Security Policy Management Research Articles

Strategic management of diplomatic engagements, security policies, economic initiatives, and cultural influence: Analyzing Pakistan’s leadership role in South Asia's geopolitical stability

This study investigates the numerous crucial factors affecting Pakistan's strategic importance in South Asia, including economic pursuits, cultural influence, security measures, and diplomatic relations. The research uses a mixed methods approach to identify significant relationships between these traits and the perceived effectiveness of Pakistan's regional initiatives. The findings indicate that security protocols negatively impact Pakistan's strategic importance; however, they are positively influenced by economic initiatives and cultural presence in South Asia. Demographic parameters such as age and educational level strongly affect perceptions of Pakistan's regional influence. The study highlights cultural, political, and economic factors that bolster or undermine Pakistan's global stature. Policymakers seeking to enhance Pakistan's regional influence should regard these implications with gravity. The study offers valuable policy recommendations for addressing current challenges and enhances our understanding of South Asian geopolitics.

Evaluating the status of information security management in faculty libraries: a case study of Allameh Tabatabai University

ABSTRACT Aim This study aims to evaluate the status of Information Security Management in Faculty Libraries at Allameh Tabatabai University, Tehran, Iran. This study is based on the standard of ISO/IEC 27,002. Method The research method is a descriptive survey. Data was collected through a researcher-made questionnaire based on the ISO/IEC standard 27,002 which includes 11 main indicators and 39 sub-components. The statistical population of this study is 45 main and middle managers of faculties’ libraries of Allameh Tabatabai University located in Tehran (Faculties of Law, Psychology and Educational Sciences, Management and Accounting, Physical Education, Literature and Foreign Languages, Communication Sciences, Economics, Social Sciences, Mathematical and Computer Sciences). Due to the limited statistical population, sampling was not performed. Data analysis was done using descriptive statistics, inferential, and SPSS software. Findings The average score of information security management performance in the faculty libraries of Allameh Tabatabaei University located in Tehran according to ISO/IEC27002 is above average. Examination of the average scores of performance evaluation indicators of faculty libraries of Allameh Tabatabai University showed that four indicators including Information Security Management Policy, Information Security Incident Management, Cryptography, and Security Supplier Relationships are not in a favorable situation and need attention from the relevant managers. In other indicators, the performance of faculty libraries is at the desired level. Conclusion The results show a desirable level of information security management in the faculty libraries of Allameh Tabatabai in Tehran. However, some indicators, such as Information Security Policies, Information Security Incident Management, Cryptography, and Supplier Relationships, are still weaker. Therefore, to achieve security goals some suggestions are provided.

A model transformation based security policy automatic management framework for software-defined networking

Software-defined networking (SDN) has been utilized to enforce the security of traditional networks. However, the existing SDN-based security enforcement mechanisms rely heavily on the security policies containing the underlying information of data plane, such as MAC address, IP address or switch ports. These security policies need to be specifically developed by network operators and loaded into the control plane manually. With increasing the scale of underlying network, the existing security policy management mechanisms confront more and more challenges. The security policy transformation for SDN networks is to research how to transform the high-level security policy without containing the underlying information into the practical flow entries used by Openflow switches automatically, thereby implementing the automatic management of security policies. To achieve this objective, we propose a model transformation based security policy automatic management framework for software-defined networking in this paper. Leveraging its functional modules, the framework can solve the problems of how to find a connected path for each access control rule of security policy model (SPM) in data plane, how to transform the connected path into the system model of flow entries, as well as how to generate the practical flow entries according to the system model of flow entries. In order to validate the effectiveness and performance of framework, we implement the framework by leveraging POX controller and Mininet emulator. The experimental results illustrate the framework can transform SPM into practical flow entries, synchronously perceive the modifications caused by cutting down one connected path or changing SPM, and continuously keep the data plane holding the security properties defined by SPM at runtime.

Dynamic Security Policies for Cloud Infrastructures: An AI-Based Framework

The rapid expansion of cloud computing has introduced significant challenges in maintaining robust security policies due to the dynamic and scalable nature of cloud environments. This research presents an AI-based framework for developing and implementing dynamic security policies in cloud infrastructures. The proposed framework leverages machine learning algorithms to analyze and predict potential security threats, enabling the real-time adaptation of security measures. By continuously monitoring cloud resources and utilizing intelligent threat detection mechanisms, the framework ensures a proactive approach to cloud security. Case studies demonstrate the effectiveness of the AI-driven framework in enhancing the security posture of cloud infrastructures, reducing vulnerabilities, and minimizing the risk of data breaches. The results indicate that the integration of AI in cloud security policy management offers substantial improvements in response times and threat mitigation capabilities.

