Security Management System Research Articles

K-means Optimized Network Security Management in the Internet Context

The rapid development of the Internet has had a broad and profound impact on humanity, making information acquisition and dissemination more convenient. It has also brought significant opportunities and benefits to business and the economy. However, there are some issues, such as personal factors and data security concerns. In order to solve the above problems, the K-means algorithm is optimized from the perspectives of K-value validity index, feature weighting and three-branch decision making. First, the optimal clustering results are determined according to K-value validity index, and the influence of different dimensional features on clustering is considered for feature weighting, and the uncertain objects in the three-branch decision deadlock class are divided into the boundary domain. The delay decision of the boundary domain data is carried out, and the K-means clustering optimization algorithm is improved by combining the above three aspects, and the intelligent network security management system is developed on this basis. The results showed that the K-means optimization algorithm achieved the highest average accuracy rate, adjusted Morandi index, and adjusted mutual information across various datasets, with values of 96.01%, 0.866, and 0.869, respectively. In practical network attack scenarios, the K-means optimization algorithm attained an attack threat recognition accuracy of 94.38%. Under unknown network attack types, its detection rate and false alarm rate were 94.63% and 1.32%, respectively. Surveys conducted post-implementation of the intelligent network security management system indicated that over 90% of users were satisfied with their experience of the system. In summary, the proposed method accurately identifies potential network threats in network data, fulfilling performance requirements for network security management systems and ensuring the security of network resources.

Implementation plan of the information security management system based on the NTC-ISO-IEC 27001:2013 standard and security risk analysis. Case study: Higher education institution

Implementation plan of the information security management system based on the NTC-ISO-IEC 27001:2013 standard and security risk analysis. Case study: Higher education institution

Revolutionizing Freight Management: A Synergistic Approach Using IoT and Blockchain Technologies

This article explores the transformative potential of integrating Internet of Things (IoT) and blockchain technologies in freight tracking and management. Traditional freight tracking methods often suffer from inaccuracies, delays, and lack of transparency, leading to inefficiencies across the supply chain. Integrating IoT devices, such as GPS trackers, RFID tags, and condition monitoring sensors, with blockchain's secure and immutable ledger system offers a promising solution to these challenges. This article examines the current state of freight tracking, the fundamentals of IoT and blockchain technologies, and their combined application in creating real-time, secure, and transparent freight management systems. It discusses the benefits of this integrated approach, including enhanced visibility, improved efficiency, reduced disputes, and more agile supply chain operations. The article also addresses the challenges and considerations in implementing such systems, including technical hurdles, data privacy concerns, scalability issues, and regulatory requirements. Finally, it explores future prospects and research directions, such as the integration with AI and machine learning and the potential for expanding applications beyond tracking to areas like autonomous logistics. Through a comprehensive analysis of current implementations and future possibilities, this article provides valuable insights into how IoT-blockchain integration is poised to revolutionize the freight industry, offering a roadmap for more efficient, secure, and transparent global supply chains.

Wazuh SIEM for Cyber Security and Threat Mitigation in Apparel Industries

Security of IT infrastructure is critical in the modern digital environment, particularly for industries that manufacture clothing. The application of the Wazuh Security Information and Event Management (SIEM) system to improve security monitoring and compliance for an IT system in the apparel industry is the main topic of this study. To improve the apparel industry cyber threat monitoring system in real-time monitoring, detecting the threat vectors that support the centralized management system, to meet these objectives of the company, an SIEM security management system has been installed and configured with the components of Wazuh manager, indexer, Wazuh agent, and Wazuh dashboard as well. An Oracle virtual lab environment was created to install and configure the Wazuh system a robust Linux operating system was installed at the server level and Windows 10 was installed on the client end to the authenticity failure of the security system. To implement the Wazuh system, the project management guideline was followed which ensured the planning and implementation of the project, testing phases, and along with review and maintenance. Wazuh security management system successfully identified the authentical failure reports and vulnerabilities and generated automated reports from the system that showed the result of 1 critical, 19 high, and 5 medium levels of vulnerabilities shown in Figure 6, and the necessary patch recommended to solve the critical issues. On the other hand, the system also generated security events as well as integrity monitoring system reports. The deployment of the Wazuh security management system ensured the robust cost-effective security management system with high quality for detecting cyber threats which supports the regulatory and compliance requirements and is a viable tool for the apparel industry to protect the stakeholders’ interest.

