Security Professionals Research Articles

Identity and Access Management: High-level Conceptual Framework

Information security is shifting from a traditional perimeter-based approach to an identity-based approach where the organization's boundaries are where their digital identities exist. The organization has multiple stakeholders having access to various organization resources. Systems and applications are part of organization resources that help them achieve their business goals. These systems and applications are internally or externally exposed to allow all stakeholders to have seamless access, thus making identity and access management a big challenge. Identity and Access Management (IAM) is a fundamental part of information security. It plays a critical role in keeping the organization's information security posture resilient to cyber attacks. This paper will identify various components of an IAM solution that are essential and should be considered while implementing and assessing the IAM solution and provides a high-level IAM framework that will allow information security professionals to assess the IAM security posture of an organization.

ПЕДАГОГІЧНІ УМОВИ ВДОСКОНАЛЕННЯ ПІДГОТОВКИ ФАХІВЦІВ З ПИТАНЬ ЦИВІЛЬНОЇ БЕЗПЕКИ В ПРОЦЕСІ ПІДВИЩЕННЯ КВАЛІФІКАЦІЇ

Purpose. The work is devoted to the substantiation of pedagogical conditions that contribute to the improvement of training of civil security specialists in the process of professional development. Methodology. The following types of methodology were used in order to solve the following problems: theoretical - analysis of pedagogical and educational literature on the problem of research, comparison, systematization and generalization of existing ways and methods of improving training of civil security specialists in the process of professional development, empirical - methods of collecting and processing empirical material (pedagogical observation and survey); systematization and generalization of the experience of organizing professional development of specialists at the Institute of Public Administration and Research in Civil Defense. Findings. Based on the structural and logical analysis of the literature, the methodological essence of the concept of “pedagogical conditions” related to the improvement of training of specialists in civil security in the process of professional development in educational establishments. Effective pedagogical conditions are substantiated, which at the present stage of professional activity of specialists in civil security will ensure the development of their professional competencies in the system of postgraduate education. The description of each pedagogical condition is given and its semantic components which influence advanced training of experts on questions of civil safety positively (pedagogical modeling of improvement of experts’ preparation on questions of civil safety in the course of advanced training on a competence basis; expansion and enrichment of practical experience of experts on complex decision of educational tasks for responding to emergencies, close to real life; creating of an informational educational environment for the development of professional competencies of specialists in civil security in institutions, educational establishments; development of professional self-improvement of specialists in civil security). Originality. For the first time, a comprehensive study was conducted in order to substantiate the pedagogical conditions for improving the training of specialists in civil security in the process of professional development. Practical value. Globalization transformations, technological innovations in society and the economic crisis create a need for specialists who will be able to perform the tasks that correspond to the priority areas of the state to ensure the safe life and activities of people at a high level. In achieving a high level of professional competence, an important role is given to postgraduate education, which creates favorable conditions for optimizing the process of professional development of civil security professionals. Conclusions. The pedagogical conditions mentioned in the work are a favorable basis for improving professional development and achieving a high level of professional competencies of specialists in civil security.

Exploring user requirements of network forensic tools

Network forensic tools enable security professionals to monitor network performance and compromises. These tools are used to monitor internal and external network attacks. Technological improvements have enabled criminals to wipe out tracks of cybercrime to elude alterations. Network forensics procedures use processes to expedite investigation by tracking each original packet and event that is generated in the network. There are many network forensic tools, both open source and commercial versions available in the market. In this work, the result of a survey participated by different experts in open source network forensic tools have been presented. The advantages, challenges, and necessities have been identified for network forensic investigation of such tools. A few open source network forensic tools have been studied and performed a comparative analysis based on six key parameters. Further, two malware datasets are analyzed using open source tools to perform investigation and present a comprehensive network forensic analysis comprising IO graphs, Flow graphs, TCP stream, UDP multicast stream, mac-based analysis, and operating system analysis.

Impact of comprehensive information security awareness and cognitive characteristics on security incident management – an empirical study

Organizations deploy a team of dedicated security professionals and spend significant resources safeguarding their digital assets. Despite best efforts, security incidents are on the rise and remain a key challenge. The literature has focused inadequately on the lack of professionals’ awareness of security, system, or situational aspects. Extant literature on the impact of awareness on threat management tasks is disjointed and does not adequately consider the metacognitive awareness and self-efficacy of security professionals. To this effect, we propose and empirically validate a model to study the relationship between security, system, situational awareness, and security professionals’ ability to detect, assess, and mitigate threats. We also investigate the effects of metacognitive awareness and self-efficacy on the relationship between awareness and threat management tasks. We validate the model using a survey of 100 information security professionals. Results indicate a significant relationship between awareness, metacognitive awareness, self-efficacy, and threat management task performance. The analysis also demonstrates that metacognitive awareness and self-efficacy mediated the impact of awareness on threat management task performance. We discuss the effects and implications of this study for practice and research.

