Information Security Management System Research Articles

Primena veštačke inteligencije u bankarskom sektoru i bezbednosna zaštita poslovnih informacija

Artificial intelligence has been attracting the attention of the scientific and professional public for decades. Today, in the digital age, it is more and more present in business and projects. The creation and implementation, but also the use of innovations created as a result of working with artificial intelligence, requires a multidisciplinary approach. One such innovation is REA Raiffeisen Bank's Electronic Assistant. REA has been created on the Weaver platform and uses certain artificial intelligence-based solutions, participating in the service business and communicating in a manner that respects the key points of the same. Simple and communicative for the user, REA is an example of the complexity that is a prerequisite for its creation and implementation. Therefore, this set of knowledge and skills, as well as the final outcomes of work on this project, are the inspiration both for work on such and similar innovations, and on the effects that can be monitored by research. Analyses show that business communication is dominated by telephone conversation, e-mail, website, while the Chatbot's share in business communication shows a score of 15%. The Chatbot is expected to be used in emergencies, when quick responses are needed: in resolving complaints, getting comprehensive answers, finding assistants to help people, booking hotels or restaurants, paying bills, etc. Although only partly present (15%), the Chatbot managed to attract the attention of the business public. The mentioned case study and desk analysis applied in this paper offer arguments which prove that the use of innovative systems in banking, based on artificial intelligence, is justified. Cyber security (trust) is the basic support in preserving privacy of the actors operating in that environment. Since security is the basic support for an innovative approach, the paper discusses the ISO 27001 international standard for the protection and security of information, which implements the Information Security Management System.

ISMS ROLE IN THE IMPROVEMENT OF DIGITAL FORENSICS RELATED PROCESS IN SOC's

Organizations concerned about digital or computer forensics capability which establishes procedures and records to support a prosecution for computer crimes could benefit from implementing an ISO 27001: 2013-compliant (ISMS Information Security Management System). A certified ISMS adds credibility to information gathered in a digital forensics investigation; certification shows that the organization has an outsider which verifies that the correct procedures are in place and being followed. A certified ISMS is a valuable tool either when prosecuting an intruder or when a customer or other stakeholder seeks damages against the organization. SOC (Security Operation Center) as an organization or a security unit which handles a large volume of information requires a management complement, where ISMS would be a good choice. This idea will help finding solutions for problems related to digital forensics for non-cloud and cloud digital forensics, including Problems associated with the absence of standardization amongst different CSPs (Cloud service providers).

HUMAN RESOURCES MANAGEMENT AS A COMPONENT OF ORGANIZATION INFORMATION SECURITY

The cyber threat landscape has undergone major changes in recent years. Compared to any period since the beginning of the information age, it is more diverse and broad. First, the Covid-19 pandemic, namely the resulting transition of organizations to remote work and then the full-scale invasion of Ukraine by the Russian Federation, made adjustments to the information security strategy. Today, most organizations are aware of security threats and the need to create a reliable information security management system to ensure their effective operation in an information environment that is aggressive both technically and socially. An important area of information security in an organization is human resource management since, according to statistics from a number of reputable analytical centers, employees are the weakest link in any data security system. The organization's human resources management includes a thorough recruitment process, fostering a responsible attitude to work in compliance with the requirements for protecting restricted information, developing a corporate culture of information security and dismissal procedures. The article provides a list of documents of the regulatory framework, namely, international security standards, regulatory documents of public authorities, and internal documents of an organization regulating the rules and methods of work with personnel. The main motives for the unlawful behavior of an internal attacker are highlighted, and the organizational measures recommended in the context of ensuring information security at all three stages of interaction between a person and an organization: employment, employment, and dismissal are described. There is also indicated the expediency of using psychoanalysis, psychology, management ethics and conflictology methods in the field of personnel management for forecasting and prevention of informational threats.