The impact of ISO security standards on enhancing cybersecurity posture in organizations

The increasing frequency and sophistication of cyber threats have made organizations need to adopt robust cybersecurity frameworks. ISO security standards, particularly the ISO/IEC 27000 series, play a critical role in enhancing organizations' cybersecurity posture worldwide. These standards provide a systematic approach to managing sensitive information, ensuring its confidentiality, integrity, and availability. ISO/IEC 27001, which focuses on establishing an Information Security Management System (ISMS), is widely recognized for its ability to help organizations identify, manage, and mitigate cybersecurity risks. By adopting ISO standards, organizations benefit from improved risk management, enhanced incident response capabilities, and stronger alignment with regulatory compliance requirements, such as GDPR and HIPAA. In addition, ISO security standards promote a security-first culture within organizations, fostering greater employee awareness and encouraging the consistent implementation of best practices across departments and regions. The adoption of standards like ISO/IEC 27001 (Information security, cybersecurity and privacy protection), ISO/IEC 27018 (Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors), ISO/IEC 27017 (code of practice for information security controls based on ISO/IEC 27002 for Cloud services), ISO/IEC 27015 (Information security management guidelines for financial services) ISO/IEC 27002 (Information security, cybersecurity and privacy protection - Information security controls), and ISO/IEC 27701 (Security techniques- Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management – requirements and guidelines) has demonstrated significant improvements in data protection, especially in industries handling sensitive personal or financial data. Despite their benefits, implementing ISO standards poses challenges, such as resource constraints, scalability, and the need for continuous updates. As the threat landscape evolves, ISO security standards will remain integral to developing a proactive cybersecurity strategy, integrating with emerging technologies such as artificial intelligence and IoT. The global adoption of these standards reflects their pivotal role in securing the digital infrastructure of modern organizations.

Legal protection of personal data security in Indonesian Local Government apps: Al Farabi's perspective

The rapid advancement of technology is a double-edged sword. While it provides easy access to information, it also opens the door to unrestricted access, including personal data. Governments worldwide are leveraging technology to enhance their connection with citizens and deliver top-tier public services. In this vein, the Provincial Government of DKI Jakarta as an Indonesian local government, launched a SuperApps called JAKI in 2019 as a dynamic platform for two-way communication between DKI Jakarta residents and local authorities. This research employs empirical juridical methods, incorporating statutory and conceptual approaches. Drawing from primary sources, including DKI Jakarta Regional Secretariat Decree Number 99 of 2022 concerning the Citizen Relations Management application and interviews with the Smart City Developer Service Unit, the study demonstrates that JAKI ensures robust data security. The app complies with ISO 2700, an international standard that regulates information security management systems and fulfils the three core components: confidentiality, integrity and availability. Furthermore, in alignment with Al Farabi's concept of information security accountability, the emphasis is placed on collaborative social responsibility between data owners and collectors, represented by DKI Jakarta Provincial Government. This cooperation is both fair and beneficial, adhering to the fundamental principles of political philosophy and ethics.

BPMT: A hybrid model for secure and effective electronic medical record management system

Designing an efficient distributed blockchain system to store and access rising electronic medical records (EMR) is still challenging. Although many techniques have been designed to utilize EMRs proficiently, they still suffer from accessing time, storage time, and throughput. In this work, we have proposed a Merkle and B+ tree-based hybrid model to improve the performance of the blockchain system. B+ tree has improved the system's performance because of its practical layout and balanced structure. At the same time, Merkle Tree has ensured the integrity and security of the information. The proposed (B+ Merkle tree) BPMT model has reduced the storage time of records, improved the system's throughput, and significantly reduced memory use. These enhancements are supported by a thorough complexity analysis and testing on several datasets, which validate the efficacy and scalability of the model. The outcomes validate the performance improvements of the model and lay the groundwork for further developments in blockchain-based EMR management.

