Security Failures Research Articles

COVID-19 Pandemic Tweets by Iranian Political Elites: A Content Analysis Study

COVID-19 Pandemic Tweets by Iranian Political Elites: A Content Analysis Study

La seguridad del paciente en las residencias sociosanitarias. La experiencia de la Comunidad Autónoma de la Región de Murcia

The pandemic has exposed the vulnerability of residential centers and the fragility of the population that lives there. In the Region of Murcia, care for this population group became a priority and a regional plan was drawn up to attend the needs of residents from the ethical framework of procedural justice. The immediacy imposed by the health crisis has meant that all this intervention is not without risks. Based on the Reason model, we have carried out a root cause analysis of the contributing factors that led the nursing homes to suffer a devastating impact, categorizing the security failures at three levels: infection control, social health environment and health-clinical environment. The pandemic has shown the urgency of strengthening the care model that we offer to our elders. A model that guarantees the coverage of the needs of extremely fragile patients that go beyond health and biomedical care and that considers their preferences and values.

Secure data exchange in Industrial Internet of Things

The use of the Industrial Internet of Things (IoT) is widespread, working as an enabler to implement large, scalable, reliable, and secure industrial environments. Although existing deployments do not meet security standards and have limited resources for each component which leads to several security breaches, such as trust between components, partner factories, or remote-control. These security failures can lead to critical outcomes, from theft of production information to forced production stoppages, accidents, including physical and others.The combination of blockchain-based solutions with IIoT environments is gaining momentum due to their resilience and security properties. However, chain-structured classic blockchain solutions are very resource-intensive and are not suitable for power-constrained IoT devices. To mitigate the mentioned security concerns, a secure architecture is proposed using a structured asynchronous blockchain DAG (Directed Acyclic Graph) that simultaneously provides security and transaction efficiency for the solution. The solution was modelled with special details in the use cases and sequence diagrams. Security concerns were integrated from the start, and a threat model was created using the STRIDE approach to test the security of the proposed solution. As a result, a flexible solution was been developed that significantly reduces the attack vectors in IIoT environments. The proposed architecture is versatile and flexible, is supported by an extensive security assessment, which allows it to be deployed in a variety of customizable industrial environments and scenarios, as well as to include future hardware and software extensions.

Information security policy non-compliance: Can capitulation theory explain user behaviors?

Informational security policies depend on user compliance to protect computing resources. When users are lax with security measures and fail to follow security related directives, data breaches are more likely to occur. We hypothesize that users are giving up on security compliance because they believe breaches are inevitable. We test the explanatory theory of security capitulation based on technology threat avoidance, protection motivation theory, and technology acceptance theory. Capitulation theory examines distrust of security, theft of privacy, vulnerability, security threats and security self-efficacy as predictors of capitulation, which influences motivation to protect computing assets. Results indicate that distrust of security, loss of privacy, vulnerability, threats, and self-efficacy are significantly related to capitulation. This research provides insight into emerging explanations of continuing organizational security failures.

Evaluating attractiveness of cyberattack path using resistance concept and page-rank algorithm

The industrial control systems (ICSs) and instrumentation and control (I&C) systems of nuclear power plants (NPPs) have changed from analog systems to digital systems. Digital systems offer maintenance and usability advantages, but are prone to cyberattacks. The conventional belief that digital systems are essentially free from cyberattacks owing to the presence of air gaps has been negated by several attacks on actual NPPs. Theoretically, a system can be secured by using all possible security measures. However, in reality, the resources available for cybersecurity are limited. Therefore, the efficient distribution of resources is a critical issue. The conventional methods were mainly focused on impairment failure.In this study, we propose a system that suggests the most attractive attack path that can consider both type 1 (impairment failure) and type 2 (Byzantine failure) security failure. The proposed algorithm consists of two parts: a graph map that evaluates the attractiveness of an attack path, and a path-finding part that searches for the shortest path in the graph map. To quantify the attractiveness of the attack path, we propose a resistance concept. In addition, we quantify the importance of components in the system using a page-rank algorithm. We adopt Dijkstra's algorithm to automatically determine the most attractive path. With the proposed methodology, it is expected that an attractive attack path that considers both type 1 and type 2 security failure can be found, and a corresponding efficient cybersecurity strategy can be established.

