Security Specialists Research Articles

Monitoring and Improving Managed Security Services inside a Security Operation Center

Nowadays, small to medium sized companies, which usually cannot afford hiring dedicated security experts, are interested in benefiting from Managed Security Services (MSS) provided by third party Security Operation Centers (SOC) to tackle network-wide threats. Accordingly, the performance of the SOC is becoming more and more important to the service providers in order to optimize their resources and compete in the global market. Security specialists in a SOC, called analysts, have an important role to analyze suspicious machine-generated alerts to see whether they are real attacks. How to monitor and improve the performance of analysts inside a SOC is a critical issue that most service providers need to address. In this paper, by observing workflows of a real-world SOC, a tool consisting of three different modules is designed for monitoring analysts' activities, analysis performance measurement, and performing simulation scenarios. The tool empowers managers to evaluate the SOC's performance which helps them to conform to Service-Level Agreement (SLA) regarding required response time to security incidents, and see the need for improvement. Moreover, the designed tool is strengthened by a background service module to provide feedback about anomalies or informative issues for security analysts in the SOC. Three case studies have been conducted based on real data collected from the operational SOC, and simulation results have demonstrated the effectiveness of the different modules of the designed tool in improving the SOC performance.

Facing the mobile revolution: A Romanian insight

Research question: Are the accounting graduates prepared to deal with mobile devices’ security issues? Motivation: Nowadays, mobile computing is a part of the younger generation, the entering workforce in coming years, and from this point of view the BYOD (Bring Your Own Device) approach will continue its increasing trend. The authors investigated the accounting bachelors’ knowledge in regard with mobile devices’ use aiming at signaling the existing gap on mobile devices’ security awareness. IT security specialists consider that both, academia and industry should focus their security awareness campaigns aiming at combat the false sense of security that mobile devices’ users have. Idea: The authors aimed at providing an in-depth understanding of the accounting students’ profile as mobile devices’ users and their knowledge and awareness in regard with mobile security threats. Data: The analyzed sample includes 180 subjects, out of which 81% are bachelors in accounting (38% 1st year; 43% 3rd year) and 19% master students in accounting and banking. Tools: The literature review helped us in structuring our research objectives and design a multiple-choice questionnaire used in the empirical study. Findings: The study reflects the students’ insufficient information in regard with mobile devices features and security issues. This is the result of the limited IT lectures and seminars in the curriculum and the insufficient focus on mobile devices’ use in the accounting profession. Students should understand the mobile devices as complex devices providing diverse features, not limited to communication with friends and Internet information searching. Contribution: The study contributes towards closing the existing gap in the Romanian research and literature in regard with young generation insufficient knowledge on mobile devices’ security and the potential threat brought by BYOD on the companies’ IT environment.

Sharing information safely and securely: the foundation of a modern health care system.

Sharing information safely and securely: the foundation of a modern health care system.

Social networks of educational purpose as a subject of protection in the preparation of specialists of information security

The paper studies application of social networks as a component of the educational information environment of an educational institution in the educational process. The aim of the research is to justify the need to train specialists in the field of information security to provide protection and safe use of social networks in the educational process. To ensure information security of social networks applied in educational processes, it is proposed to incorporate training programs for information security specialists to build their competencies of information security of social networks, including gaining advanced skills to combat new challenging cyber threats, as well as to employ information security specialists with a high level of expertise in cyber security of social networks, determine their work functions in the elaboration of organizational and technical measures to protect users of social networks. In the course of the research, publications on incorporating social networks into the educational process as a didactic tool were analyzed. In particular, on the basis of the conducted analysis of the cited publications and taking into account the authors’ own experience, the properties of social networks that are most promising for their use as a learning platform were determined. However, along with the above positive aspects and advantages, social networks can also be considered as indirect and even direct sources of cyber threats targeted at both the entire educational process and individual users’ accounts. Theoretical and empirical pedagogical methods were used to accomplish the objectives. This facilitated efficient systematization of the collected data for its successful study and identification of the most typical features of the social networks when applied in the educational process and extension of those with specific properties were identified. The paper also describes threats that may arise when using such networks in an educational organization, suggests measures to mitigate risks and discusses functions of information security specialists in ensuring security of social networks used in the educational process. Also, it was established that for the effective and safe use of social networks in the educational process, the organizer of this activity requires specific professional competence in the field of information security, which can be insufficient among the overwhelming majority of lecturers of both general and vocational education. Moreover, a conclusion was drawn about the need to train specialists in the information security of social networks, so they can gain the required professional competences and execute their specific occupations. Proposals were made on the possible development of these competences in the course of studying certain disciplines at the level of the secondary vocational education. Integration of the described approach into the educational process of training information security specialists in institutions of secondary vocational education, aimed at providing maintenance of social networks, will allow meeting the demand for such specialists and, thereby, increasing their competitiveness in the market of educational services.