Application of Deep Learning in Public Network Security Management

With the rapid advancement of information technology, network security issues have become increasingly prominent, posing significant challenges in the field of public administration. Deep learning, as a cutting-edge technology in artificial intelligence, is emerging as a critical tool for enhancing network security management due to its exceptional performance in big data processing and pattern recognition. This paper reviews the basic concepts of deep learning and its current applications in network security management, discusses the design and implementation of deep learning-based network security management systems, and analyzes their effectiveness and evaluation through specific application cases. The results show that deep learning excels in areas such as intrusion detection, malware detection, network traffic analysis, and anomaly detection, significantly enhancing network security defenses. However, the application of deep learning in network security still faces challenges such as data privacy, model robustness, and computational resources. The paper concludes by proposing future development directions, providing theoretical support and practical references for further improving public network security management.

Utilizing ISO 27001:2022 to Design Information Security for BPRACo SME Digital Transformation

In the digital age of the Industrial Revolution 4.0, organizations like BPRACo must undergo Digital Transformation (DT). A significant challenge is the lack of adequate information security controls, which can lead to DT failure. Smaller banks, such as BPR, face difficulties in adopting effective information security management strategies that are proven for larger institutions. This study aims to identify the application of ISO 27001:2022 standards and develop an information security management system focusing on the most critical annex clauses for SME digital transformation. It also seeks to evaluate and analyze the impact of an information security management system aligned with these key clauses on SME DT success. The research employs a five-stage Design Science Research (DSR). Data were collected through interviews and document analysis, then analyzed using the ISO 27001:2022 framework for Information Security Management Systems (ISMS). The study identified six priority Clause and Annex controls for BPRACo. Based on the gaps, six essential solutions were designed, compiled into an implementation roadmap to enhance BPRACo readiness for full ISMS implementation and certification, supporting DT success in small banks. This research provides valuable insights and practical implications for information security management in small banks.

The Influence of Information Security Management System Implementation on the Financial Performance of Indian Companies: Examining the Moderating Effect of National Culture

The extensive focus on information technology (IT) within organizations, along with the substantial significance of information security issues, has made information security a top priority for executives. The International Organization for Standardization 27001 (ISO-27001) policy outlines the requirements for an effective Information Security Management System (ISMS). Implementing an ISMS not only enhances the overall profitability of a firm, but it also has a significant impact in various scenarios. In this study, we examined how ISMS implementation can assist corporations financially, with a specific focus on the moderating effect of Indian national culture. We analyzed financial performance following ISMS and ISO-27001 implementation using sample data from 420 Indian small and medium-sized enterprises (SMEs). By analyzing 256 survey questionnaires from 420 SMEs, we found that national culture amplifies the strong interaction between ISMS implementation and SME performance in India. We found that ISMS implementation increased the profitability of recognized Indian firms, supporting study hypotheses. The findings provide valuable insights for SMEs seeking to enhance financial performance through ISMS implementation, emphasizing the moderating role of national culture in shaping these outcomes.

Blockchain Technology: Unlocking New Frontiers in Data Management and Transparency

This article explores the transformative potential of blockchain technology in revolutionizing data management and enhancing transparency across various industries. As a decentralized, immutable ledger system, blockchain offers a secure and efficient way to record, share, and verify information, eliminating the need for intermediaries and reducing the risk of fraud. The article reviews the fundamental principles of blockchain, including distributed consensus, cryptographic security, and smart contracts, to highlight how these features improve data integrity and trust in digital transactions. Through case studies in sectors such as finance, supply chain management, healthcare, and government services, the article demonstrates how blockchain can streamline operations, reduce costs, and promote accountability. Particular attention is given to the role of blockchain in improving transparency by providing an auditable and tamper-proof record of transactions, which is especially valuable in industries prone to corruption and data manipulation. The article also addresses the challenges facing blockchain adoption, including scalability issues, regulatory concerns, and the need for standardization. Additionally, the potential of blockchain in emerging applications, such as decentralized finance (DeFi) and non-fungible tokens (NFTs), is discussed, highlighting the technology’s expanding role in reshaping digital economies. The article concludes by emphasizing that while blockchain is still in its developmental stages, its ability to foster greater transparency and more secure data management systems positions it as a key driver of innovation in the digital age. Future research is recommended to explore further integration strategies and address challenges in widespread blockchain adoption.

