Security Project Research Articles

A risk-based approach to mitigating the Gen(AI) challenge to assessment integrity

In the evolving landscape of higher education, emerging technologies such as Generative AI (GenAI) present both opportunities and challenges. The rapid increase in access to, and sophistication of, GenAI poses significant challenges for our institution and the wider sector (Bearman & Luckin 2020, Bobula 2024, Chan & Hu 2023). The most immediate of these challenges is the increased risk to the existing approaches used to assure that students achieve the stated outcomes of their learning experiences. Director of Higher Education Integrity Unit, TEQSA, Dr Helen Gniel argues ‘We are entering an age where institutions can no longer ensure the integrity of every single assessment, and it makes sense to think at that bigger level […] what are the mechanisms that you have in place to be confident that an individual has demonstrated the learning outcomes to receive that degree’(TEQSA information request: AI risk mitigation, webinar, 21 March 2024). While higher education institutions are exploring opportunities to realise the potential benefits of GenAI, our immediate focus is on mitigating these risks. This poster describes institutional Programmatic Assessment Security Project (PASP) at the University of Newcastle (UON), a pioneering four-stage initiative designed to address academic integrity risks associated with inappropriate uses of GenAI in summative assessment (Lodge 2024). Academic integrity risks in this context refers to the potential for students to engage in academic misconduct by using GenAI tools in ways that violate institutional policies or ethical standards for assessment. These risks pose a threat to the validity and reliability of summative assessments, potentially compromising the integrity of academic qualifications and the learning process itself. Led by the central teaching and learning support unit, in collaboration with the Artificial Intelligence Working Group (AIWG) a group of expert practitioners and academic stakeholders at UON, the PASP aims to secure assessments across a program of study, assuring student attainment of program learning outcomes. This innovative approach aligns with the sector’s focus on programmatic assessment and supports compliance with regulatory requirements, including TEQSA’s mid 2024 request for institutions to submit a detailed action plan to mitigate the risks that GenAI poses to the integrity of awards (TEQSA 2024). This poster showcases exemplary innovation in practice through the PASP, advancing research and practice in technology-enhanced learning (TEL). The PASP employs a risk-based approach, identifying seven risk factors for inappropriate student use of GenAI in assessment tasks. The first step in this project involved Course Coordinators completing an Assessment Reflection Survey, guiding them to reflect on individual assessment tasks in relation to these risk factors. The survey data were then used to compile an understanding of the varying levels of assessment risk across the institution’s programs. The PASP will deliver a defined series of secure assessments, delivered at key moments across a program of study to assure student attainment of program learning outcomes. This poster provides insight into UON’s contemporary and agile approach to TEL and assessment redesign, with potential for staff at other institutions to adopt similar responses.

THE INTERESTS OF THE UK FOREIGN POLICY IN THE CONTEXT OF THE FORMATION OF THE AUKUS INTERSTATE ASSOCIATION

The article is devoted to the study of the evolution of the UK's foreign policy in the period after its withdrawal from the European Union (post-Brexit period) in the context of the country's participation in the formation of the AUKUS (an abbreviation of the English names of Australia, the United Kingdom and the United States). The research methodology was formed by the principles of historicism, systematicity, and objectivity, general scientific methods of logic, comparative analysis, special historical methods of historiographic analysis, historical-systemic, chronological, historical-genetic, retrospective analysis, and comparative-historical methods of scientific knowledge. It is noted that the creation of the interstate association AUKUS in 2021 was a resonant event in the world of international politics. The agreements provide for the development of systemic military-political cooperation between the three states at the strategic level in the long term with the primacy of the US-British alliance, which will potentially have a significant impact on the configuration of the international security system, especially in the context of current attempts to revise it It is stated that the relatively recently launched international security project AUKUS has already become one of the examples of active foreign policy activities of the British governments in the post-Brexit period, which is fully consistent with the Global Britain strategy. By participating in AUKUS, the British side not only contributes to global security and strengthens its military presence in one of the key regions of world politics, protects its own geopolitical and economic interests, but also guarantees the development of high-tech knowledge-intensive industries for the long term. The project of comprehensive sectoral military and defence cooperation proposed by the United States (with the support of two allied states) reflects an attempt to maintain American and British influence in the Indo-Pacific region and globally in the face of the growing conflict with China. With the resumption of the US policy of isolationism and protectionism, and possible financial problems of the UK as the second most important partner, the AUKUS project faces uncertain prospects. Ukraine's international prospects also depend on the success or failure of the AUKUS project.

