Security Management System Research Articles

Deep reinforcement learning in edge networks: Challenges and future directions

Driven by the perception of IoT applications and advanced communication technologies, including beyond 5G and 6G, recent years have seen a paradigm shift from traditional cloud computing towards the local edge of the networks. Modern edge-centric networks have become autonomous and decentralized to expand IoT applications and corresponding data fusion. When edge networks are uncertain, network entities execute tasks locally to increase network performance. Over the past decade, Reinforcement Learning (RL) algorithms have been integrated into edge networks to generate optimal decisions and intelligent edge networks. However, complex edge networks with ample state and action space create several challenges in making optimal decisions with the RL technique. To address such shortcomings, Deep Reinforcement Learning (DRL) is combined with edge networks to build an intelligent edge framework. Concerning the benefits of edge intelligence, this paper summarizes the importance of traditional and advanced DRL methodologies in edge networks. Besides, we discuss different types of DRL-enabled libraries and state-of-the-art edge models for processing real-time IoT applications. Then, we review other emerging issues in edge networks regarding data offloading, caching, dynamic network access, edge information fusion, and data privacy. Moreover, we incorporate various DRL-enabled IoT applications in edge networks such as healthcare applications, industrial applications, traffic management, etc. Finally, we shed light on future trends of intelligent edge computing regarding system performance, security, and network management.

Analysis of problems and countermeasures in computer network engineering security

This paper analyzes the existing security issues in computer network engineering and proposes a series of countermeasures. To address the problems of hacker attacks and information leakage, it is recommended to strengthen network monitoring and the application of encryption technology. For the issues of malware and virus dissemination, it is advised to regularly update antivirus software and enhance employee security awareness training. Regarding network data leakage and privacy breaches, the use of secure transmission protocols and multi-factor authentication technology is advocated. For network security management and maintenance issues, establishing a sound security management system and emergency response plans is recommended to ensure the stable operation of network systems. Through the implementation of the above measures, the security level of computer network engineering can be effectively improved, ensuring the normal operation of network systems and the security of information.

Qualitative aspects of Industry 4.0 as a determinant of the improvement of the information security management system

Qualitative aspects of Industry 4.0 as a determinant of the improvement of the information security management system

A generic approach for network defense strategies generation based on evolutionary game theory

The generation of optimal defense strategies in dynamic adversarial environments is crucial for cybersecurity. Recently, defense approaches based on evolutionary game theory have gained significant achievements. However, they would fail when facing complex networks and sophisticated attack strategies, due to the fatal drawbacks of defense strategy generation considering atomic attacks only. To relieve this issue, a generic approach for generating defense strategies using evolutionary game theory is proposed in this paper. Initially, a novel payoff quantification method for network attack-defense games based on attack graphs is designed. Innovatively, two factors concerning the decision-maker's degree of irrationality (DI) and the level of environmental security (LES) are introduced into the replicator dynamics equation to model the impacts on equilibrium solutions. Noting that Active Directory (AD) domain service is one of the most used and representative information security management system in Windows domains, from which attack graphs and paths can be plainly extracted and analyzed. Therefore, it is necessary and imperative to anchor AD to unfold the theoretical analyses and experiments validation based on a real environment. Case studies on a real-world AD network demonstrate that the proposed approach is effective and can generate stable and efficient defense strategies.

Analysis of Relationships between Non-conformities, Process Maturity and Continual Improvement in Information Security Management Systems

Abstract In the current global context, companies need a defined minimum level of information security to recognize and deal with related threats and risks. Due to market, customer or legal requirements, specifications and requirements for information security are implemented uniformly according to standards such as the information security management standard ISO/IEC 27001 or industry-specific standards such as Trusted Information Security Assessment Exchange - TISAX, ISO IEC 27019 Energy Utility Information Security Standard. The conformity to these standard requirements within the established management system is checked during periodically required audits. However, there are various reasons for which, even after many years of audits in companies, there are still insufficient process implementations for information security requirements. The aim of the paper is to analyze the status of conformity and thus also the process maturity in selected samples of companies that have already had information security management systems (ISMS) implemented for several years. In detail, the reasons for deviations from the minimum requirements with associated risks for the security of information in companies were analyzed, which allow conclusions to be drawn about possible process improvements. The paper also analyzes why, despite established measures and existing expertise, only a limited level of process maturity is achieved on average. Other possible approaches to the implementation procedure for dealing with non-conformities in information security are also considered. The results of this research show that there is a need for an adjusted continuous improvement process, which makes risks resulting from insufficient process maturity more visible. Proposals for such improvements are listed.

