Approach For Security Evaluation Research Articles

Computational Study of Security Risk Evaluation in Energy Management and Control Systems Based on a Fuzzy MCDM Method

Numerous cyberattacks on connected control systems are being reported every day. Such control systems are subject to hostile external attacks due to their communication system. Network security is vital because it protects sensitive information from cyber threats and preserves network operations and trustworthiness. Multiple safety solutions are implemented in strong and reliable network security plans to safeguard users and companies from spyware and cyber attacks, such as distributed denial of service attacks. A crucial component that must be conducted prior to any security implementation is a security analysis. Because cyberattack encounters in power control networks are currently limited, a comprehensive security evaluation approach for power control technology in communication networks is required. According to previous studies, the challenges of security evaluation include a power control process security assessment as well as the security level of every control phase. To address such issues, the fuzzy technique for order preference by similarity to ideal solution (TOPSIS) based on multiple criteria decision-making (MCDM) is presented for a security risk assessment of the communication networks of energy management and control systems (EMCS). The methodology focuses on quantifying the security extent in each control step; in order to value the security vulnerability variables derived by the protection analysis model, an MCDM strategy incorporated as a TOPSIS is presented. Ultimately, the example of six communication networks of a power management system is modelled to conduct the security evaluation. The outcome validates the utility of the security evaluation.

An approach for security evaluation and certification of a complete quantum communication system

Although quantum communication systems are being deployed on a global scale, their realistic security certification is not yet available. Here we present a security evaluation and improvement protocol for complete quantum communication systems. The protocol subdivides a system by defining seven system implementation sub-layers based on a hierarchical order of information flow; then it categorises the known system implementation imperfections by hardness of protection and practical risk. Next, an initial analysis report lists all potential loopholes in its quantum-optical part. It is followed by interactions with the system manufacturer, testing and patching most loopholes, and re-assessing their status. Our protocol has been applied on multiple commercial quantum key distribution systems to improve their security. A detailed description of our methodology is presented with the example of a subcarrier-wave system. Our protocol is a step towards future security evaluation and security certification standards.

Vulnerability Identification and Evaluation of Interdependent Natural Gas-Electricity Systems

The intensified interdependency of natural gas and electricity systems poses urgent needs and new challenges in identifying vulnerable components of the interdependent system, which could be significantly different from those of individual systems because of the interdependency. This paper proposes a method to identify and rank vulnerable components of interdependent natural gas-electricity systems. Specially, a topological model and the vulnerability index for the interdependent system are constructed, and vulnerable component identification method is put forward to select and rank components by simultaneously considering topological and functional vulnerabilities. The proposed vulnerable component identification method is quantitatively assessed via a security evaluation approach, which calculates electricity and gas supply-demand imbalance when the vulnerable components are out of service. Numerical results of a 6-bus electricity/7-node gas system and a modified IEEE 118-bus electricity/20-node gas system illustrate effectiveness of the proposed method.

Towards Security Effectiveness Evaluation for Cloud Services Selection following a Risk-Driven Approach

Cloud computing is gaining a lot of popularity with an increasing number of services available in the market. This has rendered services selection and evaluation a difficult and challenging task, particularly for security-based evaluation. A key problem with much of the literature on cloud services security evaluation is that it fails to consider the overall evaluation context given the cloud characteristics and the underlying influence factors including threats, vulnerabilities, and security controls. In this paper, we propose a holistic risk-driven security evaluation approach for cloud services selection. We first use fuzzy DEMATEL method to jointly assess the likelihood and impact of threats with respect to the cloud service types, the exploitability of vulnerabilities to the identified threats, and the effectiveness of security controls in mitigating those vulnerabilities. Consequently, the overall diffusion of risk is captured via the relations across these concepts, which is leveraged to filter and prioritize the most critical security controls. The selected controls were then weighted using a combination of fuzzy DEMATEL and fuzzy ANP methods based on several factors, including their effectiveness in preventing the identified risks, user’s preferences and level of control (i.e., responsibilities). The latter denotes how much control a cloud user is transferring to the cloud provider. To enhance the reliability of the results, the subjective weights were integrated with objective weights using the Entropy method. Finally, the TOPSIS method was employed for services ranking and the Improvement Gap Analysis (IGA) method was leveraged to provide more insights on the strength and weaknesses of the selected services. An illustrative example is given to demonstrate the application of the proposed framework.

A Model for Availability and Security Risk Evaluation for Systems With VMM Rejuvenation Enabled by VM Migration Scheduling

Most companies and organizations rely nowadays on virtualized environments to host and run their applications. Some of these applications have stringent availability and security requirements. An important challenge for high availability in virtualized systems is software aging, which can lead the system to hangs or other types of failures. Software rejuvenation is applied to cope with software aging problems, whereas previous research suggests the use of Virtual Machine (VM) migration to reduce the downtime related to Virtual Machine Monitor (VMM) software rejuvenation. However, there is still a gap regarding the security implications of applying VM migration scheduling as support for VMM software rejuvenation. In this paper, we propose a security evaluation approach based on an availability model for virtualized systems with VM migration for VMM rejuvenation. The goal is to find the proper rejuvenation scheduling to reach the desired levels (or at least to avoid the undesired levels) of security risk and availability. We present three case studies comprising major security threats, namely Man-in-the-middle and Denial of Service attacks. Results provide insightful information regarding the tradeoff between availability and security risk when applying VM migration scheduling for rejuvenation purposes.

On the computational security of randomized stream ciphers proposed by Mihaljević and Imai

This paper yields a (computational) security analysis for a generic class of randomized stream ciphers based on joint employmentof encryption, error-correction coding, and dedicated random coding. We show that the security of these ciphers can be considerablyless than their designers claim. In contrast to the approach for security evaluation used before, our technique is significantly simplerand allows us to find out the code-theoretic sense of parameters that determine the security of these ciphers. We also proposeanother possible solution (based on nonlinear random coding) for design of randomized stream ciphers with enhanced security.

A security evaluation approach for information systems in telecommunication enterprises

In recent years, information systems in telecommunication enterprises have been characterised by boundary expansion and increase of departmental-level applications. These changes increase the complexity of security evaluation and pose new challenges to enterprises' information security. Taking into account the behaviour characters of system users, we put forward a system security evaluation approach based on access paths. This approach can help evaluators and users find out potential security risks without figuring out the boundary of systems explicitly. It has no special requirements for system scale and can be used in the evaluation of enterprise-level and departmental-level systems. This paper also presents the formal definition of access path and related evaluation rules.