Jordan’s Strategic Alliance With the West to Protect the Hashemite Regime

Jordan’s strategic alliance with the Western countries was established at the same time as the establishment of the state. It was a survival tool for the Hashemite regime which was perceived in the West and the Middle East in particular as a weak and vulnerable regime. The internal and external threats, as well as the coup attempts, were many and therefore the regime had to create a defense alliance with a Western power. Naturally, Britain was the first security support for the Hashemite regime and as its position in the Middle East declined at the end of the 1950s, the United States replaced Britain and became the Western power that protected the Hashemite regime. This was due to its pro-Western policy. Jordan receives the largest foreign aid from America (after Israel), is involved in security projects, participates in training with the American army and with Western countries, and is a partner with them in the fight against global terrorism. However, it should be mentioned that Israel also took a significant part in the defense of the Hashemite regime and was involved, officially and unofficially, in a number of operations starting in the 1950s. At that time, Israel’s perception of security took shape, which saw the existence of the Hashemite regime in Jordan as an Israeli interest, and therefore did everything possible to prevent its fall.

WEBSITE SECURITY ANALYSIS CURUG VILLAGE GOVERNMENT USING OPEN WEB APPLICATION SECURITY PROJECT (OWASP)

Cybersecurity has become a crucial issue in the current digital era, especially for government websites that are often targeted by attacks. According to the National Cyber and Crypto Agency (BSSN), government websites are vulnerable to hacking. This study aims to analyze the security of the Curug Village Government website using the Open Web Application Security Project (OWASP). The analysis was conducted on the ten main categories of web application security vulnerabilities listed in OWASP Top 10 2021, including Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable and Outdated Components, Identification and Authentication Failures, Software and Data Integrity Failures, Security Logging and Monitoring Failures, and Server-side Request Forgery. The results of the testing showed that 4 out of 8 vulnerabilities fall into the OWASP TOP 10 for 2021, particularly in the categories of Injection and Security Misconfiguration. Recommendations for improvements are provided based on these findings, which are expected to help the Curug Village Government strengthen their cybersecurity.

Future Food Security Challenges in Riau Province, Indonesia

The food crisis is a real problem in various regions around the world, including Indonesia. This phenomenon is influenced by the rate of population growth which is increasing while farmlands are depleting due to the conversion of land into settlements, especially in Riau Province which is experiencing food security threats. Food security projections are made to provide an overview of the future condition of food security in Riau Province to support sustainability. The basic data used are data for 2018 and 2019. The measurement method used is the scenario method and then the availability calculation method according to Minister of Agriculture Regulation Number 43/Permentan/OT.140/7/2010. Meanwhile, the calculation of food needs uses a formula taking into account the average consumption per capita per year from the regional agriculture service multiplied by the population in the year concerned. Then, the projections are measured using the arithmetic population growth formula approach for food availability and the geometric population growth formula for the food needs of the population. The food commodity in Riau Province used in the analysis is rice. The calculation results show that in the future food availability in Riau Province will not be able to meet its food needs. Keywords: availability of rice, rice needs, food security

