Security Audit Research Articles

A Methodical Framework for Conducting Reconnaissance and Enumeration in the Ethical Hacking Lifecycle

Reconnaissance and enumeration are both equally significant phases of the penetration testing lifecycle. In hindsight, both reconnaissance and enumeration seem to be very similar as the pair involve information gathering. Whilst reconnaissance leverages passive approaches without direct interaction with the target, enumeration exploits susceptibilities and vulnerabilities in direct client-server communication. Both phases involve gathering information and pinpointing the attack surface within the network of the target. To do so, powerful tools such as Nmap and Netcat are utilized by ethical hackers and penetration testers to identify and resolve security vulnerabilities and weaknesses. Nmap is an open-source command-line tool used for information gathering, network discovery, and security auditing. Whereas Netcat is a back-end tool that manages networks, monitors traffic flow between systems, as well as allows port scanning and listening. However, the plethora of tools and approaches available for these two phases often introduce inconsistencies and time wastage, which can lead to frustration and poor outcome for inexperienced penetration testers. Additionally, not all commands found online are relevant and applicable. In such situations, there is a high probability that the user will feel overwhelmed and exasperated with the overflow of new and foreign information. To address this daunting challenge, this study developed a methodical framework that can provide a technical guide for the reconnaissance and enumeration phases of the penetration testing lifecycle. Furthermore, a clear and thorough step-by-step procedure and detailed explanations of each stage and commands initiated using Nmap and Netcat are provided. The output of this study will be extremely beneficial and informative to a vast group of audience, ranging from university students majoring in security to individuals interested in ethical hacking, and even someone looking for a job with a position of a penetration tester. Furthermore, this technical guide on Nmap and Netcat extends the common body of knowledge in penetration, as a bridge between the industry and academia.

Secure Auditing and Deduplicating Data in Cloud

Abstract: With the widespread adoption of cloud computing, ensuring the security and integrity of data stored in the cloud has become a critical concern. This paper presents a novel approach for achieving secure auditing and deduplication of data in cloud environments. The proposed method addresses the challenges of data integrity verification and duplicate elimination while preserving the privacy of the stored data. By leveraging cryptographic techniques, including homomorphic encryption and Merkle hash trees, the system enables efficient and privacy- preserving auditing of data integrity. Additionally, a deduplication mechanism is integrated to eliminate redundant copies of data, reducing storage costs and improving efficiency. The proposed solution provides end-to-end security guarantees, ensuring that data remains confidential, unaltered, and readily available for authorized users. Extensive experimental evaluations demonstrate the effectiveness and efficiency of the proposed approach, making it a promising solution for secure data management in cloud environments

Assessment methodology for security of an automated control system of critical information infrastructure against DDoS attacks based on Monte Carlo simulation

Objective. The purpose of the study is to develop a methodology for assessing the security of an automated control system of critical information infrastructure from DDoS attacks. The purpose of the methodology development is to provide the decision–maker with a scientifically sound tool for assessing the risk of implementing a DDoS attack.Method. To achieve the stated goal of the study, simulation modeling based on the Monte Carlo method was used.Result. The expediency of using Monte Carlo simulation to assess the probability of server failure under DDoS attacks is confirmed. It was concluded that the server can be considered as a queuing system, however, the flow of incoming applications under DDoS attacks is not Poisson, so the use of analytical expressions to assess the probability of failure is considered incorrect. The simulation results allow the decision-maker to assess the probability of server failure and make organizational and technical decisions to increase the level of security. Analysis of the simulation results showed the effectiveness of improving server performance by increasing service channels.Conclusion. Thus, the developed methodology will be useful in conducting an information security audit of an organization to justify the amount of its insurance premium in the framework of cyber risk insurance. A possible direction for further research is to study the issue of computer network security, taking into account the features of a specific topology.

Database Security

Abstract: Database security is a crucial factor in safeguarding sensitive data in today's information-centric world. As organizations increasingly rely on databases for storing and managing vast volumes of data, ensuring the security of databases has become a top priority. This paper proposes a methodology for enhancing database security by addressing identified challenges and attacks. The methodology involves various steps, including identifying and assessing potential threats, evaluating existing security measures, implementing multi-layered defense, enforcing the principle of least privilege, regularly updating and patching DBMS, conducting regular security audits, providing user awareness training, implementing data encryption, monitoring and logging database activities, developing an incident response plan, staying updated with the latest research and best practices, and continuously improving security measures. By following this methodology, organizations can effectively enhance the security of their databases and safeguard critical data from potential attacks and breaches. Emphasis is placed on regular review and updates to security measures to proactively address evolving threats and ensure continuous protection of sensitive data.

