Security Risk Management Research Articles

Software-hardware complex for modeling secure IIoT distributed ledger

This paper describes the modeling of the industrial Internet-of-Things network for further exploration of its security properties. The goal is to increase the security of process control systems for industrial facilities based on the development of conceptual foundations, methodology, mathematical models, methods and software tools for comprehensive analysis and cyber security risk management of process control systems for industrial facilities using cognitive modeling technology and data mining. One specific task is modeling DLT implementation for industrial network. Common structure of the proposed modeling network is described. Example of smart contracts for the distributed ledger are presented. Performance of lightweight implementations for ciphers and hash functions are given.

Optimal Security Risk Management Mechanism for the 5G Cloudified Infrastructure

This work proposes an optimal security risk management mechanism to holistically minimize the risks of a Denial of Service (DoS) attack and Service Level Agreement (SLA) violations that might unfold at the 5G edge-cloud ecosystem. Using the Semi-Markov Decision Process framework, a cyber risk-aware controller is designed to optimally decide on the admission, placement, and migration of a service taking into consideration a user taxonomy and the service requirements. A new cost structure that balances the targeted security risks as well as the cost and the reward of a secure service provisioning is introduced to pave the way for a safe edge-cloud operation. To proactively restrict the population of untrusted users, we consider security controls in the form of a linear and an exponential cost functions and show that the former represents a more flexible and profitable pathway for a Mobile Network Operator to operate at the expense of an inflated security risk while the latter leads to the opposite outcome. Results show that the baseline mechanism might violate the SLA and expose the edge and the cloud to a DoS attack in levels that are 10 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> , 10 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">12</sup> , and 10 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">14</sup> times higher than those of the proposed controller.

Risk analysis of terrorist attacks on LNG storage tanks at ports

In recent years, with the increasing demand for liquefied natural gas (LNG) worldwide, a large amount of LNG is stored, processed, and transported in ports. The port's LNG storage tanks may become a hot target for terrorist attacks because the failure or destruction of these facilities will put markets, cities, and the environment at high risk. This article presents a new risk analysis method of terrorist attacks on the port's LNG Storage tanks. The steps are as follows: (1) Identify risk factors from a multidimensional perspective. (2) Analyze the risk using the Bayesian network and event tree. (3) Evaluate and quantify the accident consequence. (4) Use knowledge graph to store risk knowledge. We verify the effectiveness of the method through case studies. The defence capabilities of the police and different prevention strategies were studied. The results show significant differences in accident consequence between different defensive and emergency response forces. We also conducted nine scenario analysis, which could provide a theoretical basis and method support for public security and urban risk management departments' security prevention decisions.

Perspectives on Cyber Security for Offshore Oil and Gas Assets

In an ever-evolving technological industry, the oil and gas sector is already moving forward through the adaptation of Industry 4.0 and the adaptation of advanced cyber technologies through Oil and Gas 4.0. As IT/OT (information technology/operational technology) systems are evolving technologically, so are the cyber security threats faced by the offshore oil and gas assets. This paper aims to raise the awareness of cyber security threats and the organizational and technical measures that need to be adopted by the oil and gas industry for remote and complex assets in the upstream sector. A comprehensive literature review covering the areas of new IT/OT systems integration and cyber security risk analysis and management is presented. The results of a survey on the subject of cyber security for offshore oil and gas assets are also presented, and they provide valuable insight into the current industry culture and the perception of cyber security concepts. The importance of organizational culture, personnel training and involvement, as well as corporate engagement and support in the subject of cyber security is highlighted.

