Information Systems Security Research Articles

The method of protecting information resources based on the semiotic model of cyberspace

The subject of research in the article is the processes of ensuring the protection of information resources in the cyber-physical space. The goal is to develop a model for implementing a method of information protection in cyber-physical space. The development is based on a semiotic model of cyberspace. The task is to develop effective strategies for protecting information resources and managing cyber security in cyberspace, taking into account social and perceptual aspects. Used methods: methods of analytical modeling and fuzzy logic. The following results were obtained. It is shown that the complex, multifaceted presentation of information in the network requires a complex approach with the separation of mixed content of information into interconnected levels. A semiotic approach is proposed, which allows for a more in-depth analysis of the interaction between people and technologies, which is especially important for understanding and managing complex information security systems. A six-level model of cyberspace was developed with a method of assessing the level of security for each of the levels of the developed model, and an integral indicator of potential threats to the owners of network information resources was proposed. The developed model was verified. The developed semiotic model of cyberspace and the integrated indicator of potential threats make it possible to improve the monitoring and management of cyber security of the owners of network information resources by taking into account various factors, including taking into account social and perceptual aspects, which is a key factor for the development of effective strategies for the protection of information resources in cyberspace.

ISWM: an information security system for water surface oil spill monitoring based on NB-IoT

ISWM: an information security system for water surface oil spill monitoring based on NB-IoT

СПОСОБ ЗАЩИТЫ КОРПОРАТИВНОЙ СЕТИ НА ОСНОВЕ ДИНАМИЧЕСКОГО РАСПРЕДЕЛЕНИЯ ИНФОРМАЦИОННЫХ РЕСУРСОВ

The general trend in ensuring network security is the transition to the use of comprehensive information security systems. As the statistics of cyber attacks have shown, the objects of destructive influences, as a rule, are software and information resources of corporate networks. Within the framework of the well-known concept of comprehensive protection of network resources, the principle of situational transfer of information resources to protected nodes is substantiated. The article formulates the problem of dynamic distribution of local databases across nodes of a corporate information network. The implementation of such a mechanism is carried out in the event of a threat to the integrity of information resources by a priori formalization and initiation of an algorithm for solving the problem of assignments of a special type in Boolean variables. The features of the mathematical model of an extremal problem are the minimization of the cost of computing resources when solving a set of applied problems and taking into account the requirement for placing local databases on several network nodes with backup capabilities. In other words, a situationally formed plan for storing information resources involves placing one local database on at least the main and backup servers. The article considers the general methodology for determining the plan for placing databases on corporate network nodes and an example of its numerical implementation using the integer programming method. Based on the research results, recommendations are formulated consisting of choosing the optimal option for placing distributed database components on corporate network nodes, which ensures its full functionality and minimizes the risks of violating the integrity of information resources.

Biały wywiad w zarządzaniu bezpieczeństwem informacji

Open-source intelligence (OSINT) poses a threat to the information security system in an organisation (business, armed forces) and even in a whole state. The aim of the article is to provide an overview of this issue, to present the threats posed by open source intelligence and to identify ways of countering them. The theoretical part is complemented by a practical case study and confirms the hypotheses: gathering information from the open sources is possible, but it does not always allow for a comprehensive intelligence product. Moreover, the information security management minimises the risk of collecting data from the open sources. The second part provides recommendations and proposes a universal model of information security management in an organisation.

Innovative information security methods for vertically integrated companies

The article is devoted to the study of methods for ensuring information security for vertically integrated companies. The study examined the concept of a vertically integrated company, studied its features, risks, information security structure and key components of its software. The authors analyzed modern methods and tools for ensuring cybersecurity, applicable in the analyzed companies, and carried out a comparative analysis of their advantages and disadvantages. The work mentions integrated information security systems. Particular attention is paid to authentication technology based on SIM cards with an electronic digital signature as one of its mechanisms. The article examines tokens as traditional tools for implementing electronic digital signatures and SIM cards from the point of view of more modern technology, and also carries out a comparative analysis of them from the economic, technical and legal aspects. The work describes and visualizes a diagram of the process of installing tokens and SIM cards in the business process of vertically integrated companies, and the process of replacing tokens with SIM cards is considered from three points of view: economic, technical and legal. The result of the study was the expansion of the existing knowledge base about ensuring information security in vertically integrated companies and the identification of the implementation of SIM card-based authentication technology as prevailing in relation to the token-based authentication system.