МАТЕМАТИЧНА МОДЕЛЬ ВЗАЄМОВІДНОСИН СИСТЕМИ КЕРУВАННЯ ІНФОРМАЦІЙНОЮ БЕЗПЕКОЮ

An effective solution to the problems of analysis and synthesis of information security management systems can not be provided by simple ways of simply describing their behavior in different conditions - systems engineering solves problems that require quantitative evaluation of characteristics. Such data, obtained experimentally or by mathematical modeling, should reveal the properties of information security management systems. The main one is efficiency, which means the degree of compliance of the results of information protection to the goal. The latter, depending on the resources available, the knowledge of developers and other factors, can be achieved to one degree or another, and there are alternative ways to implement it. In a number of publications the authors propose the basics of the categorical apparatus of set theory, which allows to explain the relationship between sets of threats and sets of information protection system, which allows to build different mathematical models to analyze information exchange systems in critical application systems. At present, the creation of information security management systems is not possible without research and generalization of world experience in building information systems and their constituent subsystems, one of the key of which are information protection and intrusion prevention systems. Components of the process of attacking the mechanisms of protection and blocking or destruction of cyber threats themselves are components of the mathematical support of such systems. The basis of such models is the mathematical apparatus, which should ensure the adequacy of modeling of information security processes for any conditions of cyber threats. When defining the mathematical apparatus, it is necessary to clearly understand how certain sets of cyber threats are built, and how the sets of cyber threat sets, sets of security system elements and sets of cyber attack detection systems, which should control the correctness of the information security process. The article analyzes various options for building models of information security management system and creates a mathematical model that takes into account the internal relationships of different subsets of components of the information security system under the influence of cyber threats.

Development of multi-agent information security management system

The issue of creating an information security system is very relevant in the world today. One of the urgent tasks is to solve the issues of effective protection of information from both external and internal threats through the creation and implementation of information security management systems in automated systems of enterprises, which, among other things, requires the formalization of the task of protecting information for its subsequent implementation by software and other means. Now there are security analysis systems, for example, that examine the security elements settings of workstations and servers operating systems, analyze the network topology, look for unprotected network connections, examine the settings of firewalls. The disadvantage of these systems is that they are not suitable for monitoring large volumes of network traffic. The solution to this problem is the use of monitoring tools capable of analyzing large amounts of data in real time. Therefore, a significant place in the article is given to the review of developments based on artificial intelligence technologies, namely multi-agent systems, review of information security models, threat risk assessment in automated systems.
 The functional architecture of the information security management system based on a multi-agent system has been proposed to search in real time for information security optimal solutions through the selection of such coalitions of protection mechanisms agents that will allow to build the optimal protection of the automated system according to the selected criteria. The model with complete overlapping of threats has been substantiated and adopted as a basis, which allows to analyze the overall situation and choose strategically important decisions directly during the organization of information security. The essence of of multi-agent systems functioning that implement a decentralized control system based on the work of autonomous agents that can be implemented programmatically has been revealed. The role of threat agents, resource agents, agents of protection mechanisms and their functional purpose have been defined. The problem of searching a set of protection mechanisms agents coalition for the current state of the automated system as a problem of optimal search by the criterion of protection cost, taking into account the value of information, has been generalized. Due to the modularity of the multi-agent system, the further work will be aimed at detailing its components and perfection.

The state of development of artificial intelligence in polish industry: opinions of employees

Abstract Purpose The purpose of the article is to show how employees of industrial organizations perceive the development of artificial intelligence (AI) within them and to gather their opinions on what AI solutions are most commonly used in Polish industry. The literature review pointed to the lack of knowledge on how employees of Polish industrial companies perceive the development of AI in their respective companies and what AI solutions they already use. Design/methodology/approach Literature review and surveys were used to collect the data. The study was carried out using a survey questionnaire. The sample was taken with a specific aim in mind: first, 30 entities were selected for that purpose, while in the second stage the employees (managers and specialists) were chosen from among those. Findings In most cases, employees are not afraid of losing their jobs due to the development of AI systems in their industries. They are positive about the use of solutions that include AI elements. In the opinion of the vast majority of respondents, modern technologies, including AI, help them in their work and facilitate it. Most popular current industrial applications are: robotic process automation technologies, Cognex cameras using neural networks, machine-learning and data technologies, distributed control systems (DSCs), enterprise resource planning (ERP)) systems, and security information and event management (SIEM) systems. Practical implication-Results of this research can be useful for developing programs aimed at reducing the fear and anxiety associated with the ongoing Industrial Revolution. Originality/value The presented research results are the only ones that show the opinions of employees regarding artificial intelligence in Polish organizations.

