Security Management Process Research Articles

PROJEKTOWANIE PROCESU ZARZĄDZANIA BEZPIECZEŃSTWEM PAŃSTWA: PRZYKŁAD ROZWIĄZAŃ W PRZYPADKU POLSKI

The process of national security management must take into account each state’s interests in order to meet the expectations, needs and aspirations of the whole nation. In the initial conceptual and decision-making stage, this process includes ideological and doctrinal-level thinking as well as considerations at the program and operational levels. The following implementation stage covers the initiation of concrete security measures. This process must be flexible and take into account all changes taking place in the external environment of the state, as well as all transformations occurring within the security system, in order to create an effective and long-term security policy. An efficient organization of national security management requires a broad interdisciplinary approach taking into account executive issues, as well as decisions made at the central – ministerial level. In Poland, there are two mechanisms to derive national security strategies, adjudicate their results, and then adapt to evolving conditions and needs. These mechanisms are the state defense strategy verified by Strategic Defence Review process and national security system verified by the Strategic National Security Review. This article will summarize these two processes to include recent changes based on the evolving international security arena.

МОДЕЛЬ ЖИЗНЕННОГО ЦИКЛА СИСТЕМЫ ЗАЩИТЫ ИНФОРМАЦИИ

When building an information security system, one of the key problems is the creation of regulatory documents. Regulators in the field of information security determine the list of necessary documentation mainly in relation to protection mechanisms (authentication, anti-virus protection, etc.) and practically do not take into account the stages of the life cycle of information security tools and personnel of the organization. The article proposes an approach to formalization of the list of information security management processes that need regulation. This approach allows the formation of information security policy to take into account the processes of personnel management and the complex of software and hardware information security, which is necessary to ensure a high level of security of critical information infrastructure.

A context-based building security alarm through power and sensors analysis

The great technology advance over the last few years has led to a great increase in the quantity and availability of information. Having the means to obtain the required information, the main challenge is to make the best use of such information, by extracting as much knowledge as possible. The building security management process is no exception. With the emergence of IoT and the mature approach of SCADA, it is possible to guarantee a higher level of security, by analyzing the data that they are able to provide. However, a careful analysis is required to make the system able to correctly distinguish a normal situation from an undesired one. A given situation can be normal in a given context but reason for alarm in another. For this purpose, this paper presents a building security alarm enhanced with context-awareness which allows it to correctly identify an undesired situation in a given context.

Towards data-driven decision support for organizational IT security audits

Abstract As the IT landscape of organizations increasingly needs to comply with various laws and regulations, organizations manage a plethora of security-related data and have to verify the adequacy and effectiveness of their security controls through internal and external audits. Existing Governance, Risk and Compliance (GRC) approaches provide little support for auditors or are tailored to the needs of auditors and do not fully support required management activities of the auditee. To address this gap and move towards a holistic solution, a data-driven approach is proposed. Following the design science research paradigm, a data-driven approach for audit data management and analytics that addresses organizational needs as well as requirements for audit data analytics was developed. We contribute workflow support and associated data models to support auditing and security decision making processes. The evaluation shows the viability of the proposed IT artifact and its potential to reduce costs and complexity of security management processes and IT security audits. By developing a model and associated decision support workflows for the entire IT security audit lifecycle, we present a solution for both the auditee and the auditor. This is useful to developers of GRC tools, vendors, auditors and organizational decision makers.

A structured and hierarchical safe climate model and its application to safe communities

This study aims to examine the question of community management in China. Particular attention will be paid to the concept of community safety climate, including its meaning, the factors that influence it, and the research methods that have been used. This study has conducted a community injury and accident case analysis. It has also conducted an expert and on-site questionnaire survey. The results show that there are ten principal components of community safety climate. A new questionnaire that was targeted at community safety climate measurement was designed and developed. Five key factors of community safety climate were extracted by Exploratory Factor Analysis (EFA) and Principal Components Analysis (PCA). The key factors consisted of community staff safety awareness, community participation, level of management committed to the security, community security implementation, and community security training. A safe community climate model was made based on safety management, organisational behaviour theory, and statistical theory. The model was successfully used to quantitatively explain the relationship between the factor structure and factor combination. The factor structure and factor combination can be used to objectively analyse and explain the basic process of the current security management and community safety climate. The mechanism of community safety climate was displayed to find an improved evaluation method. It was found to be practicable to conduct a verification of safety climate evaluation as the basic theoretical and technological route for community accident prevention.

LEGAL REGULATIONS AND FUNCTIONING OF THE NATIONAL SAFETY THREATS MAP –AN ESSENTIAL ELEMENT OF THE PUBLIC SECURITY MANAGEMENT PROCESS BY THE POLISH POLICE

At present, Polish Police has noticed the importance of society in preventing and fighting crime. The example is a National Safety Threats Map interactive tool where inhabitants can anonymously report information about threats appearing in their neighbourhood forcing appropriate service to react as also radical change of a constable’s work by bringing it closer to citizens. The article describes the legal regulations and functioning of the National Safety Threats Map – an essential element of the public security management process by the Polish Police.

