Cybersecurity Framework and the UK’s Cyber Essentials security standards. We achieve this by mapping questions and requirements expressed in insurance forms to the security controls covered in each of the standards. This allows us to identify security controls and standards that are considered—and likely most valued—by insurers and those that are neglected. We find that while there is some reasonable coverage across forms, there is an underrepresentation of best practice standards and controls generally, and particularly in some control areas (e.g., procedural/governance controls, incident response and recovery).

Nanoscale Synergy: Unveiling Gas Sensing Paradigms Through First Principles Exploration of Vertical Hexagonal Boron Nitride/Graphene Heterostructures

Modern civilization relies on rapid and accurate gas molecule identification at low concentrations for environmental surveillance, civilian security, healthcare evaluation, and inside atmospheric control. Density functional theory simulations are used to study the adsorption of CH4, CO2, PH3, N2O, NH3, O3, and SO2 gas molecules on a vertical hexagonal boron nitride/graphene heterostructure using the CASTEP code. Negative adsorption energy is only detected for NH3, O3, and SO2 gases. Our adsorption energy measurements show that the heterostructure is sensitive to NH3, O3, and SO2 gas molecules but insensitive to other gas molecules, as shown by the positive results. Further electrical and optical properties are only performed on gas‐adsorbed structures. It is found that the pure heterostructure acts like a semiconductor and has a band gap of 1.742 eV, which changes when gas is absorbed. Each of the structures has high absorption coefficients in the UV region, making them promising candidates for optoelectronic devices. The determination of the adsorbed gas type can be achieved by measuring the peak intensity and peak position of reflection or absorption. Heterostructures exhibit superior sensing capabilities for NH3 compared to other gases because of their enhanced adsorption energy, distinctive electrical band gap, and notable optical characteristics.

Evaluating cryptographic vulnerabilities created by quantum computing in industrial control systems

AbstractQuantum computing is expected to eventually be able to break the public‐key cryptography algorithms currently used throughout information technology (IT) infrastructure, undermining foundational tools used to maintain information security across the country's critical infrastructure. As these systems converge, the security posture of operational technology (OT) systems has to adapt to a new threat landscape and adopt some of the same security controls as those used in enterprise IT, especially cryptographic controls that rely on public‐key cryptography, which are ubiquitous in enterprise IT systems. Operators and manufacturers of industrial control systems (ICSs) and OT systems will need to understand and address the unique ways in which these systems will be vulnerable to adversaries equipped with quantum computers. We assessed quantum computing–facilitated cryptographic vulnerabilities in ICSs and OT systems to identify the issues in need of the most‐urgent attention from ICS and OT owners, operators, and manufacturers. Employing a modified consequence‐driven, cyber‐informed engineering process informed by literature review and analysis, we mapped protocols using or enabling cryptographic protections across common ICS network topologies as part of an assessment of how an attacker could cause harm, especially damaging physical consequences resulting from manipulation of cyber–physical systems, through the cryptographic compromise of ICS and OT networks and components. Our evaluation of identified and ranked risks to related control systems was also informed by relevant literature on ICS risk assessment and mitigation, cyber harms, and historical attacks on critical infrastructure. Using our analysis, we assessed the overall difficulty in mitigating risk from each of the identified vulnerability archetypes. The resulting analysis identified vulnerabilities associated with code‐signing processes as the highest priority for attention when updating systems for a postquantum future. This risk was followed by vulnerabilities associated with forged certificates for identification and vulnerabilities associated with forged session keys, identified as lower priorities but still of concern. Informed by our findings, we offer recommendations related to the protection of these vulnerabilities and the improvement of ICS security in developed systems.

Análisis de la efectividad de phishing automático

The article examines the growing threat of automated phishing, a social engineering technique that has evolved with automation, complicating the protection of computer systems both in Ecuador and globally. The objective is to analyze the effectiveness of this technique and its impact on information security. The methodology used includes a systematic review of the literature on automated phishing, highlighting how automation has increased the sophistication and scope of these attacks. The results show that automated attacks, facilitated by artificial intelligence and machine learning, have surpassed traditional attacks in frequency globally. In Ecuador, although less common, automated attacks have had a notable impact, especially in sectors with limited security measures. The findings highlight the need to adopt robust security controls, such as multi-factor authentication and ongoing cybersecurity training, in addition to following international standards such as ISO/IEC 27001 to mitigate the risks of automated phishing. Awareness talks are also recommended to strengthen security against these threats.

Overall structural degradation of a high-piled wharf under chloride invasion and the impact force of ship berthing

The security of high-piled wharfs in offshore environments is subject to long-term threats from chloride invasion and the impact force of ship berthing. This paper presents a comprehensive investigation of the deterioration of high-piled wharfs under the combined effects of chloride invasion and the impact force of ship berthing in a marine environment. A theoretical method is developed to model the degradation of the structural performance of high-piled wharfs based on the full process of reinforcing steel corrosion under the combined action of chloride invasion and stress. The proposed method is validated via comparisons with different theoretical solutions, experiments and field investigations. Furthermore, a three-dimensional finite element model is developed for the overall high-piled wharf structure with pile‒soil interactions using the Drucker‒Prager model (D‒P pile‒soil interaction) under different stiffness degradation states and different impact forces of ship berthing. The FEM model comprehensively considers the degradation of the beams, panels and piles of the wharf structure due to differences in the environment of chloride invasion. After verifying the finite element model, further research is conducted on the time-dependent behaviour of the ultimate lateral bearing capacity and the deformation of the overall structure of the high-piled wharf under different stiffness degradation states at different ages in the service life. The results reveal the failure mechanism of the lateral bearing deformation and the degradation pattern of the lateral bearing performance for the overall high-piled wharf structure under the combined effects of chloride invasion and the impact force of ship berthing. The outcomes of the present solution possess theoretical significance and application value for the security and risk control of high-piled wharfs in service.