OWASP A03 Injection Vulnerability in Web Application Development

Web applications are crucial for businesses and individuals by providing efficient communication, collaboration, and access to services and information via browsers, boosting connectedness, productivity, and creativity in the digital era. Insecure web applications pose risks of data breaches, malware, and unauthorized access which jeopardize user privacy, trust, and organizational security. Web developers must be knowledgeable and prepared to deal with common vulnerabilities in web applications. A prototype web application (https://webriska3.tech) with lesson and editor module is developed to train web developers on the Open Web Application Security Project (OWASP) Top Ten security risks, focusing on A03 - Injection vulnerability. OWASP A03 Injection vulnerability is one of the most common vulnerabilities that is at the heart of any database-driven web applications. Evaluation on the prototype in improvement knowledge on A03 – Injection vulnerability, testers are recruited to complete two coding tasks in laboratory environment. 80% of testers mastered Output escaping/encoding defensive technique while Prepared statement/Parameterized Query defensive technique is the hardest to master. The prototype obtained average System Usability Scale (SUS) score of 57 that is below average, indicating issues with the prototype interface. This work showed promising results of increase understanding on A03 Injection vulnerability and implementation skills to protect web application against attack and exploitations.

The United Nations Charter and the African Union Constitutive Act: The search for compatibility in addressing African peace and security

ABSTRACT Collective security by regional organisations continues to be impacted by evolving global security threats. Previously focused at the global level, the shift from interstate conflicts to intra-state conflicts resulted in the acknowledgement of regionalism and the functions of collective security being implemented at the regional level. This paper examines the development of regionalism in the security sphere and the evolving relationship between the United Nations (UN) and regional organisations. Employing historical and comparative perspectives, it considers both the development of regional security projects and the reasons for their successes and failures. It also critically analyses the various constitutional developments that have occurred within regional arrangements looking particularly at the African Union (AU) and what accounts for such regional organisations to depart from the normative framework of regional arrangements contained in Chapter VIII of the UN Charter. The paper uses primary and secondary material to understand the compatibility of Chapter VIII of the UN Charter and the Constitutive Act of the AU as mechanisms used to respond to peace and security challenges on the African continent. The design of the study is qualitative research and the AU is used as a case study from other regional organisations. The theoretical framework adopted, based on its explanatory power, is collective security.

Structural equations modelling applied to the study of Communities Supported Agriculture (CSAs) located in the Southeastern region of Brazil

Food production is an increasingly relevant issue in the current framework associated with food and water security and future years projections. In addition, the production of organic food has gained significance in recent years, revealing a growing change in the population's consumption habits. The Communities Supported Agriculture (CSAs) play an important role in enabling productive areas for planting crops in agroecological and biodynamic standards. Given this, this study aimed to investigate the relationship between different CSAs variables located in the Southeastern region of Brazil to validate or not the hypotheses created. Thus, the study was designed as a descriptive research and quantitative approach, using an inductive logic survey. In addition, the methodology was set up with the support of the Structural Equation Modeling technique. The study confirmed the hypothesis (H1) that socioeconomic characteristics positively influence CSAs’ performance. The limitations were associated with the method of data collection and the difficulties imposed by the Covid-19 pandemic.

Assessment of Total Quality Management Practices on Sustainable Food Security Project in Nigeria

Most developing nations encountered various challenges due to unsustainable food security projects, despite huge financial commitment and time invested on food sustainability, the impact is not really sufficient. This raises a concern to conduct a study on how total quality management practices affects sustainable food security project in Nigeria, This study adopted a survey research design, using a structured questionnaire. A formular developed by Cochran was used to determine the sample size of 246 farmers from the North-Western state of Nigeria. The data collected were analyzed using percentage distribution statistics and multiple Regression analysis. The findings revealed that, there was a significant relationship (R2 = 0.401; p<0.05) between leadership commitment and measurement index on food accessibility. From the findings of the study, it was discovered that effective leadership commitment and measurement could enhance food accessibility in Nigeria Therefore, it could be concluded that government developing policies based on farmers input could promotes food security in Nigeria.

Social security and retirement around the world: lessons from a long-term collaboration

Abstract Declining labor force participation of older men throughout the 20th century and recent increases in participation have generated substantial interest in understanding the effect of public pensions on retirement. The National Bureau of Economic Research's International Social Security (ISS) Project, a long-term collaboration among researchers in a dozen developed countries, has explored this and related questions. The project employs a harmonized approach to conduct within-country analyses that are combined for meaningful cross-country comparisons. The key lesson is that the choices of policy makers affect the incentive to work at older ages and these incentives have important effects on retirement behavior.

