Security-related Aspects Research Articles

Understanding Public Perception of Internet Security in the European Union

Abstract This paper presents an extensive analysis of Internet security experiences and perceptions among European Union (EU) citizens, as detailed by data within commented graphics highlighting awareness of online privacy practices, security-related aspects and data tracking methods. The paper also examines the implications of the General Data Protection Regulation (GDPR) regarding businesses operating within the EU and the European Economic Area (EEA). Via a thorough investigation of Internet users' awareness of cookies as tracking tools and the prevalence of security-related incidents, the paper provides insights into the evolving landscape of online privacy and security. It elucidates the challenges and opportunities presented by GDPR compliance for businesses, compliance requirements, spanning core principles and broader implications of data processing practices. The findings mark the imperative to align businesses’ operations with GDPR provisions, addressing key aspects such as consent mechanisms, lawful bases and the importance of robust data security measures. The conclusion reveals the significance derived from the intersection of internet security perceptions, GDPR compliance, and business operations within the EU and EEA. Synthesizing empirical data with regulatory analysis, the paper provides a valuable understanding of the challenges and opportunities within the evolving regulatory landscape, thereby equipping businesses with actionable strategies in order to safeguard data privacy rights and uphold regulatory compliance in the digital age.

A Contemporary Secure Microservices Discovery Architecture with Service Tags for Smart City Infrastructures

The re-conceptualization of fundamental elements from traditional monolithic structures to the Microservices framework has emerged as a vital vision for the future of IoT systems. This transformation is pivotal in addressing the present and future challenges faced by IoT systems and enhancing their overall operational qualities. The adoption of Microservices in IoT introduces an array of opportunities for innovative research, which collectively contribute to its feasibility and success. The transition from traditional systems to Microservices in IoT brings forth various complex challenges that need to be effectively addressed. Key challenges include ensuring seamless Microservice discovery, efficient API gateway management, scalable distribution services, reliable uniform service discovery, robust containerization, and stringent access control mechanisms. These challenges encompass both technical and security-related aspects, necessitating innovative solutions to overcome them. To overcome these challenges, our research proposes a secure service discovery architecture that integrates security measures at each stage of the discovery process. This methodology employs advanced encryption techniques, authentication protocols, and authorization mechanisms to safeguard Microservices in IoT. A mathematical framework is introduced to formalize and implement these security measures, ensuring a robust and reliable approach to Microservices adoption in the IoT ecosystem. In the experimental phase of our research, we aim to validate the proposed secure service discovery architecture through a series of rigorous tests and simulations. We will assess its performance, scalability, and security efficacy under various real-world scenarios and IoT use cases. Experimental results and performance metrics will be analyzed to provide empirical evidence of the viability and effectiveness of our proposed methodology in addressing Microservices-related challenges in IoT systems.

Security at the Edge for Resource-Limited IoT Devices.

The Internet of Things (IoT) is rapidly growing, with an estimated 14.4 billion active endpoints in 2022 and a forecast of approximately 30 billion connected devices by 2027. This proliferation of IoT devices has come with significant security challenges, including intrinsic security vulnerabilities, limited computing power, and the absence of timely security updates. Attacks leveraging such shortcomings could lead to severe consequences, including data breaches and potential disruptions to critical infrastructures. In response to these challenges, this research paper presents the IoT Proxy, a modular component designed to create a more resilient and secure IoT environment, especially in resource-limited scenarios. The core idea behind the IoT Proxy is to externalize security-related aspects of IoT devices by channeling their traffic through a secure network gateway equipped with different Virtual Network Security Functions (VNSFs). Our solution includes a Virtual Private Network (VPN) terminator and an Intrusion Prevention System (IPS) that uses a machine learning-based technique called oblivious authentication to identify connected devices. The IoT Proxy's modular, scalable, and externalized security approach creates a more resilient and secure IoT environment, especially for resource-limited IoT devices. The promising experimental results from laboratory testing demonstrate the suitability of IoT Proxy to secure real-world IoT ecosystems.