Understanding security failures of anonymous authentication schemes for cloud environments

Currently, password-based remote authentication mechanism has become an essential procedure to ensure users access the resources of the cloud server securely. Dozens of password-based multi-factor authentication schemes have been successively proposed recently. Unfortunately, most of them are vulnerable to various known attacks. The key to designing a secure and privacy-preserving authentication scheme is drawing some lessons from the security failures of existing schemes. In this work, we investigate three anonymous multi-factor authentication schemes based on passwords for cloud environments (i.e., Karuppiah et al.’s scheme at MONET’19, Lin’s scheme at IEEE Syst J’19, Rajamanickam et al.’s scheme at IEEE Syst J’20), and demonstrate that these three schemes all suffer from off-line guessing attacks and are short of an important property (i.e., forward secrecy). We also propose several effective countermeasures to remedy these weaknesses. Our analysis shows that none of these three protocols can achieve their security goals. Furthermore, we make a summary of the causes of the flaws, and reveal that the vulnerabilities of these schemes are caused by violating the basic design principles for a secure protocol (e.g., Ma et al.’s principles at IJCS’14). In addition, we investigate whether dozens of recently proposed schemes follow the design principles of Ma et al..

Cost Benefit Analysis of Incorporating Security and Evaluation of Its Effects on Various Phases of Agile Software Development

This article addresses the costs and benefits of integrating security into the development of applications and gives formulas for calculating security costs and benefits. The lack of safe application might lead to safety issues. Increasingly, there are accidents recorded that expose security flaws in many major software systems. It results in significant losses for consumer companies. While software businesses are working to produce secure software, the utility of secure software is quite limited. In contrast to the traditional manufacturers of commodities, for example, automakers, software developers have no legal responsibility if their products include flaws. The market reacts adversely to software manufacturers with serious vulnerabilities in their products. This is because of the loss of credibility, cost of patches, and so on. The study shows that the market is ready to penalize the supplier for insecurity and therefore offers the chance to deliver safer technologies. To improve cost/efficiency, the vulnerabilities are connected by accessible fixes. Significant savings are gained when security shortcomings are corrected during designing requirements instead of fixing security failures after deploying software. For suppliers, updates are more expensive to produce and publish. In addition, development costs can be reduced by plugging security issues in the early stages of development.

APPLICATION OF THE SECURE HASHING ALGORITHM (SHA) METHOD AND ROLE-BASED ACCESS SECURITY AUTHENTICATION IN LARAVEL 7

Information systems that are well made will produce applications that have optimal performance for all accesses to the system. The problem that is often encountered is a system that is easy to hack and tamper with entering from the login system, causing the system to experience data security failure and is accompanied by very dangerous file and database damage. The Laravel Framework provides access security that is Progressive, Scalable and Community Framework to be developed by information system developers, but for the default system from Laravel 7 it is still not enough to provide a solution for data security and access levels for users. Then additional systems are needed in the form of: Secure Hashing Algorithm (SHA), Multi Level Access Algorithm (MLA) and Middleware Checking Access System to overcome data security problems, access and system damage. Testing on the modified login system from the Laravel 7 framework this study has been successful to map users, their access levels, block SQL injection and secure data access accordingly

An empirical analysis of the information security culture key factors framework

Information security is a challenge facing organisations, as security breaches pose a serious threat to sensitive information. Organisations face security risks in relation to their information assets, which may also stem from their own employees. Organisations need to focus on employee behaviour to limit security failures, as if they wish to establish effective security culture with employees acting as a natural safeguard for information assets. This study was conducted to respond to a need for more empirical studies that focus on a development of security culture to provide a comprehensive framework. The Information Security Culture and Key Factors Framework has been developed, incorporating two types of factors: those that influence security culture and those that reflect it. This paper validates the applicability of the framework and tests related hypotheses through an empirical study. An exploratory survey was conducted, and 266 valid responses were obtained. Phase two of the study demonstrates the framework levels of validity and reliability through the use of factor analysis. Different hypothetical correlations were analysed through the use of structural equation modelling, with indirect exploratory effect of the moderators achieved through a multi-group analysis. The findings show that the framework has validity and achieved an acceptable fit with the data. This study fills an important gap in the significant relationship between personality traits and security culture. It also contributes to the improvement of information security management through the introduction of a comprehensive framework in practice, which functions in the establishment of security culture. The factors are vital in justifying security culture acceptance, and the framework provides an important tool that can be used to assess and improve an organisational security culture.

Quantitative Security Evaluation of Intrusion Tolerant Systems With Markovian Arrivals

Intrusion tolerance is an ability to keep the correct service by masking the intrusion based on fault-tolerant techniques. With the rapid development of virtualization, the virtual machine (VM)-based intrusion tolerance scheme has been developed according to the concept of state machine replication with Byzantine fault tolerant technique. In this article, we present the quantitative security evaluation of the VM-based intrusion tolerant system with the time to security failure. We assume that the arrival stream follows a Markovian arrival process (MAP), which is one of the most general stochastic processes, and analytically derive the Laplace-Stieltjes transform of time to security failure based on the analysis of the MAP/G/1/∞ queue.

