Security Policy Research Articles

Crafting organizational security policies for critical infrastructures: an architectural approach

Crafting organizational security policies for critical infrastructures: an architectural approach

Evaluating the status of information security management in faculty libraries: a case study of Allameh Tabatabai University

ABSTRACT Aim This study aims to evaluate the status of Information Security Management in Faculty Libraries at Allameh Tabatabai University, Tehran, Iran. This study is based on the standard of ISO/IEC 27,002. Method The research method is a descriptive survey. Data was collected through a researcher-made questionnaire based on the ISO/IEC standard 27,002 which includes 11 main indicators and 39 sub-components. The statistical population of this study is 45 main and middle managers of faculties’ libraries of Allameh Tabatabai University located in Tehran (Faculties of Law, Psychology and Educational Sciences, Management and Accounting, Physical Education, Literature and Foreign Languages, Communication Sciences, Economics, Social Sciences, Mathematical and Computer Sciences). Due to the limited statistical population, sampling was not performed. Data analysis was done using descriptive statistics, inferential, and SPSS software. Findings The average score of information security management performance in the faculty libraries of Allameh Tabatabaei University located in Tehran according to ISO/IEC27002 is above average. Examination of the average scores of performance evaluation indicators of faculty libraries of Allameh Tabatabai University showed that four indicators including Information Security Management Policy, Information Security Incident Management, Cryptography, and Security Supplier Relationships are not in a favorable situation and need attention from the relevant managers. In other indicators, the performance of faculty libraries is at the desired level. Conclusion The results show a desirable level of information security management in the faculty libraries of Allameh Tabatabai in Tehran. However, some indicators, such as Information Security Policies, Information Security Incident Management, Cryptography, and Supplier Relationships, are still weaker. Therefore, to achieve security goals some suggestions are provided.

Overlooking nature: the Arctic, climate change, and environmental diplomacy in the study of Canadian foreign policy

ABSTRACT This article examines three prominent concepts in post-Cold War foreign policy in Canada: the Arctic, climate change, and environmental diplomacy. We study the prevalence of articles on these topics in the wider field of Canadian foreign policy studies, who is responsible for their production, and how they relate to each other and to the broader field of Canadian foreign policy studies. Through a quantitative analysis of these concepts in six academic journals between 1989 and 2022, we find that contrary to their importance to Canadian foreign policy practice during that time, the Arctic, climate change, and environmental diplomacy are: (1) marginal to mainstream scholarship on Canadian foreign and security policy; (2) conceptually closely linked together; and (3) shaped by the knowledge production of a relatively small epistemic community of scholars. We outline the methodology of our literature review for the Arctic, climate change, and environmental diplomacy within Canadian foreign policy scholarship, present our findings, and discuss their significance for understanding these topics within the broader field of Canadian foreign policy studies.

Practical Strategies for The Economic Development of Mexico: Nearshoring Trend

This research aimed to suggest practical strategies for Mexico's economic development through the trend of nearshoring. It involved identifying, analyzing, and organizing the causes of the conflict between China and the USA over international trade and exploring the opportunities that nearshoring to Mexico can offer. Qualitative research methods were applied, and documentary research techniques were used based on two study objects: a) the Sino-American dispute over international trade and b) nearshoring to Mexico. Nearshoring to Mexico is driven by various factors, including tariff benefits from Free Trade Agreements, low labor costs in manufacturing companies, and a stable exchange rate. Therefore, Mexico needs to encourage the development of industrial parks, implement an effective Public Security Policy, offer tax incentives to attract Foreign Direct Investment and improve port, road, and air infrastructure to take full advantage of this trend.