Enhancing Network Visibility and Security through Tensor Analysis

The increasing size, variety, rate of growth and change, and complexity of network data has warranted advanced network analysis and services. Tools that provide automated analysis through traditional or advanced signature-based systems or machine learning classifiers suffer from practical difficulties. These tools fail to provide comprehensive and contextual insights into the network when put to practical use in operational cyber security. In this paper, we present an effective tool for network security and traffic analysis that uses high-performance data analytics based on a class of unsupervised learning algorithms called tensor decompositions. The tool aims to provide a scalable analysis of the network traffic data and also reduce the cognitive load of network analysts and be network-expert-friendly by presenting clear and actionable insights into the network.In this paper, we demonstrate the successful use of the tool in two completely diverse operational cyber security environments, namely, (1) security operations center (SOC) for the SCinet network at the SuperComputing (SC) Conference in 2016 and 2017 and (2) Reservoir Labs’ Local Area Network (LAN). In each of these environments, we produce actionable results for cyber security specialists including (but not limited to) (1) finding malicious network traffic involving internal and external attackers using port scans, SSH brute forcing, and NTP amplification attacks, (2) uncovering obfuscated network threats such as data exfiltration using DNS port and using ICMP traffic, and (3) finding network misconfiguration and performance degradation patterns.

НОРМАТИВНО-ПРАВОВІ ЗАСАДИ ЗАБЕЗПЕЧЕННЯ ПРОФЕСІЙНОЇ ПІДГОТОВКИ ФАХІВЦІВ ІЗ КІБЕРБЕЗПЕКИ ТА ЗАХИСТУ ІНФОРМАЦІЇ

The article is devoted to the problem of qualitative professional training of specialists in cybersecurity and information protection through legal prism. One of the consequences of global informatization of state and military structures was the emergence of a fundamentally new environment of confrontation of competing states named cyberspace.The purpose of the article is to identify and analyze the legal and regulatory framework for providing the high-quality professional training of specialists in cybersecurity and information security, formulating of proposals for improving the professional training of specialists of the selected profile.The process of professional training of specialists of cyber security and information security in Ukraine is under development and requires research and standardization. In our opinion, the analysis of normative legal acts will determine the main ways of improving the training of professionals of the selected profile.Based on the analysis of three key regulations, the author distinguished the task of ensuring cybersecurity and information security in the country that can be solved with the involvement of higher education institutions. This will increase the effectiveness of the training of future specialists of the selected profile. The specific solutions were proposed for solving the certain issues:1) Creation of consulting points on cybersecurity and information protection on the basis of higher school. 2) Creation of training cybercenters. 3) Creation of expert groups of scientists. 4) An organization of courses on improving the digital literacy and cultural behavior in cyberspace for everyone. 5) It was proposed areas of activity for which it is expedient to develop the educational professional programs “Professional cybersecurity (in specialization)”. 6) The involvement of the members of the National Academy of Sciences of Ukraine and foreign scientists in the field of cyber security and information protection training in the educational process. 7) An organization of the thematic scientific-practical and methodological conferences.The prospects for further scientific research will address the organizational and methodological support of the proposed solutions.

Vulnerability assessment as a service for fog-centric ICT ecosystems: A healthcare use case

Modern ICT ecosystems such as healthcare environments (hospitals, care-centers etc.), operate in different abstraction layers (cloud, fog, extreme-edge) and comprise large numbers of network entities such as terminals, devices, sensors or even specialized appliances (virtual or physical). It is common in such environments, that several network entities with intermittent connectivity, join and leave the network in an unstructured and unsupervised manner (Wi-Fi access-points, BYOD policies, IoT, etc.). Such devices of frivolous nature, or even trusted devices/terminals, are prone to security vulnerabilities, since they are operated by regular, non-expert users who are not aware of any security aspects whatsoever. To effectively manage and proactively protect such large, complex and multilayered networks, dedicated personnel (system administrators, security specialists etc.) must be employed and specialized appliances must be deployed. On the other hand, modern cyber-warfare has become even more elaborate and insightful. Thus, ICT infrastructures must continuously evolve and adapt to the everchanging cyber-threats, which is a rather cumbersome and expensive task to accomplish. Towards addressing the above-mentioned issues, this paper proposes a cross-layered system, which leverages the Software Defined Networking (SDN) paradigm and the distributed Fog architecture, for network slicing and task offloading to provide dynamic, security-aware Vulnerability-Assessment as a service for large ICT infrastructures. The presented system provides seamless assessment for all existing and newly introduced network entities against all known security vulnerabilities, certifies them through a Common Vulnerability Scoring System (CVSS), classifies them according to the cyber-threat they introduce, and finally assigns them to a connectivity-appropriate VLAN. The presented system was preliminarily evaluated under a controlled-conditions simulation environment.