How cameras enhance safety on a small campus

First responders need continuous situational awareness to keep their communities safe. But maintaining a high‐level security presence on a college campus is difficult to achieve with foot patrols alone. That's especially true at smaller institutions, where the available staffing resources in terms of certified officers and security professionals may be limited. The physical environment of a college presents another challenge in the form of large interior spaces and outdoor blind spots.

Access to user data stored by organizations—divides surrounding information security professionals in Chinese IT organizations

With the rapid development of computer-based information systems in China, securing organizational systems as information assets is central to achieving a strategic advantage. Because information security (IS) experts with database access are the weakest link in the IS chain, scholarly contributions are needed in this important area. The interpretations of widespread data breaches committed by organizations’ information security experts have significant grounding. Drawing on social control theory, we propose a research framework to examine formal control, informal control, and self-control systems that can affect IS professionals’ perceptions and IS behaviors in Chinese IT organizations. We use in-depth interviews with IS professionals in Wuhan, Beijing, and Shenzhen to answer research questions relating to the research framework. The study’s primary contribution is to go beyond the extant IS research, which concentrates on sanction-based deterrence, and identify multiple dimensions rooted in social control perspectives. Based on interviews with practitioners and researchers, this study further advances our understanding of IS control deviance using information management and communication-related approaches.

DIRECTIONS OF OFFENSE PREVENTION IN THE STOCK MARKET OF UKRAINE

Abstract. The article considers the legislative and regulatory documents which outline the features of detecting offenses in the stock market of Ukraine. The main offenses in the domestic stock market have been formed, and the subjects, objects and types of sanctions for offenses have been considered. It is determined that the main body in the field of detection and prevention of stock market violations is the National Securities and Stock Market Commission (NSSMC), which considers cases of offenses, regulates the activities of issuers and financial intermediaries, prepares reports on stock market operations, carries out licensing of professional participants and provides cooperation with state institutions, state and local authorities in the field of crime prevention. An analysis of offenses in the stock market of Ukraine during 2017—2019 has been carried out. The main directions of stock market offenses prevention are outlined, namely: imposition of financial sanctions, revocation or suspension of licenses of professional participants, issuance of orders and resolutions, increase of fines in the stock market, prevention of price manipulation. Proposals were made to improve the activities of the Stock market infrastructure development agency, in particular to form a single complete and detailed base of issuers, professional participants, offenses, foreign investors and large securities holders. It is proposed to reduce violations in the stock market through active cooperation with the International Organization of Securities Commissions (IOSCO). In general, we can conclude that there is no critical situation in the field of offenses in the stock market of Ukraine, as evidenced by analytical studies.
 Keywords: offenses, stock market, license, issuer, professional market participants, National Securities and Stock Market Commission.
 JEL Classification G18, K22, K40, K49
 Formulas: 0; fig.: 4; tabl.: 0; bibl.: 16.

Mapping the Psychosocialcultural Aspects of Healthcare Professionals' Information Security Practices: Systematic Mapping Study.

BackgroundData breaches in health care are on the rise, emphasizing the need for a holistic approach to mitigation efforts.ObjectiveThe purpose of this study was to develop a comprehensive framework for modeling and analyzing health care professionals’ information security practices related to their individual characteristics, such as their psychological, social, and cultural traits.MethodsThe study area was a hospital setting under an ongoing project called the Healthcare Security Practice Analysis, Modeling, and Incentivization (HSPAMI) project. A literature review was conducted for relevant theories and information security practices. The theories and security practices were used to develop an ontology and a comprehensive framework consisting of psychological, social, cultural, and demographic variables.ResultsIn the review, a number of psychological, social, and cultural theories were identified, including the health belief model, protection motivation theory, theory of planned behavior, and social control theory, in addition to some social demographic variables, to form a comprehensive set of health care professionals’ characteristics. Furthermore, an ontology was developed from these theories to systematically organize the concepts. The framework, called the psychosociocultural (PSC) framework, was then developed from the various combined psychological and sociocultural attributes of the ontology. The Human Aspect of Information Security Questionnaire was adopted as a comprehensive tool for gathering staff security practices as mediating variables in the framework.ConclusionsData breaches occur often in health care today. This frequency has been attributed to the lack of experience of health care professionals in information security, the lack of development of conscious care security practices, and the lack of motivation to incentivize health care professionals. The frequent data breaches in health care threaten the mutual trust between health care professionals and patients, which implicitly impacts the quality of the health care service. The modeling and analysis of health care professionals’ security practices can be conducted with the PSC framework by combining methods of statistical survey, observations, and interviews in relation to PSC variables, such as perceptions (perceived benefits, perceived threats, and perceived barriers) or psychological traits, social factors, cultural factors, and social demographics.