A Survey on Satellite Communication System Security

In recent years, satellite communication systems (SCSs) have rapidly developed in terms of their role and capabilities, promoted by advancements in space launch technologies. However, this rapid development has also led to the emergence of significant security vulnerabilities, demonstrated through real-world targeted attacks such as AcidRain and AcidPour that demand immediate attention from the security community. In response, various countermeasures, encompassing both technological and policy-based approaches, have been proposed to mitigate these threats. However, the multitude and diversity of these proposals make their comparison complex, requiring a systemized view of the landscape. In this paper, we systematically categorize and analyze both attacks and defenses within the framework of confidentiality, integrity, and availability, focusing on specific threats that pose substantial risks to SCSs. Furthermore, we evaluate existing countermeasures against potential threats in SCS environments and offer insights into the security policies of different nations, recognizing the strategic importance of satellite communications as a national asset. Finally, we present prospective security challenges and solutions for future SCSs, including full quantum communication, AI-integrated SCSs, and standardized protocols for the next generation of terrestrial–space communication.

Information security policy effectiveness: a managerial perspective of the financial industry in Vietnam

Purpose Information security (InfoSec) policy violations are of great concern to all organisations worldwide, especially in the financial industry. Although the importance of InfoSec policy has been highlighted for many decades, InfoSec breaches still occur due to a low level of employee compliance and a lack of engagement and competence in high-level management. However, previous studies have primarily investigated the behavioural aspects of InfoSec policy compliance at the individual level rather than the managerial factors involved in constructing InfoSec policy and developing its effectiveness. Thus, drawing on neo-institutional theory and a transformational leadership framework, this research investigated the influence of external mechanisms and transformational leadership on InfoSec policy effectiveness. Design/methodology/approach The research model was implemented using field survey data from professional managers in the financial sector. Findings The results reported that neo-institutional mechanisms and transformational leadership shape InfoSec policy effectiveness in an organisation. Originality/value This study broadens current InfoSec policy research from an individual level to a managerial perspective and enhances the existing literature on neo-institutional and transformational leadership in the context of InfoSec. It highlights the need to evaluate InfoSec policy based on external factors and to support transformational leadership styles that promote InfoSec policy enforcement and effectiveness.

Large-scale production of non-conventional edible plants for biodiverse school meals

IntroductionSchool feeding programs are important for ensuring food security and promoting child health and development, particularly in low-income countries. In view of this importance, it is possible to increase the quality of these meals by diversifying the vegetables offered and incorporating underutilized plants to improve dietary diversity and nutritional quality into school meals.MethodsThis study was carried out using the action research methodology following the implementation and development of the “Inova na Horta” project in the city of Jundiaí, São Paulo, Brazil. The project was based on the existing and functioning physical and organizational structure of a municipal organic farm. Vegetables were selected from among 210 non-conventional species and varieties, which were further selected for continuous production based on 8 nutritional, culinary and cultivation criteria.ResultsThirty-four vegetables were selected for continuous cultivation and provisions to the school kitchens. Nine tons of vegetables were produced and provided to 90 municipal schools from 2020–2023. Leafy vegetables accounted for most the production, with a total weight of 6441 kg corresponding to 71.6% of the total harvest. Kitchen teams were trained throughout the project duration.DiscussionThe feasibility of the production and culinary use of 34 biodiverse, nutrient-rich and underutilized food vegetables for school meals was demonstrated. The selected vegetables are nutrient-rich and contain higher amounts of minerals and proteins than the control vegetables (conventional vegetables), thus complementing several nutrients in school meals. This methodology can be replicated by municipalities of various sizes as a public policy of food and nutritional security associated with the valorization of local biodiversity.

Marilena Koppa. The Evolution of the Common Security and Defence Policy: Critical Junctures and the Quest for EU Strategic Autonomy

Marilena Koppa. The Evolution of the Common Security and Defence Policy: Critical Junctures and the Quest for EU Strategic Autonomy. St Antony’s Series. Cham: Springer International Publishing, 2022 // https://doi.org/10.1007/978-3-030-99158-6.  

