Information Security Requirements Research Articles

Analysis of Relationships between Non-conformities, Process Maturity and Continual Improvement in Information Security Management Systems

Abstract In the current global context, companies need a defined minimum level of information security to recognize and deal with related threats and risks. Due to market, customer or legal requirements, specifications and requirements for information security are implemented uniformly according to standards such as the information security management standard ISO/IEC 27001 or industry-specific standards such as Trusted Information Security Assessment Exchange - TISAX, ISO IEC 27019 Energy Utility Information Security Standard. The conformity to these standard requirements within the established management system is checked during periodically required audits. However, there are various reasons for which, even after many years of audits in companies, there are still insufficient process implementations for information security requirements. The aim of the paper is to analyze the status of conformity and thus also the process maturity in selected samples of companies that have already had information security management systems (ISMS) implemented for several years. In detail, the reasons for deviations from the minimum requirements with associated risks for the security of information in companies were analyzed, which allow conclusions to be drawn about possible process improvements. The paper also analyzes why, despite established measures and existing expertise, only a limited level of process maturity is achieved on average. Other possible approaches to the implementation procedure for dealing with non-conformities in information security are also considered. The results of this research show that there is a need for an adjusted continuous improvement process, which makes risks resulting from insufficient process maturity more visible. Proposals for such improvements are listed.

Dynamic encryption method for MQTT communication

Internet of vehicles (IoV) system is mixed-criticality, and different functions have different requirements for information security and real-time performance. Thesis aims to design a comprehensive dynamic encryption algorithm to ensure the function of the IoV system while taking into account the security level required by different critical functions. The algorithm can flexibly coordinate the security requirements between different functions, improve the efficiency and reliability of the system to the greatest extent, and ensure information security. In order to verify the performance of the algorithm, thesis uses Pycharm platform to carry out simulation experiments through python programming and verifies the feasibility of the algorithm.

Model of current threats to security of confiden-tial data in divisional information systems

The paper proposes a model for determining actual threats to the information security of distributed information systems, based on algorithms of fuzzy inference and the theory of fuzzy neural systems, unlike known ones, uses sufficient and necessary indicators, excludes expert errors, increases the detection of the number of actual threats to information security of distributed systems by 5 %, reduces the cost of purchasing information protection equipment from 15 to 30%. It takes into account the following factors: the IT infrastructure of the distributed information system, the capabilities of attackers and their level of motivation in the distributed information system, the list of existing protection tools in the distributed information system.
 The proposed approach differs from existing ones in the following: lack of involvement of highly qualified specialists in the field of information security; the process is automated, has a low computational complexity; absence of deficiencies in expert assessments; allows you to determine the list of current information security threats in information systems of various classes and types.
 The task of ensuring the security of confidential information becomes the most urgent, which is due to the growth of computer attacks and leaks of information, which are reflected in the statistical data on the commission of crimes in the field of high technologies, the growth of criminal activity using modern communication devices and the Internet.
 Existing methods of modeling current threats to information security and assessing the effectiveness of the information protection system cannot be used at all stages of the life cycle of distributed information systems - they do not take into account the following indicators in the complex: IT infrastructure of distributed information systems, current threats to information security, security requirements for confidential information, a list of means of protecting confidential information and their value as important indicators when solving these problems.
 In order to achieve the goals of ensuring the security of confidential information, it is necessary to: organize the effective creation of an information protection system (information security system), effective modeling (identification of the list) of current threats to information security, identification of the current violator, and also provide the opportunity to conduct a qualitative assessment of the effectiveness of the information security (protection) system.
 One of the most important tasks of ensuring the security of confidential information is the assessment of the effectiveness of the protection (security) system. In this regard, the goal of the work (research) is to improve the quality of the evaluation of the effectiveness of the protection (security) systems of distributed information systems by determining sufficient and necessary evaluation indicators using modern (promising) information technologies that allow the most effective solution of the following tasks: determination operating parameters of adaptive production fuzzy neural systems, which are most suitable for solving the tasks, application of Data Science technologies in data processing, fuzzy output algorithms.

A Model of an Automated Electronic Document Management System Operating under Conditions of Probable Compromise of Signature Keys, Based on a Hierarchical Decomposition of Trusted Storage Environments

The results of an analysis of the functioning of the electronic document management system in the context of the development of methods and means of cryptanalysis and an avalanche increase in the number of processed documents are presented. A conceptual model and method for decomposing the storage subsystem into contours of operational and long-term storage of electronic documents are proposed. A mathematical model of hierarchical control of the integrity of electronic documents is presented, which takes into account the integrative properties of electronic documents, as well as requirements for storage periods and information security. The methodology and results of assessing the advantages of the developed technical solution based on the logical-probabilistic method are presented.