Mental and behavioral disorders related to work in Brazil: temporal trends and the impact of the Social Security Technical Nexus.

This article aimed to assess the temporal trend of work-related mental and behavioral disorders in Brazil, as well as to measure the effect of changes in the implementation of the Social Security Technical Nexus (NTP, acronym in Portuguese) on the incidence of these disorders among beneficiaries of the General Social Security System (RGPS, acronym in Portuguese). It is an analysis of time series and interrupted time series with data from the Brazilian Ministry of Social Security information system on cases of work-related mental and behavioral disorders from 2003 to 2019. The Prais-Winsten method was employed to calculate the annual percent change (APC) of the incidence rates for the conditions under study. The average incidence of work-related mental and behavioral disorders was 35.48 per 100,000 RGPS links during the period 2003-2019, with an increasing trend (APC = 9.67%; p = 0.033) for Brazil. Before the implementation of changes in the NTP (2003-2007), this value was 15.59, with an increasing trend (APC = 29.28%; p < 0.001), and it more than doubled (43.77) after the RGPS modified the way of establishing the nexus between illness and work (2008-2019). The post-NTP trend for work-related mental and behavioral disorders was a decrease in the country (APC = -23.73%; p < 0.001), a pattern that was repeated for all regions of the country. The findings suggest that the changes in the way of establishing the NTP between illness and work represented an advancement in the system of recording and notifying work-related mental and behavioral disorders in Brazil.

Research on the application of network security defence in database security services based on deep learning integrated with big data analytics

Every day, more people use the internet to send and receive sensitive information. A lot of confidential data is being transmitted electronically between people and businesses. Cyber-attacks, which are the inevitable result of our growing reliance on digital technology, are a reality that we must face today. This paper aims to investigate the impact of Big Data Analytics (BDA) on information security and vice versa. Additionally, an Artificial Neural Network (ANN)-based Deep Learning (DL) method for Anomaly Detection (AD) is presented in this work. To improve AD, the proposed method uses a DL-based detection method, which is used to parse through many collected security events to develop individual event profiles. The paper also investigated how BDA can be used to address Information Security (IS) issues and how existing Big Data technologies can be adapted to improve BDA's security. This study developed a DL-based Security Information System (DL-SIS) using a combination of event identification for data preprocessing and different Artificial Neural Network (ANN) methods. The feasibility and impact of implementing a Big Data Analytics (BDA) system for AD are investigated and addressed in this study. From this study, we learn that BDA systems are highly effective in securing Critical Information Setup from several discrete cyberattacks and that they are currently the best method available. By analyzing the False Positive Rate (FPR), the system facilitates quick action by security analysts in response to cyber threats. DL-SIS had the highest AD accuracy of 99.40% but performed poorly in the high-dimensional dataset.

Financial Support for Information Protection Measures: Problems and Solutions

Aim . Coverage of the problem of ensuring economic security in conditions of insufficient financing of information protection measures both from the state, which establishes requirements for the protection of restricted access information of various types, ranging from state secrets to personal data of citizens, and from organizations that implement these requirements.Tasks. Formation of proposals to overcome difficulties in the implementation of financial measures to ensure the protection of information in organizations in order to implement measures to ensure economic security.Methods. In this paper, using the methods of factor, statistical and quantitative analysis, statistical information in the field of financing information protection measures is considered, the parameters of financing some measures are estimated based on open data presented in the Unified Information System in the field of procurement, as well as the provisions of legal acts of the Russian Federation in the field of information security and public-private partnership and an attempt has been made to prove the existence of problems in the financing of information protection measures.Results . It is proved that ensuring the economic security of nuclear power plants (on the example of the Russian Federation) on the basis of financial support for information protection measures is one of the most pressing problems in the modern digital world. Every year, threats to the security of information systems are becoming more complex and sophisticated, requiring organizations and companies to make additional efforts and resources to effectively counter. Practical ways of solving the problem of financing information protection measures in order to ensure economic security are proposed, using both the possibility of expanding public-private partnership in this area and other measures that organizations can directly use.Conclusions . Despite the need to ensure economic security, many organizations face financial difficulties in implementing information security measures. Limited budget funds, improper allocation of resources, inefficient financing strategy, difficulties in finding and purchasing effective Russian software and technical means of information protection in the conditions of sanctions impact on the Russian Federation – all these are obstacles to the successful provision of economic security.