Risk and Compliance

Many organizations are facing complex risk management issues and are ill equipped to sufficiently mitigate risk in a focused manner. Studies have shown that an astonishing 57% of senior level executives label “risk and compliance” as the two top categories they feel least prepared to address (Quantivate, 2019, para. 1). Consequently, only 6% of directors maintain confidence that their organization is effectively managing risk (Guis, Mieszala, Panayiotou & Poppensieker, 2018, para. 4). With so many organizations facing an existential risk management crisis, this beckons the question how many organizations have implemented a mature information security risk management program through the use of a focused risk assessment to drive the creation and maintenance of the information security program and are enforced through IT auditing (Streff, 2019). The existence of assessing risk and using the results to create and maintain the information security program and enforcing through auditing are listed in order or relative importance. This paper will aim to discuss the importance of each pillar and explain the reasoning behind the priority between the three concepts.

Exploring Sybil and Double-Spending Risks in Blockchain Systems

The first step to realise the true potential of blockchain systems is to explain the associated security risks and vulnerabilities. These risks and vulnerabilities, exploited by the threat agent to affect the valuable assets and services. In this work, we use a security risk management (SRM) domain model and develop a framework to explore two security risks - Sybil and Double-spending - that are observed and considered most concerning security risks within blockchain systems. The framework illustrates the protected assets or assets to secure, the classification of threats that the attacker can trigger using Sybil attack, the identification of threats that cause Double-spending, the vulnerabilities of identified threats, and their countermeasures. We evaluated a newly built framework by exploring Sybil and Double-spending risks in Ethereum-based healthcare applications. We also recognise the various other security and implementation challenges of blockchain that hinder the acceptance of blockchain-enabled solutions. Furthermore, we discuss the permissioned blockchain systems making an appearance in industry-level enterprises and how permissioned blockchain systems control these challenges. We conclude the paper and outline the future work that aims to build an ontology-based blockchain security reference model. The results of this work could help blockchain developers, practitioners, and other associated stakeholders to communicate about Sybil and Double-spending risks, what security countermeasures should be introduced, and what security and implementation challenges are emerging in blockchain systems.

Biases in security risk management: Do security professionals follow prospect theory in their decisions?

Security professionals play a decisive role in security risk decision making, with important implications for security in organisations and society. Because of this subjective input in security understanding possible biases in this process is paramount. In this paper, well known biases as observed and described in prospect theory are studied in individual security risk decision making by security professionals. To this end, we distributed a questionnaire among security professionals including both original dilemmas from prospect theory and dilemmas adapted to the context of incident prevention. It was hypothesised that security professionals dealing with risks and decision making under risk on an almost daily basis would or should be less vulnerable to decision biases involving risks, in particular when framed in terms of incident prevention. The results show that security professionals are vulnerable to decision biases at the same scale as lay people, but some biases are weaker when decision problems are framed in terms of security as opposed to monetary gains and losses. Of the individual characteristics defining experience, only the general education level observably affects vulnerability for biases in security decision making in this study. A higher general education level leads to a significantly higher vulnerability to decision biases. By highlighting the vulnerability of security professionals to decision biases, this study contributes essential awareness and knowledge for improved decision making, for example by different representation of probabilities and uncertainty.

Онтологическое обеспечение управления рисками информационной безопасности

As a result of the work focused on improving the efficiency of the information security system through the development of an ontological model and an approach based on it to ensure information security (IS) risk management, a flexible result was obtained, which is designed to ensure an increase in the efficiency of the information security system by reducing the time spent on managerial decision-making. At the end of the work, a comparative analysis of existing approaches and techniques to information security risk management and the described approach was carried out. Based on the developed ontology and approach, highly intelligent information security risk management systems and the information security system can be created on its basis.

A Data Security Framework for Cloud Computing Services

Cyberattacks are difficult to prevent because the targeted companies and organizations are often relying on new and fundamentally insecure cloud-based technologies, such as the Internet of Things. With increasing industry adoption and migration of traditional computing services to the cloud, one of the main challenges in cybersecurity is to provide mechanisms to secure these technologies. This work proposes a Data Security Framework for cloud computing services (CCS) that evaluates and improves CCS data security from a software engineering perspective by evaluating the levels of security within the cloud computing paradigm using engineering methods and techniques applied to CCS. This framework is developed by means of a methodology based on a heuristic theory that incorporates knowledge generated by existing works as well as the experience of their implementation. The paper presents the design details of the framework, which consists of three stages: identification of data security requirements, management of data security risks and evaluation of data security performance in CCS.