Bezbednost informacija u automobilskoj industriji - mehanizam TISAX

With the development of information technologies and their application in all spheres of activity, information security has become an actual problem. A significant step towards solving that problem was the adoption of the ISO/IEC 27000 family of standards for information security management systems (ISMS). The practical application of these standards showed that the generic standard cannot satisfy all specific requirements for information security in certain areas, so the adoption of sector standards in areas such as telecommunications, electric power systems, cloud computing, etc. At the same time, in some branches of industry, special standards were adopted to express their specificities. One of those areas is the automotive industry, where the TISAX mechanism has been established to ensure that suppliers comply with information security requirements, especially when it comes to information related to prototypes. This paper provides a summary of the TISAX mechanism, its structure and constituent elements, as well as its relationship with the ISO/IEC 27000 family of standards.

Selection of best cipher system using fuzzy soft decision methodology

Selection of a most suitable cipher system among several such systems is an important problem of the customers which help to acquire a right cipher system for meeting the requirements of information security to safeguard the vital data. Any mistake in the selection of a right cipher system is very harmful as it may lead to compromise the security of vital information. In the paper, we propose a multi-criterion fuzzy soft decision making methodology to select one of the most suitable cipher system. Proposed methodology uses fuzzy soft set, fuzzy soft matrix, dominancy matrix and S-fuzzy set to compute score values and take a right decision. It exhibits out performance over existing methods as shown by explaining some examples. We apply proposed methodology in selecting a most suitable cipher system from a set of systems with respect to the choice of desired security attributes required by the customers.

К ВОПРОСУ О ФОРМАЛИЗАЦИИ ЗАДАЧИ РАНЖИРОВАНИЯ ТРЕБОВАНИЙ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ

The article is devoted to the issue of requirements fulfillment aimed at ensuring information security in an organization. The main contradiction of the subject area concerned is pointed out, which consists in the presence of a huge number of different variants of requirements fulfillment in the absence of a possibility to choose their correct and optimal order. The task of requirements ranking is set and the idea of the proposed solution is described in the form of seven provisions aimed at coordinated recording of heterogeneous requirements in a single notation, and an intuitive scheme of the idea is synthesized (with all seven provisions indicated on it).
 To represent the idea, the following entities are introduced: an object-organization and its elements to which requirements are imposed; generalized conditions for satisfying requirements that do not depend on the specifics of the organization; variations of sets of conditions that take into account a particular organization; basic conditions that check the presence/absence of elements 
 of the object and the values of their parameters; algorithms of activities in the organization to satisfy the conditions; priorities of requirements and resources needed by the algorithms. It is concluded that such formalization will lead organically to the algorithmic solution of the ranking problem and, eventually, to automation.
 The most suitable automated ways of solving the problem of ranking information security requirements – algorithmic application of combinatorial optimization and machine learning methods – are specified. Their high efficiency in comparison with «manual» methods used in modern information protection practice is predicted.
 The novelty, theoretical and practical significance of the obtained results are noted, as well as the prospect of further research – the construction of an analytical model of requirements fulfillment, which could be the basis of an appropriate method, followed by its program implementation and conducting of necessary experiments.

АВТОМАТИЗАЦИЯ ПРОЦЕССОВ ОБЕСПЕЧЕНИЯ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ НА ОСНОВЕ РАЗРАБОТКИ МОДЕЛИ МИНИМИЗАЦИИ РИСКОВ КОНСТРУКТОРСКО-ТЕХНОЛОГИЧЕСКОГО ПРОЕКТА

Minimizing risks in developing intellectually intensive products, connected with the exclusion of unauthorized entry into the design and technological project security system, is the most important task of preserving the development of Russian creative potential. The research method is to identify and analyse the application of engineering and psychological aspects of the design activities of intellectual-intensive products. Clearly formed and documented requirements for information and technological security, supplemented by research in the field of engineering psychology, make it possible to minimise the risks of threats to enter the system along the entire chain of the design and production process. Building a model for minimising the risks of a design and technological project, which makes it possible to fulfil technological safety requirements based on developing quality assessment criteria, considering the use of engineering and psychological knowledge, is the solution to a very urgent problem.

ASSESSMENT OF COMPLIANCE WITH INFORMATION SECURITY REQUIREMENTS VIA SECUBE

This article focuses on the assessment of compliance with information security requirements using SeCube, a comprehensive information security management system. It explores howSeCube facilitates organizations in meeting various information security standards and regulations. Key features of SeCube, such as risk assessment, policy management, incident tracking, and compliance reporting are examined. The article also highlights the benefits and challenges of using SeCube for compliance purposes, providing insights into its effectiveness in maintaining high information security standards.