КАТЕГОРИРОВАНИЕ И МАРКИРОВКА ДОКУМЕНТОВ КАК МЕТОД ЗАЩИТЫ ИНФОРМАЦИИ В ИНФОРМАЦИОННЫХ СИСТЕМАХ (НА ОПЫТЕ США)

In recent years, there has been a sharp increase in targeted computer attacks on the information resources of the Russian Federation and enterprises and individual organizations. In these conditions, the problem of protecting information processed in digital form in government information systems and personal data information systems is significantly updated. This problem accumulates the experience of mastering information technologies in developed countries, is interdisciplinary in nature and is therefore studied by technical, legal and other sciences. Based on open publications, the author summarizes information about the approach of the United States and other Western countries to the protection of unclassified controlled information. Using the analysis of official documents on information security, the article highlights a complex structured approach to the differentiation of protected unclassified information, its special labeling, which allows for «end-to-end» control over the circulation of information during its entire life cycle of existence. Studying the US experience in the field of information security in information systems allows us to deepen our understanding of the content and forms of confidential information, clarify the directions of development and adjust the methods of protecting official information of limited distribution.

ANALYSIS MATURITY LEVEL MEDICAL SERVICES ELECTRONIC USING COBIT 5 FRAMEWORK (CASE STUDY: RSUD XYZ)

The objective of this study is to develop an audit strategy for information system security at XYZ General Hospital, perform a comprehensive security assessment of the REMPEYEK (Electronic Service Medical Record) information system, and provide recommendations for improvement. Quantitative research is a methodology that involves the collection of data through direct assessment of the individuals or entities under investigation. In addition, the COBIT 5 tool is employed to analyze the gathered data in order to acquire a quantitative capability analysis. This study examines the COBIT 5 framework's relevance to the identification of business objectives for information system security in the context of the Rempeyek information system. The identified problems and obstacles in the system include inadequate budget management, insufficient coordination between Diklitbang and the units involved in application development, and a misalignment between information technology systems and security measures. The findings of the assessment on the maturity of the information system security indicate that the DSS05 and APO13 domains have achieved a level 2 status, known as "Managed Process." The capability values for these domains are recorded as 2.02 and 2.68, respectively. This suggests that the relevant procedures have been effectively executed, supervised, and regulated.

Exploring and Acquiring Modern Human Resource Competencies in Cybersecurity Amidst State Digital Transformation

This paper validates the relevance of contemporary electronic communication systems, networks, and hardware and software suites and tools being particularly susceptible to cyber influences. The goal of the article is to concisely summarize international experience in modern human resource competencies within the cybersecurity domain and to identify their components according to specific directions. The paper examines current international trends regarding the formation of a minimal necessary package for creating, implementing, technical support, and enhancing an information security and cyber defense management system. This necessitates the development of a digitally aware society by the state, a crucial area of its internal policy. It emphasizes the undeniable fact that the demand for cybersecurity professionals will continually grow as high-technology society advances. In the context of the state’s total defense, the role of unified training for defense force personnel and the civilian sector in cybersecurity is beyond doubt. It is concluded that the main focus in forming Cybercom of partner countries is adequate funding, careful selection of personnel, quality professional training, and ensuring full interoperability of diverse structural units of subjects ensuring information protection and cybersecurity at the state level. The share of cyber threats is increasing, and this trend will intensify over the next decade as the internet technology sphere is developing rapidly, and digital solutions are being used in combination (e.g., artificial intelligence and blockchain). For instance, current Russia is one of the main threats to national and international cybersecurity, actively implementing the concept of information confrontation based on a combination of destructive actions in cyberspace. An increase in conflicts between states and the intensity of intelligence and subversive activities in cyberspace is expected. The number of states seeking to form their own cyber-intelligence, master the latest methods of destructive influence in cyberspace, and strengthen state control over the state segment of the Internet is growing. The technical level of cyber threats is increasing, and new tools and mechanisms for cyber attacks are constantly being improved and developed