INTEGRATED ENTERPRISE RISK MANAGEMENT (IERM) FOR PENSION FUND ORGANISATIONS: FROM A TECHNOLOGY POINT OF VIEW

Any appraisal at this point must keep in mind that the epidemic is far from over and that the pandemic was economic and financial consequences has been considerably reduced due to the strong governmental efforts. Such event occurred in this digital era has shaped many financial institutions, including the pension funds, to take bold policy actions to overcome this issue in the future, as their role in protecting and managing people`s retirement savings is crucial and critical (Feher and Bidegain, 2020). A pension fund is also an institutional investor who invests substantial sums of money in public and private enterprises. The principal purpose of a pension fund is to ensure that there will be enough money to cover employees' pensions once they retire in the future. Proper Integrated Enterprise Risk Management (IERM) is needed to cater for ISO 31000: 2018 Risk Management Standard – Principles and Guidelines and ISO 27001:2013 Information technology — Security techniques — Information security management systems — Requirements. This paper attempts to highlight the key IT-related risk factors and IERM in the context of a pension fund in this digitalization and post Covid-19 era; among others is the enhancement of performance of the investment system, digital readiness, technology-related processes, and system integrity.

Methodology and software development for auditing information security management systems

Objectives. Classification of information systems (IS) security indicators and the creation of the method of improved software tool based on its results (in comparison with similar software tool developed earlier by the authors) for auditing information security management systems of organizations in the Republic of Belarus.Methods. During the development and improvement of the software tool using the method of systeminformation analysis and the approaches to its implementation were identified based on following capabilities: organization of questionnaires of heads of departments and services whose specialists work with IS designed to information processing not classified as state secrets or IS with limited dissemination; assessment of the level of compliance of the organization's IS information protection system with the requirements established by the legislation of the Republic of Belarus and other national regulatory legal acts; systematization of recommendations for improving the level of compliance of the organization's IS protection system with the established requirements.Results. Based on the results of the developed improved software tool approbation, it was found that the use of this tool makes it possible to reduce by 20–30 % the financing of costs for the implementation of the auditing the information security management systems of an organization.Conclusion. The developed improved software tool, compared to analogues, is characterized by reduced cost due to the following properties: ease of launch and configuration; independence from the type of operating system; the possibility of organizing both local and remote access. The developed improved software tool was tested in the branch "Long-Distance Communication Branch" of RUE "Beletelecom".

ЦИФРОВА ТРАНСФОРМАЦІЯ КІБЕРБЕЗПЕКИ НА МІКРОРІВНІ В УМОВАХ ВОЄННОГО СТАНУ

The article describes the possible transformational processes of cybersecurity of business entities in martial law. Authors argue that the security criteria of modern digital entrepreneurship include the following mandatory facts: data must always be encrypted during storage and transmission; encryption must take place at the client level; only the client should have access to the encryption keys; actual data should not be transmitted through open mail channels; the company must control the storage of encrypted information and access keys to it.
 A number of current external and internal threats to doing business are listed, including network intrusion, loss of devices with saved passwords, and encryption viruses. Main tasks of enterprises in terms of cybersecurity, namely: identification of potential threats to cybersecurity of enterprises and vulnerabilities; cyber incident prevention; neutralization or minimization of threats to information security of the enterprise.
 Authors consider the impact of the information security management system ISO / IEC 27001: 2013 on the work of organizations. It has been found that this system provides an opportunity to implement best practices to improve data protection and eliminate the threat of security breaches of information systems.
 The article focuses on the fact that in the framework of cybersecurity in martial law and in the further digitization of activities at the micro level, the basic and priority tasks should be mainly new quality of production processes of technological laboratories: planning work in accordance with requirements industry standards, guidelines and best practices; sampling into the system by assigning it a specific identifier; calculation of results and their design.
 Entrepreneurial practice shows that, for example, Ramsomware is the most common threat in the implementation of business processes. Ramsomware is divided into two main types – cryptographers (“cryptoransomware”) and blockers (blockers –“blockers”). Encryptors, when they get to the main computer of the enterprise, encrypt valuable files such as documents, photos, databases. Ramsomware’s business threats include, for example, temporary data loss, which can completely disrupt critical business processes; constant data losses, leading to a decline in the company’s competitiveness, reduced sales revenue in the long run, disrupted continuous access to data.
 Authors of the article came to the conclusion that in the light of such criminal cyberattacks, of course, it is logical to develop various types of protection in order to protect data from their interception. This protection must be: invisible to the naked eye; have a secure mail channel; e-mail certificate; e-mail safe; e-mail shredder; cybersecurity center; encryption of letters and attachments; protected view.

