Technical Controls Research Articles

Cybersecurity strategies for non-profit organizations

The paper explores effective cybersecurity strategies tailored for non-profit organizations, addressing their unique challenges of limited resources and sensitive data handling. It examines the current threat landscape, highlighting common vulnerabilities such as phishing attacks, ransomware, and data breaches. The research presents key cybersecurity strategies, including risk assessment and management, employee training and awareness, implementation of technical controls, data protection and privacy measures, and third-party risk management. Cost-effective solutions are emphasized, focusing on open-source security tools, cloud-based services, and collaborative information-sharing networks. The study concludes that by adopting a holistic approach encompassing people, processes, and technology, non-profits can significantly enhance their security posture and resilience against cyber threats, ensuring the continuity of their critical missions while operating within resource constraints.

Analysis for Network Security Measures for Protecting Organizational Data

Objectives: The number, severity, and sophistication of cybersecurity incidents are rising, suggesting that the next generation of cybersecurity threats cannot be fully mitigated by technical security controls alone. In order to strengthen cybersecurity in this day and age, end users must practise proper cyber hygiene. Methods: According to research, social culture affects reducing cybersecurity risk. The majority of research on the topic has been conducted in other nations, therefore it's possible that findings won't apply to India because of its distinct social and cultural norms. There is a dearth of research on the cybersecurity behaviour of Indian smartphone users by using descriptive analysis. Findings: In an effort to close the aforementioned research gap, our study has created a framework that enhances smartphone users' cybersecurity behaviour. This investigation was carried out in two stages by the researcher. Conclusion: Finding out about the present cybersecurity practices of Indian smartphone users was the first phase's goal. The second phase's goal was to create a framework and evaluate how well it works to improve smartphone users' cybersecurity behaviour.

Architecting Resilience : A Framework for Secure and Compliant Healthcare IT Infrastructures

Healthcare information technology (IT) systems face unique challenges in maintaining data security and regulatory compliance while supporting critical patient care functions. This article provides a comprehensive analysis of the complex interplay between data protection measures and compliance requirements in the healthcare sector. We examine key components of data security, including encryption, data integrity measures, and secure transfer protocols, with a specific focus on their application to sensitive patient information. The impact of regulations such as HIPAA on system design and maintenance is explored, offering insights into the alignment of IT practices with evolving standards. Through a review of current literature and industry best practices, we present strategies for risk management, employee training, and the implementation of technical controls that address both security and compliance needs. Emerging trends, including cloud computing, the Internet of Medical Things (IoMT), and artificial intelligence in healthcare security, are discussed to provide a forward-looking perspective. This article contributes to the ongoing dialogue on balancing innovation with security in healthcare IT, offering practical recommendations for healthcare organizations to enhance their data protection measures while ensuring regulatory compliance.

Cyber Security Controls and Countermeasures

Today's digital economy encompasses a conglomeration of devices, data, applications, and complex networks that can be hosted on-premises, in data centers or in cloud environments to support business functions. As a cybersecurity professional, you will be tasked to manage risks like cyber threats and data breaches in the workplace. The risks may emanate from the data that resides in the systems, like servers, computers or external drives and the physical assets themselves, like routers and switches. The onus is on preventing security events and limiting the damage or consequences of any event that might happen. Managing these risks in an organization can be achieved by implementing cyber security controls and countermeasures. Cyber security controls can be categorized into three distinct major groups: administrative control, physical control, and technological control. The administrative controls focus on security policies, guidelines, rules, procedures and standards designed by management to control access and utilization of confidential information. Physical control refers to a set of IT security controls deployed at the physical premise to prevent unauthorized physical access to data centres. Technical controls involve the use of systems and technical solutions to prevent security events in networks and cloud platforms. Additionally, when implementing security controls, the function of cyber security controls can be broadly divided into seven groups: directive, deterrent, preventive, compensating, corrective, detective, and recovery controls. Furthermore, security frameworks such as NIST, CIS controls COBIT, and ISO/IEC series form the cornerstone of cyber security controls and countermeasures. The aforementioned aspects will be discussed further in the later sections. For now, it is to provide a general picture of the cyber security controls and countermeasures. Keywords – Security Controls, Countermeasures, Frameworks, Information Systems, Risk

Defending Against Modern Web Attacks: Strategies for Safeguarding User Identities and Data