Human Enhancement Without Organizational Knowledge and by Organizational Order

Organizations strive to ensure and maintain the reliability, safety, security, usability, and competitiveness of their processes, goods, and services. Improvement of employees’ skills and abilities contributes to these ends and is a relevant issue for the field of human factors. However, going a step further than designing ergonomics, implementing protocols, and conducting training is the attempt to enhance employee skills directly through various technological means. So-called Human Enhancement aims at direct technological interference with the employees’ skills and is a notoriously controversial yet deeply historical phenomenon. Drawing from empirical and theoretical literature on Human Enhancement, we seek to provide an initial analysis of this phenomenon in an organizational context. One motivational aspect of contemporary Human Enhancement is the need to meet internal, often self-related, or external, usually social or organizational, demands. Given the different effects and means of Human Enhancement, some forms are illicit, sanctioned, and/or condemned as morally wrong, while others are obligatory and well-established. Enhancement efforts can be based on individual initiative and, hence, without organizational knowledge. The opposite of the spectrum are enhancements applied by organizational order. We also emphasize how an organizational culture may incentivize engagement with illicit means of Human Enhancement. Potentially linked to safety and security-related aspects, its enhancement effects in relation to these two poles can inform stakeholders in their regulatory decisions.

Design of a Music Recommendation Device Using Mini-Xception CNN and Facial Recognition

Due to the emerging developments in Artificial Intelligence and Machine Learning Technologies, various prediction systems are been developed based on human emotions and real time aspects of human psychology as well. Facial recognition system is one such mechanism which is the most vibrant strategy used for predicting human emotions. It is extensively applied in surveillance systems, fault identification and other security related aspects. Based on the human emotions researchers have already proposed several music recommendation systems. This paper aims to propose a Facial recognition-based music recommendation system to treat the psychology patients. This helps to recover the patients from mental stress, anxiety, and depression. The suggested method aims to take into account the limitations of the face recognition system in current frameworks, such as the requirement to lower the processing delay for deep feature extraction and the necessity to design a Mini exception technique based on Deep Convolutional Neural Network (DCNN) architecture. The FER- 2013 image dataset, which consists of 35000 face photos with automated labelling is considered. It is used to determine how well the proposed approach would detect the various emotion classes. In comparison to other states of methods, the Mini exception technique utilised in CNN layers acts as a lightweight system. The proposed solution has a 92% accuracy rate and removes the barrier between the current frameworks. The suggested music is taken from a music database and then further mapped in accordance with the algorithm's output.

Security Risk Assessments: Modeling and Risk Level Propagation

Security risk assessment is an important task in systems engineering. It is used to derive security requirements for a secure system design and to evaluate design alternatives as well as vulnerabilities. Security risk assessment is also a complex and interdisciplinary task, where experts from the application domain and the security domain have to collaborate and understand each other. Automated and tool-supported approaches are desired to help manage the complexity. However, the models used for system engineering usually focus on functional behavior and lack security-related aspects. Therefore, we present our modeling approach that alleviates communication between the involved experts and features steps of computer-aided modeling to achieve consistency and avoid omission errors. We demonstrate our approach with an example. We also describe how to model impact rating and attack feasibility estimation in a modular fashion, along with the propagation and aggregation of these estimations through the model. As a result, experts can make local decisions or changes in the model, which in turn provides the impact of these decisions or changes on the overall risk profile. Finally, we discuss the advantages of our model-based method.

Nationales Gesundheitsziel Patientensicherheit

Improving patient safety is key to better health and nursing care. The Association for the Continuous Development of the National Health Target Process, health-targets.de (gesundheitsziele.de), has defined two focus areas, each with six goals, to jointly initiate significant progress in patient safety in Germany and achieve the health target of the same name. It is based on the "Global Patient Safety Action Plan 2021-2030" of the World Health Organization (WHO) and contributes to its implementation on anational level.The national health target addresses all players in healthcare and highlights the role of patients. Strengthening patient safety culture and expanding patient safety competence are at the center of the target process.For patient safety culture, asystemic approach is crucial. Individual-related factors as well as structural and process-oriented variables are looked at. Acooperation that focusses on the wellbeing of patients is essential.Patient safety competence spotlights knowledge on security related aspects in healthcare. At the same time, it focuses on the ability of all those involved to influence care in apositive way-thereby being open to the capabilities of patients.