Study on Management System for Information Security

According to the relevance of the existing information's role in various companies, competent management is required to ensure the security of that information. The information security refers to protecting information and minimizing unauthorized access to it. Management system of the information security means the information security of a part of general and overall information security in an organization that is based on business risks’ approach and aims to establish, implement, operate, monitor, verify, maintain and improve information security. In this study, we have tried to introduce information security management system, types of threatening risks of information systems and also introduce and offer proper ways to maintain information security of each organization and then work on necessary requirements in order to design information security system and phases of implementing management system of information security.

Cyber Security Risk management with attack detection frameworks using multi connect variational auto-encoder with probabilistic Bayesian networks

This research proposes novel techniques in cyber security risk management and attack detection frameworks using deep learning architectures. Here the risk management of physical networks has been analysed using multi connect variational auto-encoder. Risk values were included in an ISMS (information security management system) as well a quantitative risk assessment was undertaken. According to the quantitative analysis, the proposed remedies could lower risk. Then the cyber attacks in the network were detected using probabilistic Bayesian networks. Performance of deep model is compared to that of a traditional ML method, and detection of distributed attacks is compared to that of a centralised system. According to tests, our distributed attack detection system beats centralised DL-based detection systems. For UNBS-NB-15 dataset, proposed MCVAE_PBNN achieved Accuracy of 96%, False Alarm Rate (FAR) of 71%, Sensitivity of 92%, Specificity of 82%, False positive rate (FPR) of 63%, AUC of 75% and KDD99 dataset proposed MCVAE_PBNN achieved Accuracy of 95%, False Alarm Rate (FAR) of 68%, Sensitivity of 92%, Specificity of 84%, False positive rate (FPR) of 61%, AUC of 78%.

Construction of Fuzzy Database and Analysis Interface Using Fuzzy Graphs for Management System Operation Analysis

Proper management is required to guarantee that an organization functions smoothly and continues to provide its services. Management systems, such as Information Security Management Systems (ISMS) and IT Service Management Systems (ITSMS), are typically applied to the entire organization, and such systems attempt to provide continual improvement. Efficient engagement with business operations is an issue; consequently, understanding and analyzing actual situations is required. The authors have been researching analysis methods using fuzzy theory, which enables imprecise expressions. By building a useful fuzzy database and realizing an analysis method for management system operations, the goal is to develop a useful tool for organizational management. In this paper, the authors describe the concept of fuzzy database construction, an analysis method, and a case study related to management system operations. Fuzzy graphs are used for visualization in the analysis to grasp the overall picture and characteristics of the management system.

Internet of Things Information Network Security Situational Awareness Based on Machine Learning Algorithms