The Effects of IT Management Certification Type and Corporate Social Responsibility Performance on Investors’ Responses to Cybersecurity Breaches

ABSTRACT We investigate the joint effects of IT management certification type (for example, International Organization for Standardization (ISO) 27001 certification, the certification of a company’s Information Security Management System against the ISO 27001 standard, the leading international standard focused on information security) and CSR performance on investors’ responses to cybersecurity breaches. We find that the ISO 27001 certificate issued by an independent certification body serves as a proactive remedial strategy for reputation management and attenuates investors’ negative reactions following data breaches. However, the connection between the certification body that issues the certificate and the financial audit firm of the audited company may impair the effectiveness of the certificate serving as a remedial strategy for cybersecurity breaches. Similarly, superior CSR performance provides insurance-like protection and spillovers to reduce investors’ negative responses to cybersecurity breaches. We also provide some evidence suggesting that IT management certification type and CSR performance are likely substitutive mechanisms.

ІНФОРМАЦІЙНІ РЕСУРСИ СИСТЕМИ ЗАБЕЗПЕЧЕННЯ КОРПОРАТИВНОЇ БЕЗПЕКИ БІЗНЕСУ

The study revealed the relevance of the issue of managing corporate business security, namely from the standpoint of forming information and analytical support for the management of these processes. The research method was the improvement of the formation of theoretical-methodical and applied principles using information resources of the system for ensuring corporate business security. It has been proven that information resources provide a number of important functions and tasks in the management system of corporate business security. In general, the system of such support is formed in the following directions: (1) analysis of the business security system; (2) identification of risks and threats from the external business environment; (3) identification of internal risks and threats; (4) management and protection of information, ensuring information security; (5) business intelligence and countering economic espionage. It was concluded that for each of the identified areas, appropriate information is needed, which corresponds to the following nature of the need. Thus, within the framework of the analysis of the business security system, information is needed that includes financial and economic indicators, production indicators, labor indicators and which includes marketing aspects of the enterprise; within the scope of identification of challenges, risks and threats that come from the external business environment - analytical reviews of markets, data on competitors; reviews of the business environment, analytics, trends, expert opinions on expected changes in legislation and their consequences for business; to identify internal risks and threats - data from internal structural divisions on expected risks and threats, personnel characteristics, socionics results, reports on the rhythm of production and sales of products; within the framework of effective activity in the field of data and information protection - the level of protection of commercial information, the level of security of document circulation, the quality of information and analytical support; for the implementation of effective business intelligence - innovative and technological activities of leading competitors, objects of their intellectual property, as well as all internal information security parameters. It is argued that the collection and use of such data - information resources allows to effectively solve a whole set of tasks in the corporate security management system of business, namely, the formation of full-fledged information and analytical support for the analysis of the state, level, and structural characteristics of security; identification of existing and existing threats by directions: competitors, counterparties, decisions of authorities, factors of the external environment; temporary identification and prejudice of factors of decrease in efficiency, deliberate destructive actions of personnel, intra-company entrepreneurship, spread of low-quality, "wrong" business processes, business technologies; achieving a high level of information hygiene, cyber security, an appropriate level of information protection, preventing its leakage in any form and manifestation; Collection of the latest data for timely response to the actions of competitors, getting ahead of them by strengthening business competitiveness, protection against economic espionage.