THE MODELING OF PROCESSES OF DESIGN OF INFORMATION PROTECTION SYSTEMS IN FINANCIAL INFORMATION SYSTEMS

The relevance and necessity of implementing measures to protect information in banks, as well as in other organizations of the financial and credit sphere of activity is due to a number of reasons. Firstly, these are the requirements of regulators in the field of information security. For systems of this type, there are also requirements for information security measures, which are set out in GOST R 57580.1-2017. Secondly, it is the objective presence of threats of various nature that require mandatory neutralization and exist in many modern information systems. In order to ensure information security, the security mechanisms used in the banking sector should take into account such factors as a significant amount of processed information, the need to ensure correct, stable and trouble-free operation, the multi-user nature of access to information resources, and ensuring the security of managed equipment. It is particularly worth highlighting the fact that failures and errors in the operation of banking information systems can entail not only economic damage or negative social consequences. In general, ensuring the information security of banking facilities is one of the most important tasks currently being solved at the state level, since they directly affect the stability of its economy. These circumstances determine the relevance of writing the article. The purpose of writing this paper is to develop a set of models describing the features of organizational, legal and technical processes that must be performed in banking information systems. As a methodological basis for writing the work, GOST R 57580.1-2017, as well as regulatory legal acts of the FSTEC of Russia, which are in the public domain, were used. To describe the ongoing work that must be performed to ensure the protection of information in banking information systems, the methodology of functional graphical modeling IDEF0 was used. The result of the research presented in this paper is a set of graphical and symbolic models describing the processes performed at the stages of designing and functioning of the information security system in critical information infrastructures.

ОСОБЕННОСТИ РОЗЫСКНЫХ МЕРОПРИЯТИЙ ПРИ РАССЛЕДОВАНИИ ПРЕСТУПЛЕНИЙ, СОВЕРШАЕМЫХ В СФЕРЕ КОМПЬЮТЕРНОЙ ИНФОРМАЦИИ

It is difficult to overestimate the issues of improving the tactics of investigative measures in the investigation of crimes in the field of computer information. In recent years, due to the significant growth of digitalization, both quantitative indicators of crimes in the field of computer information and their qualitative level have been steadily increasing. It becomes more difficult for investigative bodies to collect the necessary evidence, detect electronic and digital traces, determine their authorship and establish cause-and-effect relationships. Modern operational investigative measures assume that law enforcement officers have the skills to detect and analyze digital data, extract electronic traces, as well as record these data as evidence. The investigation of crimes in the field of computer information requires specialized knowledge and skills to effectively counter the new methods and technologies used by offenders. The relevance of the search tactics is due to the need to adapt to the ever-changing cyber threat and ensure the security of information systems. It is determined that law enforcement agencies need to constantly improve their skills and enrich their knowledge, the need for appropriate material and technical equipment, assuming the availability of specialized tools, is obvious. It is especially important to modernize the tactics of searching for suspects. It has been revealed that wiretapping is an important element in conducting operational search activities. Listening involves installing audio tracking devices on telephone communication lines, as well as concluding an agreement with telecom operators to gain access to Internet traffic and telephone conversations. However, there are significant risks of abuse of authority by law enforcement agencies. Unfortunately, the law does not define a list of criteria by which it is possible to determine whether listening should be used in a particular case or not. This creates threats to users’ personal data and introduces uncertainty into law enforcement activities.