In order to accurately predict the security situation of Internet of Things information network, a research method based on machine learning algorithm for security situational awareness of Internet of Things information network is proposed. The perception result is represented by the perception model, the sample data are preprocessed based on the linear discriminant analysis method, the sample data are optimized to obtain the combined features, and then the processed data are used as the training input of the RBF neural network to find out the mapping relationship with the network situation value, so as to quantify the security posture of the system. The results show that automatic discovery and classification of seven violations is achieved. Since the platform was launched in China Mobile, more than 65,000 suspected illegal IoT cards have been discovered, effectively monitoring and controlling the operation and behavior of IoT cards. The processing efficiency of IoT card violations has been increased by more than 20 times. After the system is put into use, the discovery of suspected illegal users and behaviors can be realized through full automation, and the process of analysis, confirmation, and disposal can be shortened to 2 hours, which effectively reduce the false alarm rate and reduce operator costs. In previous monitoring of IoT cards, the false-positive rate of illegal IoT cards was about 83%, while the false-positive rate of existing algorithms dropped to 20%.Monitoring shows that business abuse monitoring detects the highest proportion of illegal IoT cards, 59%; infractions of Internet of Things cards detected through Internet abuse monitoring accounted for 20%; the proportion of Internet of Things card with machine card separation is 8%; in the information security risk monitoring (including spam text messages and harassing phone calls), the number of illegal Internet of Things cards found is small, only 3% and 2%, respectively; other infractions, including unauthorized use in locations and user complaints, accounted for 8%. It can effectively improve the ability to discover illegal IoT cards, greatly improve the accuracy of judgment, and improve the efficiency of disposal. The comparison verifies that the method is reliable and effective in the security situation awareness of the Internet of Things information network. Using the Internet of Things information security management system software based on the machine learning algorithm, the system software suitable for anomaly data detection is trained by adjusting the main parameters of the algorithm, which improves the automation and intelligence degree of the system software.

Design and Implementation of Smart Glasses with ISMS and Risk Management Functionalities for a Technical Operator

This work aims to describe the design and implementation of smart glasses to be used by industrial operators allowing the display environment related information such as temperature, humidity as well as machine maintenance operations, the associated risks, and Information Security Management System (ISMS) controls. In order to achieve this design, several analyses were conducted in order to determine the optimal design possible namely an external and an internal functional and a risk analysis, in addition to an ergonomic study. Based on the aforementioned study and analyses, a model was created and simulated using the commercial software SoildWorks and ISISPORTEUS. The smart glasses functionalities have been evaluated in a real industrial environment.

Should cooperatives be the leaders of sustainability?

Özet
 Bu çalışmanın amacı, ISO 500’de yer alan kooperatiflerin web sitelerinin incelenerek sürdürülebilirlik çatısı altında sürdürülebilirliğin sosyal, ekonomik ve çevresel boyutlarına göre mevcut durumlarını ortaya koymaktır. Bu kapsamda, kooperatiflerin Kurumsal Sosyal Sorumluluk, ISO 9001 Kalite Yönetim Sistemi, ISO 14001 Çevre Yönetim Sistemi, ISO 27001 Bilgi Güvenliği Yönetim Sistemi, ISO 22000 Gıda Güvenliği Yönetim Sistemi, ISO 45001 İş Sağlığı ve Güvenliği Yönetim Sistemi, ISO 50001 Enerji Yönetim Sistemi sertifikasyon durumu incelenmiştir. Betimsel tarama modelinde olan araştırmada amaçlı örneklem yöntemiyle seçilen yedi kooperatifin web siteleri taranmıştır. Araştırmada içerik analizi yöntemlerinden yüzde ve frekans analizi kullanılmıştır ve veriler arasındaki korelasyon incelenmiştir. Analizler sonucunda sürdürülebilirlik kavramı kapsamında incelenen parametrelerle kooperatiflerin ISO 500 sıralaması arasında anlamlı bir ilişkinin olmadığı görülmektedir. Bununla birlikte kooperatiflerin tamamının sosyal sorumluluk projeleri yaptığı, %86’sının kalite (ISO 9001), %71’inin çevre (ISO 14001), iş sağlığı ve güvenliği (ISO 45001) ve gıda güvenliği (ISO 22000), %29’unun enerji güvenliği (ISO 50001) ve %14’ünün bilgi güvenliği (ISO 27001) yönetim sistemlerine sahip olduğu belirlenmiştir.