Optimal control algorithms for Gabon’s Smart Grid: Enhancing efficiency and sustainability

The adoption of smart grid technologies offers Gabon several opportunities to enhance energy efficiency and sustainability. This study investigates the use of optimum control algorithms to increase grid stability and enhance the utilization of renewable energy sources. Mathematical models and simulations are used to assess genetic algorithms in light of Gabon's unique energy situation. Systems known as electrical smart grids supply electricity to users directly from power plants in an effort to reduce costs, cut down on blackouts, and improve energy efficiency. Smart grids, or SGs, are well-known pieces of equipment because of their amazing capabilities, which include bi-directional communication, stability, power failure detection, and interconnectivity with appliances for monitoring. Many modern data and security management systems, including modeling, monitoring, optimization, and/or artificial intelligence, lead to SGs. Energy was once cheap, easily managed, and dependent only on fundamental elements. Demand has significantly increased as a result of the current circumstances, which has also increased Gabon's electricity expenses, the likelihood of a contingency, and the complexity of the electrical network. In Gabon, smart grids have shown to be the most practical and clever way to lessen these problems in recent years. An electrical network with information technology integrated is called a smart grid. According to this study, using genetic algorithms in a smart grid could lower Gabon's overall electricity prices. In order to meet demand, the proposed approach makes use of off-grid battery banks and renewable energy sources. The goal of GA optimization is the short-term time averaged power cost; factors that affect this include grid energy to satisfy load, battery discharge, and other factors. MATLAB software is used to solve the optimization problem over a 24-hour period of renewable input, real-time energy pricing, and load. The results are presented.

Utilizing ISO 27001:2022 In Information Security Design For BPRCCo SME Digital Transformation

In the industrial revolution 4.0 era, organizations like BPRCCo need to carry out Digital Transformation (TD) to remain competitive. However, the main challenge in this process is information security which is often result of TD failure. Previous research highlights the importance of ambidextrous information security management (traditional and agile approaches) for large banks in achieving TD, especially in information security. However, this approach has not been proven for small-scale banks such as BPR. Therefore, this research aims to develop recommendations for information security management system (SMKI) solutions that are relevant for MSMEs and estimate improvements in their capabilities to support TD. The research method involves Design Science Research (DSR), including problem identification, requirements specification, design and development, demonstration, and evaluation. Data was collected through interviews and data analysis, then analyzed using the ISMS framework based on the ISO 27001:2022 standard. Based on the results of risk analysis and mapping of previous research, it was found that AB control in the PDCA and Annex cycles is a priority for BPRCCo. Next, a number of solutions were designed based on ISMS practices. This recommendation is prepared as an implementation roadmap that can help BPRCCo prepare and fully implement ISMS in critical areas to support TD. This research contributes to the understanding of ISMS for small-scale banks, especially as a case study for SME, and for similar organizations.

ASSESSING THE SECURITY OF AN IT&C SYSTEM USING SCAN TESTS

Cyber security has become a topic of strategic importance both internationally and nationally. In order to protect against cyber threats, it is essential to have an appropriate cyber security management system. The purpose of the present paper is to assess the confidentiality, integrity and availability as well as the security of information by identifying vulnerabilities in the network, in order to comply with the security requirements in accordance with the ISO/IEC 27001 standard.

Strategi Bisnis dalam Menghadapi Persaingan Data Center Pasca Pandemi di Indonesia (Studi Kasus: PT. XYZ Medan)

This research aims to determine the internal and external factors in the PT XYZ Medan data center, so as to obtain the right alternative business strategy by knowing the current position of the PT the best center in Indonesia. Data was collected through interviews with top management of PT XYZ Medan. The method used is the IFE Matrix, EFE Matrix, IE Matrix, SWOT and QSPM Matrix to determine appropriate alternative data center business strategies. The results of the research show that the company's main strength factor is the data center which has the best level of security and has been certified by ISO 27001:2013 ISMS (Information Security Management System). Apart from that, the results of the IE matrix show that the position of the PT XYZ Medan Data Center is in quadrant I, namely Growth (concentration through vertical integration) and the best strategy obtained is optimizing service, quality and affordable prices in order to retain customers.