A Game Theoretical Model of Radiological Terrorism Defense

Radiological dispersal devices (RDD) pose a threat to the United States. Healthcare facilities housing high-risk radioactive materials and devices are potentially easy targets for unauthorized access and are vulnerable to malevolent acts of theft or sabotage. The three most attractive candidates for use in RDD considered in this study are: &lt;sup&gt;60&lt;/sup&gt;Co (radiosurgery devices), &lt;sup&gt;137&lt;/sup&gt;Cs (blood irradiators) and &lt;sup&gt;192&lt;/sup&gt;Ir (brachytherapy high dose radiation device). The threat posed by RDDs has led to evaluating the security risk of radioactive materials and defending against attacks. The concepts of risk analysis used in conjunction with game theory lay the foundations of quantitative security risk management. This paper develops a two player non-cooperative one-shot simultaneous defender-attacker game. The defender (healthcare facility) chooses to defend one of the three high-risk radioactive material targets and the attacker (terrorists or adversaries) chooses to attack one of the three high-risk radioactive material targets. A risk-informed approach is used to model players’ payoffs or expected utilities for each choice of strategies. A game-theoretic model (RDD game) captures the strategic interaction between competing players who act rationally to maximize their expected utility. The evaluation of the RDD game results in a von Neuman max-min strategy solution being preferable to a mixed strategy Nash equilibrium solution. The von Neumann max-min strategy solution of the defender defending cobalt and the attacker attacking cesium is found to be the most prescriptive result, thus favoring the current efforts of phasing out cesium blood irradiators and replacing them with alternative technologies. The RDD game not only gives the defender strategic options to budget scarce security resources but also helps healthcare facilities make optimal choices under severe uncertainty about the terrorist threat.

An Empirical Examination of the Effects of CTO Leadership on the Alignment of the Governance of Big Data and Information Security Risk Management Effectiveness

Aim/Purpose: Board of Directors seek to use their big data as a competitive advantage. Still, scholars note the complexities of corporate governance in practice related to information security risk management (ISRM) effectiveness. Background: While the interest in ISRM and its relationship to organizational success has grown, the scholarly literature is unclear about the effects of Chief Technology Officers (CTOs) leadership styles, the alignment of the governance of big data, and ISRM effectiveness in organizations in the West-ern United States. Methodology: The research method selected for this study was a quantitative, correlational research design. Data from 139 participant survey responses from Chief Technology Officers (CTOs) in the Western United States were analyzed using 3 regression models to test for mediation following Baron and Kenny’s methodology. Contribution: Previous scholarship has established the importance of leadership styles, big data governance, and ISRM effectiveness, but not in a combined understanding of the relationship between all three variables. The researchers’ primary objective was to contribute valuable knowledge to the practical field of computer science by empirically validating the relationships between the CTOs leadership styles, the alignment of the governance of big data, and ISRM effectiveness. Findings: The results of the first regression model between CTOs leadership styles and ISRM effectiveness were statistically significant. The second regression model results between CTOs leadership styles and the alignment of the governance of big data were not statistically significant. The results of the third regression model between CTOs leadership styles, the alignment of the governance of big data, and ISRM effectiveness were statistically significant. The alignment of the governance of big data was a significant predictor in the model. At the same time, the predictive strength of all 3 CTOs leadership styles was diminished between the first regression model and the third regression model. The regression models indicated that the alignment of the governance of big data was a partial mediator of the relationship between CTOs leadership styles and ISRM effectiveness. Recommendations for Practitioners: With big data growing at an exponential rate, this research may be useful in helping other practitioners think about how to test mediation with other interconnected variables related to the alignment of the governance of big data. Overall, the alignment of governance of big data being a partial mediator of the relationship between CTOs leadership styles and ISRM effectiveness suggests the significant role that the alignment of the governance of big data plays within an organization. Recommendations for Researchers: While this exact study has not been previously conducted with these three variables with CTOs in the Western United States, overall, these results are in agreement with the literature that information security governance does not significantly mediate the relationship between IT leadership styles and ISRM. However, some of the overall findings did vary from the literature, including the predictive relationship between transactional leadership and ISRM effectiveness. With the finding of partial mediation indicated in this study, this also suggests that the alignment of the governance of big data provides a partial intervention between CTOs leadership styles and ISRM effectiveness. Impact on Society: Big data breaches are increasing year after year, exposing sensitive information that can lead to harm to citizens. This study supports the broader scholarly consensus that to achieve ISRM effectiveness, better alignment of governance policies is essential. This research highlights the importance of higher-level governance as it relates to ISRM effectiveness, implying that ineffective governance could negatively impact both leadership and ISRM effectiveness, which could potentially cause reputational harm. Future Research: This study raised questions about CTO leadership styles, the specific governance structures involved related to the alignment of big data and ISRM effectiveness. While the research around these variables independently is mature, there is an overall lack of mediation studies as it relates to the impact of the alignment of the governance of big data. With the lack of alignment around a universal framework, evolving frameworks could be tested in future research to see if similar results are obtained.