AI Cyber Defense and eBPF

This paper will delve into the integration of Artificial Intelligence (AI) and extended Berkeley Packet Filter (eBPF) technology to enhance cyber defense capability. The most important aspect of AI is detection of threats where it employs sophisticated algorithms in the analysis of large data sets to identify any form of pattern which signals a threat in cyberspace. It enhances behavioral analysis in the monitoring of user and system behavior to identify suspicious activities. AI also helps to instantly react against the threats by automatically taking actions like isolating an infected machine or blocking the suspicious network traffic in order to minimize the response time and consequent damage. AI can predict the attacks based on historical data and current trends and design proactive defense strategies. On the other hand. eBPF technology complements AI by providing programmable kernel tracing, real-time monitoring, low overhead, and security enhancements. Attaching eBPF programs to kernel hooks provides insights into network traffic, system events, and application behavior, intrusion detection, performance monitoring, and troubleshooting. Its implementation is still optimal with less performance impact on the system. The system retains its robust security stance due to the deployment of eBPF, enforcement of kernel-level security policies, and detection of malicious activities. This synergy between AI and eBPF would mean smarter cybersecurity solutions that can change adeptly with each emerging threat and help raise defenses for the organization.

The Limits of Empiricism: A Critique of Data-Driven Theory Development

The abundance of data available to researchers has led to increasing interest in data-derived theoretical development. Although this is a valid method of deriving theoretical models, it is subject to numerous limitations and hazards that may threaten the validity and usefulness of the models. The purpose of this paper is to critique empirically driven theoretical development. Our goal is to offer a cautionary tale about the limits of derivation of theory from empirical analysis in the hopes that our analysis and critique can strengthen empirical derivation of theory. In this paper, we use the empirical derivation of the Unified Model of Information Security Policy Compliance (UMISPC) as a research case study to illustrate some of these limitations and risks. For example, we critique the opportunistic dropping of theoretical paths based on statistical results, cautioning that doing so is insufficient for forming new theory. We also report several attempts at validating UMISPC through replication, including our own, which used data from a survey of 525 employed American adults. Comparison of the replications and original model indicates a general failure to replicate substantial portions of the original paper. We discuss five specific pitfalls associated with empirically driven model development and make recommendations for future studies that use inductive, data-driven approaches to derive theoretical models.

Bangladesh's Climate Vulnerability and Overseas Migration: Navigating Challenges and Paving the Way Forward

Bangladesh ranks seventh on the Global Climate Risk Index 2021, which identifies the nations most susceptible to natural catastrophes, demonstrating how sensitive the country is to both climate change and natural disasters. Millions of people are forced to migrate to neighboring cities and urban areas in search of work and a living each year as a result of climate change and natural disasters such as river bank erosion, salinity intrusion, floods, cyclones, and landslides in Bhola, Khulna, Bagerhat, Patuakhali, and Gaibandha. Urban life is strained by this influx, especially in terms of housing, water supply, and sanitation. Many of these individuals also seek overseas employment as a means of survival. While numerous organizations, including government institutions, are working to promote safe and regular international migration and overseas employment, a portion of these individuals fall prey to labor trafficking due to a lack of information, monitoring, and services from the administration. Additionally, communities in climate-risk areas are ultimately forced to choose between internal and international migration due to the sluggish adoption of climate-resilient agricultural methods and technologies, as well as the dearth of technical and vocational education options. For these regions of significant natural disasters and climate change, the government has to provide more secure migration policies and encourage productive remittance investment.

The dual ‘dual’ policy: Two conceptions of ‘deterrence and reassurance’ in Norwegian security policy and analyses

ABSTRACT This article argues that the conceptual basis for the Norwegian policy framed by ‘deterrence and reassurance’ towards the Soviet Union/Russia has consisted of two divergent ‘balancing acts’. One is ‘calibrated deterrence’, where reassurance is the means to ‘balance’ the deterrent effect. The other is a ‘balance’ between two theoretically conflicting means of achieving security: calibrated deterrence, versus reassurance understood as efforts and means to achieve common security. The argument implies that reassurance balancing deterrence has represented different things according to its use. Clarifying these distinct dyads improves our theoretical understanding of how states conduct their deterrent policies.

Browser Security

Web browsers play a crucial role in accessing and interacting with information on the internet. However, they also present significant security challenges due to their complexity and the diverse range of threats they face. This paper provides an overview of web browser security, focusing on the key challenges, vulnerabilities, and defences. It discusses common attack vectors, such as cross-site scripting (XSS) and cross-site request forgery (CSRF), as well as browser security features like sandboxing, secure storage, and Content Security Policy (CSP). Additionally, the paper explores emerging threats and future directions in web browser security, highlighting the importance of ongoing research and collaboration among browser vendors, developers, and security experts to ensure a more secure browsing experience for users.