Transformations of the information space in the post-truth-age

Socio-political changes in the end of the 20th and the beginning of the 21st centuries in the conditions of geopolitical processes specified by the collapse of the Soviet and socialistic systems, rapid development of information-and-communication technologies have transformed information space. Contemporary Ukrainian journalism and its national information space have been established in interdependence with sociopolitical, economic, cultural-educational development of the independent Ukrainian state. Media were both a mirror and a catalyzer of the socio-political processes. Ukraine’s development in the current conditions of the military aggression and increased information threats creates a necessity to protect its national information space, to improve the system of information security and resist to information operations, and to decrease negative results of the impact of external information. Globalization of the information space and the increased scope of untrue information in the post-truth age require an expansion of the opportunities for media education, a development of critical thinking and enhancement of the level of citizens’ media literacy, their ability to counterstand manipulations both from inside and outside.

Combining of Heterogeneous Destructive Impact on the Information System and Countering Attacks (on Example by Insider Activity and DDoS-Attack)

Problem statement. By now, information security specialists have developed a sufficiently broad pool of mechanisms and means of countering cyberattacks for virtually all classes of destructive effects on information systems. Therefore, in order to break the relative parity "attack vs defense", attackers intensify their onslaught on information security systems by combining heterogeneous destructive influences, thus hampering the ability to counteract them. Despite a significant number of publications devoted to such information confrontation, there are no scientific studies devoted to analyzing this relatively new phenomenon in terms of identifying the limits of combinations, as well as the ability to counteract possible combinations in the public domain. The aim of the work is to study the phenomenon of combining heterogeneous destructive influences on the information system and counteracting such attacks. Methods used. The possibility of combining qualitatively heterogeneous attacks on the information system of the organization is studied. In order to classify and distinguish such attacks, categorical division apparatus is applied using the following pairs: Human vs Automaton, Inside vs Outside, Single vs Multiple. Result. The application of categorical division allowed to distinguish 8 classes of attacks from the position of their realization mechanism; the interpretation of each of the classes is given and an example is given. Novelty. The combination of two seemingly unrelated destructive influences – insider activity and DDoS-attack – is considered for the first time; their generalized scheme, stages of their implementation, as well as the complexity of counteraction to them are given.

Artificial Intelligence — a New Form of Using Special Knowledge in Investigating and Solving Cybercrimes

The number of cybercrimes has grown considerably in recent years and now poses a serious threat for the national security of states, information systems and personal data of citizens. The reasons for this considerable increase in cybercrime are the change of global policy, the special military operation, and the restrictions connected with the COVID-19 pandemic. The authors examine the importance of using special knowledge and artificial intelligence (AI) in the investigation of cybercrimes. They research the concept of a cybercrime, and analyze the ideas of scholars on strengthening the counteraction to such criminal activities, which have been spreading rapidly in recent years. The authors conclude that cybercrimes are understood as socially dangerous unlawful behavior, carried out with the use of information technologies and inflicting considerable damage on the economic and reputational interests of people, organizations and the state. They present a classification of the most common types of cybercrimes and key methods of carrying them out. They also analyze the research discussion on the contents of special knowledge, which allows the authors to conclude that in modern legal conditions AI, being a new form of special knowledge, requires a new understanding in view of the use of this knowledge in criminal proceedings. Taking into consideration that this format includes machine self-learning, neural networks, evolutionary algorithms, etc., the authors attempt to outline how they can be used for solving complex criminalistic tasks that require a preliminary analysis of large volumes of forensically relevant information, identification of images and regularities, and argumentation of making organizational-procedural decisions. The authors examine the cyberspheres where special technical knowledge is used, such as cybersecurity, computer architecture, reverse engineering, digital forensics, system administration. AI has a tremendous potential for the modern criminal process, its use will make it possible to enhance the effectiveness of investigatory work as it will considerably improve the speed and effectiveness of procedural actions and pre-court proceedings for criminal cases in general. It is, however, necessary to take into account the existing risks and limitations connected with its use in court-investigative practice. The authors conclude that in order to ensure the adequate use of opportunities offered by AI in the criminal process, it is necessary to develop ethical and legal principles of its inclusion in the sphere of special knowledge used in criminal court proceedings for acquiring forensic evidence on criminal cases.