An Inspection Regime for Cyber Weapons: A Challenge Too Far?

Two of the most pressing questions concerning international peace and security today are how to avoid an escalation of conflicts in cyberspace and how to ensure responsible behavior and accountability of states in their use of information and communication technologies. With more than thirty states now possessing offensive cyber capabilities and cybersecurity incidents such as Stuxnet, WannaCry, and NotPetya causing significant physical effects or financial damage, there is a clear need to find a better way to manage security risks connected with the use of increasingly sophisticated cyber means by states. At present, this issue is on the agenda of two United Nations groups and is mainly addressed through a “framework for responsible behavior of states” consisting of international law, voluntary and non-binding norms, and confidence-building measures for states’ use of information and communication technologies. What the current discussions do not address, however, is whether the security risks could also be regulated through an arms control and inspection regime for cyber weapons. While such a regime has been proposed by scholars, states remain skeptical or even actively opposed to efforts to impose traditional arms control measures on offensive cyber capabilities. This essay examines why a cyber weapons inspection regime is so difficult to devise. It argues that due to their nature and mode of functioning, cyber weapons significantly differ from traditional nuclear, chemical, or biological weapons, such that mechanisms established by traditional arms control treaties either will not work or will not be agreed to by states. Instead, new regulatory approaches are necessary.

Security Risk Management in the Electronic Banking Environment: Some Evidence for Banking Systems

The banking industry has witnessed a significant growth in the use of the Internet, and in the procurement of goods and services and electronic data exchange, which requires a secure Internet to achieve a high level of confidence with institutional customers, so banking institutions realized the importance of security and confidentiality in electronic banking operations.The research aims to answer the following question: How to reduce the security risks in the e-banking environment?. In order to achieve the objective of the research, a descriptive analytical approach was adopted and specialized research was used in the field of e-banking risk management, leading to findings and recommendations.