Analisis Implementasi Keamanan Sistem Informasi pada Perusahaan Herald Sulsel

As a company that manages large amounts of sensitive data, information system security is a critical factor to protect important company information and maintain data integrity and availability. This article aims to analyze the implementation of information system security at the Herald Sulsel Company, as well as identify the steps taken by the company to protect its information system. This study uses a qualitative approach by collecting data through interviews with key personnel involved in information system security management, as well as through a review of existing security documents and policies. The results of this analysis provide an in-depth understanding of employee awareness of the importance of information system security, the company's efforts to protect information system security and internal and external network management to prevent security attacks. The findings of this study indicate that the Herald Sulsel Company has implemented a number of effective security measures. Herald Sulsel uses its own and third party server systems to prevent unauthorized access to their network. Encryption and authentication are also used to protect sensitive data sent over the network.

A blockchain‐based secure framework for data management

AbstractData management is a crucial requirement due to the autonomous and constrained nature of Unmanned Aerial Vehicles (UAVs), Internet of Things (IoTs), and the aviation domain. The autonomous and restricted nature of these sectors increases the need for a shared, distributed database, strong access control management, consensus in autonomous decision‐making, and effective communication across diverse protocols and devices. This research presents a comprehensive approach and offers a new viewpoint to the field of blockchain while establishing a fundamental baseline for future improvements in data management systems and addressing the shortcomings of previously proposed existing frameworks in order to fulfill the complex needs of secure data management. This study contributes to the advancement of secure and efficient data management systems by implementing robust data monitoring for error detection, ensuring data integrity, and enabling encrypted or anonymous data sharing based on sensitivity levels. Additionally, the integration of diverse devices, enforcement of immutable regulations compliance, and development of permissioned blockchain systems for identity management further enhance the system's capabilities, offering comprehensive solutions for modern data management challenges. In the tests, the proposed framework showed increased successful transactions in all rate controllers. Besides, effect of the validator number on throughput and latency is tested and analyzed thoroughly.

Penerapan Nilai-Nilai Kebangsaan Bersumber dari Pancasila dan UUD 1945 dalam Meninjau Strategi Manajemen Sekuriti pada PT. PLN (Persero) Guna Meningkatkan Kepuasan Pemenuhan Kebutuhan Listrik untuk Menyejahterakan Masyarakat Indonesia

PLN is a state-owned company which operates in the fields of electricity generation, electricity supply, telecommunications, finance and maintenance services. In accordance with the existing electricity supply law, the Indonesian state-owned company which is given the authority to manage the electricity industry, starting from the industrial, housing, business, government office and public street lighting sectors is PT. PLN. Apart from that, PT. PLN is also obliged to improve the welfare of the Indonesian people by fulfilling electricity needs in accordance with the 5th principle of Pancasila. The method used in this research is the literature review journal method. This research is to describe the extent to which national values originating from Pancasila and the 1945 Constitution are implemented in PT's security management strategy. PLN to increase satisfaction with meeting the electricity needs of the Indonesian people. The aim of this research is to analyze the implementation of security management strategies at PT. PLN is based on national values, namely the 5th principle of Pancasila and Law Number 30 of 2009 concerning Electricity Articles 28a and 28b. PT. PLN as a state-owned business actor which is fully obliged and responsible for its design in accordance with existing laws, must ensure that the security management system implemented by this company covers security and safety aspects in its operations.

Blockchain-Based Zero-Trust Supply Chain Security Integrated with Deep Reinforcement Learning for Inventory Optimization

Modern supply chain systems face significant challenges, including lack of transparency, inefficient inventory management, and vulnerability to disruptions and security threats. Traditional optimization methods often struggle to adapt to the complex and dynamic nature of these systems. This paper presents a novel blockchain-based zero-trust supply chain security framework integrated with deep reinforcement learning (SAC-rainbow) to address these challenges. The SAC-rainbow framework leverages the Soft Actor–Critic (SAC) algorithm with prioritized experience replay for inventory optimization and a blockchain-based zero-trust mechanism for secure supply chain management. The SAC-rainbow algorithm learns adaptive policies under demand uncertainty, while the blockchain architecture ensures secure, transparent, and traceable record-keeping and automated execution of supply chain transactions. An experiment using real-world supply chain data demonstrated the superior performance of the proposed framework in terms of reward maximization, inventory stability, and security metrics. The SAC-rainbow framework offers a promising solution for addressing the challenges of modern supply chains by leveraging blockchain, deep reinforcement learning, and zero-trust security principles. This research paves the way for developing secure, transparent, and efficient supply chain management systems in the face of growing complexity and security risks.