АУДИТ ІНФОРМАЦІЙНОЇ БЕЗПЕКИ ДЛЯ ЗАХИСТУ ІНФОРМАЦІЙНИХ АКТИВІВ ПІДПРИЄМСТВ В УМОВАХ ГЛОБАЛЬНИХ ВИКЛИКІВ

In the modern conditions of global challenges, along with climate action failure, extreme weather, human environmental damage, there are cyberattacks and data fraud or theft, the spread of infectious diseases (pandemics), which resulted in the activation of digitalization processes of social, economic and political processes in general and business entities financial and economic activity in particular. Modern business processes cannot be imagined without the use of information assets, because today they are becoming the most valuable resource for business development. However, in the conditions of modern global challenges and the state of war, there are more and more threats associated with the loss of access by business entities to the information assets of their own business, therefore the topic of enterprise information protection is an urgent issue that requires research and practical recommendations development. The aim of the research is analysis the enterprise's information security audit process and the development of practical recommendations for securing the enterprise's information assets in the global challenges conditions. The methods of the research: logical and meaningful method, methods of comparison, systematization, induction and deduction, analysis and synthesis, coefficient method. The hypothesis of the research was assumptions about the possibility of determining the state of information security of business assets through the enterprise vulnerability indicator and securing its information assets by conducting an information security audit. The statement of basic materials. The place of Ukraine in the World Digital Competitiveness Ranking was analyzed and the main weak points are identified. The model of building an information security system is presented. The enterprise information security indicators are considered. It is proposed to identify the state of security of the enterprise's information assets using the company's vulnerability indicator. It is proposed to conduct an audit of the enterprise's information security in four interrelated stages, which will make it possible to protect the company's information assets from potential threats and attacks by intruders. The originality and practical significance of the research confirmed by research and substantiation of the importance of the enterprises information assets protecting in the conditions of martial law and recommendations for the information assets securing from potential threats using the enterprise vulnerability indicator and conducting regular information security audit. Conclusions and perspectives of further research. It was determined that the company's information threats can be identified using a vulnerability indicator, and the company's information assets can be secured by applying an information security audit of its assets. Further research will be aimed at a more extensive analysis of factors that can influence the determination of the enterprise's vulnerability and the emergence of potential costs from cyber attacks and data theft.

Identifying Key Activities, Artifacts and Roles in Agile Engineering of Secure Software with Hierarchical Clustering

Different activities, artifacts, and roles can be found in the literature on the agile engineering of secure software (AESS). The purpose of this paper is to consolidate them and thus identify key activities, artifacts, and roles that can be employed in AESS. To gain initial sets of activities, artifacts, and roles, the literature was first extensively reviewed. Activities, artifacts, and roles were then cross-evaluated with similarity matrices. Finally, similarity matrices were converted into distance matrices, enabling the use of Ward’s hierarchical clustering method for consolidating activities, artifacts, and roles into clusters. Clusters of activities, artifacts, and roles were then named as key activities, artifacts, and roles. We identified seven key activities (i.e., security auditing, security analysis and testing, security training, security prioritization and monitoring, risk management, security planning and threat modeling; and security requirements engineering), five key artifacts (i.e., security requirement artifacts, security repositories, security reports, security tags, and security policies), and four key roles (i.e., security guru, security developer, penetration tester, and security team) in AESS. The identified key activities, artifacts, and roles can be used by software development teams to improve their software engineering processes in terms of software security.

Audit Keamanan Sistem Informasi Menggunakan Cobit 5 di PT. Paramita Surya Makmur Plastika

One of the main problems for a company is information system security. High security is needed to maintain the confidentiality and misuse of information in the organization. To improve the security of business operations and the quality of information technology resources, it is necessary to evaluate to optimize the security of existing information technology assets. The purpose of this research is to carry out an information system security audit at PT. Paramita Surya Makmur Plastika using COBIT 5 and documenting the information system audit findings of PT. Paramita Surya Makmur Plastika to produce an audit report. Based on the results of research that has been carried out through interviews and questionnaires using COBIT 5 and using the APO13 and DSS05 sub domains, the results show that the existing capability is at level 1 while the expected capability level is at level 3 andt the capability gap is 2.