Energy Consumption Minimization in Secure Multi-Antenna UAV-Assisted MEC Networks With Channel Uncertainty

This paper investigates the robust and secure task transmission and computation scheme in multi-antenna unmanned aerial vehicle (UAV)-assisted mobile edge computing (MEC) networks, where the UAV is dual-function, i.e., aerial MEC and aerial relay. The channel uncertainty is considered during information offloading and downloading. An energy consumption minimization problem is formulated under some constraints including users’ quality of service and information security requirements and the UAV’s trajectory’s causality, by jointly optimizing the CPU frequency, the offloading time, the beamforming vectors, the artificial noise and the trajectory of the UAV, as well as the CPU frequency, the offloading time and the transmit power of each user. To solve the non-convex problem, a reformulated problem is first derived by a series of convex reformation methods, i.e., semi-definite relaxation, S-Procedure and first-order approximation, and then, solved by a proposed successive convex approximation (SCA)-based algorithm. The convergence performance and computational complexity of the proposed algorithm are analyzed. Numerical results demonstrate that the proposed scheme outperforms existing benchmark schemes. Besides, the proposed SCA-based algorithm is superior to traditional alternative optimization-based algorithm.

Security label and attribute-based access control in service-oriented environments

Compared with traditional systems, service-oriented environments are more dynamic and distributed. Although traditional access control is able to fulfill the security of requirements of closed systems on the whole, it can no longer meet the requirements of service-oriented environments. To deal with the issues that access control in the service-oriented environment needs to cross the boundary of the security domain, the high distribution, and heterogeneity of environmental characteristics, and how to establish efficient and guaranteed access to resources, access control based on security label and attribute is proposed for fine-grained resource information and rich policy security requirements. By using a CP-ABE mechanism, distributed fine-grained access control can be realized in the company of solving the issue of policy privacy leakage; By using the security label technology, the multi-level security mandatory access control is realized, and the security flow of information is achieved, thus protecting the service and its methods from unauthorized users. Finally, the proposed scheme has been verified to have reliable security through security analysis. The experimental outcomes indicate this proposed scheme is available and effective in terms of performance.

АЛГОРИТМ МНОГОКРИТЕРИАЛЬНОГО АНАЛИЗА ТЕКСТОВОЙ ИНФОРМАЦИИ

The article is devoted to the problem of formalization of requirements for various objects and systems. Such a rigorous recording of requirements will allow not only to form their necessary and sufficient set, but also to choose the optimal order of their fulfillment – that is, to solve the problem of ranking. For this purpose, a review of relevant scientific publications of Russian scientists is carried out, in which the point of view on the formal form of recording such requirements is presented. The results of the review are systematized in tabular form. All years of publications have a range of 15 years, the field of application of requirements presents a great variety from design of information systems and mechanical devices in spacecraft to educational planning, and the proposed forms of recording consist of separate formulas and text descriptions to full-fledged models and programming languages.
 According to the results of the review, appropriate conclusions are drawn, namely the following: the relevance of the problem (at least for the last 15 years), the lack of quality solutions, a multitude of proposed forms of record with a small predominance of analytical models and programming languages, poor automation of work with requirements. It is concluded that there are no solutions, even potentially applicable for the formation of a system of requirements for information security of information systems in a unified notation. The necessity of creation of own mathematical toolkit is substantiated both for unified formalization of all requirements of various types and purposes, and for carrying out optimization measures over them on the choice of the list and order of execution. In conclusion the novelty of the conducted research, theoretical and practical significance of the work are indicated.

Balancing software and training requirements for information security

Information security is one of the key areas of consideration to assure reliable and dependable information systems (IS). Achieving an appropriate level of IS security requires concurrent consideration of the technical aspects of IS and the human aspects related to the end users of IS. These aspects can be described in the form of information security requirements. We propose an approach that helps select and balance information security software requirements (iSSR) and information security training requirements (iSTR) according to the information security performance of end users. The approach was tested in an experiment involving 128 IS professionals. The results showed that using the proposed approach helps IS professionals with limited experience in information security make significantly better decisions regarding iSSR and iSTR.

Designing An Information Security Framework For The Indonesia Water Industry Sector

The majority of Indonesia's water industry sectors have implemented smart water management systems as part of their business development, which has an indirect impact on enterprise information security. However, in general, water sector enterprises continue to place a low priority on information security, and the development of information system frameworks is based on generic norms employed by financial firms. There has been no research on information security frameworks especially built for water firms in Indonesia that use information security standards in the utilities sector. This article proposes a solution in the form of a new framework for Indonesian water firms that combines international information security requirements in the utilities sector with Indonesian government rules. This approach of development combines worldwide standards with national rules. The Cybersecurity Capability Maturity Model (C2M2) and ISO 27019 are two international standards commonly used by utility businesses globally. Government Regulation or Peraturan Pemerintah (PP) Number 71 of 2019 on the Implementation of Electronic Systems and Transactions is the relevant national regulation. The framework addresses information technology, telecommunications, and operational technology, with four approach categories: governance and ecosystem, protection, defense, and resilience. According to the research findings, the newly integrated framework can be applied and is worthy of recommendation. This framework also meets the standards for information security and can be used by Indonesian water corporations.

