Security Risk Analysis Research Articles

Analysis of IoT Security Risks based on the exposure of the MQTT Protocol

Due to the tremendous growth of Internet of Things (IoT) applications - e.g. smart homes, smart grids, smart factories – and the emerging integration into industrial systems, the cyber threat landscape for IoT and IIoT applications is rapidly evolving. Security by Design principles are still widely neglected in the design of IoT devices and protocols. For consumer IoT, the privacy of the applicant can be compromised when devices are inappropriately secured. With regard to Industrial IoT, the usage of insecure IIoT protocols such as MQTT can have a severe impact on the industrial environment such as failure or impairment of production systems. We evaluate the prevalence of exposed IoT and IIoT devices related to the protocol MQTT by means of the search engine Shodan. The approach, design and results of our analysis are summarized in this paper.

Digital Twin-Based Safety Risk Coupling of Prefabricated Building Hoisting.

Safety management in hoisting is the key issue to determine the development of prefabricated building construction. However, the security management in the hoisting stage lacks a truly effective method of information physical fusion, and the safety risk analysis of hoisting does not consider the interaction of risk factors. In this paper, a hoisting safety risk management framework based on digital twin (DT) is presented. The digital twin hoisting safety risk coupling model is built. The proposed model integrates the Internet of Things (IoT), Building Information Modeling (BIM), and a security risk analysis method combining the Apriori algorithm and complex network. The real-time perception and virtual–real interaction of multi-source information in the hoisting process are realized, the association rules and coupling relationship among hoisting safety risk factors are mined, and the time-varying data information is visualized. Demonstration in the construction of a large-scale prefabricated building shows that with the proposed framework, it is possible to complete the information fusion between the hoisting site and the virtual model and realize the visual management. The correlative relationship among hoisting construction safety risk factors is analyzed, and the key control factors are found. Moreover, the efficiency of information integration and sharing is improved, the gap of coupling analysis of security risk factors is filled, and effective security management and decision-making are achieved with the proposed approach.

A Zero Trust Hybrid Security and Safety Risk Analysis Method

Abstract Designing complex, socio-technical, cyber-physical systems has become increasingly challenging in recent years. Interdependencies between engineering domains can lead to emergent behavior that is difficult to predict and manage. The recent shift toward model-based design has demonstrated significant advantages for minimizing these challenges (McDermott et al. 2020. Benchmarking the benefits and current maturity of model-based systems engineering across the enterprise. results of the model-based systems engineering (MBSE) maturity survey, part 1: Executive summary. Technical Report SERC-2020-SR-001, Systems Engineering Research Center.). Further, the early identification of safety and security design weaknesses in safety-critical systems leads to reduced redesign costs in later design phases (Yang and EI-Haik, 2003. Design for Six Sigma. McGraw-Hill, New York City; Clausing and Frey, 2005. Improving system reliability by failure-mode avoidance including four concept design strategies. Systems Engineering, 8(3), pp. 245–261.). As a result, this article contributes the Multidisciplinary Early Design Risk Assessment Framework (MEDRAF) methodology for early combined safety and security assessment based on interdisciplinary dependency models of a system. The focus is on factors contributing to the estimation of the probabilities of successful attacks on system components. The Zero Trust paradigm is applied in which all humans, hardware, and processes interacting with the system are considered to pose a security risk. A calculation of security-related probability estimates is presented which is dependent on the current global security environment. Subsequently, security and safety probability estimates are combined to present an overall safety-security risk calculation using hybrid safety-security trees. The risk values help designers assess the loss of specific key components and safety functions. The methodology is demonstrated with a case study of a spent fuel pool cooling system in a nuclear reactor. The results of the case study show that the risk of losing one key system component doubles when combining security and safety compared to only assessing safety events. This paper is based on a paper presented at the CIE 2020 conference (Papakonstantinou et al., 2020. Towards a zero trust hybrid security and safety risk analysis method. In International Design Engineering Technical Conferences and Computers and Information in Engineering Conference, American Society of Mechanical Engineers.).

Analysis of Compliance and Supply Chain Security Risks Based on ISO 28001 in a Logistic Service Provider in Indonesia

Risk of goods and security incidents, such as theft, boycott, smuggling and terrorism are likely to occur in a shipping process, therefore risk controls are needed to reduce the adverse effects. A research on the supply chain security risk management based on ISO 28001 security supply chain is conducted to overcome such problems. The purpose of this research is to analyse compliance & supply chain security risks and propose a mitigation based on ISO 28001 in a logistic service provider in Indonesia. A gap analysis is conducted to assess the compliance of security performance in seven areas, i.e. supply chain security management, security plans, asset security, personnel security, information security, security of goods & conveyance and transportation units closed cargo. The result of the assessment showed that a compliance level of above 75% indicates that the company is ready to implement an ISO 28001. The risk mitigation plan is proposed based on Failure mode effect analysis (FMEA) which calculates the Risk Priority Number (RPN). The RPN value indicates the level of risk where the higher the value, the more critical the risk and become the priority to handle. The mitigation proposed for managing risk are reducing, sharing and avoiding.