Research on Security Weakness Using Penetration Testing in a Distributed Firewall

The growing number of cyber-crimes is affecting all industries worldwide, as there is no business or industry that has maximum protection in this domain. This problem can produce minimal damage if an organization has information security audits periodically. The process of an audit includes several steps, such as penetration testing, vulnerability scans, and network assessments. After the audit is conducted, a report that contains the vulnerabilities is generated to help the organization to understand the current situation from this perspective. Risk exposure should be as low as possible because in cases of an attack, the entire business is damaged. In this article, we present the process of an in-depth security audit on a distributed firewall, with different approaches for the best results. The research of our distributed firewall involves the detection and remediation of system vulnerabilities by various means. In our research, we aim to solve the weaknesses that have not been solved to date. The feedback of our study is revealed with the help of a risk report in the scope of providing a top-level view of the security of a distributed firewall. To provide a high security level for the distributed firewall, we will address the security flaws uncovered in firewalls as part of our research.

Reputation-based Security model for detecting biased attacks in BigData

As internet of things (IoT) devices are increasing since the emergence of these devices in 2010, the data stored by these devices should have a proper security measure so that it can be stored without getting in hands of an attacker. The data stored has to be analyzed whether the data is safe or malicious, as the malicious data can corrupt the whole information. The security model in BigData has many challenges such as vulnerability to fake data generation, troubles with cryptographic protection, and absent security audits. As cyberattacks are increasing the main objective of each organization is to secure the data efficiently. This paper presents a model of reputation security for the detection of biased attacks on BigData. The proposed model provides various evaluation models to identify biased attack in malicious IoT devices and provide a secure communication metric for BigData. The results show better rates in terms of attack detection rate, attack detection failure rata, system throughput and number of dead nodes when the attack rate is increased when compared with the existing reputation-based security (ERS) model. Moreover, this model reputation-based biased attack detection (RBAD) increases the security of the IoT devices in the BigData and reduces the biased attack coming from various malicious nodes.

Android decompiler performance on benign and malicious apps: an empirical study

Decompilers are indispensable tools in Android malware analysis and app security auditing. Numerous academic works also employ an Android decompiler as the first step in a program analysis pipeline. In such settings, decompilation is frequently regarded as a “solved” problem, in that it is simply expected that source code can be accurately recovered from an app. On the other hand, it is known that, e.g, obfuscation can negatively impact a decompiler’s effectiveness. Therefore, in order to better understand potential failure modes of, e.g., automated analysis pipelines involving decompilation, it is important to characterize the performance of decompilers on both benign and malicious apps. To this end, we have performed what is, to the best of our knowledge, the first large-scale study of Android decompilation failure rates, using three sets of apps; namely, 3,018 open-source apps, 13,601 apps crawled from Google Play, and an existing collection of 24,553 malware samples. In addition to the state-of-the-art Dalvik bytecode decompiler Jadx, we also studied the performance of three popular Java decompilers. Furthermore, this paper also presents the findings from a follow-up study on 54,945 malware apps, where we additionally performed an analysis of the reasons for decompilation failures. Our study revealed that decompilers generally have very low failure rates, and that few failures on benign apps appear to be related to obfuscation. On malware, however, obfuscation appears to be a more prominent cause of failures, although the vast majority of malicious apps could still be fully decompiled by an ensemble of decompilers.

Research on Big Data Audit Practice based on Medical Insurance Fund Audit

The rapid development of information technology makes the national audit data base and audit method change accordingly. In recent years, China's medical insurance reform and development is remarkable. The framework of the medical insurance system covering urban and rural residents has been basically formed, and the management service system has been completely informationized and digitized. Medical security audit in the new era must adapt to the changes in the new era and step into the practice of big data audit. Based on the audit practice in the field of medical security, this paper analyzes the current situation of the big data environment faced by the current medical security fund audit, discusses the existing problems of medical insurance audit based on big data, and puts forward suggestions to promote the deepening development of big data audit.

Challenges and solutions in medical record keeping and data security

This literature review analyzes the challenges and solutions associated with the security and privacy of electronic health records (EHR). The extensive implementation of electronic health records (EHRs) provides advantages, including cost savings and enhanced quality of care, yet it also presents considerable vulnerabilities. Patient concerns regarding data protection are significant, driven by fears of unauthorized access and data breaches. This review examines the security risks associated with EHR systems, emphasizing three primary categories of safeguards: administrative, physical, and technical. This study examines the challenges presented by the Internet of Things (IoT) in relation to Electronic Health Records (EHRs), emphasizing the necessity for strong security protocols to manage heterogeneity, uncontrolled environments, and scalability requirements. This paper examines diverse security solutions, such as encryption and access control mechanisms, including Role-Based Access Control (RBAC), while emphasizing the significance of a multidisciplinary approach in the management of Electronic Health Record (EHR) systems. The rising frequency of cyberattacks on healthcare organizations highlights the necessity for proactive risk management strategies, which should encompass regular security audits, staff training, and the establishment of robust physical and technical safeguards.