Cyber-X: Own Server Based Platform for Pentesting

Security technology is important to security, but the practices of the people who develop, integrate, evaluate, configure, maintain, and use that technology are more important; indeed, these practices are the foundation of technical security. We argue that the flexibility of virtual environments will play a critical role in many cyber security related aspects. Problems like the assessment of newly devised intrusion detection techniques, the evaluation of skills of cyber defense team members, the evaluation of the disruptive effects caused by the diffusion of new malware, are just few examples of issues that cannot be directly addressed in production systems even though they require realistic operating environments in order to be suitably performed.

Applying Blockchain Technology to Security-Related Aspects of Electronic Healthcare Record Infrastructure

The centralised architecture employed by electronic health records (EHRs) may constitute a single point of failure. From the perspective of availability, an alternative cloud-based EHR infrastructure is effective and efficient. However, this increased availability has created challenges related to the security and privacy of patients’ medical records. The sensitive nature of EHRs attracts the attention of cyber-criminals. There has been a rise in the number of data breaches related to EHRs. The infrastructure used by EHRs does not assure the privacy and security of patients’ medical records. Features of blockchain platforms, such as decentralisation, immutability, auditability, and transparency, may provide a viable means of augmenting or improving services related to the security of EHRs. This study presents a series of experimental data flow configurations to test the application of blockchain technology to aspects of EHRs. The insights gained from these experiments are founded on a theoretical base to provide recommendations for applying blockchain technology to services related to the security of EHR infrastructure. These recommendations may be employed by developers when redesigning existing EHR systems or deploying new EHR systems.

An efficient approach for reviewing security-related aspects in agile requirements specifications of web applications

Defects in requirement specifications can have severe consequences during the software development life cycle. Some of them may result in poor product quality and/or time and budget overrun due to incorrect or missing quality characteristics, such as security. This characteristic requires special attention in web applications because they have become a target for manipulating sensible data. Several concerns make security difficult to deal with. For instance, security requirements are often misunderstood and improperly specified due to lack of security expertise and emphasis on security during early stages of software development. This often leads to unspecified or ill-defined security-related aspects. These concerns become even more challenging in agile contexts, where lightweight documentation is typically produced. To tackle this problem, we designed an approach for reviewing security-related aspects in agile requirements specifications of web applications. Our proposal considers user stories and security specifications as inputs and relates those user stories to security properties via natural language processing. Based on the related security properties, our approach identifies high-level security requirements from the Open Web Application Security Project (OWASP) to be verified and generates a reading technique to support reviewers in detecting defects. We evaluate our approach via three experimental trials conducted with 56 novice software engineers, measuring effectiveness, efficiency, usefulness and ease of use. We compare our approach against using: (1) the OWASP high-level security requirements and (2) a perspective-based approach as proposed in contemporary state of the art. The results strengthen our confidence that using our approach has a positive impact (with large effect size) on the performance of inspectors in terms of effectiveness and efficiency.

Analysis of safety benefits and security concerns from the use of autonomous vehicles: A grouped random parameters bivariate probit approach with heterogeneity in means

This paper investigates public perceptions towards potential safety benefits, and safety- and security-related concerns from the future use of autonomous vehicles by utilizing data collected from an online survey. The survey includes responses from 584 individuals from the United States, who responded to a varying range of questions related to autonomous vehicles and their usage. The subsequent exploratory statistical analysis is conducted by employing a novel method, namely the grouped random parameters bivariate probit model with heterogeneity in means. The proposed method accounts for the challenges stemming from the presence of multiple layers of unobserved heterogeneity in the data, and simultaneously offers more insightful results. From the analysis, several socio-demographic characteristics, and driving attitude related characteristics and opinions were found to affect the perceptions towards the safety and security related aspects of autonomous vehicles. The heterogeneity in means approach revealed distinct individual-specific characteristics that affect the peak of the distribution of the parameter density function of the random parameters, adding further clarity to the understanding of the factors affecting individuals’ perceptions towards autonomous vehicles. The findings from this study suggest the ongoing evaluation of public perceptions, and reinforce the requirement of analyzing temporal variations in public perceptions. This can, in turn, aid regulatory and governance entities and autonomous vehicle manufacturers to adapt their strategies and implementation plans accordingly.