Model based security verification of Cyber-Physical System based on Petrinet: A case study of Nuclear power plant

A variety of modern Cyber-Physical Systems (CPSs) are distributed and asynchronous systems that are becoming the backbone for smart infrastructures and systems such as smart grids, power plants, medical appliances, social robots etc. The weaving of cyber components with the physical system improves resource utilization and system reliability. However, it makes the CPSs significantly vulnerable to several cyber threats by increasing the attack surfaces. In safety-critical cyber-physical systems, the primary focus is on safety assurance. Any mistake or ignorance in security analysis may greatly amplify the losses in the presence of cyber threats. Such security failure may result in severe damages that may range from affecting critical infrastructures up to even loss of human lives. Thus, an early-staged security modeling of these systems is a prominent issue and requires a systematic approach for modeling a secure design as well as performance evaluation of alternative designs for the same. An in-depth security analysis involves the identification of a standard set of evaluation metrics. The proposed work provides the design-time methodology to map and analyze system security qualitatively and quantitatively using Stochastic Petri nets and their fundamental properties. The effectiveness of the proposed methodology is evaluated using a Nuclear power plant (NPP) case study.

United States Secret Service Organizational Innovation Trend Review: Focusing on Improvement of Security Failure Cases

United States Secret Service Organizational Innovation Trend Review: Focusing on Improvement of Security Failure Cases 의 이용 수, 등재여부, 발행기관, 저자, 초록, 목차, 참고문헌 등 논문에 관한 다양한 정보 및 관련논문 목록과 논문의 분야별 BEST, NEW 논문 목록을 확인 하실 수 있습니다.

Machine-Learning-Based Efficient and Secure RSU Placement Mechanism for Software-Defined-IoV

The massive increase in computing and network capabilities has resulted in a paradigm shift from vehicular networks to the Internet of Vehicles (IoV). Owing to the dynamic and heterogeneous nature of IoV, it requires efficient resource management using smart technologies, such as software-defined network (SDN), machine learning (ML), and so on. Roadside units (RSUs) in software-defined-IoV (SD-IoV) networks are responsible for network efficiency and offer several safety functions. However, it is not viable to deploy enough RSUs, and also the existing RSU placement lacks universal coverage within a region. Furthermore, any disruption in network performance or security impacts vehicular activities severely. Thus, this work aims to improve network efficiency through optimal RSU placement and enhance security with a malicious IoV detection algorithm in an SD-IoV network. Therefore, the memetic-based RSU (M-RSU) placement algorithm is proposed to reduce communication delay and increase the coverage area among IoV devices through an optimum RSU deployment. Besides the M-RSU algorithm, the work also proposes a distributed ML (DML)-based intrusion detection system (IDS) that prevents the SD-IoV network from disastrous security failures. The simulation results show that M-RSU placement reduces the transmission delay. The DML-based IDS detects the malicious IoV with an accuracy of 89.82% compared to traditional ML algorithms.

LightLedger: A Novel Blockchain-Based Domain Certificate Authentication and Validation Scheme

Nowadays, existing public key infrastructures (PKIs) certificate authentication suffers from many security failures. Trusted certificate authorities (CAs) can issue a valid certificate for any domain name. Although CA is supposed to be trusted by a client if the certificate issued to the client links to the chain of trust (e.g., root CA or subordinate CA). By compromising any of the latter (e.g., root CAs or subordinate CAs) an attacker can jeopardize the security of the entire system. Moreover, third-party CAs have to be trusted by domain owners. Currently, the trust is not balanced among the entities involved in the certificate authentication and issuance process (i.e., CAs and domain owners). To counter this problem approaches such as Domain authentication name entity (DANE) and Certificate Authority Authorization (CAA) offer additional securities for domain authentication. However, these approaches depend upon DNS/DNSSEC infrastructure which requires complex requirements for deployment as well as the adoption rate has been low. In this paper, we design, implement a robust and scalable domain authentication scheme based on blockchain technology with privacy-preserving features for low-constrained devices (e.g., mobile, browser, and IoT devices). The proposed system records a set of trusted CAs each associated with a specific domain in the blockchain. That is, each CA has to first verify if it is trusted to perform the actual issuance process. We compare our scheme with existing authentication methods and show that it requires less storage capacity and low bandwidth to authenticate certificates than other methods.

Tecnologías de vigilancia en las empresas mexicanas para protegerse de la inseguridad

El presente artículo tiene como objetivo estudiar los efectos de la violencia y la inseguridad en las empresas mexicanas, enfocándose en la inversión en medidas preventivas que consideran las tecnologías de vigilancia –alarmas y cámaras de video– como alternativa para protegerse de la inseguridad. A partir del análisis estadístico de cuatro encuestas de victimización de empresas en México –2012, 2014, 2016 y 2018– a las que se tuvo acceso a través del Laboratorio de Microdatos del Instituto Nacional de Estadística y Geografía (INEGI), se encontró que las empresas han incrementado su inversión en tecnologías de vigilancia en los últimos años y que esta inversión no está únicamente asociada con la victimización directa, sino también es una medida preventiva que se explica a partir de variables como el entorno a nivel local, la percepción de inseguridad, las fallas de la seguridad pública, entre otras.