Дистанционный мониторинг состояния заземляющего устройства

In connection with the rapid development of technologies, increasing the volume of data exchange and increasing requirements for information security, there is a need to pay special attention to the causes of possible data loss. One of the most common reasons is the quality of power supply of telecommunications networks. Since the density of elements on the microcircuit crystals has increased many times over, the breakdown voltage of these elements has significantly decreased. Therefore, with a slight overvoltage or electromagnetic influence, electronic components may fail, or errors may occur in the transmission of information, and even data destruction in memory devices may occur. The quality of power supply is significantly affected by the state of the grounding device, the main parameter of which is the resistance to the flow of electric current. In order to timely detect a malfunction of the grounding device, it is necessary to provide remote monitoring of its condition. The article presents the main provisions of the method of remote monitoring of the condition of the grounding device.

Secure Rate-Splitting Multiple Access for Maritime Cognitive Radio Network: Power Allocation and UAV’s Location Optimization

This paper investigates the secure rate-splitting multiple access (RSMA) cooperation for the maritime cognitive unmanned aerial vehicle (UAV) network. Specifically, we first take into account the primary privacy information and the secondary maritime UAV’s quality of service. Then, we formulate an optimization problem to maximize UAV’s transmission rate according to the RSMA decoding principle and primary information security requirements. To solve this non-convex problem, we design a CPFS algorithm to allocate the transmit power and adjust the UAV’s location. In addition, the worst case is analyzed, which is the lower-bound secondary transmission rate. Finally, simulation results indicate that the proposed scheme improves the UAV’s transmission rate compared with the traditional schemes.

УЗЛУКСИЗ ҲАРАКАТДАГИ АХБОРОТТИЗИМЛАРИ УЧУН АНАЛИТИК МОДЕЛ

Requirements for information security and reliable operation of systems do not become obsolete. On the contrary, the demand for them has increased and has become a problem that does not lose its relevance. It's no secret that the fault tolerance of large software systems is of great importance, especially when they are online. The presented article is devoted to these issues and a model is proposed for evaluating software quality indicators under failure conditions.

Lightweight Cryptographic Simulation of Power IoT Fused with Bayesian Network Algorithms

In the power system, the transmission and processing of information is a very important link, and the core part of it is electronic data, and the transmission and processing of electronic data is the most important link in the power system. Because information is continuously passed between network nodes, the security requirements for information are high. With the development of Internet technology, its application field has been widely expanded to various industries. Therefore, to better ensure power quality and improve network operation efficiency, it is necessary to rationally and effectively manage the entire communication system. Power Internet of Things technology combines information transmission and processing links and realizes data sharing between various communication nodes in the entire network system through intelligent management, thereby improving overall information security. This paper first introduces the research of Bayesian network algorithm, then studies the process of lightweight encryption implementation of power Internet of Things, and then simulates and compares various encryption algorithms to obtain the best encryption scheme, and finally verifies through simulation that the algorithm can effectively ensure the safe transmission of information and improve the efficiency of network operation.

Метод назначения прав доступа к приложениям в корпоративной мобильной сети

The article focuses on studying and implementing a method of assigning access rights to the applications in a corporate mobile network with different requirements for security, which will allow considering the specific activities of multiple users. The existing solutions for assigning access rights to applications and services of the intranet are analyzed, the need to create a method that ensures information security when implementing access in corporate networks with different requirements for the level of security is substantiated. Due to the results of analysis of trends and development prospects of modern corporate mobile networks there has been found a contradiction between the requirements for information security of universal mobile devices with access to secure services and technical capabilities of information security systems that ensure access security in the corporate networks with different security requirements. To solve the problem, a multi-user system has been implemented that ensures operation of any computer equipment and mobile devices of an organization whose DBMS has a client-server architecture. The functional requirements for the developed method include the ability to perform user authorization, providing the administrator with the ability to manage user access rights to various applications, managing application storage, recording user operations, and keeping records. In the course of the software implementation of the method of assigning access rights, the design of the database is described in stages, a model of information flows is built, a physical diagram of the interaction of individual procedures is considered, on the basis of which the database is created, a user interface with forms that display information stored in the database is developed.

Integration of AQAP 2110 standard requirements with information security requirements according to ISO 27001

Integration of AQAP 2110 standard requirements with information security requirements according to ISO 27001