Abstract: Organizations must adopt a comprehensive approach to safeguard user identities and sensitive data in the face of increasingly sophisticated web-based attacks. This article presents a multi-faceted strategy for defending against modern web threats, addressing key aspects such as phishing prevention, secure authentication mechanisms, protection against cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks, browser and endpoint security, web application security best practices, and the implementation of a Zero Trust security model. By examining the current landscape of web-based threats and providing actionable recommendations, this article aims to empower organizations with the knowledge and tools necessary to combat evolving cyber threats effectively. The proposed defensive measures encompass user awareness and education, robust technical controls, secure coding practices, and adopting technologies such as multi-factor authentication, biometric authentication, web application firewalls, and browser isolation techniques. Additionally, the article emphasizes the importance of a proactive approach to incident response and threat intelligence, enabling organizations to swiftly detect, contain, and mitigate web-based attacks. By implementing these strategies, organizations can significantly enhance their resilience against modern web threats, safeguarding user identities, protecting sensitive data, and maintaining a secure online presence in an increasingly hostile digital environment

Evaluating applied security controls for safeguarding medical device-integrated electronic medical records.

Medical device-integrated electronic medical records (MDI-EMR) pose significant challenges in ensuring effective usage, data security and patient safety. The complexities of MDI-EMR necessitate applying various security mechanisms to safeguard against cyber threats. Therefore, we evaluated cyber threats to MDI-EMR and the effectiveness of applied security controls using a proposed framework from sociotechnical and risk assessment perspectives. We conducted a qualitative case study evaluation in a general hospital in Saudi Arabia using interviews, observation, and document analysis from the perspectives of major MDI-EMR stakeholders, including healthcare providers, IT professionals and cybersecurity specialists. The results showed the interplay among physical, technical and administrative security controls that maintained a secure posture of MDI-EMR. The effectiveness of security controls is highly influenced by the staff's cybersecurity awareness and training. The perceived effectiveness of security controls varied among users, with some expressing satisfaction with the ease of use and reliability, while others highlighting challenges such as password complexity and access procedures. Understanding these diverse perspectives is crucial for tailoring security measures to meet the needs of different stakeholders effectively. Collaboration among the key stakeholders is crucial for implementing security controls for MDI-EMR. Balancing security measures with usability concerns is essential, as highlighted by challenges in implementing technical controls. A comprehensive approach encompassing physical, technical and administrative controls, continuous education and awareness initiatives are significant to empower staff in recognising and mitigating cyber threats effectively to safeguard medical data and ensure the integrity of healthcare systems.

The Impact of Air Pollution from Industrial Fires in Urban Settings: Monitoring, Modelling, Health, and Environmental Justice Perspectives

Industrial fires at facilities including waste management sites, warehouses, factories, chemical works, and fuel storage depots are relatively frequent occurrences. Often, these fires occur adjacent to urban communities and result in ground-level airborne pollutant concentrations that are well above guideline values. Land, water, livestock, and crops may also be contaminated by the emissions and by firefighting activities. Moreover, impacted communities tend to have a higher proportion of minority ethnic populations as well as individuals with underlying health vulnerabilities and those of lower socio-economic status. Nevertheless, this is an aspect of air quality that is under-researched, and so this review aims to highlight the public health hazards associated with industrial fires and the need for an effective, coordinated, public health response. We also review the range of monitoring techniques that have been utilised in such fires and highlight the role of dispersion modelling in predicting plume trajectories and in estimating population exposure. We recommend establishing 1 h guideline values for particulate matter to facilitate timely public health interventions, and we highlight the need to review regulatory and technical controls for sites prone to fires, particularly in the waste sector.

A Comprehensive Survey of Social Engineering Attacks: Taxonomy of Attacks, Prevention, and Mitigation Strategies

Social engineering attacks pose a significant threat to individuals, organizations, and governments globally. These attacks leverage human psychology, manipulating individuals into divulging sensitive information or undertaking actions that jeopardize security. The various forms of social engineering attacks can lead to dire consequences for the targeted victims. However, with preventive and mitigation strategies such as security awareness training, policy formulation, and technical controls, the risks associated with social engineering attacks can be diminished. This paper offers a comprehensive overview of social engineering attacks, delving into their diverse types and methodologies. It further discusses various strategies to counteract and alleviate the threats posed by these attacks. The study introduces a taxonomy of social engineering attacks, categorizing them based on the operator, prevention measures, and mitigation techniques. This thorough analysis underscores the current challenges in the domain and suggests potential future trajectories in the field.