RISK ANALYSIS OF DIGITAL LOAN COMPARISON PLATFORM

Advanced technologies can improve the efficiency of business processes, but incorrect system implementation can also become a huge source of damage. Therefore, the issue of IT security is very important. The concept of IT security has many aspects. One of them is security risk analysis, which must be considered by each system developer. The article describes one of the risk analysis methods - the CORAS method. The goal of research was to complete the risk analysis of the loan comparison platform. As a result, the risk mitigation recommendations were developed.

Harmonizing safety and security risk analysis and prevention in cyber-physical systems

Cyber-physical system (CPS) has been widely adopted in modern industrial productions. Safety and security (S&S) play an important role in CPS, which assists the reliability of the system. Traditionally, safety and security risks were managed independently. As the development of cyber technology, S&S issues become complex and could affect each other in multiple ways. There is a strong need to develop a systematic method to manage safety and security risks simultaneously. In this work, a systematic method to integrately analyze S&S risks is proposed. Firstly, attack route models (ARM) as the root cause of typical cyber-threats are summarized from the literature together with their corresponding consequences in CPS. Secondly, in addition to commonly adopted physical safety prevention route (PSPR), cyber security prevention route (CSPR) based on ARM is developed to investigate the safety hazards and security threats. Then, safety critical variable analysis (SCVA) is proposed to quantify the S&S risk. Finally, SCVA, CSPR and PSPR are integrated via the bowtie method. The key contribution of the work is the method which simultaneously consider safety and security risk for CPS. In parallel. SCVA represents the working status of CPS devices, which would be useful to quantitatively determine the severity of consequence and further level of risk.

Security Risk Analysis of Grid Edge Computing

The emergence of edge computing technology brings new development direction to the construction of power grid industry. At present, for the edge computing technology of China is still in the exploratory stage, the combination of power grid and edge computing may face new security risks. This paper analysed the security risks that may occur in grid edge computing under the circumstances of identification system, communication technology, equipment protection and resource constraints, and put forward the relevant security risk analysis model and defence, aiming at solving the security problems of grid edge computing and promoting the better development of power grid.

A Method of Simplifying the Asset Dependency Cycle in Security Risk Analysis

In recent years, one obstacle to information security risk analysis is the complexity of asset dependency. Developing research tends to produce models with great complexity and some that do not involve dependency cycles, make the model difficult to implement. This research developed the idea of compound nodes to produce a modular risk analysis that simplify the asset dependency cycle. This study uses the following assumptions: aimed at quantitative assessments, values based on likelihood, and based on graph basic models. The stages of the method consist of identification of cyclic in the initial model, reconstructing cyclic graph into acyclic graph, and reconstruction of cyclic sub graph into acyclic sub graph. Through an illustrative example, this research produces a method that helps facilitate understanding the complexity of asset dependencies in risk analysis.

Research on network security risk analysis method based on full traffic

In the application process of industrial Internet, network security threats and malicious attacks occur from time to time. In order to improve the ability of network perception of unknown threats and the level of network security protection, this paper proposes a network security detection method based on full flow. Through online intelligent detection of network malicious traffic, unknown threats and malicious attacks can be found, provide guarantee for improving enterprise network security level.

Perspectives on Cyber Security for Offshore Oil and Gas Assets

In an ever-evolving technological industry, the oil and gas sector is already moving forward through the adaptation of Industry 4.0 and the adaptation of advanced cyber technologies through Oil and Gas 4.0. As IT/OT (information technology/operational technology) systems are evolving technologically, so are the cyber security threats faced by the offshore oil and gas assets. This paper aims to raise the awareness of cyber security threats and the organizational and technical measures that need to be adopted by the oil and gas industry for remote and complex assets in the upstream sector. A comprehensive literature review covering the areas of new IT/OT systems integration and cyber security risk analysis and management is presented. The results of a survey on the subject of cyber security for offshore oil and gas assets are also presented, and they provide valuable insight into the current industry culture and the perception of cyber security concepts. The importance of organizational culture, personnel training and involvement, as well as corporate engagement and support in the subject of cyber security is highlighted.