From Citizen Investigators to Cyber Patrols: Volunteer Internet Regulation in Russia

State control over the Russian internet (Runet) has been enforced by dedicated administrations and private digital entrepreneurs since the early 2010s. Along with them, groups of digital vigilantes report on “negative” online content and claim to be fighting against activities considered to be criminal or contrary to social norms. However, their ideological convictions and moral supports are diverse and changing. This article analyses two nonprofits: Molodezhnaia Sluzhba Bezopasnosti (MSB, Youth Security Service) and Liga Bezopasnogo Interneta (LBI, Safe Internet League), which sponsors an emergent “cyber Cossack” movement. MSB, which can be referred to as “citizen investigators,” has developed a high degree of technical and legal experience and cooperates actively with the police. LBI promotes a conservative vigilantism to ensure “virtuous browsing,” with a strong focus on education. In March 2019 hearings at the Russian Civic Chamber on a bill addressing the activity of kiberdruzhiny (cyber patrols) revealed tensions between the “politically involved” (Duma members and kiberdruzhiny’s organizations) supporting the bill and the “experts” (representatives of internet companies and security specialists) opposed to it alleging the proposed law’s inefficiency. A third group, the supporters of a free and democratic Runet, is absent from the official debates but speaks out on social networks and through independent media against the development of civil surveillance. Article in English DOI: 10.25285/2078-1938-2019-11-3-46-70

Аналіз міжнародного досвіду при підготовці майбутніх фахівців з інформаційної безпеки

To date, the training system for future IT professionals on information security and integrated information security systems is quite conservative and has some inertia that must be taken into account when reforming the higher education system, including the cybersecurity training system (information security), in line with the goals and objectives of Ukraine's European integration in higher education in the context of the Bologna Process and the transition to new lists of training areas for professionals in information technology. Given that the training of future information security professionals is relatively new (since it was launched in Ukraine only in 1997 in accordance with the law of Ukraine No. 537-V) and the most dynamic in its activity, the relevance of the development of information security training system is even more relevant. That is why, in this article, we considered how the training of future information security specialists is carried out in institutions of higher education of leading countries in the world. In particular, we have considered countries such as the United States of America, the German Federal Republic, the United Kingdom of Great Britain and Northern Ireland, the French Republic, the Republic of Austria and the Republic of Poland. Basically, in this article we have identified the directions in which future information security specialists are trained in the leading countries of the world, reviewed and analyzed educational programs for the training of information security specialists and disciplines related to professional disciplines. In addition, we identified the main differences in training in a particular country and made a comparative analysis between the training of future information security professionals in Ukraine and the leading countries of the world.

Особливості формування культури здорового способу життя у майбутніх фахівців із кібербезпеки

Особливості формування культури здорового способу життя у майбутніх фахівців із кібербезпеки

Model of data for improving cybersecurity IP-PBX

The current state of development of information and telecommunication systems is impressive with its pace of implementation, scope and variety of technologies. Introduction of IP-telephony in various spheres of human activity allows ordinary people to simplify their lives, implement the main aspects for business, such as: increasing sales, improving employee efficiency, improving customer service quality, automating work processes, presenting the necessary information for management, etc. This technology (IP-telephony) has become a vivid symbiosis of classical telephony and the Internet, combining all the most important functions of these technologies. However, using IP telephony is important to ensure the necessary level of cybersecurity, since failure to implement this aspect can lead to significant financial and image losses, so the development and research of new effective methods for improving the cyber security of IP-telephony is an urgent task. Therefore, the purpose of this work is to build a data model for improving the cyber security IP-PBX. To achieve the goal, we will create a variety of types of IP-PBX vulnerabilities, a set of steps to implement cyberattack on the IP-PBX and a set of actions to improve the cyber security of the IP-PBX, which will identify possible types of vulnerabilities for the IP-PBX, investigate the sequence of steps to implement cyberattacks on IP-PBX and after performing preventive actions to improve the level of cybersecurity IP-PBX. After setting up an IP telephony server, following the example presented in the article, successful implementation of a cyberattack requires a very high level of intruder qualification of hacker and significant logistical costs. The developed model will be useful, first of all, for system administrators, as well as for information security specialists in the response teams for cyber incidents such as Computer Emergency Response Team / Computer Security Incident Response Team, which are responsible for the security of information and telecommunication systems within enterprises and organizations.