GDPR compliance via software evolution: Weaving security controls in software design

Software should comply with international privacy laws, like the General Data Protection Regulation (GDPR). However, implementing appropriate technical controls is often an error-prone and time-consuming process. This is partly due to the limited knowledge of software engineers about privacy and security. This paper proposes SoCo, a semi-automated approach to support organizations in achieving software compliance with the GDPR data protection principles. To do so, SoCo supports engineers in identifying and integrating appropriate technical controls in sequence diagrams during the design phase. SoCo includes a technique to assist engineers to identify data processing activities in software applications modeled as sequence diagrams that may need to comply with the GDPR, a catalog of privacy and security controls that engineers can use to fix non-compliant activities, and a technique to implement such controls in the non-compliant sequence diagrams. Our evaluation results show that SoCo can help software engineers identify and design appropriate security controls to address GDPR violations and required moderate manual effort when applied to a substantive open-source application.Editor’s note: Open Science material was validated by the Journal of Systems and Software Open Science Board.

Protecting Sensitive Data with Secure Data Enclaves

A Secure Data Enclave is a system that allows data owners, such as governments and private firms, to control data access and ensure data security while facilitating approved uses of data by other parties. This model of data use offers additional protections and technical controls for the data owner compared to the more commonly used approach of transferring data from the owner to another party through a data sharing agreement. Under the data use model, the data owner retains full transparency and auditing over the other party's access, which can be difficult to achieve in practice with even the best legal instrument for data sharing. We describe the key technical requirements for a Secure Data Enclave, provide a reference architecture for its implementation on Amazon Web Services using managed cloud services, and describe four use cases of this architecture in partnerships with state governments to control access to sensitive administrative data.

Analysing and managing risk from third-party OAuth application access

Modern cloud application architectures allow users to dynamically grant third-party apps access to their cloud resources. When looking at a large, anonymised dataset of over 600,000 users and their approvals of over 43,000 applications, we found that organisations often are unaware of the magnitude of the access problems: on average, an organisation will grant 440 unique third-party apps access to Google data and resources; one organisation’s users approved 12,330 unique applications; out of all the approved applications, over 44 per cent have been granted access to either sensitive data or all data on the user’s Google Drive. The use of OAuth 2.0 has resulted in users creating numerous, unknown access paths from external third-party apps to organisations’ data and resources, in a way that is often hidden and unmanaged by organisations’ IT or security departments. In addition, the credentials granted to access users’ cloud data and resources often can be refreshed indefinitely. Security operations face challenges such as minimal to no tracking or management of these paths or credentials, along with immature or incomplete technical controls. This paper discusses an approach to understanding, assessing, analysing and managing third-party OAuth application risk, using anonymised real-world data as relevant examples, to provide prescriptive guidance on reducing risk associated with third-party applications.

Reducing organizational inequalities associated with algorithmic controls

Algorithmic technologies are widely applied in organizational decision-making today, which can improve resource allocation and decision-making coordination to facilitate the accuracy and efficiency of the decision-making process within and across organizations. However, algorithmic controls also introduce and amplify organizational inequalities—workers who are female, people of color and the marginalized population, and workers with low skills, a low level of education, or who have low technology literacy can be disadvantaged and discriminated against due to the lack of transparency, explainability, objectivity, and accountability in these algorithms. Through a systematic literature review, this study comprehensively compares three different types of controls in organizations: technical controls, bureaucratic controls, and algorithmic controls, which led to our understanding of the advantages and disadvantages associated with algorithmic controls. The literature on the organizational inequality related to the employment of algorithmic controls is then discussed and summarized. Finally, we explore the potential of trustworthy algorithmic controls and participatory development of algorithms to mitigate organizational inequalities associated with algorithmic controls. Our findings raise the awareness related to the potential corporate inequalities associated with algorithmic controls in organizations and endorse the development of future generations of hiring and employment algorithms through trustworthy and participatory approaches.

Information Security and Privacy Protection Strategies in the Process of Electronic Archiving

In the era of digital transformation, electronic archiving plays a pivotal role in preserving and managing vast amounts of information. However, as organizations increasingly rely on electronic archives, ensuring robust information security and privacy protection becomes paramount. This paper proposes a comprehensive framework for enhancing information security and privacy protection strategies within the electronic archiving process. Drawing upon insights from the fields of cyber security, data privacy, and archival science, our framework addresses key challenges and offers practical solutions to safeguard sensitive information throughout its lifecycle. Through a synthesis of existing literature, case studies, and expert interviews, we identify critical vulnerabilities and propose proactive measures to mitigate risks associated with unauthorized access, data breaches, and privacy violations. Our framework integrates technical controls, policy guidelines, and organizational practices to establish a resilient architecture that fosters trust, integrity, and confidentiality in electronic archiving systems. By adopting our proposed strategies, organizations can strengthen their defiance mechanisms and uphold the principles of information security and privacy in the digital age.