Job Selection Priorities of Accounting and Finance Graduates: An Empirical Evidence from Pakistan

This study aims to evaluate the impact of six independent variables namely; professional growth, financial earnings, organizational repute, job environment, job security, and interest in the subject on one dependent variable i.e. job selection priorities of accounting and finance graduates in the perspective of Pakistan. The data of the study comprises 900 responses from final year graduates of 15 universities of Pakistan. The study used a structured questionnaire technique consisting of three parts (Part I= Demographic Characteristics, Part II and Part III= Assessment information of independent and dependent variables respectively) with 28 close-ended questions. Each item of the questionnaire was assessed using a 5-point Likert scale. The study employed demographic analysis, scale analysis, and inferential analysis. The empirical findings evidenced a positive correlation of all independent variables with dependent variables whereas no correlation was found among independent variables, and only three independent variables have a significant impact on the dependent variable of the study.

Risk assessment without the risk? A controversy about security and risk in Norway

Security and ‘securing’ is high on the public agenda. Questions are raised on where, to what degree and against what the government and others should introduce preventive security measures. This article investigates a controversy in Norway about the role of probability in risk assessment within security. The article asks how the question of the probability of incidents is problematized and addressed by actors involved. It discusses how the controversy can be interpreted and what it might tell us about security and risk. The article builds on an exploratory study of the reasoning of security professionals in relation to a standard on security risk assessment. It shows how the downplaying of probability is defended, but also how it creates dilemmas and is criticized. The argument against estimating probability is that it is often difficult or impossible. Probability is, however, also a moderating factor. Probability turns unlikely futures into lower risks than likely futures. Those arguing against the security risk standard point to the consequence of downplaying probability in risk estimates. A key finding is how risk assessment in areas of low tolerance for incidents introduces a discrepancy that is difficult to handle. On the one hand, security analysts are supposed to deal with threats as risks, implying scaling, comparison and level of acceptance. On the other hand, they are supposed to create security, implying the opposite of scaling and risk acceptance. Risk assessment becomes difficult if there is little appetite for taking risk. Michael Power’s three ideal models of risk management logics are introduced in the discussion as heuristic tools of a sensitizing kind. The article concludes that risk research could benefit from engaging with security theory, to investigate how risk management might be shaped by security practises.

Cybersecurity Challenges and the Academic Health Center: An Interactive Tabletop Simulation for Executives.

Academic health centers (AHCs) face cybersecurity vulnerabilities that have potential costs to an institution's finances, reputation, and ability to deliver care. Yet many AHC executives may not have sufficient knowledge of the potential impact of cyberattacks on institutional missions such as clinical care, research, and education. Improved cybersecurity awareness and education are areas of opportunity for many AHCs. The authors developed and facilitated a tabletop cybersecurity simulation at an international conference for AHC leaders in September 2019 to raise awareness of cybersecurity issues and threats and to provide a forum for discussions of concerns specific to CEOs and C-suite-level executives. The 3.5-hour interactive simulation used an evolving, 3-phase case study describing a hypothetical cyberattack on an AHC with a ransomware demand. The approximately 70 participants, from AHCs spanning 25 states and 11 countries, worked in teams and discussed how they would react if they held roles similar to their real-life positions. The authors provide the full scenario as a resource. The exercise was well received by the participants. In the postsession debrief, many participants noted that cybersecurity preparedness had not received the level of institutional attention given to threats such as epidemics or natural disasters. Significant variance in teams' courses of action during the simulation highlighted a lack of consensus with regard to foundational decisions. Participants identified this as an area that could be remedied by the development of guidelines or protocols. As health care cybersecurity challenges persist or grow in magnitude, AHCs will have increased opportunities to lead in the development of best practices for preparedness and response. AHCs are well positioned to work with clinicians, security professionals, regulators, law enforcement, and other stakeholders to develop tools and protocols to improve health care cybersecurity and better protect patients.