On small perturbations of Markov cyber threat models

In this work, we consider Markov chain-based stochastic modeling of cyber threats acting on computer systems. In the framework of this approach, computer systems are considered as systems with failures and recoveries by analogy with technical system models in reliability theory. Under the assumption that the cyber threats are independent random events, we derive the explicit analytic formulas for the state probabilities of the corresponding Markov chain and the mean time to security failure (MTSF). Then we investigate the case of dependent cyber threats and derive the approximate expressions for the state probabilities and MTSF within the framework of the first-order perturbation theory. As an illustration of our results, we consider a few simple examples.

Long-Term Mental Health Costs of the Great Chinese Famine

The Great Chinese Famine (1959–61) claimed tens of millions of lives. However, its long-term mental health costs on those who survived remains unexamined. To address this gap, we calculate the famine intensity of prefecture-level regions across China from a rich set of death records and use its variation and data from a recent nationally representative survey to identify the long-term effects of the famine on the mental health of those in rural areas who experienced the famine in the early years of their lives. Difference-in-differences estimates revealed that a one-standard-deviation rise in the experienced famine intensity predicts a 2.3% increase in the probability of severe depressive symptoms (or about 24.8% of the mean). This roughly translates into 3.77 million cases caused by the famine, which is quite likely an undercount. The main mediating channels of this effect include starvation experience, unequal resource allocation, and toxic stress. Our findings shed new light on how large-scale food security failures may impact the mental well-being of the survivors.

Do ecosystem insecurity and social vulnerability lead to failure of water security?

Achieving water security for humans and ecosystems is a pervasive challenge globally. Extensive areas of the Americas are at significant risk of water insecurity, resulting from global-change processes coupled with regional and local impacts. Drought, flooding, and water quality challenges pose significant threats, while at the same time, rapid urban expansion, competing water demands, river modifications, and expanding global markets for water-intensive agricultural products drive water insecurity. This paper takes a social-ecological systems perspective, aiming to identify examples and pathways towards resilient ecosystems and social development. It draws on lessons from two science-policy network projects, one focusing on water scarcity in arid and semi-arid regions of Argentina, Chile, Brazil, Peru, Mexico and the United States; and the second addressing river and lake basins as sentinels of climate variability and human effects on water quantity and quality in Canada, the United States, Argentina, Colombia, Uruguay and Chile. Together, these ‘complementary contrasts’ provide an analytical basis to empirically examine stakeholder engagement, knowledge co-production and science-policy interaction supporting decision-making to achieve water security. The paper identifies four tenets for decision-making based on water-security-focused global-change science in the Americas: 1) Decision makers should focus on protecting ecosystems because water security (along with food and energy security) depend on them; 2) Water-use and allocation decisions ought to be made considering future environmental and societal vulnerabilities, especially climate projections; 3) Holistic approaches (at basin or other appropriate levels) are best suited to ensure social-ecological system resilience and reduce vulnerability; and 4) It is essential to support local/traditional livelihoods, and underserved populations to achieve equitable water security and ecosystem resilience.

Evaluating mean time to security failure based on continuous-time Markov chains

In the article, we consider a Markov model of computer attacks, in the framework of which attacks and the system responses are modelled by homogeneous Poisson point processes. We describe a method of solving the corresponding Kolmogorov system of equations by calculating eigenvalues and eigenvectors of some matrix. An important random variable associated with the corresponding Markov chain and called the time to security failure is explored in detail. The comparison of the results obtained and the results of simulation modelling are presented.

Blockchains for constrained edge devices

Today’s networks are seeing a large influx of Internet connected devices that reside primarily on the edge of the network. Many of these devices, such as Internet of Things (IoT) devices, are resource constrained both by storage capacity and power requirements that limit a device’s Internet availability. Several interesting architectures have been proposed to address security, device management, configuration, and multi-party interaction concerns using blockchain technology. These architectures require a trusted intermediary to interact with the blockchain on behalf of the edge device. This introduces a single point of failure in trust and security. This paper proposes a novel adaptation of blockchain technology to enable these edge devices to interact and participate with a blockchain without requiring a trusted intermediary. The proposed architecture provides a flexible and extensible framework that enables multi party interactions to take place at the edge of the network. The efficacy of the proposed design is demonstrated through theoretical analysis and by an application to a network of resource constrained IoT devices.