Reducing Rockfall Hazards in Tunnel Construction: A Case Study Using Root Cause Analysis Methodology

Abstract 
 
 Assessing the conditions that create a rockfall hazard is a realistic goal in efforts to reduce worker injuries related to rockfall incidents. If tunnel workers can properly assess the risks of rockfall, with appropriate technical and administrative controls, they can better mitigate the risks. To achieve this goal, the Root Cause Analysis (RCA) methodology can be considered as a risk assessment method. An effective risk assessment method should include the ability to observe variable ceiling conditions and assess how much potential they represent for injuring workers. RCA's ability to prioritize the risks associated with changing conditions provides significant benefits to anyone responsible for designing, approving, or installing controls that are reasonably repeatable and stabilize the ceiling or reduce the risk of material falling from the roof. Using the RCA methodology, this study presents a case analysis of the risks and causes of rockfall incidents in a metro construction project. This study explains the use of an RCA methodology that can help improve system-level failures and weaknesses, such as rocks falling from the ceiling of a tunnel. It can be seen that personnel problems, management failures and information systems problems are now replacing technical failures as the focus of most accident analyses.

Common Techniques, Success Attack Factors and Obstacles to Social Engineering: A Systematic Literature Review

Knowledge of Social Engineering is crucial to prevent potential attacks related to organizational Information Security. The objective of this paper aims to identify the most common social engineering techniques, success attack factors, and obstacles, as well as the good practices and frameworks that could be adopted concerning their mitigation. As an analysis methodology, a Systematic Literature Review was carried out. The findings revealed that the discussion about SE attacks has increased and that the most imminent threat is phishing. Exploiting human vulnerabilities is a growing threat when the attack is not carried out directly through technical means. There continue to be more technical attacks than non-technical attacks. Encouraging organizational security prevention, like training, education, technical controls, process development, defense in detail, and the development of security policies, should be considered mitigating factors for the negative impact of SE attacks. Most SE frameworks/models are focused on attack techniques and methods, mostly on technical components, decorating human factor. As a novelty, we found the opportunity to develop a new framework that could improve coverage of the gaps found, supported on security international standards, that could help and support researchers in developing their work, understanding open research topics, and providing a clearer understanding of this type of threat. Doi: 10.28991/ESJ-2024-08-02-025 Full Text: PDF

A Security Framework for Addressing Privacy Issues in the Zoom Conference System

The COVID-19 pandemic had a significant impact on many facets of human behavior. Most significantly, it required significant changes to how daily activities were conducted. The majority of individuals were forced to work and communicate from home due to social distancing, which opened the door for more virtual meetings. Since most organizations started allowing their employees to work from home, the majority of online meeting platforms—like Zoom and Microsoft Teams—have become more and more popular. Online meetings were not only used by businesses but also by educational institutes to carry out online learning, hospitals to conduct meetings and certain surgeries, and many other industries. The online meetings are practical and simple to organize, but their information security is not as high as that of conventional meetings. Security and privacy issues resulted from this. The safety of personal information such as names, contacts, and locations, the security of online recordings since sensitive information was discussed in most meetings, the security of data while it was in transit, and the potential for competitors to intercept your business were among the many security issues that were raised. Zoom, as one of the famous online conference systems, faced many global concerns, such as sharing private information with third parties, exposing users to unauthorized bullying calls, and adopting questionable end-to-end encryption processes. Additionally, companies have had virtual meetings hacked, leading to privacy issues since hackers can obtain data illegally. Therefore, this research proposes a security framework to address the privacy issues in the Zoom system by applying a set of governance and technical controls. The governance controls provide a strategic view of how an organization controls its security while implementing the technical controls avoids privacy issues in online conference systems. The proposed framework implements a set of technical controls such as encryption, auditing, authentication, and role-based access control. The results were promising and significantly addressed Zoom's privacy issues.

EVS-BASED THERAPIES FOR INTERVERTEBRAL DISC REGENERATION: WHERE DO WE STAND?