Security Audit for Vulnerability Detection and Mitigation of UPT Integrated Laboratory (ILab) ITERA Website Based on OWASP Zed Attack Proxy (ZAP)

Information technology now has many positive and negative effects on comfort. One of the negative effects of this technology is high level security attacks that can exploit various vulnerabilities and loopholes. Vulnerability testing (security audits) is therefore necessary to identify and overcome the vulnerabilities of the risks raised. The author is UPT Terpada Laboratory (Ilab) ITERA (https:http://ilab.itera.ac.id), a website maintained by his UPT Institute at the University of Technology Sumatra. This website contains all information about the labs of the University of Technology of Sumatra. Security audits are performed using the OWASP ZAP tool. A security check was performed on web ilab.itera.ac.id and the high priority alert results are: 1 vulnerability, medium priority warning: Three vulnerabilities, low priority warnings: Seven vulnerabilities and information: 3 vulnerabilities.

Research on Key Technologies of Personal Information Security Protection in Big Data

Big data is composed of linear associated data and nonlinear data. Big data is characterized by multiple types, large data scale, fast data processing, high data value and low value density. As more information can be obtained through big data mining or web crawler, the leakage of users' personal information occurs from time to time, which seriously endangers the stability of social order. Therefore, protecting personal information from infringement in the era of big data has become an urgent problem to be solved. This paper constructs the technical framework of the life cycle and protection of personal information in big data, and summarizes the key technologies such as authorization, access control, security audit, traceability audit and data desensitization. In addition, in-depth research on these key technologies will be conducted to provide complete solutions for the protection of personal information in big data, crack down on illegal behaviors of user information trading, and create a positive network security environment.

THE PLACE OF OSINT IN THE CYBER KILL CHAIN

In recent years, there has been a trend towards an increase in the number of cyber attacks on organizations and individual users. In many cases, a key factor in the implementation of an information security incident is the attacker's effective preparation for a cyber attack: target selection, reconnaissance, i.e. obtaining any information that may be needed when planning an attack, weaponization based on discovered defense mechanisms, software and hardware, etc. and delivery, i.e. choosing how the malware will reach the victim and what steps will be required to activate it further. Having a significant amount of important and critical information for the organization from the point of view of ensuring security provides the attacker with the opportunity to choose the optimal attack scenario and significantly increases the chances of its success. The problem is that today's OSINT methods and tools allow you to find almost any information that is not protected in a real way, which significantly increases the risks, especially for organizations that find it difficult to control all the information that their employees post on social networks, disclose in interviews or accidentally enters the Internet. However, most intelligence tools are not only available to attackers, so ethical hackers and penetration testers can also use OSINT tools to examine an organization's vulnerabilities and improve its defenses before attackers exploit those vulnerabilities. The article examines the main methods of intelligence based on open sources, considers the most common and most often used OSINT tools, describes the life cycle of a cyber attack and defines the stages that require the use of OSINT tools when conducting an audit of the organization's information security and penetration tests.

TECHNICAL AUDIT OF SECURITY OF INFORMATION - TELECOMMUNICATION SYSTEMS OF ENTERPRISES

The content of the audit and vulnerability testing of the information and telecommunication system (ITS) of any enterprise is considered. Based on the results of the information security audit, the overall security of the company's ITS is assessed. It is proposed to assess the security of IT using penetration testing in the following areas: penetration testing from outside and inside the information infrastructure, social engineering testing of the company's personnel and testing for resistance to DDoS attacks; assessment of the security of the mobile application, web resource and wireless networks. The proposed general algorithm for IT infrastructure penetration testing (analysis of vulnerabilities and security of information resources) in the form of stages: initialization, passive and active intelligence, operation and post-exploitation, systematization and presentation of the results of security assessment, risk and vulnerability assessment, recommendations regarding them elimination. In stages all operations are carried out without causing real damage to the ITS. The purpose of a technical audit is shown, which covers the components of the ITS and can be considered as an independent examination or a procedure for their investigation in order to assess the condition and identify reserves. Technical audit as a result of checking the software and technical part of the resource provides an opportunity to form a list of key problems and get comprehensive recommendations for their elimination. It is noted that in accordance with modern requirements, technical audit can be used as an audit in the form of remote technical support, and information security audit can be considered as a variant of technical audit. Conducting an information security audit includes: analysis of risks associated with the possibility of information security threats to resources; assessment of the current level of ITS security; localization of "bottlenecks" in the ITS protection system; assessment of ITS compliance with existing standards in the field of security; providing recommendations on the implementation of new and improving the effectiveness of existing ITS security mechanisms. The content of the detailed report of the technical audit of the enterprise's ITS security has been revealed.