Practical Multi-Keyword Ranked Search with Time- Based Access Control over Encrypted Cloud Data

The recent trends suggest that there is an increase in the inclination towards storing data in the cloud due to explosive and massive growth of the volume of the data in the cloud computing environment. It helps them to reduce their computational and storage costs but also undeniably brought in concerns about security and privacy as the owners of the highly sensitive data lose control of it directly. The sensitive data could include electronic-based medical records, confidential fiscal documents, etc. An increased distrust about storage of files in a third-party service provider of cloud resources would contradict the very same reason for which cloud storage facilities were introduced. That’s because we cannot deny the fact that cloud based storage systems offer on- demand and ubiquitous access to flexible storage and computational resources. The keyword ranked search methodologies used in the existing systems mainly focus on enhancing and enriching the efficiency of searching the files and their respective functionalities but a lack of straight forward analysis of security and issues with providing access control have not been addressed. To address these disadvantages, in this paper, we propose an efficient Multi-Keyword Ranked Search scheme with Fine-grained access control (MRSF).MRSF is a methodology which can combine matching of coordinates technique with Term Frequency-Inverse Document Frequency (TF-IDF) to thereby achieve a highly precise retrieval of any cipher text of interest. It also improves the secure k-nearest neighbors (kNN) method. By utilizing an access strategy which is polynomial based, it can effectively refine the search privileges of the users’. Professional security analysis proves that MRSF is secure with respect to safeguarding the secrecy of outsourced data and the privacy of tokens and indices. Along with this enhanced methodology of ranked search scheme, a time limit based access control feature has also been proposed to ensure that the adaptive attackers are stalled from giving prolonged access to the data files. Session expiry will ensure security of data and that is to be achieved by providing a time window for the file retrieval. Extensive experiments also show that MRSF reaches higher search precision and many more functionalities when compared to the existing systems.

The Uncertainty of Side-channel Analysis: A Way to Leverage from Heuristics

Performing a comprehensive side-channel analysis evaluation of small embedded devices is a process known for its variability and complexity. In real-world experimental setups, the results are largely influenced by a huge amount of parameters, some of which are not easily adjusted without trial and error and are heavily relying on the experience of professional security analysts. In this article, we advocate the usage of an existing statistical methodology called Six Sigma (6 ) for side-channel analysis optimization. This well-known methodology is commonly used in other industrial fields, such as production and quality engineering, to reduce the variability of industrial processes. We propose a customized Six Sigma methodology, which allows even a less-experienced security analysis to select optimal values for the different variables that are critical for the side-channel analysis procedure. Moreover, we show how our methodology helps in improving different phases in the side-channel analysis process.

Preface

The Faculty of Agro-Based Industry, Universiti Malaysia Kelantan (UMK) is proud to host the 3rd Asia Pacific Regional Conference on Food Security (ARCoFS 2021), which was held on 9th March 2021 as a virtual conference. We would like to thank our co-organizers from Institute of Food Security and Sustainable Agriculture (Malaysia), International Institute of Plantation Management (Malaysia), Vikrama Simhapuri University (India), IPB University (Indonesia), Bangladesh Agricultural University (Bangladesh), Princess of Naradhiwas University (Thailand) for making this virtual conference a paramount and valuable event. The four main topics highlighted in this conference include Food Security and Climate Change, Sustainable Agrotechnology, Alternative Agroproduct Development, and Environmental Economics.The ARCoFS 2021 aims to provide food security professionals in the Asia Pacific region with a platform to exchange the latest information on sustainable food production, to identify mega-trends that influence food security, and to recognize the main indicators of food insecurity and plan for proactive strategies for the food security sector.List of Organising committee, List of committees are available in this pdf.

Workplace Violence and Perspectives of Healthcare Professionals on Electronic White Code System

The aim of the study was to investigate the white code implementation in a public hospital which intends to provide security for healthcare professionals to reduce the risks of being exposed to workplace violence (WPV) by patients and patient relatives. In this study, 109 WPV cases in Afyonkarahisar Public Hospital were examined. According to study results; mostly female healthcare professionals (63,3%) were exposed WPV while the aggressors were male (72,4%) in most cases. Most of the WPV incidents happened in the Emergency Department (35,7%) and hallways (26,6%). Frequent violence type was verbal violence (50,4%) and physical violence (21,1%) followed it. Participants believed that white code system had a positive effect on preventing WPV incidents, still the violence was inevitable. The main reason underlying WPV incidents was determined due to long waiting times for treatment and low communication capabilities. Study results suggest to decrease the number of WPV incidents; white code applications should be implemented in healthcare institutions, healthcare professional should be trained about WPV, how to keep from violence incidents and what to do in case of WPV, make them feel that the managers and the institution are behind them.