Data Monetization Service Development Using Iterative Lifecycle Framework, Quality Assurance, and Open Web Application Security Project: A Case Study of a Utility Company in Indonesia

The research aims to provide Data Monetization (DM) services for an Indonesian utility company as a pilot to generate additional revenue beyond the primary operation. The service is built using an iterative development lifecycle framework and evaluated based on five Quality Goals (QGs), including application and security testing activities. The framework includes methods for processing and modeling electricity usage data, testing application quality, checking infrastructure quality, and ensuring access security for front-end and back-end applications using the Open Web Application Security Project (OWASP). For data modeling, Support Vector Regression (SVR) is used, and it outperforms Polynomial Regression (PR) and Multi-Layer Perception (MLP) Neural Networks. Furthermore, QG shows strong performance with an Relative Root Mean Squared Error (RRMSE) value < 10%, high forecasting ability with Mean Average Probability Error (MAPE) < 10%, and a near-zero average error rate (Mean Squared Error (MSE)) square using minimal data from four months. The services go through functional and integration test to ensure product quality and application performance, which results in a minimum of 95% service response in throughput, 0.128 seconds for processing 2,000 requests, stability at 300–500 in one second per hour, and 7–21 seconds during peak hours. Additionally, the service passes nine penetration tests and ten vulnerability assessments using the OWASP top 10:2021 category. Based on the comprehensive testing and evaluation results, both the application and the service are considered ready and secured for deployment.

MobileNet based secured compliance through open web application security projects in cloud system

The daunting issues that are promptly faced worldwide are the sophisticated cyber-attacks in all kinds of organizations and applications. The development of cloud computing pushed organizations to shift their business towards the virtual machines of the cloud. Nonetheless, the lack of security throughout the programmatic and declarative levels explicitly prone to cyber-attacks in the cloud platform. The exploitation of web pages and the cloud is due to the uncrated open web application security projects (OWASP) fragilities and fragilities in the cloud containers and network resources. With the utilization of advanced hacking vectors, the attackers attack data integrity, confidentiality, and availability. Hence, it’s ineluctable to frame the application security-based technique for the reduction of attacks. In concern to this, we propose a novel Deep learning-based secured advanced web application firewall to overcome the lack of missing programmatic and declarative level securities in the application. For this, we adopted the MobileNet-based technique to ensure the assurance of security. Simulations are effectuated and analyzed the robustness with the statistical parameters such as accuracy, precision, sensitivity, and specificity and made the comparative study with the existing works. Our proposed technique surpasses all the other techniques and provides better security in the cloud.

Assessment of Vulnerabilities in Student Records Web-Based Systems for Public and Private Higher Learning Institutions in Tanzania

In spite that HLIs in Tanzania use web-based systems for managing, storing and processing of HLIs information and data such as website contents, academic results and financial records. The HLIs web-based system have been compromised by attackers due to presence of vulnerabilities. The main objective of this study is to assess the vulnerabilities of Students Records Web-based Systems (SRWBS) for private and public Higher Learning Institutions (HLIs) in Tanzania using black-box testing methodology by employing two automatic vulnerability scanners namely OWASP ZAP (Open Webs Application Security Project Zed Attack Proxy; open-source tool) and Acunetix (proprietary tool). This study assesses the vulnerability of SRWBS for 3 private HLIs and 5 public HLIs in Tanzania. The results reveal the total of 29 vulnerabilities which include but are not limited to Broken Authentication and Session Management, Broken Access Control, Security Misconfiguration, Sensitive Data Exposure, Vulnerable JS (Java Script) Libraries, CSRF (Cros Site Request Forgery), Using Components with Known Vulnerabilities, XSS (Cross Site Script), DOM (Document Object Model) based XSS and Reflected XSS. SRWBS of public HLIs were found more vulnerable by average 44.2% than the SRWBS of private HLIs which were vulnerable by average of 37%. Based on these results, this study provides some recommendations for mitigating vulnerabilities and improving the security of SRWBS for private and public HLIs in Tanzania.