Analysis and security management of telecommunication systems based on predictive technologies

This paper presents the peculiarities of providing information, taking into account the subjective aspect of this process. The main purpose of the study is to develop an algorithm for analyzing and managing integrated security, which will unify the approaches to information security management. Security does not exist by itself, in isolation from a person. It is provided for a person and it is appreciated. Therefore, the notion of security has not only an objective but also a subjective aspect, since the assessment of its level is ultimately man. Using cognitive modeling methods can greatly improve the analysis and management of the security of the telecommunication system. The advantages of the cognitive approach are the ability to simulate poorly structured (poorly formalized) systems that are characterized by incomplete or uncertain knowledge of them. The application of the developed algorithm will allow the specialists to begin to develop appropriate computational procedures and modules, which can be further used in telecommunication system security. The results of the research will be useful for information security specialists.

Gradient boosting trees method in the task of software identification

Subject of Research.The paper proposes an approach to the use of gradient boosted decision trees algorithm. For this purpose, CatBoost algorithm developed by Yandex is proposed. Its implementation is aimed at the problem solution of OS Linux software identification in order to reduce the number of system vulnerabilities, which occur due to the installation of unauthorized software by automated system users. We consider an approach to the program signatures formation and further training of CatBoostClassifier classifier model. The subsequent recognition task is set for the identified programs that were not previously involved in the model training process. Method. Free CatBoost software was used for implementation of the gradient boosted decision trees algorithm. CatBoostClassifier multi-classification model was created on its basis. The use of this model allows identifying test sample elf-files.Main Results. The training parameters of the classification model are selected. An experiment is carried out to identify elf-files with the use of ten different featuresof emerging signature programs. The results obtained in the new approach are compared with the results of the previously developed method of identification based on the application of the statistical criterion of Chi-square homogeneity at the significance level p = 0.01. Practical Relevance. The results of the study can be recommended to information security specialists for data media audit. The developed approach gives the possibility to identify violations of the established security policy in the processing of confidential information.

Applying the physics of notation to the evaluation of a security and privacy requirements engineering methodology

PurposeThe purpose of this study is the analysis of a security and privacy requirements engineering methodology. Such methodologies are considered an important part of systems’ development process when they contain and process a large amount of critical information, and thus need to remain secure and ensure privacy.Design/methodology/approachThese methodologies provide techniques, methods and norms for tackling security and privacy issues in information systems. In this process, the utilisation of effective, clear and understandable modelling languages with sufficient notation is of utmost importance, as the produced models are used not only among IT experts or among security specialists but also for communication among various stakeholders, in business environments or among novices in an academic environment.FindingsThe qualitative analysis revealed a partial satisfaction of these principles.Originality/valueThis paper evaluates the effectiveness of a security and privacy requirements engineering methodology, namely, Secure Tropos, on the nine principles of the theory of notation.

Modern Comparative Analysis on Training of Future Security and Safety Specialists in Ukraine and the USA

Abstract The article deals with the peculiarities of security activities in Ukraine and the USA and, consequently, aims to comparatively analyze professional training of future security and safety specialists in these countries. The author has presented comparative description of future security and safety specialists’ training in Ukraine and the USA. It must be noted that research findings of Ukrainian comparativists on the peculiarities of security specialists’ professional training in the leading European countries are of great significance for the problem under study. Indeed, nowadays quality services can only be provided by those security companies, whose staff are equipped with modern technologies and have undergone relevant professional training. In Ukraine, however, professional training of security specialists should be improved in novel and comprehensive ways. The author has singled out some problematic aspects in professional activities of security specialists. The author concludes that taking into account modern requirements, future security specialists should master the foundations of economic knowledge, have a high level of culture, speak foreign languages, show initiative, be responsible, strive for self-development and self-study, introduce important innovations, acquire the skills of working with modern information and communication technologies that will enhance the quality of security activities. The prospects for further studies involve conducting comparative analysis on professional training of future security and safety specialists in the leading European countries.