KubeAegis: A Unified Security Policy Management Framework for Containerized Environments

KubeAegis: A Unified Security Policy Management Framework for Containerized Environments

Risk Assessment of an Automated Document Management System in a Hierarchical Management System

The functioning of any document management system in the infrastructure of a hierarchical process control system is to ensure uninterrupted work with documents at all stages of their use for the system's subjects, from designers, administrators to users and executors. Only with a well-established security system with an authorization management system can an automated document management system (ADMS) achieve efficient operation. In its turn, the security system of the automated document management system is based on the developed security policy and risk management system. The paper considers the infrastructure of an automated document management system, methods for assessing risk levels, which determine the choice of security tools and determining the level of security for a hierarchical management system. The proposed research results have been tested in the functioning of security systems at airports with a hierarchical structure of process control.

Security Management on Arduino-Based Electronic Devices

Arduino has emerged as a very popular electronic board because of its low-cost, open hardware approach and flexibility with a huge potential for prototyping, small product runs, Internet of Things, makers or educational electronic projects, among others. However, there is a literature gap concerning wide analysis on different versions and types of Arduino boards, which include software, hardware and communication vulnerabilities analysis. This work analyzes the software, hardware and communication vulnerabilities that can be found in different versions of Arduino boards (entry level, enhanced features, Internet of Things-oriented, non-official and with Operating System). The results of the analysis show that, in most cases, Arduino boards present hardware and software limitations and security vulnerabilities, probably due to their low-cost requirement design. Some examples are: an easy-to-override firmware, lack of power protection or non-encrypted board communications in the case of Arduino Yun. Also Arduino does not check bad use of memory stack, so bad memory operations may end up easily on memory corruption and unexpected behavior. All these limitations and vulnerabilities may lead to security breaches on the deployed environment. Therefore, any security management policy must take these weaknesses into account.

Digital information security management policy in academic libraries: A systematic review (2010–2022)

Digital information security management (DISM) is considered an important tool to ensure the privacy and protection of data and resources in an electronic environment. The purpose of this research is to look into the applications of DISM policies in terms of practices and implementation in academic libraries. It also identifies the challenges faced by academic libraries in applying these DISM practices regarding policy. A systematic literature review was conducted to achieve the objectives of the study. The data were collected from well-known different databases, that is, Library Information Science and Technology Abstracts (LISTA), Library and Information Science Abstracts (LISA), IEEE Xplore, Emerald Insight, ACM Digital Library, Scopus, Sage journals, Taylor & Francis, ProQuest, Science Direct, Wiley Online Library, and Google Scholar. It followed the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) guidelines to choose relevant articles with keyword searching. Some academic libraries have developed DISM policies on data protection, data backup, information security (IS) systems, the development of hardware and software, the training of library staff, data protection from malware and social engineering, and data security and privacy. A few libraries have developed a mechanism to protect and secure users’ sensitive data from hackers, viruses, malware and social engineering. Findings indicated that both organisations and users trust libraries due to their strict privacy and data security policies. However, some academic libraries did not adopt and implement DISM policies in their organisations, even though they had written DISM policies. Libraries have been facing issues with the DISM policy on data security and privacy, data backup, IS systems, hardware and software upgrades and technical support of library staff. They also face budgetary challenges and a lack of readiness among librarians to adopt emerging tools and technology such as DISM. Library professionals faced challenges in developing and implementing the DISM policy. For data security and privacy, stakeholders, administrators and library professionals must promote the DISM policy culture in academics. This study is beneficial for library professionals, policymakers, administrators and management to make DISM policies and implement them in their organisation or libraries to secure sensitive, personal data and resources. This article is the first review of DISM policy in academic libraries of its kind and would be useful for information professionals, stakeholders and administrators.