A Survey on Blockchain Technology: Evolution, Architecture and Security

Blockchain is a revolutionary technology that is making a great impact on modern society due to its transparency, decentralization, and security properties. Blockchain gained considerable attention due to its very first application of Cryptocurrencies e.g., Bitcoin. In the near future, Blockchain technology is determined to transform the way we live, interact, and perform businesses. Recently, academics, industrialists, and researchers are aggressively investigating different aspects of Blockchain as an emerging technology. Unlike other Blockchain surveys focusing on either its applications, challenges, characteristics, or security, we present a comprehensive survey of Blockchain technology’s evolution, architecture, development frameworks, and security issues. We also present a comparative analysis of frameworks, classification of consensus algorithms, and analysis of security risks & cryptographic primitives that have been used in the Blockchain so far. Finally, this paper elaborates on key future directions, novel use cases and open research challenges, which could be explored by researchers to make further advances in this field.

Systematic Analysis of Safety and Security Risks in Smart Homes

The revolution in Internet of Things (IoT)-based devices and applications has provided smart applications for humans. These applications range from healthcare to traffic-flow management, to communication devices, to smart security devices, and many others. In particular, government and private organizations are showing significant interest in IoT-enabled applications for smart homes. Despite the perceived benefits and interest, human safety is also a key concern. This research is aimed at systematically analyzing the available literature on smart homes and identifying areas of concern or risk with a view to supporting the design of safe and secure smart homes. For this systematic review process, relevant work in the most highly regarded journals published in the period 2016–2020 (a section of 2020 is included) was analyzed. A final set of 99 relevant articles (journal articles, book sections, conference papers, and survey papers) was analyzed in this study. This analysis is focused on three research questions and relevant keywords. The systematic analysis results and key insights will help researchers and practitioners to make more informed decisions when dealing with the safety and security risks of smart homes, especially in emergency situations.

The influence of internal-external factors on the cloud computing adoption

The present study integrates external and internal factors for measuring the performance of the organisation through the adoption of cloud computing activities. External factors consisted of perceived IT security risk, risk analysis, and social influence; whereas, trust, technology innovation, and industry usage were considered as internal factors. A statistical approach, namely structural equation modelling, was employed for the analysis of the data obtained through a questionnaire survey. The findings showed that external factors hurt cloud computing adoption (CCA), whereas internal factors and perceived ease of use have a positive impact on CCA. This investigation is intended to guide the policy and decision makers in formulating the efficient strategies/policies for the effective implementation of CCA.

E-commerce supply chain management mode based on management information security

In the era of high informationization, supply chain management, as a symbol of a management era, brings us not only a new management tool, but also more importantly, updated management concepts and replanning, design, and ways to optimize business processes. The purpose of this article is to study the current information security issues that are common in China’s supply chain, such as the weak awareness of information security among corporate employees; the widespread disregard of information security management; the lack of a unified information security strategic planning and prevention mechanism; adverse selection risks and various defeats. In the specific application, starting from the overall business needs of the supply chain, referring to the framework of the supply chain information security system, through assessment and risk analysis, the security needs of the supply chain and its nodes are defined, and finally the e-commerce supply based on management information security is developed. Chain management mode. The experimental data show that the e-commerce supply chain management model based on management information security can effectively improve e-commerce operation efficiency and improve security performance. Experimental data show that the management mode of e-commerce supply chain management improves the security efficiency of e-commerce by about 20% and the operating efficiency by about 15%. The development of e-commerce is instructive.

I-SCRAM: A Framework for IoT Supply Chain Risk Analysis and Mitigation Decisions

Supply chain security is becoming an important factor in security risk analysis for modern information and communication technology (ICT) systems. As Internet of Things (IoT) devices proliferate and get adopted into critical infrastructure, the role of suppliers in risk assessment becomes all the more significant. IoT security risks are affected by supplier trust since suppliers possess the capacity to modify black box systems without detection. The risks posed by potentially malicious or compromised suppliers are compounded by interdependence among suppliers. In this paper, we propose I-SCRAM, a framework to analyze supply chain risks in IoT systems and to support risk mitigating decisions. After defining an expanded system model that consists of interconnected components and a hierarchy of component vendors, we develop and propose metrics to quantify systemic risks. Finally, we present a decision framework that helps in selection of vendors to mitigate supply chain risk. Through a case study and simulation, we show that I-SCRAM successfully minimizes system risk as higher budget and more reliable component sources become available, while allowing flexibility in prioritizing sources of risk.