Investigating the Prognostic Significance of Immune-Nutritional Indices in Esophageal Cancer Patients Following Esophagectomy

Background: Esophageal cancer remains one of the most challenging malignancies to treat, with survival rates significantly influenced by various hematological and nutritional markers. Understanding these markers is critical in optimizing treatment approaches and improving patient outcomes. Objective: This study aimed to investigate the prognostic significance of several markers, including Mean Corpuscular Volume (MCV), Red Cell Distribution Width (RDW), Mean Platelet Volume (MPV), C-Reactive Protein (CRP), Albumin, Total Lymphocyte Count (TLC), CRP Albumin ratio (CAR), and the Prognostic Nutritional Index (PNI), in patients with esophageal cancer undergoing esophagectomy. Methods: A prospective observational study was conducted involving 43 patients diagnosed with esophageal carcinoma at Dr. Ruth K.M. Pfau Civil Hospital Karachi. Data collection included patient demographics, tumor characteristics, and laboratory results obtained from the Hospital Information and Management Security System (HIMSS). Statistical analysis was performed using SPSS version 25, with Kaplan–Meier survival curves and log-rank tests assessing the impact of hematological and nutritional markers on survival outcomes. Results: The majority of patients presented with advanced disease (Stage III and IV) and tumor sizes ranging from 5 to 10 cm. Mean survival times and statistical comparisons were analyzed, but no significant differences in survival based on the markers were observed. For example, patients with low and high PNI values did not show significant differences in survival (Log-rank test p-value = 0.382). Conclusion: The study did not demonstrate significant prognostic differences based on the evaluated hematological and nutritional markers. However, it highlights the importance of considering these factors in the overall management of esophageal cancer, suggesting further research with larger sample sizes and diverse populations is necessary.

Redesigning the HR processes for scaling up ISOQAR (India) Private Limited

Learning outcomes Post analysis of the case study, students will be able to comprehend the significance of Six Sigma and its integration with the human resources (HR) processes in the service sector. Post case study discussion, students will be able to: examine the HR processes of ISOQAR (India) and deduce the reasons to seek change in their approach; validate the importance of integrating Six Sigma in the human resource management (HRM) framework of an organization; and categorize the difficulties encountered while implementing Six Sigma in the service sector compared to those in a manufacturing environment. Case overview/synopsis In September 2006, four senior employees of an audit firm made the decision to start their own venture. They identified a gap in a sizable and fiercely competitive auditing industry. Nishid Shivdas, Suhas Risbood, Shiv Prakash Bhutra and Burgis Bulsara, co-founders of ISOQAR (India), had distinct leadership experiences that drove the organization to concentrate on developing a broad range of services, with a focus on management consulting, training and audit services. They created a distinctive positioning in market in a short span and reported growth by building strong customer relationships, providing high-quality service and personalized attention to individual clients and meeting deadlines. The wide gamut of services included areas such as the payment card industry, data security standard, information security management systems, business continuity management, service management systems, food safety management system, Responsible Jewellery Council certification services, retail audit services and risk assessment services. They concentrated on collaborating with UKAS for their accreditations. The focus on offering great services with faster response times, a varied array of services and the expertise of its founders let them to price their services at par with some of its competitors, and even higher in few cases. It did not have a large support staff; however, the ones they had were multifaceted, both full time and contractual. Being in the service industry, the founders realized that to maintain growth as the firm aims to grow geographically, their heavy engagement in the existing operations would have to give way to more standardized processes in general and HR in particular. Ensuring the integration of the current workforce to the Six Sigma framework presented challenges. Complexity academic level This case is designed for second-year students enrolled in Master of Business Administration/Post Graduate Diploma in Management (MBA/PGDM) or equivalent postgraduate-level programmes, in the domain of “Human Resource.” It will enable the students to engage with the significance of “Six Sigma” being used in various processes in the HRM framework. It can also be taught to students in the domain of Marketing because of its relevance to the service sector. Supplementary materials Teaching notes are available for educators only. Subject code CSS 6: Human Resource Management.

ENVIRONMENTAL DAMAGE AND GLOBAL WARMING ARE LABOR LAW ISSUES: A REFLECTION

This article aims to reflect on whether labor law relates to handling environmental damage and global warming issues, also becoming an alternative tool to solve those issues. The main reason for the reflection is that labor law and environmental law have the same actor, entrepreneurs as employers, with their companies. This article is written with a conceptual approach to employers and their companies' activities in both labor and environmental law concepts. The reflection shows that labor law has a strategic position in economic activities, which could be a way to solve environmental damage and global warming issues because of employers and their companies' production process. Labor law could solve the issues: First, laws about environmental protection and occupational health and security management systems should be integrated. Second, the authorization of the Company Regulation and Compulsory Company Manpower Report mechanism should be used to control whether employers obey and fulfil environmental protection laws. Third, the Workers' Union/Laborers' Union's voice and movement in environmental protection relating to companies as workplaces should be utilized. Fourth, support work-from-home and digital workplace trends as an alternative choice that is environmentally friendly because it decreases traffic for workers who use their personal vehicles to go to and back from their workplaces.