Effective Collaboration in the Management of Access Control Policies: A Survey of Tools

Access control (AC) tools implement security policies for controlling access to various assets, including file systems, physical resources, and social media posts. They are also used as pedagogical tools for exploring and understanding intricate details of complex security policies. However, current tools are not developed based on the actual needs of security and policy professionals. They are not equipped to support basic and vital operations like providing a policy overview, policy comparisons, identifying and resolving policy conflicts. In this paper, we explore (a) the specific challenges faced in the collaboration between access control policy makers and implementers, and (b) the limitations that current tools have towards addressing these challenges. We argue that a lack of effective collaboration between policy makers and implementers may lead to a misunderstanding of security policy semantics. The main reason for this problem is that policy makers and implementers use different technical languages for communication. The lack of a common technical language leads to a miscommunication between the two parties. The key aim of our work is to review the currently available research-based access control tools and to identify their pros and cons. To accomplish this, we have reviewed a set of access control tools that have a wide variety of features and applications. We have also identified a set of tasks that these access control tools possess to help the work of policy professionals who are involved in the creation, management and maintenance of security policies. We also compared the functionalities of these tools, the different types of security policies that they support, and their visualizations. Together, these comparisons provide a clear understanding of what current access control systems lack and how they can be improved in order to support effective collaboration between policy makers and policy implementers. We have also found that many of these tools could be more accessible to non-technical policy professionals to understand the semantics of security policies if these tools provide features for visualizing security policies.

The Effect of COVID-19 on Remote Work Policies

The climate for information security has drastically shifted due to the COVID-19 pandemic. In the past, information security focused on the purview of the office space and the physical infrastructure, with increased specializations in digital architecture such as the Internet of Things, cloud services, and Software-as-a-Service (SaaS). Remote work was often discouraged due to ineffective mitigation strategies, especially when personal devices were involved. Remote work has become commonplace, and information security specialists must adapt to the changing environment. Effective information security policy management for a modern age will include effective mobile and remote usage provisions that maintain the same or similar workflow as on-site activities. Virtualization offers enhanced security for remote work while maintaining set routines.

Assessment and Mitigation of Information Security Policy in Budgeting System using KAMI Index 4.1

This Threats to information resources require information security management policies in every agency. The Information Security Index (KAMI Index) is one of the methods developed by the Ministry of Communication and Information Technology, used to evaluate the maturity level, completeness of ISO/IEC 27001:2013 implementation and information security readyness. As a national zakat institution, XYZ Organization has utilized information technology in several systems, including the budgeting system. However, the information security index has never been measured. This condition may result in the risk of threats to information security, so it is necessary to measure. The Budgeting System needs to be measured using KAMI Index 4.1. The assessment criteria are carried out on seven categories to know how the quality of the information security policy is. The results of this assessment, XYZ organization gets an electronic system score is 17, governance 75, risk management 30, framework 31, asset management 37, ICT 38, securing third party involvement 40%, service security 20%, personal data protection 27% so the total score of 5 categories is 211 or at level I+ to II. This organization has started implement the framework at early stage and has not met the initial requirements for ISO/IEC 27001:2013 certification.

Evaluation of Basic Principles of Information Security at University Using COBIT 5

Information security issues commonly arise in a company and institution, including those in University. Some of the threats and attacks are unauthorized access, system user accountability, and logical and physical issues. This study reveals the obedience rate of the information security principle in Universitas Amikom Purwokerto and provides a recovery strategy. The domains being used were APO13, DSS5, and MEA3. The researcher employed a descriptive quantitative method by having documentation, interview, and administering a questionnaire to the respondents. The respondents were 83 employees who got selected by using the purposive sampling technique. The result shows that the capability level is in level 3, known as the established process. It means that the employees have applied the current procedure, even though they have not applied information security management. The proposed refinement strategy emphasizes the security policy, classification and asset management, physics and environment security, and business continuity management. The gap can be fixed by implementing the proposed refinement strategy. Future researchers may evaluate obedience based on the identified variables by keeping the standard in mind.

MANAGEMENT AND LEGAL ASPECTS OF ECONOMIC SECURITY OF ENTERPRISES IN THE PROCESS OF INNOVATION

Abstract. Today, the activity of innovatively active enterprises is a rarity in our country, and it never need support and stable operating conditions. However, a number of negative, both external and internal factors and threats significantly destabilize the state of functioning of innovatively active enterprises in Ukraine. In pandemic, their influence has only increased and requires decisive management decisions that would guarantee the safety of business for these enterprises. For the effective implementation of security policy management of the activities of innovatively active enterprises, an effective mechanism is needed, which should include proper resource provision. It is impossible to carry out effective business security and implement planned management decisions without the proper amount of resources. The importance of resource support for business security management of innovatively active enterprises is proved, taking into account legal aspects. It has been established that the efficiency of the financial and economic activity of an innovatively active enterprise depends, first of all, on a certain set of resources at the disposal of the given enterprise. Resources are always limited, so each innovatively active enterprise must determine which goals will ensure the most productive use of these resources. The main factor in the development of enterprises on the verge of the fifth and sixth technological modes is the ability to ensure the flexibility of the production and management process and the relationship between the quality of technology development and active innovation. The purpose is to form the choice of the type of business security management in the innovation sphere under the influence of COVID-19, taking into account legal aspects. The research methodology includes methods of graphic display, abstraction, analysis and synthesis. The main research method was expert research. As a result, a characteristic-meaningful matrix was formed with each type of business security management. Keywords: innovation, security, economic security, enterprises, management. JEL Classification O31, O32 Formulas: 0; fig.: 3; tabl.: 3; bibl.: 15.