What goes around comes around: an in-depth analysis of how respondents interpret ISP non-/compliance questionnaire items

Purpose Research on employee non-/compliance to information security policies suffers from inconsistent results and there is an ongoing discussion about the dominating survey research methodology and its potential effect on these results. This study aims to add to this discussion by investigating discrepancies between what the authors claim to measure (theoretical properties of variables) and what they actually measure (respondents’ interpretations of the operationalized variables). This study asks: How well do respondents’ interpretations of variables correspond to their theoretical definitions? What are the characteristics of any discrepancies between variable definitions and respondent interpretations? Design/methodology/approach This study is based on in-depth interviews with 17 respondents from the Swedish public sector to understand how they interpret questionnaire measurement items operationalizing the variables Perceived Severity from Protection Motivation Theory and Attitude from Theory of Planned Behavior. Findings The authors found that respondents’ interpretations in many cases differ substantially from the theoretical definitions. Overall, the authors found four principal ways in which respondents interpreted measurement items – referred to as property contextualization, extension, alteration and oscillation – each implying more or less (dis)alignment with the intended theoretical properties of the two variables examined. Originality/value The qualitative method used proved vital to better understand respondents’ interpretations which, in turn, is key for improving self-reporting measurement instruments. To the best of the authors’ knowledge, this study is a first step toward understanding how precise and uniform definitions of variables’ theoretical properties can be operationalized into effective measurement items.

Research Map of Social Security for Employment: Bibliometric Analysis Approach

This study aims to examine the development of research on Social Security for Employment as published in journals focusing on this theme. This study used a qualitative method with a bibliometric analysis approach. The data used are secondary data obtained from the Scopus database comprising 201 journal articles with the theme of Social Security for Employment. Then, the data is processed and analyzed using the VOSviewer application to visualize bibliometric maps. The findings of the study reveal that in bibliometric author mapping, the author who published the most research was Drake R.E. The institution that made the most significant contribution was the Office of Retirement and Disability Policy. Additionally, the most contributing and productive country in research related to this theme is the United States. Furthermore, the most frequently used keywords were worker, benefit, employee, and health. Meanwhile, based on the bibliometric keyword mapping, four clusters can become research lines, namely (1) Social security benefits for individuals with mental disabilities, (2) Social protection and worker contributions within the social security system, (3) Job and health insurance for workers and employment social security, and (4) Government social security policies regarding unemployment and labor death.

Impact of Migration on Global Politics and Security

Migration has presented a very important challenge at the global level in recent years, especially with the high economic disparity between countries and regions, wars and crises, and political instability. Even though migration policies and the legal system of asylum are at a solid level for the needs of society, the dilemma is still presented as to whether the flow of migrants affects and determines global politics and security or how this impact is at specific levels, especially at the level of income or economic capacity of regions or states. This is also the basic purpose of this study, where official data from the World Bank and United Nations give concise answers to the impact of the flow of migrants on political stability and global security. It turns out that at the global level, the flow of migrants does not represent a significant challenge in global and security policies, but at lower levels, according to countries, income represents a very significant determinant in political stability as well as Military Expenditure. Generally speaking, migration determines a country’s economic, social, and security image. After the increased migration that includes both refugees and asylum seekers in the last decade as a result of political instability, poverty, Arab Spring and Syrian war and wars in the recent past and the recent war in Ukraine and Israel, the dilemma arises whether migration as a phenomenon (in terms of percentage) has an impact on political stability and security at the world level. This is the basis of this study, which, through statistically valid data from the World Bank and the United Nations, analyzes and generalizes a conclusion about the impact of migration on political stability and security at the global level.