Developing an Open-Source, User-Friendly, OWASP-Compliant Architecture for Healthcare Web Application Testing.

Nowadays, web applications are fundamental in the healthcare sector. However, with the widespread use of this technology, risks related to cybersecurity attacks also increase. To mitigate this phenomenon, every 3-4 years, the nonprofit foundation Open Worldwide Application Security Project (OWASP) compiles a top 10 ranking of the most critical web application security risks. Along with the top 10 Web Application Security Risks, OWASP also provides the Web Security Testing Guide, which offers comprehensive guidelines for conducting security tests. This guide includes suggestions for specific tools to use when performing different tests, among other valuable insights. However, the use of these recommended tools can be costly and can require advanced technical skills and a deep understanding of security best practices and web technologies. In addition, since the OWASP work on web security is generic, it would be useful to restrict and adapt it to the healthcare area. This would help in reducing the overhead when dealing with the needed tools. The goal of this study is to make web application security assessment in healthcare more accessible by developing tools that simplify the process and makes it user- friendly. Before developing such tools, an in-depth feasibility study must be conducted to verify the existence of open-source libraries to carry out the necessary testing procedures. It will be also necessary to identify how tools could be simplified and enhanced when focusing on healthcare.

Sustainability of donor funded food security projects in Bumula Sub-County, Bungoma County, Kenya

Sustainability of donor funded food security projects in Bumula Sub-County, Bungoma County, Kenya

Fuzzy Logic and Neural network-based self-tuned PID controller of Quadcopter

Quadcopters have been established as a viable tool for the current era of technology. Quadcopters are also known as drones or unmanned aerial vehicles. The quadcopter can be used for aerial surveys for deliveries, filming, and missions such as detecting and mapping unreachable areas, hills, forests metropolitan areas, rocks, and obstructions that can be a danger or risk to navigation for commercial and security projects. It conducts its survey mission without human operator intervention. After the mission is accomplished, data can be fetched by GPS or the Quadcopter returns to a pre-programmed location where the data can be downloaded and processed. It can lead to an improvement in the position tracking performance due to an intrinsic change in the object's weight, buoyancy, and aerodynamic forces. In addition, quadcopters must navigate the extremely dynamic airborne environment that is represented by urban, rural, metropolitan, or natural environments. In light of this, efficient dock tracking is required to attain the requisite high precision performance, resulting in less time consumption, when the system's dynamic characteristics are time-dependent or the operating conditions and vision guidance alter. The automatic identification of objects by classifying images and self-tuning the gains of a PID (Proportional + Integral + Derivative) controller has been proposed in this paper. The object recognition is based on machine learning guided vision and self-tuning PID controller based on fuzzy logic and neural network.

Measuring ERP System Readiness with COBIT 2019 at IT Vendor Industry

The application of information technology that supports company business activities in IT services can be assessed for its IT governance capabilities using the COBIT 2019 framework, including security aspects. This research aims to determine the company's IT governance capabilities in the Managed Risk (APO12), Managed Security (APO13), and Managed Configuration (BAI10) domains to overcome security risks and provide recommendations for achieving a higher level of capability. This qualitative research uses data obtained through interviews and literature studies. Based on the results of capability measurements, the company received a score at level 2 to target levels 3 and 4, which indicates a gap of 1 to 2 levels. Recommendations include improving risk understanding, security awareness, security controls, and configuration management. Additionally, recommendations for ERP modules such as risk management, information security management, project management, configuration management, and quality management are proposed to address the identified issues.