New Economic Statecraft: Industrial Policy in an Era of Strategic Competition

The 2018 U.S. National Defense Strategy notes that the United States faces “an increasingly complex global security environment, characterized by overt challenges to the free and open international order and the re-emergence of long-term, strategic competition between nations.” In the ensuing months, much has been made of the security-related aspects of this return to great power competition — including Donald Trump’s role in the decline of the existing arms control architecture, responses to Russia’s annexation of Ukraine, and China’s use of subconventional — or “gray zone” — military operations in the South China Sea. What this analysis tends to miss, however, are the economic dimensions of strategic competition. To address the question of how insights from international political economy and security studies can be usefully combined to examine strategic competition, we examine how economic statecraft increasingly takes the form of economic policy beyond sanctions regimes. We argue that economic statecraft has become an increasingly central aspect of geostrategic consideration and consider how economic statecraft is being transformed in the current era.

Formal verification for a PMQTT protocol

The future of Internet of Things (IoT) foresees a world of interconnected people with every physical object in a seamless manner. The security related aspects for the IoT world are still an open field of discussion and research. The Message Queue Telemetry Transport (MQTT) application layer protocol is widely used in IoT networks. Since, MQTT standard has no mandatory requirements regarding the security services, therefore, manipulating the security related issues is different in MQTT platforms. This paper proposes a novel security protocol. It is the Protected Message Queue Telemetry Transport (PMQTT) protocol which is based on MQTT with added cryptographic primitives to offer security services for IoT systems. Moreover, a formal verification for a PMQTT protocol is conducted using the ProVerif cryptographic automated verifier tool to prove that the PMQTT protocol satisfies the intended security properties.

Catering to Your Concerns

Android users are increasingly concerned with the privacy of their data and security of their devices. To improve the security awareness of users, recent automatic techniques produce security-centric descriptions by performing program analysis. However, the generated text does not always address users’ concerns as they are generally too technical to be understood by ordinary users. Moreover, different users have varied linguistic preferences that do not match the text. Motivated by this challenge, we develop an innovative scheme to help users avoid malware and privacy-breaching apps by generating security descriptions that explain the privacy and security related aspects of an Android app in clear and understandable terms. We implement a prototype system, PERSCRIPTION, to generate personalised security-centric descriptions that automatically learn users’ security concerns and linguistic preferences to produce user-oriented descriptions. We evaluate our scheme through experiments and user studies. The results clearly demonstrate the improvement on readability and users’ security awareness of PERSCRIPTION’s descriptions compared to existing description generators.

A Systematic Review and Analytical Evaluation of Security Requirements Engineering Approaches

Security is an inevitable concern in today’s scenario of software-based application’s pervasiveness and development practices. Researchers and practitioners frequently advocate that security-related aspects should be integrated and incorporated right from the beginning of SDLC. Security requirements engineering (SRE) plays an important role during the inceptive phases of software development. Thereby, we conducted a systematic review of the current state of the literature related to SRE. In total, we selected and analyzed 108 relevant studies. After analyzing the selected studies, we identified 20 different SRE approaches and compared them on different technical parameters like ‘performance in the requirements subphase,’ ‘usability with respect to size and complexity of the project,’ ‘notation used,’ ‘industry recognition/adoption,’ ‘tool support,’ ‘standards integration’ and ‘elicitation technique used.’ The results of this study are based on the comparative analysis of the SRE approaches, their analytical evaluation by the authors and trends observed during the course of the review. The major findings of this study indicate that SRE approaches like ‘Misuse case, Secure Tropos, SEPP and SQUARE’ are most popular among researchers while UML-based approaches like ‘Misuse Case, SecureUML and UMLsec’ are easily adaptable approaches. Threat modeling as an activity is adapted by most of the SRE approaches while few approaches support risk analysis. In addition, among several other findings, our study indicates that most of the SRE approaches fail to integrate security standards and formal methods. The contribution of this work is consequently that of supplying researchers with a summarized comparison of existing SRE approaches, along with the best practices adopted in the field of security requirements engineering. The insights provided here on selection appropriateness may prove to be instrumental for research in the area and may significantly facilitate both researchers and practitioners.