МОДЕЛЬ ЭФФЕКТИВНОЙ ПОЛИТИКИ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ В КОНТЕКСТЕ ПРАКТИКИ УПРАВЛЕНИЯ

The article is devoted to the study of policy in the field of information security management and is relevant, since it contains an assessment of the effectiveness of the information security management model. However, our review of the information security management literature has identified four major weaknesses that reduce the usefulness of recommendation characteristics for state and municipal governments implementing information policy management practices. The aim of this article is to provide a comprehensive overview of information security policy management and to develop a model based on the generalization of practice. Our review of foreign literature shows that it is advisable to characterize an effective model of information policy management for government bodies. However, there is a number of shortcomings that reduce the usefulness and effectiveness of the information policy model for authorities in the implementation of security policy. In the literature, in our opinion: there is no holistic view of the information policy model (deficiency 1); there is no uniformity in terminology and semantics (flaw 2); different levels of detail are used when describing policy management actions (flaw 3); and it is difficult to use information policy management guidance from other practice areas such as risk management, information practice training and security awareness (Gap 4). The authors structure the article as follows. Firstly, it examines the existing lifecycles of information security policy management. Secondly, the authors explain the research methodology used to review and analyze the literature. Thirdly, the authors propose a model of management practices related to information security policy. Fourthly, the authors explain how the proposed model eliminates the identified shortcomings. Two conclusions can be drawn from the study: 1) the model of information security policy management involves the enforcement of power aimed at managing risks; 2) the model is focused on identifying 3 stages of institutionalization - the development, implementation and assessment of management activities

Livelihood Strategies Shape Vulnerability of Households' Food Security to Climate in Senegal

We integrate long-term observations of rainfall and repeat, large-scale, nationwide household surveys of nutrition and socio-economic status to assess the vulnerability of food security to climate in Senegal. We use a mixed methods approach and a vulnerability framework to explain how it is that food security is on average lower, and more variable year-to-year, in the climatologically wetter south and east of the country than in the drier western center and north. We find that it is sensitivity to climate that explains the spatial variation in food security, while exposure explains its temporal variation, but only where sensitivity is high. While households in the western center and north, geographically closer to the political and economic center of action, are less dependent on livelihoods based on climate-sensitive activities, notably agriculture, these activities still dominate in the more remote, landlocked and at times conflict-ridden south and east, where sensitivity to the vagaries of rainfall persists. As they work to strengthen the resilience of climate-sensitive activities, food security and climate-risk management projects and policies should move beyond simplistic, deterministic assumptions about how climate affects food security outcomes, and invest in livelihood diversification to increase rural income and reduce vulnerability of food security to climate.

A insider threat detection system based on user and entity behavior analysis

Under the background of “digital new era”, the trend of network environment diversification and personnel technical requirements complexity is becoming more and more intense. After the “Prism Gate” incident was exposed, the public began to think deeply about insider security. At present, most organizations adopt security information and event management (SIEM) security policies and the rules to carry out insider security detection. However, with the surge of insider information data, the number of false alarms and false alarms due to the lack of context increases, which consumes a lot of time and human and material resources. Based on these problems, it is particularly important to develop a new insider safety inspection system and tools. This work proposes to develop an insider threat detection system based on the security strategy of user and entity behavior analysis to realize the detection and analysis of insider threat with high precision. The main work is as follows:This work abandons the traditional SIEM combined rules to determine the anomaly, but adopts the detection strategy of User and Entity Behavior Analysis (UEBA).This work proposes an improved LSTM-GaN insider threat detection algorithm.