Организация мониторинга сетевых вторжений на основе свободно распространяемого программного обеспечения

This paper presents the results of preparing a virtual bench for modeling and detecting network attacks using a freely distributed intrusion detection system (IDS). The relevance of the work is related to the growing demand for IDS as sources of information security events for security information and event management (SIEM) systems. A comparative analysis of the most popular freely distributed open-source network IDSs was carried out and the choice of the Zeek system for its use in the project was substantiated. The work uses Zeek network logs, which contain important and structured information about the analyzed network traffic. The laboratory bench was built on the basis of a Linux virtual machine and a Mininet network simulator. A graphical representation of the developed virtual stand is proposed. An experimental study of the effectiveness of an intrusion detection system is demonstrated by simulating a network denial of service attack and further analyzing the received network traffic using IDS tools.

Enterprise Architecture Planning for College Information Systems using the TOGAF-ADM Framework and ISO 27001

The planning for the development of Information Systems and Technology is carried out with the main goal of realizing the Vision and Mission of Higher Education. The Information System design framework used is TOGAF (The Open Group Architecture Framework) - ADM (Architecture Development Methode), in that framework consists of several steps of implementing a representative architectural design to be used in architectural design at the Toyota Indonesia Community Academy which focuses on Business, Data, Applications and Technology. For the information system security management system, TOGAF-ADM can collaborate with ISO 27001:2013, where when we plan the development of the enterprise information system architecture for universities, we must also focus on information system security in accordance with the information system security system contained in the ISO 27001 :2013. By using a combination framework between TOGAF-ADM and ISO 27001, it is very appropriate to be used as a method for planning Enterprise Architecture in Higher Education that prioritizes business, applications and technology and adopts an information security management system from ISO 27001 .

The concept of assessing the risks of cybersecurity of the information system of the critical infrastructure object

Ensuring cyber and information security for critical infrastructure is achieved through the implementation of an appropriate set of information security management measures, which can be provided in the form of software policies, methods, procedures, organizational structures and functions. Information security requirements are determined, in particular, by systematic risk assessment of information security, which can be one of the elements of the predicted approach to identifying hazards in the provision of services to service participants in the information interaction of the information system. The paper presents conceptual provisions for assessing and managing cybersecurity risks of the critical infrastructure information system. The proposed concept involves the definition of: areas of security threats to the information system; involved information assets and calculation of their value; assessment of the probability of attacks on the information system; assessment of the probability of success of attacks on the information system and more. Risk assessment methods are proposed that take into account the probability of success of an attack and the probability of an attack occurring, which makes it possible to eliminate the shortcomings inherent in known approaches and provide more accurate identification of attack methods associated with the attacker's behavior. The concept of cybersecurity risk assessment and the methodology for analyzing and assessing security threats that are presented in the work correspond to approaches to building risk-oriented information security management systems and can become the basis for developing an information security system in the information system of a critical infrastructure object.

ОБ ОСОБЕННОСТЯХ И ПРИНЦИПАХ ПОСТРОЕНИЯ СИСТЕМЫ УПРАВЛЕНИЯ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТЬЮ

This article discusses the importance of establishing and implementing an information security management system. It provides statistics on which specific areas are prone to mass attacks in 2021, and suggests ways to provide additional information security and minimize the chances of information loss

Risk Risk Assessment and Development of Access Control Information Security Governance Based on ISO/IEC 27001:2013 At XYZ University

The rapid development of information technology at this time also has an impact on the use of information technology in the university environment. XYZ University as a university that has quite a lot of students also applies information technology to support their distance learning. The role of information technology is quite crucial and important. Unfortunately, the issue of information security which is an important part of information technology often gets less attention. Its undeniable that the emergence of threats or weaknesses in information technology can disrupt the course of service activities using information technology. Therefore, it is necessary to manage information technology and risk-based document standard procedures as outlined in governance to manage emerging threats or weaknesses. ISO/IEC 27001:2013 is an framework of information security management system that can be used as a basis for managing information security. This study identifies assets, threats, weaknesses, risk analysis, BIA, risk assessment, and risk mapping based on clauses to produce recommendations for policy documents, procedures, and work instructions to improve information security control based on ISO 27001:2013 clauses. Considering its high risk value, this study produced several recommendations for security documents, namely 5 policy documents, 6 procedure guidelines, 8 work instructions, and 12 forms.