Evaluasi Risiko Celah Keamanan Aplikasi E-Office menggunakan Metode OWASP

Based on data from Badan Siber dan Sandi Negara (BSSN) in 2022, it was reported that a total of 1,950 security vulnerabilities were found in 457 electronic systems across various applications widely used by the public. The purpose of this research is to evaluate the risk of existing security vulnerabilities in the E-Office application and determine the level and impact that these vulnerabilities can cause. This research focuses on information system security, specifically evaluating the risk of security vulnerabilities in the E-Office application of the Ogan Ilir Regency. The research was conducted using the Open Web Application Security Project (OWASP) method with a risk rating assessment. The research process began with a literature review to gather data and information sources, determine the scope and research objectives, test, identify security vulnerabilities, analyze security vulnerabilities, and the results of the analysis. The research subject is the E-Office application of Ogan Ilir Regency, with the object of the research being the security vulnerabilities in that application. OWASPZap was used as a tool to obtain data on security vulnerabilities, and using OWASPZap, 38 security vulnerabilities were found, with 18 of them meeting the criteria of the OWASP Top 10. Our findings indicate that the security vulnerabilities in the E-Office application of Ogan Ilir Regency include vulnerabilities in authentication levels, access control, configuration, and data validation processes.

Analysis of Cybersecurity Vulnerabilities in Mobile Payment Applications

Skepticism about security of mobile payment applications has plagued user adoption of such platforms in some countries. Software developers have generally de-emphasized core principles guiding delivering safe mobile applications since for mobile payment applications, movement of monetary value is their priority. We find in surveyed literature that this situation is prevalent in low economy/low financial inclusion countries. Selected were 50 Fintech and traditional banks m-payment applications in both high and lower economic and technological advancement (high E&T apps and lower E&T apps respectively) countries in Africa. This work may have significance in finance or economy, but it is mainly to unravel cybersecurity concerns. The analyses (static and dynamic) of the applications targeted top ten vulnerabilities on 2023 Common Weakness Enumeration (CWE) and Open Worldwide Application Security Project (OWASP) lists. The study employed Mobile Security Framework (MobSF) as the primary tool for both Android and iOS application while Automated Security Risk Assessment (AUSERA) tool was used to validate the vulnerabilities reported by MobSF. Results show that traditional m-payment apps were generally more secure than Fintech m-payment apps. In the later category, vulnerabilities under information leakage and cryptography category were the most prevalent. On the average, no marked difference was observed in security performance between high E&T apps and lower E&T apps. Incorrect default permission, cleartext storage of sensitive information, use of risky cryptographic algorithm, use of insufficiently random values and information exposure were the most prevalent vulnerabilities. Conversely, insecure implementation of SSL and trusting all certificates or accepting self-signed certificates had fewest occurrences. Poor code quality was the highest source of security vulnerabilities in the study. Declining statistics of SMS leakage in recent studies was confirmed in this work. The most implemented security measure was certificate pinning for preventing or detecting man-in-the-middle attack.

Agile Transformation through the Performing Management of It and Cyber Security Projects, at the Government Level

Abstract Modern theories of intelligence have developed from the observation that the person, throughout life, is in constant development. In order to be successful, certain conditions must be met. These conditions for achieving success in life depend on the skills that are formed during formal education, or at least should be pursued as goals, beyond the disciplines. In a current information society, the quality of life as well the perspectives of social change and economic development depend on information and its exploitation, especially in the institutional field of managing computer applications for the absorption of European funds, becoming a matter of national importance, with critical values for national security, characterized by the state of economic equilibrium. Scientific knowledge and information are of particular importance in the global information society by: supporting innovation through technology, promoting economic development through the use of emerging technologies, making decisions efficiently and transparently at government level. The implementation and use of intelligent technologies have a decisive role in the development of the degree of digitization of public services through non-refundable funding from European funds and the National Recovery and Resilience Plan. The reinvention of the government can be transformed into a reality through the digitization and computerization of the public administration, assuming the modernization of the infrastructure through specific sources of funding, such as European funds, ensuring security through advanced cyber protection and defense capabilities against possible vulnerabilities, risks or cyber-attacks. Achieving performance within the public institution requires an increased concern for innovation, creativity and change.