A Novel Dynamic S-Box Generation Scheme Based on Quantum Random Walks Controlled by a Hyper-Chaotic Map

For many years, chaotic maps have been widely used in the design of various algorithms in cryptographic systems. In this paper, a new model (compound chaotic system) of quantum random walks controlled by a hyper-chaotic map is constructed and a novel scheme for constructing a dynamic S-Box based on the new model is proposed. Through aperiodic evaluation and statistical complexity measurement, it is shown that the compound chaotic system has features such as complex structure and stronger randomness than classical chaotic systems. Based on the chaotic sequence generated by the composite system, we design a dynamic S-Box generation mechanism. The mechanism can quickly generate high-security S-Boxes. Then, an example of randomly generating S-Boxes is given alongside an analytical evaluation of S-Box standard performance criteria such as bijection, boomerang uniformity, bit independence, nonlinearity, linear approximate probability, strict avalanche effect, differential uniformity, the and generalized majority logic criterion. The evaluation results confirm that the performance of the S-Box is excellent. Thus, the proposed dynamic S-Box construction technique can be used to generate cryptographically strong substitution-boxes in practical information security systems.

Анализ процесса создания безопасной информационной системы предприятия

The article is an analysis of the key stages of the development of a secure enterprise information system. The focus is on highlighting the stages of determining information security objectives, risk assessment, vulnerability identification, as well as the process of making informed decisions in the context of information system security. The article provides detailed recommendations for creating reports on the completed risk analysis and the process of making informed decisions based on the results obtained. As part of the work, the analysis of the processes of compiling a matrix of the probability of the occurrence of threats, building a model of the violator and the stages of building a threat model was also carried out, providing an understanding of effective recommendations for assessing and managing the risks of information security of the enterprise and forecasting threats. The definitions of all the terms used and examples of the access matrix, the threat probability matrix are also given. The components of the intruder models and threat models are indicated. The most common errors in the process of creating a risk analysis report and presenting it to management are noted. The presented analysis serves as an important resource for information security specialists and business managers who are interested in building a reliable and secure information system.

Digital media system design and visual art analysis based on information security

BackgroundWith the growing maturity of Internet technology and 5G transmission technology, digital media systems begin to present more complex scenario applications. Software design security issues are also increasingly evident in digital media systems. This paper analyzes the security issues of digital media system design from the perspective of software protection security. Discussed based on the information security digital media system design and visual art analysis. MethodsThis paper discusses based on the software security protection design and visual art analysis, first proposed the media convergence and information security risk assessment research, including media convergence cognition, information security risk management theory, system information security risk assessment methods and based on the media under the digital certificate. Secondly, the information security algorithm based on digital media technology is studied. From the basic knowledge of digital image, a method of image encryption based on the change of pixel value, the common algorithm of digital image watermarking technology and the encryption technology of digital media are summarized. ResultsExperiments were carried out on three art painting data sets, including Painting91, Oil Painting and Pandora. Compared with the existing label distribution learning methods on the Painting91style dataset, the algorithms SA-IIS and SA-BFGS achieve the classification accuracy of 65.51 % and 66.52 %, respectively. The classification result of the baseline method of VGGNet is 63.89 % on the OilPainting dataset. On the Pandora-style dataset, the classification accuracy of MSCNN1 method is 71.32 %, and the experimental results of CNNF4 method reach 71.76 %. ConclusionThe method proposed in this paper has good application results in different data sets, and the digital media art design system has high reliability and fault tolerance. From the perspective of information security, different index systems have higher security levels.

A review on security implementations in soft-processors for IoT applications

With the increase in the number of devices connected to the Internet, the need to maintain and harden information security in Internet systems has significantly increased. This has led to the development of hardware systems that implement security services. Therefore, from a taxonomy to sort and classify the key criteria to processor design, an overview and in-depth analysis of soft-processors that implement algorithms for Internet of Thing applications is presented highlighting their advantages and disadvantages to be used in larger systems. In order to perform a systematic review of the engineering literature related to the interest topic in this work, a bidirectional review methodology consisting of the following three phases has been proposed and applied: review planning, review conducting, and review reporting. Then, soft-processor architectures implementing security algorithms are compared considering computational cost, speed, bus size, number of pipeline stages, and performance. Finally, based on a feature analysis, the strengths and threats of soft-processors when implementing information security for Internet of Things applications are discussed, and the LORS design model is proposed to lead to recommendations for future designs.