Enhancing Cybersecurity with Blockchain-based Identity Management

In the digital age, the rapid increase in cyber threats has highlighted the need for more robust and secure identity management systems. Traditional centralized identity management systems are often vulnerable to data breaches, unauthorized access, and identity theft, posing significant risks to individuals and organizations. This paper explores the potential of blockchain technology to enhance cybersecurity through decentralized identity management. By leveraging the inherent properties of blockchain—such as immutability, transparency, and decentralization—blockchain-based identity management systems offer a more secure and efficient alternative to traditional methods. The paper provides an in-depth analysis of how blockchain can be utilized to store and manage digital identities securely, reducing the risk of identity fraud and data breaches. It examines various blockchain-based identity management frameworks, highlighting their advantages and potential challenges in implementation. Furthermore, the study discusses the integration of blockchain with other emerging technologies, such as cryptographic algorithms and smart contracts, to create a more resilient cybersecurity infrastructure. Through a review of current literature and case studies, the paper demonstrates the effectiveness of blockchain in enhancing data security and privacy while promoting user control over personal information. The findings suggest that adopting blockchain-based identity management could significantly mitigate cybersecurity threats and enhance trust in digital transactions. However, the paper also acknowledges the need for addressing scalability, regulatory compliance, and interoperability issues to fully realize the potential of blockchain in cybersecurity. This research contributes to the growing body of knowledge on innovative cybersecurity solutions and provides a foundation for future studies in the field.

Hardening Active Directory Graphs via Evolutionary Diversity Optimization based Policies

Active Directory (AD) is the default security management system for Windows domain networks. An AD environment can be described as a cyber-attack graph, with nodes representing computers, accounts, etc., and edges indicating existing accesses or known exploits that enable attackers to move from one node to another. This paper explores a Stackelberg game model between one attacker and one defender on an AD attack graph. The attacker’s goal is to maximize their chances of successfully reaching the destination before getting detected. The defender’s aim is to block a constant number of edges to minimize the attacker’s chance of success. The paper shows that the problem is #P-hard and, therefore, intractable to solve exactly. To defend the AD graph from cyber attackers, this paper proposes two defensive approaches. In the first approach, we convert the attacker’s problem to an exponential sized Dynamic Program that is approximated by a Neural Network (NN). Once trained, the NN serves as an efficient fitness function for defender’s Evolutionary Diversity Optimization based defensive policy. The diversity emphasis on the defender’s solution provides a diverse set of training samples, improving the training accuracy of our NN for modeling the attacker. In the second approach, we propose a RL based policy to solve the attacker’s problem and Critic network assisted Evolutionary Diversity Optimization based defensive policy to solve defender’s problem. Experimental results on synthetic AD graphs show that the proposed defensive policies are scalable, highly effective, approximate attacker’s problem accurately, and generate good defensive plans.

Blockchain Technology and Smart Contract Application in Security Management of Intelligent Chemical Plants

As blockchain technology and smart contracts develop, computer technology is constantly integrating with smart chemical plants. Due to the continuous development of intelligent chemical plants, their systems have gradually become large and dispersed, posing a threat to safety management. In order to improve the performance of intelligent security management systems, the study first explores the principles of blockchain and smart contract technology, and then combined with the requirements of intelligent chemical plant security management systems, designs an intelligent security management system based on blockchain and smart contract technology. The experimental results showed that compared to systems without smart contract support, the communication success rate between nodes was lower. The error rates of blockchain-based encryption systems, deep learning-based encryption systems and improved data encryption systems proposed in the study were 0.22, 0.07 and 0.09, respectively. The packet loss rates were 0.13, 0.04 and 0.05, respectively. The lower the bit error rate and packet loss rate of the encryption system, the clearer the illegal eavesdropping information. The experimental results indicate that the intelligent security management system designed in this study has good encryption performance and a higher communication success rate. The results have certain reference value in security management application in intelligent chemical plants.