ФУНКЦИОНАЛЬНАЯ МОДЕЛЬ ИССЛЕДОВАНИЯ БЕЗОПАСНОСТИ СИСТЕМЫ ДИСТАНЦИОННОГО ОБУЧЕНИЯ

The article analyzes the scope of the distance learning system and considers architecture and typical subsystems. Conclude that educational institution distance learning system is a distributed heterogeneous system with a web interface and round-the-clock access to the global network. The distance learning system processes, in addition to publicly available information, various types of confidential data, for example, personal data, electronic payments, author's training courses. Intentional and unintentional threats affect this information during storage, processing and transmission, which leads to violation of the information security components: accessibility, integrity and confidentiality. Therefore, it is necessary to apply protection measures to counter threats. Security specialists use systematic and expert approaches to evaluate the measures effectiveness. The measures effectiveness indicators are safety risk registers, penetration tests, indicators of the system current security and their deviation from targeted security or regulatory safety requirements. The purpose of the work is the development of an approach to assessing the distance learning system current safety state. To achieve the goal, the author proposes a functional model for the safety investigation. The model describes the current system security as a function of the many implemented protection measures, the results of penetration testing and security risks. To calculate the risks, the author proposed to use a three-factor model that takes into account the threat frequency, damage and the protection measures effectiveness factor to counteract the threat. A qualitative scale evaluates the value of the resulting safety function. The value of the function is calculated using the ball-rating scale and the normalized value of the safety risk for each distance learning functional subsystem. The results of the work are a list of security threats for four distance learning functional subsystems, a functional safety assessment model in the IDEF0 notation and a mathematical description of the safety function. In conclusion, the author describes the scope of the model possible application and the relevance of automation in the form of a software.

Trend Micro: Unseen Threats, Imminent Losses: 2018 Midyear Security Roundup

Security specialists are going to have to look harder to see the problems on their networks, says Trend Micro in its latest report. Vulnerabilities and exploits are lurking in unexpected places and many of our customary defences are unable to pick them up.

Global crop yield forecasting using seasonal climate information from a multi-model ensemble

Forecasting year-to-year variations in the yields of major crops globally is expected to have utility in strengthening the ability of societies to better respond to food production shocks and food price spikes triggered by climate extremes. However, substantial improvements to the methodology used in global crop forecasting are required to realize a reliable operational service. Here, we assess the reliability of global within-season and pre-season predictions of yield variability obtained by applying statistical yield models to seasonal temperature and precipitation hindcast data derived from a multi-model ensemble (MME). This analysis is performed for five individual atmosphere-ocean coupled general circulation models (GCMs) and the two MME datasets generated using the average method and the mosaic method. Four major crops, maize, rice, wheat and soybean are studied. The mosaic method reliably predicts the yield variability over a large portion (25–38%) of the global harvested area three months before harvesting. The areas where the mosaic method displays good prediction skill are two to three times larger than those achieved using the average method (9–15%). Using the mosaic method, reliable within-season predictions of national yield variability can be produced in 36%, 24%, 25% and 30% of the maize-, soybean, rice- and wheat-producing countries, respectively. The pre-season predictions are found to be reliable in 23–32% of the crop-producing countries. As yield variability at the national level is of interest to commodity and food security specialists, the mosaic method provides a basis for developing an operational global yield forecasting service.

АНАЛИЗ СОСТОЯНИЯ СИСТЕМЫ ПОДГОТОВКИ СПЕЦИАЛИСТОВ В ОБЛАСТИ ИФОРМАЦИОННОЙ БЕЗОПАСНОСТИ

The analysis of the training system for specialists working in the field of information security plays an important role to improve staffing in the field of information security in the Russian Federation in the context of new challenges and threats in the information sphere. The article presents the results of analysis and summarizes the data on state of the system of training, retraining and advanced training provided for information security experts. The presented analytical materials are taking into account the results of the data analysis about the security specialists working in Federal Executive authorities (Federal authorities), regional executive authorities, local governmental bodies and their subordinate organizations, corporations, and organizations of licensees of the FSTEC of Russia. The presented analytical materials can be used for development of proposals in order to improve the national system of training, professional retraining and advanced training of information security specialists, as well as for development of control indicators for the admission of persons to the training in the field of information security at the expense of the Federal budget allocations.

Information Security and Ecosystems in Smart Cities

The purpose of this article is to evaluate the impact of ecosystems on Information Security in Smart Cities using Dubai as a case study. Innovative interconnected systems can affect the integrity of the information used by residents and citizens if not properly secured. The case study research method was used to examine the impact of the Internet of Everything on secure information exchanges. Data collected from the case study was used to assess the smartness of the urban development in managing its communication processes and information assets in a secure and confidential manner. The limitations of the study are found in its focus on one single city. By evaluating processes used to obtain information from interconnected systems, steps can be taken that would help to reduce threats in thriving innovative urban environments. The findings support the theory and perceptions held by management practitioners and information security specialists.