Implementing Quantum Resistant Algorithm in Blockchain-Based Applications

With quantum computing evolving very fast as we speak, the security and integrity of blockchain-based applications will become the most crucial aspect. A proposal is raised to use blockchain technology as a platform for writing and probating ‘wills’. Blockchain technology in drafting and probating wills makes them safe from manipulations, highly secure, and transparent. It also dramatically decreases the time required without catering for the challenges created by the current system. [9] This paper presents a new method for will transfer and inheritance management by implementing quantum-resistant algorithms in the security architecture of a blockchain decentralized application (DApp). The system uses IPFS Network for data storage and quantum-safe algorithms as retrieval and sending algorithms. The system includes Quantum-Resistant Dilithium Signatures and Merkle trees as the fundamental components for safeguarding the transfers of assets and claims for inheritance. Quantum-Resistant Dilithium Signatures offer an unbreakable shield against quantum attacks that are expected to happen, which in turn safeguards the privacy and authenticity of transactions. While Merkle trees are responsible for the organization of inheritance claims in an effective and tamper-proof manner, the introduced system incorporates smart contracts to address the execution of an inheritance case, adding more security and automation to the asset distribution process. The system ensures a robust security framework by integrating quantum-resistant algorithms at the very core of the blockchain DApp for instance, retrieval and sending. This research is of great significance to blockchain technology which is the emerging technology of the future because it addresses the existing threat of quantum computing by showing the feasibility of using quantum-resistant algorithms in practical applications. As established by the findings, besides Quantum-Resistant Dilithium Signatures and Merkle trees, the systems of asset transfers and inheritance management within blockchain networks are enhanced in terms of safety and reliability. Hence, paving the road to the creation of more secure and trustworthy digital asset management systems.

Information Security and Privacy Management in Intelligent Transportation Systems

With the global digitalization of services, passenger Intelligent Transportation Systems (ITSs) have emerged as transformative components, yet the practical implementation of state-of-the-art measures to ensure information security and privacy presents substantial challenges. In this article, we propose a framework for information security and privacy management. The framework is validated through two empirical studies. First, the framework is used to extract data during the literature review defining state-of-the-art aspects and measures. Second, a survey-based analysis of running passenger ITSs in selected regions of the European Union provides insights into real-life ITS implementations, enabling a thorough comparison with the proposed state-of-the-art measures. The study also showed that the proposed framework depicts some dependencies between measures, and, thus, using its matrix structure for the state of information security and privacy management in the organization helps to cross-check the usage of policies or methodologies by the organization departments. Our findings resulted in recommendations for organizations developing ITSs to enhance their information security and privacy management systems and bridge the gap between research proposals and practical implementation.

Blockchain Enabled Social Network for Detecting Fake Accounts

Front end technology with permanent accounts is employed in online social networks to help people get to know one another. In an effort to maintain connection with everyone, Facebook and Twitter are changing along with the users. OSNs are used by them for planning events, news exchange, interpersonal communication, and even running their own online enterprises. Because of OSNs' quick growth and the abundance of personal data that its users have shared, attackers and imposters have been lured to them with the intention of stealing personal information, spreading disruptive activities, and publishing false information. A further rationale for creating fictitious profiles for hateful accounts. In an attempt to harm the reputation of the person they detest, these users make profiles using their usernames and publish photographs and articles that aren't related to them. to use blockchain technology, Aadhar number verification, and SVM profile classification to create a reliable solution for detecting phoney social network profiles. By analysing several aspects of social media profiles, the SVM classification uses machine learning to discern between real and fraudulent accounts. By verifying Aadhar numbers through legitimate channels, Aadhar number verification is integrated into the registration process, guaranteeing the authenticity of user identities. A decentralised and secure identity management system is made possible by the use of blockchain technology, with smart contracts providing immutable storage for verified user data.