ФІНАНСОВІ МЕХАНІЗМИ ЗАБЕЗПЕЧЕННЯ РОЗВИТКУ ПІДПРИЄМСТВ АГРАРНОГО СЕКТОРУ ЕКОНОМІКИ: ОСОБЛИВОСТІ ТА НЕДОЛІКИ

В умовах нестабільного ринкового середовища зростає роль ефективності управління фінансами підприємств через застосування дієвих фінансових механізмів розвитку підприємств аграрного сектору. Проаналізовано основні фінансові механізми розвитку підприємств галузі сільського господарства, визначено їх особливості та недоліки. Встановлено, що запроваджена система фінансування державної підтримки агропромислового комплексу не забезпечує визначеного на законодавчому рівні сприяння життєдіяльності аграрних підприємств, їх конкурентоспроможності на внутрішньому й зовнішньому ринках, гарантування продовольчої безпеки, посилення соціального захисту сільського населення переважно через недосконалість наявних механізмів та небажання самих аграріїв користуватися ними. Визначено стримуючі фактори кредитування аграрних підприємств та розвитку агрострахування, що унеможливлює поліпшення їх фінансового забезпечення та ефективного управління ризиками в аграрному секторі задля нарощення потенціалу їх динамічного розвитку. Ефективність фінансових механізмів забезпечення розвитку аграрного сектору економіки залежить від правильно сформованої фінансової політики окремо взятого підприємства та держави загалом, що сприяє збігу економічних інтересів аграрного підприємства та держави.

Approach of the information properties destruction risks assessing based on the color scale

One of the urgent tasks of today is information protection as defined by the regulations of our state in the field of information security and cybersecurity. The protection of information is to ensure the preservation of its properties such as confidentiality, integrity, and accessibility. In the process of assessing the information security, the priorities of its protection are determined, taking into account the degree of restriction of access to it. Information security risks are assessed to select effective measures and remedies. The existing assessment methods are analyzed, based on estimates of the magnitude of possible damage from the occurrence of an information security incident and the probability or probability of its occurrence. However, none of the forms of formalizing the risk level reflects which properties may be violated within the incident. That is, the general presentation of the risk does not allow its prompt processing. With the use of modern computer technology, it has become possible to create dynamic images of the level of risk. The basis of computer graphics is an additive model of the transfer of red, green, and blue. With this in mind, a method has been developed to assess the risks of violating the properties of information. Its use will distinguish the properties of information by the set color. With the advent of information about new vulnerabilities in information and telecommunications systems, the color may change, which will signal a change in the level of risk for a particular property of information. This approach to information security risk management facilitates prompt decision-making on risk management and maintains the information security process at the appropriate level. At the same time, the use of the proposed method will allow to record changes in the numerical values of colors and, as a consequence, to find the rate of change of the level of information security risk. Its average value can be used to predict the resilience of the protection system to information security incidents. Therefore, the speed of change in the level of information security risk can expand the list of parameters for determining the index of information system development and the basis for updating the planned costs of the organization to ensure information security.

Security risk management: a case of Qalhat liquefied natural gas terminal

Purpose At the substantive level, there exists a gap in knowledge about the position of security risk management (i.e. SRM) during the terminals’ operations and management; particularly when there is potential for deliberate anti-security acts. Correspondingly, the purpose of this paper is a need for more practical research to find out the justification for the existence of the SRM and different techniques for its appropriate execution on these logistics infrastructures principally with due regard to the potential requirements in the near future. Design/methodology/approach Both qualitative and quantitative techniques are used in this study incorporating fuzzy set theory and risk assessment matrix to achieve the research objective. Findings A designed SRM framework tailored for Qalhat liquefied petroleum gas (LNG) terminal in Sultanate of Oman was established to manage the security threats which can be resulted from any probable terrorist attacks. Research limitations/implications The limited numbers of experts for the purpose of the addressed SRM are causing challenges in data collection. Practical implications The pressures for enhanced attention to critical infrastructure security have fostered new challenges for petrochemical seaports and terminals (PSTs). These tendencies dictate to maintain comprehensive security regimens that can be integrated with national and international strategies to support the country’s security against terrorism. Originality/value The development of the security risk factor table model in the case of Qalhat LNG Terminal.