Science education reform conundrum: An analysis of teacher developed common assessments

AbstractScience education reform efforts have highlighted the need for scientifically literate citizens, who are capable of using scientific knowledge and skills for reasoning, argumentation, and decision‐making. Concurrently, recent state education policies dictate that teachers’ effectiveness is measured in part by their students’ performance on high stakes assessments. To study these potentially competing reform efforts, we used multiple methods to examine (a) the level of secondary science teachers scientific literacy (SL) and their perceptions of SL skills, (b) how they rank the importance of SL skills and their self reported teaching/assessment of SL skills, and (c) how well their teacher developed common science assessments aligned with SL skills. Survey responses from secondary science teachers (n = 48) from one district revealed that their perceptions of scientific literacy were not in alignment with those of science education reform documents. Secondary science teachers (n = 28) demonstrated that they were scientifically literate, yet the assessments (n = 13) they developed did not align with several scientific literacy sub‐constructs. The findings from this study imply that science teachers would benefit from professional development to increase their assessment literacy and that school districts should reconsider whether teacher‐designed assessments should be tied to teachers' professional security and advancement.

“Get a red-hot poker and open up my eyes, it's so boring”1: Employee perceptions of cybersecurity training

Organisations and security professionals design Security Education, Training, and Awareness (SETA) programs to improve cybersecurity behaviour, but they are often poorly received by employees. To understand employee negative perceptions of SETA programs, we conducted in-depth interviews with 20 Australian employees regarding their experiences with both SETA programs and non-cybersecurity related workplace training. As expected, employees had a generally poor view of SETA programs. They reported that the same factors that are important for effective non-cybersecurity training are also important for SETA programs, such as management role modelling and well-designed workplace systems. However, the level of importance of these factors differed across the two contexts. For example, employees indicated that the misbehaviour of their colleagues is a more important factor for their appraisal of a SETA program than it is for a non-cybersecurity workplace training program. Our results suggest that employee perceptions of SETA programs relate to their previously held beliefs about cybersecurity threats, the content and delivery of the training program, the behaviour of others around them, and features of their organisation. From an applied perspective, these findings can explain why employees often do not engage with cybersecurity training material, and how their current beliefs can influence their receptivity for future training.

Enhancing employees information security awareness in private and public organisations: A systematic literature review

Preserving the confidentiality, integrity and availability (CIA) of an organisation's sensitive information systems assets against attacks and threats is a challenge in this digital age. Organisations worldwide make huge investments in information security technological countermeasures. Nonetheless, organisations in many cases fail to protect their information assets as they rely mainly on technical solutions which are not contextually compatible and sufficient. As a matter of fact, a significant number of organisational information security incidents are due to the exploitation of human elements that directly and/or indirectly cause the majority of security incidents. Therefore, employees’ information security awareness (ISA) becomes one of the critical aspects of protection against undesirable information security behaviours. However, to date, there is limited synthesised knowledge about methods for enhancing ISA and integrated insights on factors affecting employees’ ISA levels. This study, therefore, provides a systematic review of the literature on ISA and puts forward a state-of-the-art collection of ISA methods and factors for enhancing employees’ ISA within both private and public sector organisations. The results indicate that various methods and factors are used to enhance employees’ ISA in organisations. Theoretical models and gamification are the methods widely used in both private and public organisations, whereas the constructivist approach and violation detections are some of the methods used only in private organisations. Furthermore, this study offers some insights into the latest trends in ISA content development methods and factors, and fosters good ISA practice by disseminating information and knowledge amongst Information Security professionals to help them build an overarching ISA development programme in their organisations.

Securing connectivity for remote workforces

In the ongoing work-from-home (WFH) evolution, the need to better secure employee endpoints has emerged as a key issue. Many organisations have discovered what network and security professionals have long known – once the endpoint is outside the perimeter, the level of security is degraded.

When experience does not promote expertise: security professionals fail to detect low prevalence fake IDs

Professional screeners frequently verify photograph IDs in such industries as professional security, bar tending, and sales of age-restricted materials. Moreover, security screening is a vital tool for law enforcement in the search for missing or wanted persons. Nevertheless, previous research demonstrates that novice participants fail to spot fake IDs when they are rare (i.e., the low prevalence effect; LPE). To address whether this phenomenon also occurs with professional screeners, we conducted three experiments. Experiment 1 compared security professional and non-professionals. Experiment 2 compared bar-security professionals, access-security professionals, and non-professionals. Finally, Experiment 3 added a newly created Professional Identity Training Questionnaire to determine whether and how aspects of professionals’ employment predict ID-matching accuracy. Across all three experiments, all participants were susceptible to the LPE regardless of professional status. Neither length/type of professional experience nor length/type of training experience affected ID verification performance. We discuss task performance and survey responses with aims to acknowledge and address this potential problem in real-world screening scenarios.