Managing Inherent IT Business Risk against Cyber Threats: a Decision Analysis Case Study of an Oil and Gas Company

XYZ, an anonymized oil and gas company, aims to enhance cyber resilience by strategically managing inherent risk profiles in cybersecurity, aligned with business needs and stakeholder expectations. This research addresses challenges including Information Security Control determination, proficiency improvement in risk management, and ISMS preparedness. Additionally, it tackles procurement strategy for Security Operations Control across XYZ Group, operating under PSC Gross Split, Cost Recovery, and Non-PSC statuses. Utilizing diverse frameworks such as problem tree analysis, stakeholders’ power-interest matrix, MITRE ATT&CK, NIST 800-53, COBIT 2019, ISO 27005:2022, KAMI 5.0, and SMART, data analysis includes risk documents, interviews, and cyber-attack data. The research establishes effective IS Control for risk mitigation, readiness for Information Security Management System ISMS implementation, strategic programs enhancing risk management capability, and refined Security Operations Control procurement. These outcomes, incorporated into a collaborative contract structure, significantly mitigate cyber threats and potential impacts, such as disruptions to operations, revenue reduction, increased costs, data theft, and non-compliance.

Formation of a system for managing the economic security of business in the global information environment

In today's global information environment, business economic security is becoming an increasingly urgent problem. An important aspect is forming an effective economic security management system, allowing it to resist potential threats and minimize risks. The study aims to identify modern threats to the economic security of business and determine the principles of the formation of its management system in the global information environment. The components of the economic security management system of business (security objects, security subjects, goals and objectives, functions, principles, and management methods) are substantiated. The need to ensure the economic security of business is determined, which shows the importance of developing digital entrepreneurship as a critical element of economic growth, job creation, and the activation of innovation and investment processes. The formation of a digital business environment is based on digital opportunities thanks to using the potential of digital networks. A study of enterprises' use of information and communication technologies was conducted. It has been established that constant monitoring of external and internal threats to business activity will provide an opportunity to identify the causes, nature, and intensity of their action and predict the negative consequences of the impact on the level of economic security of business. At the same time, special attention should be paid to the analysis of the technological external environment, when the use of information systems, new technologies for the design and production of products, and modern electronic models of conducting business activities will contribute to favorable competitive positions of the business. Keywords: management of economic security, global information environment, business, management system.

Blockchain-based secure and scalable supply chain management system to prevent drug counterfeiting

Blockchain-based secure and scalable supply chain management system to prevent drug counterfeiting

ВЫЯВЛЕНИЕ ПРОБЛЕМ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ МЕТОДОМ СИСТЕМАТИЧЕСКОГО ОБЗОРА ЛИТЕРАТУРЫ

The field of information security covers a wide range of technical, organizational and social aspects, requiring information security specialists to take a unique and comprehensive approach to the development, support, operation, evaluation and improvement of information security management systems. An important element of successful information protection is the accurate identification and assessment of risks and vulnerabilities that may become a source of threats. In existing publications, as a rule, it is assumed that specialists have the necessary experience and knowledge to conduct risk analysis. However, in the dynamic world of information technology and threats, an information security specialist faces a huge amount of information and potential risks that are constantly evolving. Because of this, it is an impossible task to keep in mind all kinds of threats to information security. 
 The purpose is to identify actual problems of information security, potentially acting as sources of information security risk, based on the method of systematic review of the literature. Results: 73 actual problems of information security have been identified, which an information security specialist should take into account in his activities. Understanding these issues makes it possible to develop more effective protection strategies, as well as to make informed and informed decisions when developing and applying security measures.

QISS: Quantum-Enhanced Sustainable Security Incident Handling in the IoT

As the Internet of Things (IoT) becomes more integral across diverse sectors, including healthcare, energy provision and industrial automation, the exposure to cyber vulnerabilities and potential attacks increases accordingly. Facing these challenges, the essential function of an Information Security Management System (ISMS) in safeguarding vital information assets comes to the fore. Within this framework, risk management is key, tasked with the responsibility of adequately restoring the system in the event of a cybersecurity incident and evaluating potential response options. To achieve this, the ISMS must evaluate what is the best response. The time to implement a course of action must be considered, as the period required to restore the ISMS is a crucial factor. However, in an environmentally conscious world, the sustainability dimension should also be considered to choose more sustainable responses. This paper marks a notable advancement in the fields of risk management and incident response, integrating security measures with the wider goals of sustainability and corporate responsibility. It introduces a strategy for handling cybersecurity incidents that considers both the response time and sustainability. This approach provides the flexibility to prioritize either the response time, sustainability or a balanced mix of both, according to specific preferences, and subsequently identifies the most suitable actions to re-secure the system. Employing a quantum methodology, it guarantees reliable and consistent response times, independent of the incident volume. The practical application of this novel method through our framework, MARISMA, is demonstrated in real-world scenarios, underscoring its efficacy and significance in the contemporary landscape of risk management.