An Attempt to Understand Cyber Security Management Process

Modern businesses are still thriving to achieve to a security level opting for cybersecurity, in the form of a cybersecurity management process (CMP), is detail at three levels. The first level focuses on the architectural and components of this CMP. The second level details the comprehensive view, and finally presents systems and complexity view. This work also proposes a cybersecurity management model, along with some challenging issues.

Моделирование процесса управления уровнем авиационной безопасности аэропортов

Моделирование процесса управления уровнем авиационной безопасности аэропортов

ASSESSMENT OF PRODUCTION RISKS AS A METHOD OF SAFETY MANAGEMENT IN THE OIL AND GAS INDUSTRY

Methodology of analysis and assessment of risks of accidents at the oil and gas industry is developing rapidly, therefore the development of new and improvement of existing approaches, models and methods of risk assessment of accidents, their computer implementation is for our country an urgent task. Determination of estimated accident risks should be based on the results Determination of estimated accident risks should be based on the results of monitoring the technical condition of potentially dangerous objects, statistics on accidents and emergencies technogenic character, complex of monitoring of dangerous geological and hydrometeorological processes, condition of natural complexes and on the results of the simulation of dangerous situations and their effects on the health of the population In the article the results of a comprehensive survey of factors of the production process, which allow to assess the security situation, provide the basis for analysis of labor conditions and development of operational management activities in the oil and gas industry. Define the concept of risk, milestones, methods and criteria of risk assessment, and recommendations the main activities of government and industry management bodies to reduce risk of the negative effects on production. The article described in detail, why a risk assessment as a method of security management processes and operations and as a means of practical implementation of measures to prevent or reduce occupational hazards should be part of a systematic approach in the implementation of the labor process. In practice, a methodological unit of analysis and risk assessment is already being used in the fields of oil and gas industry.

Analysis of Security threats in ad hoc cloud.

The cloud is redefining the IT architectures of various business domains. Organizations have clearly recognized the unlimited benefits of cloud like dynamic payloads on the technical side and elastic financial models on the commercial side which guarantees in greater than before efficiency. The benefits of cloud computing can be maximized fully by applying novel technologies in security and risk management processes. The risk factors in terms of security is much more in public cloud computing compared to traditional computing which are bases on datacenter . In a highly shared ad hoc cloud environment which is in the control of instance-to-instance network connectivity security of the applications and sensitive data is a big challenge faced by the cloud providers. As the entire stack of applications, platform, infrastructure of the cloud is designed and managed by service providers the cloud users are uncertain about the security. This paper studies the generic security challenges in an ad hoc cloud environment .the security challenges and mitigations are discussed in section I. A survey was conducted with users of cloud from domains like health care, education and retail business. Analysis of survey data and the results are also discussed in section II.

A Framework for Information Security Governance and Management

Daily changes in the information security landscape mean that organizations face unprecedented challenges in securing their information systems. It appears easy for organizations to adopt a tactical approach in which they respond to problems as they occur. However, when such a paradigm exists, it becomes difficult to act strategically. What is required is for organizations to be able to assess their current maturity state with respect to information security governance and management, and to proactively identify problem areas that need to be addressed. Here, the authors present a capability maturity framework to support organizations in this activity. The framework addresses the technical, process, and human aspects of information security and provides insight and guidelines for organizations to implement effective information security governance and management processes.

모바일 뱅킹 정보시스템의 소프트웨어 보안성 개선을 위한 고장 트리 분석과 고장 유형 영향 분석

Due to rapid development of mobile device technologies, the mobile banking through Internet has become a major service of banking information systems as a security-critical information systems. Recently, lots of mobile banking information systems which handle personal and transaction information have been exposed to security threats in vulnerable security control and management processes, mainly software systems. Therefore, in this paper, we propose a process model for software security improvements in mobile banking information system by application of fault tree analysis(FTA) and failure modes and effects analysis(FMEA) on the most important activities such as 'user authentication' and 'access control' and 'virus detection and control' processes which security control and management of mobile banking information systems are very weak.

Application of Hazard Analysis and Critical Control Point in Sports Meeting Food

This study discusses Hazard Analysis and Critical Control Point (HACCP) theory and its effect on sports meeting food security management to provide a new way for solving sports meeting food security problems. Hazard factors in sports meeting security management are detected by identifying and analyzing potential hazard links and control strategies are put forward through combining characteristics of sports meeting food security process and analyzing critical control points. According to the good results from various management methods of one sports meeting in this city, we found that after using the HACCP management mode, the health knowledge awareness rate of workers increased to 91%, health certificate holding rate increased from 74 to 100% and dimission rate of staffs dismissed due to “five diseases” increased from 88 to 100%, which not only saves material and financial resources, but also had better effect than traditional mode. Therefore, the control strategy of sports meeting food security should be based on food security management process and five aspects, which are food practitioner and sports meeting participants, raw materials of food, tableware, environment and methods, should be controlled. HACCP management system is an effective way for ensuring food safety and it is a reliable way to carry out a quality management system that centers on HACCP in food safety management.