Comparative Study of a Cybersecurity Curriculum To Support Digital Transformation in The Public Sector

The Covid 19 pandemic that has occurred in all parts of the world since early 2020 has forced all humans to follow digital transformation. This momentum is considered good for the acceleration of digital transformation, which since the issuance of Presidential Decree Number 95 of 2018 has begun to be initiated. Digital transformation marks a radical rethinking of how an organization uses technology, people and processes to fundamentally change business performance. Digital transformation occurs in the economic, social and public sphere with the aim of creating innovation, encouraging inclusiveness and increasing efficiency and productivity. Although it is absolutely related to digital technology, digital transformation is not just technology but also takes into account other elements such as infrastructure, policies, leadership, digital literacy, mindset, data, research and cybersecurity. Cybersecurity is a crucial prerequisite because interconnection in the digital world demands data privacy and information security. In fact, the demands of cybersecurity in digital transformation are not matched by human resources who are experts in the cyber field. APTIKOM states that each year in Indonesia it only manages to produce 40 thousand - 50 thousand bachelors of information technology competence, while the need is predicted to reach 600 thousand people per year. At the higher education level, the curriculum in cybersecurity study programs tends to focus on technical areas only. Even though. Cybersecurity is a complex matter that requires a multidisciplinary approach such as experts in regulation and policy, governance and information security risk management, and so on. This research is a qualitative descriptive study. The author uses a comparative method to compare the cybersecurity curriculum in Indonesia with the Netherlands, which has a multi- disciplinary cybersecurity curriculum. So that we get multidisciplinary curriculum recommendations that can be applied in the cybersecurity curriculum in Indonesia.

Everyday visuality and risk management: Representing (in)security in UN peacekeeping

ABSTRACT Visuality is a central aspect of everyday security governance. In the recent visual turn in International Relations, however, the more mundane and routine visualities of security have been widely neglected. To address this gap, this article proposes a framework for analyzing the messages of security and risk conveyed by different modes of visual representations, ranging from press photos and educational images to outwardly appearances. Taking the United Nations Organization Stabilization Mission in the Democratic Republic of the Congo (MONUSCO) as an example, it shows that everyday visual representations reflect and contribute to security risk management in four ways: (1) They assist in the construction of self and other identities with regard to security, (2) they help to identify potential vulnerabilities, (3) they are used to educate people how to detect, assess, and behave in risky situations, and (4) they are employed to deter violent attacks.

Information Technology Development Risks in the Banking Sector

The relevance of the article is because in parallel with the processes of introduction of innovations in the field of automation and computerization of the banking system, the number of types of banking risks associated with innovations in the field of on-line customer service and internal Bank reporting, as well as information systems. As a result of this article, we have studied the latest legislative acts of the Central Bank of Russia as a mega-regulator and summarized the practice of both individual credit institutions and the banking sector in the field of information technology development risks in the banking sector. To strengthen the development of new financial technologies in the digital economy, it is necessary to regularly discuss the emergence of new phenomena and innovations; to consider the possibility of further analysis of existing methodological developments to exchange best practices of banks. Building an effective it security risk management system is not a one-time project. Still, a complex process is important, focused on minimizing external and internal threats and taking into account the limitations on resources and time factor

Regulatory Compliance Modelling Using Risk Management Techniques

We describe a novel approach to regulatory compliance decision support that leverages an asset-based cyber security risk management approach following ISO 27005, and illustrate this with an example based on the General Data Protection Regulation (GDPR). Previous work in regulatory compliance modelling and decision support utilises semantic vocabularies and reasoning techniques, and our approach has the primary benefit that regulatory compliance is integrated with other domains of risk management, so that insight from domains such as cyber security combined with regulatory compliance for privacy can be gained based on a single model of the user’s socio-technical infrastructure. The main contributions of this paper are: to show how regulatory requirements may be modelled as “compliance threats” in an asset-based risk management framework; to illustrate mapping from the GDPR’s legal text to domain assets, processes and relationships, compliance threats and control strategies to mitigate the threats; to show how the threats are trigged via recognition patterns based on asset configurations; to illustrate how the different types of regulatory requirement, e.g. obligations, prohibitions and derogating conditions, are represented in such a scheme; and finally to describe how to model causal dependencies between choices made to address a compliance threat and downstream additional compliance requirements.