РАЗРАБОТКА МЕТОДИКИ КОНТРОЛЯ УРОВНЯ ЗАЩИЩЕННОСТИ ИНФОРМАЦИИ ОБЪЕКТОВ КРИТИЧЕСКОЙ ИНФОРМАЦИОННОЙ ИНФРАСТРУКТУРЫ

Abstract Purpose of work is to increase the level of security of subjects of critical information infrastructure through the use of a “dual” regime to implement a full cycle of ensuring the security of critical information infrastructure facilities - a full national regime and a combined regime. Research method: to achieve the purpose of the work, methods of analysis, comparison, generalization, structural decomposition from the theory of system analysis, determination of criteria for monitoring the level of information security of CII objects were used. Research result: the paper presents a detailed analysis and comparison of existing concepts for controlling the level of information security used to obtain a certain level of security. A method for monitoring the level of information security of CII objects is proposed. The scientific novelty lies in the development of a methodology for monitoring the level of information security of CII objects, using an information security audit model for CII objects, which in turn uses the possibility of a “dual mode” for a full cycle of ensuring the security of CII objects – full national and combined modes, allowing, if necessary, to include additional functional blocks

Cybersecurity and Data Privacy Certification Gaps of Connected and Automated Vehicles

Protecting Connected and Automated Vehicles (CAVs) from cyber attacks and data breaches is a major challenge facing the deployment of driverless vehicles. The CAV is a complex interconnected system consisting of sensors, Artificial Intelligence (AI) processors and external units to assure the automated driving without human interaction. Such complexity increases the surface attacks and makes the CAV highly vulnerable to cyber assaults. It also entangles security audits and certifications procedures. Our work lays out a novel approach towards CAV's certification focused on cybersecurity and data privacy aspects. Stipulated by the analysis on existing standards’ limitations, we propose a Standards Coverage Map (SCM) outlining the CAV's entire ecosystem and linking organisational and technical aspects to the latest standards and regulations from the cyber perspective

Future Trends in Cloud-based CRM Solutions for Healthcare

Cloud-based Customer Relationship Management (CRM) solutions have revolutionized numerous industries, and healthcare is no exception. As healthcare organizations strive to enhance patient care, streamline operations, and improve data management, the adoption of advanced CRM systems is becoming increasingly vital. This paper delves into the emerging trends shaping the future of cloud-based CRM solutions within the healthcare sector, offering insights into how these innovations are set to transform the landscape. One significant trend is the integration of artificial intelligence (AI) and machine learning (ML) into CRM platforms. These technologies enable healthcare providers to analyze vast amounts of patient data, predict health outcomes, and personalize patient interactions more effectively. AI-driven CRM systems can identify patterns and trends that might be missed by human analysts, leading to more proactive and preventive care strategies. Another trend is the emphasis on enhanced data security and compliance. With the growing concern over data breaches and stringent regulatory requirements, healthcare CRM solutions are increasingly incorporating robust security measures. These include advanced encryption, regular security audits, and compliance with standards such as HIPAA, ensuring that patient information remains confidential and secure. Interoperability is also a key focus area, as seamless integration with other healthcare systems becomes essential. Future CRM solutions will likely offer improved compatibility with electronic health records (EHRs), telehealth platforms, and other critical systems, facilitating a more cohesive and comprehensive approach to patient care. Additionally, the shift towards patient-centered care is driving the development of CRM features that enhance patient engagement and experience. Tools such as patient portals, personalized communication, and remote monitoring capabilities are becoming standard, empowering patients to take a more active role in their healthcare journey.

Analysis of modern tools for penetration testing

Penetration testing is a security audit performed by an organization in which an expert attempts to find, penetrate, and exploit weaknesses in an organization's computer system or networks. The main goal is to find any potential weakness. It also helps organizations maintain and adhere to established standards for protecting the privacy of their customers. The article explores software tools that can be used to perform penetration testing.