An integrative conceptual framework for physical security culture in organisations

A conceptual framework for physical security culture in organisations is proposed, based on the integrative model of safety culture, as developed by Vierendeels et al. (2018). The proposed conceptual framework for physical security culture has the advantage that it brings security threats, technique, organisation and human aspects together in a coherent, integrative and related way. The framework includes five main domains of security culture, being (a) an observable technological domain, (b) an observable organisational domain, (c) an observable human domain, (d) a non-observable organisational domain or perceptual domain, and (e) a non-observable human domain or psychological domain. These five main domains can be further divided into several more specific sub-domains of security culture. At their turn, these sub-domains can be translated into measurable security results, being (a) observable security outcomes, (b) the security climate of an organisation or the shared perceptions on security, and (c) the individual intention to behave secure or insecure. The aim of the framework is to take all security-related aspects into account – based on the specific security threats to which an organisation is exposed – leading to a pro-active approach of the physical security of organisations. The framework provides specific points of departure to make the security culture measurable, and by extension controllable.

The Minsk Agreements and the osce Special Monitoring Mission

Seeking to place the smm within the broader matrix of actors and initiatives involved in Ukraine, the contribution discusses the role of the osce smm in supporting the implementation of the Minsk Agreements. The smm has a role in monitoring, reporting and facilitating the implementation of the ceasefire elements in the Minsk Agreements, and interacts with a range of stakeholders across different levels. The contribution discusses some significant challenges and impediments to the implementation of the Minsk Agreements, and looks at how the smm’s possibilities and limitations to monitor and report on the security related aspects of these Agreements are affected by such constraints.

Online Analysis of Security Risks in Elastic Cloud Applications

Security-related concerns in elastic cloud applications call for a risk-based approach due to the inherent trade-offs among security and other nonfunctional requirements, such as performance. To this end, the authors advocate a solution that can be efficiently realized through modeling the application behavior as a Markov decision process, on top of which probabilistic model checking is applied. The article explains the main steps in this approach and illustrates its use in online analysis and decision making regarding elasticity decisions. The runtime analysis is capable of providing evidence for key security-related aspects of the running applications, such as the probability of data leakage in the next hour.

Media Coverage of Taliban: Is Peace Journalism the Solution?

This article combines quantitative and qualitative analysis to investigate the reporting of the Taliban conflict in Pakistan media and finds the coverage escalatory and elitist from the peace journalism perspective. While the security-related aspects of the conflict are highlighted, the problems of victims are ignored. The data for this study were collected through content analysis, discourse analysis and interviews with conflict reporters and analysts. The key findings of this study are quite consistent with the existing peace journalism scholarship that in conflict where national interests are involved, media become nationalistic and patriotic, leaving behind the considerations of quality and good journalism.

A framework to assist email users in the identification of phishing attacks

Purpose – The purpose of this paper is to propose a framework to address the problem that email users are not well-informed or assisted by their email clients in identifying possible phishing attacks, thereby putting their personal information at risk. This paper therefore addresses the human weakness (i.e. the user’s lack of knowledge of phishing attacks which causes them to fall victim to such attacks) as well as the software related issue of email clients not visually assisting and guiding the users through the user interface. Design/methodology/approach – A literature study was conducted in the main field of information security with a specific focus on understanding phishing attacks and a modelling technique was used to represent the proposed framework. This paper argues that the framework can be suitably implemented for email clients to raise awareness about phishing attacks. To validate the framework as a plausible mechanism, it was reviewed by a focus group within the School of Information and Communication Technology (ICT) at the Nelson Mandela Metropolitan University (NMMU). The focus group consisted of academics and research students in the field of information security. Findings – This paper argues that email clients should make use of feedback mechanisms to present security related aspects to their users, so as to make them aware of the characteristics pertaining to phishing attacks. To support this argument, it presents a framework to assist email users in the identification of phishing attacks. Research limitations/implications – Future research would yield interesting results if the proposed framework were implemented into an existing email client to determine the effect of the framework on the user’s level of awareness of phishing attacks. Furthermore, the list of characteristics could be expanded to include all phishing types (such as clone phishing, smishing, vishing and pharming). This would make the framework more dynamic in that it could then address all forms of phishing attacks. Practical implications – The proposed framework could enable email clients to provide assistance through the user interface. Visibly relaying the security level to the users of the email client, and providing short descriptions as to why a certain email is considered suspicious, could result in raising the awareness of the average email user with regard to phishing attacks. Originality/value – This research presents a framework that email clients can use to identify common forms of normal and spear phishing attacks. The proposed framework addresses the problem that the average Internet user lacks a baseline level of online security awareness. It argues that the email client is the ideal place to raise the awareness of users regarding phishing attacks.