Exploring eustress and fear: A new perspective on protection motivation in information security policy compliance within the financial sector

Information security policy (ISP) compliance has emerged as a significant challenge for contemporary businesses. This underscores the crucial role of employing fear appeals to encourage employee compliance with ISP. However, the existing literature is rife with mixed and inconsistent findings regarding the influence of fear appeals on employees' intentions to comply with ISP. In an effort to address this inconsistency and delve into the mechanisms through which fear appeals impact ISP compliance, we expanded the Protection Motivation Theory by incorporating the Transactional Model of Stress and Coping. Notably, we introduced a positive emotion, eustress, into the mediating mechanism alongside fear. Our hypothesis posited that fear appeals not only generate fear but also evoke eustress, subsequently positively influencing ISP compliance. We conducted a study among financial sector employees and validated our hypothesis using structural equation modeling techniques. Our primary theoretical contributions include highlighting the critical role of eustress in enhancing ISP compliance and proposing a parallel mechanism through which fear appeals impact ISP compliance. From a practical standpoint, we demonstrate that eustress plays a more significant role in motivating employees to comply with ISP. Furthermore, we provide insights into how organizations can design fear appeal messages by incorporating the concept of eustress, thereby optimizing their effectiveness in promoting ISP compliance.

On Some Aspects of European Security and Defence in the Context Of War in Ukraine

The European security environment is currently significantly affected by Russian aggression against Ukraine. However, right from the start of the war, the European Union and its member states acted decisively, they unequivocally condemned the Russian invasion of Ukraine and began to help it politically, economically, humanitarianly and by supplying military equipment, weapons, ammunition, and training members of the Ukrainian armed forces. And although no European member state of the European Union or the North Atlantic Alliance has been attacked, the ongoing conflict negatively affects European stability and disrupts the European security and defence system. That is also why the authors, using relevant scientific methods and approaches within the framework of interdisciplinary research, deal in the article with some selected aspects of European security and defence in the context of the conflict in Ukraine. They point out how Russian aggression has influenced discussions about the roles of the European Union in ensuring security and defence on the European continent, shed light on the Union's security and defence policy, deal with issues of European strategic autonomy and related relations between the EU and NATO, and at the end of the article indicate challenges, which are closely related to European security and defence in the context of the war in Ukraine.

Optimization of the EU and Czech Security System in the Field Of Effectiveness of the Risk Management and Protection System For Security Practices

Risk management and Population protection in the Czech Republic is based on a long tradition and knowledge from dealing with emergencies and crisis situations. However, it appears that there is a need to continuously improve this area of state security policy on the basis of practical experience and deeper analyses. The possibility of optimizing the basic areas of security systems is the subject of security research by a number of Czech authorities and organizations, where the Ministry of the Interior of the Czech Republic and its educational institution, the Police Academy of the Czech Republic in Prague (hereinafter referred to as "PA"), play an important role. At this University focused not only on police topic, but also on the protection of the population and economy, public administration security and civil emergency planning, a number of research activities have been carried out, which are also used in this proposal for the optimization of security systems in the Czech Republic and partly in the EU.

CYBERCRIMES, LAW, AND CYBER FORENSICS: COMPARATIVE STUDY OF INDIAN, BRITISH, AND AMERICAN CONTEXTS

New forms of crime have emerged with the rising prevalence of computer misuse. Some of them include the use of cutting-edge tools and methods for criminal conspiracy. From spreading fraud through email to stealing and reselling intellectual property, cybercrime covers a lot of ground. The domain of computer science known as "cyber forensics" is considered to be among the most essential subfields. It is concerned with the investigation of cybercrime. The concept of cyber forensics is broken down into its parts by the author in this paper. This paper focuses on the significance of the topic as well as some of the methods and instruments that are used by cyber forensic investigators. The objective of cyber forensics is to conduct an examination of electronic content in a manner that is forensically sound with the goals of preserving, recovering, analyzing, identifying, and presenting facts and views about digital information. Cyber forensics evidence undergoes the same processes as other digital evidence and serves as supporting evidence in judicial proceedings. Cyber forensics is often linked to the investigation of cybercrime, but it may also be utilized in legal actions involving private parties. This paper demonstrates the necessity for further investigation into how cyber forensics might be used to enhance the identification of cybercrime. This research will help fill in some of the gaps in our knowledge of how cyber forensics investigations are conducted in India and explore cyber security policy in the United Kingdom, the United States, and India to identify both similarities and differences. Keywords: Cybercrime, Cyber Forensics, Policy