A case analysis of information systems and security incident responses

Our case analysis presents and identifies significant and systemic shortcomings of the incident response practices of an Australian financial organization. Organizational Incident Response Teams accumulate considerable experience in addressing information security failures and attacks. Their first-hand experiences provide organizations with a unique opportunity to draw security lessons and insights towards improving enterprise-wide security management processes. However, previous research shows a distinct lack of communication and collaboration between the functions of incident response and security management, suggesting organizations are not learning from their incident experiences. We subsequently propose a number of lessons learned and a novel security-learning model.

A Study on the Information Security Control and Management Process in Mobile Banking Systems

According to the development of information processing technology and mobile communication technology, the utilization of mobile banking systems is drastically increasing in banking system. In the foreseeable future, it is expected to increase rapidly the demands of mobile banking in bank systems with the prevalence of smart devices and technologies. However, the keeping ‘security’ is very important in banking systems that handles personal information and financial assets. But it is very difficult to improve the security of banking systems only with the vulnerabilities and faults analysis methods of information security. Hence, in this paper, we accomplish the analysis of security risk factor and security vulnerability that occur in mobile banking system. With analyzed results, we propose the information security control and management processes for assessing and improving security based on the mechanisms which composes mobile banking system.

Implementation of computer security at nuclear facilities in Germany

In recent years, electrical and I&C components in nuclear power plants (NPPs) were replaced by software-based components. Due to the increased number of software-based systems also the threat of malevolent interferences and cyber-attacks on NPPs has increased. In order to maintain nuclear security, conventional physical protection measures and protection measures in the field of computer security1 have to be implemented. Therefore, the existing security management process of the NPPs has to be expanded to computer security aspects. In this paper, we give an overview of computer security requirements for German NPPs. Furthermore, some examples for the implementation of computer security projects based on a GRS-best-practice-approach are shown.

The Routine and Emergency Coordinated Management of Public Security

The paper presents a study based on the observation of public security programme situations. Nowadays, public security management is faced with challenges such as the increase in non-traditional safety threats, high occurrence probability, obvious complex chain reactions, high security demand, vulnerable bearing systems and world-wide influences. For the new adapted requirements of public security management, this paper puts forward the concept of the coordinated routine and emergency management, which combines the routine management at normal status and the emergency manage- ment at the abnormal status based on the whole process of public security management. This paper analyzes the coordinated management system and establishes the decision-making objectives, decision-making model and constraints. In addition, this paper proposes the basic strategy of achieving the coordinated management of public security.

Data Center Governance Information Security Compliance Assessment Based on the Cobit Framewok

One of control domain of Cobit describes information security lies in Deliver and Support (DS) on DS5 Ensure Systems Security. This domain describes what things should be done by an organization to preserve and maintain the integrity of the information assets of IT where this all requires a security management process. One of the process is to perform security monitoring by conducting periodic vulnerability assessment to identify weaknesses. Because Cobit is not explained technically so it needs a method to utilizes data that has been standardized. One of the standardized database for vulnerability is CVE (Common Vulnerabilites and Exposures).This study aims to assess current condition of Data Center on Department of Transportation, Communication and Information Technology at Sleman Regency and assess the maturity level of security as well as providing solutions in particular on IT security. Next goal is to perform vulnerability assessment to find out which are the parts of the data center that may be vulnerable. Knowing weaknesses can help evaluate and provide solutions for better future. Result from this research is to create tool for vulnerability assessment and tool to calculate maturity model.

IMPLEMENTATION OF THE ABC MODEL IN A COMPANY DEALING WITH EXTRACTION OF RAW MATERIALS

ABC method is a new system for accurate product pricing, cost analysis of the causes of individual products and their optimization. The prices of products are accurately taken into account according to all relevant overhead costs in their actual context and relationships. Except of product costs, ABC method follows costs regarding customers, suppliers, distribution, transport, manufacturing, operational and security processes, management processes and other business activities. ABC method sees the company as a complex of interrelated activities and processes. ABC method represents more precise cost calculation for the product. The aim of the present article is to highlight the introduction of the ABC method to the enterprise and compare it with the traditional method. The result is to reduce costs by introducing ABC method to the enterprise.

A Study on the Improvements of Information Security Management System for Environment Education Institutes

Recent information and communication technology (ICT, Information Communication Technology) environment for the rapid changes in the information security threats and vulnerabilities in assets than ever recognized as very important. For proper information security management process improvement activities as part of the Information Security Management System certification and operate subject to gradual institutionalization and growing. Information Security Management System (ISMS) is a systematic organization to protect the information assets of an organization from the threat of cyber breaches respond to organically mean a comprehensive management system. This paper presents a variety of serious security incidents occur and appropriate educational environment to develop information security management system model. Applying the learning environment to enhance the level of data protection and information security management and direction of efforts to find ways to improve the model for improvement to propose