Моделі аналізу ризику безпеки інформаційних технологій

Моделі аналізу ризику безпеки інформаційних технологій

Security Risk Analysis of Active Distribution Networks with Large‐Scale Controllable Loads under Malicious Attacks

With the development of distributed networks, the remote controllability of the distributed energy objects and the vulnerability of user‐side information security protection measures make distributed energy objects extremely vulnerable to malicious control by attackers. Hence, the large‐scale loads may produce abnormal operation performance, such as load casting/dropping synchronously or frequent and synchronous casting and dropping, and hence, it can threaten the security and stable operation of the distribution networks. First, we analyze the security threats faced by industrial controllable load, civil controllable load, and the gains and losses of attacks on the distribution networks. Considering the factors of cyber attacks, we propose a control model and cyber attack model in active distribution networks (ADNs). And, three types of attacks that the target suffered are defined on the basis of “on” and “off” modes for control. Then, the controllable load was maliciously controlled as the research object, and a suitable scenario is selected. The impact of malicious control of the controllable load on the power supply reliability and power quality of the distribution networks are simulated and analyzed, and risk consequences for different types of attacks are provided.

Managing Security-Risks for Improving Security-Durability of Institutional Web-Applications: Design Perspective

The advanced technological need, exacerbated by the flexible time constraints, leads to several more design level unexplored vulnerabilities. Security is an extremely vital component in software development; we must take charge of security and therefore analysis of software security risk assumes utmost significance. In order to handle the cyber-security risk of the web application and protect individuals, information and properties effectively, one must consider what needs to be secured, what are the perceived threats and the protection of assets. Security preparation plans, implements, tracks, updates and consistently develops safety risk management activities. Risk management must be interpreted as the major component for tackling security efficiently. In particular, during application development, security is considered as an add-on but not the main issue. It is important for the researchers to stress on the consideration of protection right from the earlier developmental stages of the software. This approach will help in designing software which can itself combat threats and does not depend on external security programs. Therefore, it is essential to evaluate the impact of security risks during software design. In this paper the researchers have used the hybrid Fuzzy AHP-TOPSIS method to evaluate the risks for improving security durability of different Institutional Web Applications. In addition, the e-component of security risk is measured on software durability, and vice versa. The paper’s findings will prove to be valuable for enhancing the security durability of different web applications.

Method for Attack Tree Data Transformation and Import Into IT Risk Analysis Expert Systems

Information technology (IT) security risk analysis preventatively helps organizations in identifying their vulnerable systems or internal controls. Some researchers propose expert systems (ES) as the solution for risk analysis automation since risk analysis by human experts is expensive and timely. By design, ES need a knowledge base, which must be up to date and of high quality. Manual creation of databases is also expensive and cannot ensure stable information renewal. These facts make the knowledge base automation process very important. This paper proposes a novel method of converting attack trees to a format usable by expert systems for utilizing the existing attack tree repositories in facilitating information and IT security risk analysis. The method performs attack tree translation into the Java Expert System Shell (JESS) format, by consistently applying ATTop, a software bridging tool that enables automated analysis of attack trees using a model-driven engineering approach, translating attack trees into the eXtensible Markup Language (XML) format, and using the newly developed ATES (attack trees to expert system) program, performing further XML conversion into JESS compatible format. The detailed method description, along with samples of attack tree conversion and results of conversion experiments on a significant number of attack trees, are presented and discussed. The results demonstrate the high method reliability rate and viability of attack trees as a source for the knowledge bases of expert systems used in the IT security risk analysis process.

Security risk and response analysis of typical application architecture of information and communication blockchain

As the role of blockchain technology in various industries becomes more and more important, the technical limitations of its consensus mechanism, private key management and smart contracts are gradually emerging. However, security events such as blockchain platform applications are emerging one after another. As a new round of transformative power in the network era, it combines the blockchain with existing technologies to generate new formats and new models. Technology applications and existing cybersecurity regulatory policies have brought new challenges. This paper analyzes the typical application architecture of blockchain technology, and analyzes the security risks of blockchain application architecture from key layers such as storage layer, protocol layer, extension layer, and application layer. This article combines the DOC mechanism with IOT application scenarios to propose a blockchain-based confidential IOT service model (Beekeeper 1.0) that supports first-order homomorphic multiplication, and a blockchain-based confidential IOT service model that supports high-order homomorphic multiplication (Beekeeper 2.0), Beekeeper 2.0 significantly improves Beekeeper 1.0 in server capabilities, verification efficiency, verification key length, and device work diversity. This article finds that the chain code call delay basically increases with the increase in the transaction sending rate. When the transaction sending rate reaches 300TPS, the chain code calling delay only increases a little, and when the transaction sending rate reaches 300TPS, the success rate of the transaction on the chain increases. Finally, the average blockchain access delay increases with the increase in the transaction sending rate. The blockchain access delay is affected by less throughput, and the transaction success rate is stable at 98%.