MoTH: Mobile Terminal Handover Security Protocol for HUB Switching Based on 5G and Beyond (5GB) P2MP Backhaul Environment

With the evolution of wireless technologies, 5G and Beyond (5GB) communication is paving a way for efficient, ultrareliable, low-latent, and high converging services for the Internet of Things (IoT). Along with efficient communication, the security of messages is one of the concerns that must be maintained throughout the operations. Backhaul forms an essential part of 5GB with an ability to enhance the coverage and quality of service for IoT. However, conventional wired backhaul connection would cost operators thousands of dollars in the construction of 5GB infrastructure considering the ultradense nature of IoT. As a result, wireless backhaul is quickly becoming a feasible alternative to address 5GB’s direction toward network densification without affecting its other provisions. Wireless backhaul is expected to increase the landscape, covering from islands to mountains, which were difficult to access in the existing network generation. Moreover, it can effectively respond to the situation where the data traffic tremendously increased. Despite such provisioning, the wireless backhaul poses relatively various security threats and vulnerabilities due to the characteristics of wireless technologies. Several studies have been conducted to address the security problems; however, existing protocols do not support dynamic security policy and key management in a decentralized structure as well as secure handover in a specific scenario where Terminals (TMs) are moving. Motivated by this, we proposed the Mobile Terminal Handover (MoTH) security protocol to provide secure handover of mobile terminals between hubs. To solve the problem of existing protocols, a new entity called BMF is introduced to support distributed and dynamic security policy and key management in each serving network of the 5GB backhaul environment. The proposed protocol satisfies security requirements, including authentication and key management, confidentiality, integrity, and perfect forward secrecy. Additionally, it supports policy and key update services, and optimized handover. The security and correctness of the proposed protocol are thoroughly verified using the two formal security analysis tools: 1) BAN logic and 2) Scyther. Additionally, the performance evaluation shows that the proposed protocol is efficient.

Mutual authentication of nodes using session token with fingerprint and MAC address validation

Security has become an important issue during communication among mobile nodes in an unfavorable condition. The mobile node’s property is dynamic, so it isn’t easy to manage security policies. These difficulties present a barrier to building multigene security arrangements that accomplish both assurance and attractive network execution. The proposed work suggests the mutual authentication-based protocol, helping in the handshake between two nodes. Once they connected securely through this mechanism, they can interchange the required information. We have a monitoring node that will maintain the access list of the authorized nodes. The monitoring node will keep the nodes’ list based on the MAC address of nodes and digital signature key. The key is generated by combining the hash code of the MAC address with the variety of the user’s fingerprint file acting as a node. The combination of both will verify the entity. It involves the various subsections that include registering the user, token generation, sending and receiving messages through multiple algorithms. The proposed work is implemented using MATLAB. The analysis of the base work and the proposed work is visualized by structuring the GUI. Due to all the strength of the pattern of session token is further validated using the various online password checking tools, and the results obtained are quite impressive. Secure Hash Algorithm (SHA) is a cryptographic hashing algorithm used to decide a specific bit of information’s integrity. In the proposed method, we used different types of keys with additional entropy to check the trust level of password security. The result has been discussed using various entropy graphs that prove improvement over the existing approach.

Dynamic Management of Security Policies in PrivOrBAC

This article is a continuation of our previous work on identifying and developing tools and concepts to provide automatic management and derivation of security and privacy policies. In this document we are interested in the extension of the PrivOrBAC model in order to ensure a dynamic management of privacy-aware security policies. Our approach, based on smart contracts (SC) and the WS-Agreement Specification, allows automatic agents representing data providers and access requesters to enter into an access agreement that takes into consideration not only service level clauses but also security rules to protect the privacy of individuals. Our solution can be deployed in such a way that no human intervention is required to reach this type of agreement. This work shows how to use the WS-Agreement Specification to set up a process for negotiating, creating and monitoring Service Level Agreements (SLAs) in accordance with a predefined access control policy. This article concludes with a case study accompanied by a representative implementation of our solution.

Network Security Policy for Higher Education Institutions based on ISO Standards

Computer network plays a very important role in any organizations or institutions. It becomes a necessary tool, useful for communications, and can be utilized in storing data in various forms and at various locations. However, it intrinsically at risk to breaches from both internal and external attacks, and because of that, there should be an appropriate implementation and management of the network and its security. The study aimed to assess the employed network security of the higher education institutions (HEIs) and check if they conform to the six parts of ISO 27033 international standards. Standardized ISO 27033 assessment questionnaire was the main tool in gathering the data and the respondents were the network security team members of the five (5) HEIs. Results showed that HEIs did not mostly conform to the ISO 27033 requirements. Hence, to have a better guide and implementation of the institutions network security, a network security management policy based on ISO 27033 must be in place.