Within the field of disc degeneration-related low back pain, the spine community has been increasingly acknowledging the regenerative potential of extracellular vesicles (EVs). EVs are small lipid bilayer-delimited particles naturally released by cells, involved in intercellular signaling. They do so by interacting with recipient cells and releasing their biological cargo (e.g., mRNA, miRNA, DNA, protein, lipid)EVs derived from mesenchymal stromal cells and, more recently, also EVs from notochordal cells, the cells residing within the core of the juvenile human disc, are being actively studied. In general, they have been proposed to mitigate inflammation/catabolic processes, reduce apoptosis, stimulate proliferation and even improve the matrix producing capacity of the treated cells. Within this context, appropriate characterization of EVs is essential to increase the level of evidence that the reported effects are indeed EV-associated. To analyze the purity and biochemical composition of EV preparations the International Society for Extracellular Vesicles (ISEV) has prepared guidelines recommending the analysis of multiple (EV) markers, as well as proteins co-isolated/recovered with EVs. Alongside, to prove that the effects are EV-associated and not due to co-isolated factors from the tissue or cells used to derive the EVs, appropriate technical controls need to be taken along (during cell/tissue culture). As such the question arises: “what is the evidence so far?”While from a fundamental perspective EVs are very appealing, the use of natural EVs in clinical applications is challenging. It comes with drawbacks, including biologic variability, yield, cumbersome isolation, and challenging upscaling and storage to achieve industrial levels. To date there is no FDA-approved EV-based therapy for disc-related lower back pain.Nonetheless, EV-based therapeutic approaches have unique advantages over the use of (pluripotent) stem cell-based therapies, such as a high biologic, but low immunogenic and tumorigenic potential.Acknowledgements: This talk is based on experiences from part of the project NC-CHOICE [no. 19251] of the research talent programme VICI financed by the Dutch Research Council (NWO) and the iPSpine project that receives funding from the European Union's Horizon 2020 research and innovation program under grant agreement no. 825925.

A Framework for Institution to Enhancing Cybersecurity in Higher Education: A Review

The increasing prevalence of cybersecurity threats has highlighted the urgent need for Higher Education Institutions (HEIs) to prioritize and enhance their cybersecurity measures. This research article presents a comprehensive framework aimed at guiding institutions in strengthening their cybersecurity posture within the higher education sector. The framework addresses the unique challenges faced by HEIs, taking into account the multifaceted nature of cybersecurity and the evolving threat landscape. The proposed framework incorporates a systematic approach that encompasses key components essential for effective cybersecurity management. These components include governance and leadership, risk assessment and management, technical controls, awareness and training, incident response, and collaboration with external stakeholders. The framework emphasizes the integration of these components to establish a robust and holistic cybersecurity strategy. The research article draws upon a thorough review of existing literature, best practices, and industry standards to provide practical insights for HEIs. The framework offers a structured approach that enables institutions to assess their current cybersecurity posture, identify gaps, and implement targeted measures to enhance their overall security resilience. By adopting this framework, institutions can proactively address cybersecurity challenges, mitigate risks, and protect sensitive data and systems. The framework serves as a valuable resource for HEI leaders, policymakers, and cybersecurity professionals seeking to enhance cybersecurity in the higher education landscape

Analysis of Health and Safety in The Production Floor of CV. XYZ Using Job Safety Analysis Method and the Hazard Identification Risk Assesment and Risk Control Approach

Occupational Health and Safety (OHS) is a critical factor in the smooth operation of a company, involving machinery, tools, the work environment, raw materials and their processing, as well as the employees themselves. The company's issues regarding OHS culture and the inadequate use of Personal Protective Equipment (PPE) can lead to the risk of workplace accidents when employees perform their tasks. This research utilizes the Job Safety Analysis (JSA) method, which plays a role in risk identification, and the Hazard Identification, Risk Assessment, and Risk Control (HIRARC) approach to determine the direction for the implementation of risk management and OHS in the company. This study focuses on the production process of CV. XYZ, with 35 employees. Primary data were obtained through direct observation and interviews, which were then analyzed based on potential hazards discovered. The hazard identification results in the production floor revealed a total of 71 hazards, which include 23 potential hazards in the casting process, 26 potential hazards in the machining process, and 22 potential hazards in the finishing process. Based on these potential hazards, they can be classified into risk categories, including 27 (38%) potential hazards categorized as low risk, 30 (42%) potential hazards categorized as moderate risk, and 4 (6%) potential hazards categorized as high risk. Risk control measures include elimination, substitution, technical controls, administrative controls, and the use of PPE.

Influences of technical support and management controls on the performance of teleworking tasks

Resumo Este estudo verificou as influências dos controles gerenciais de ação e de resultado na relação entre suporte técnico ao teletrabalho, desempenho de tarefas e congruência de objetivos. Os dados foram coletados por meio de uma survey single entity, com 468 servidores de um órgão de Justiça, e analisados por meio de equações estruturais. Os achados mostram que o suporte técnico ao teletrabalho influencia positivamente os controles de ação e de resultado, o desempenho de tarefas e a congruência de objetivos. Evidenciou-se também que os controles de ação interferem positivamente no desempenho de tarefas e na congruência de objetivos, enquanto os controles de resultado influem, de forma direta ou por mediação, apenas na congruência de objetivos. Depreende-se que, os controles de resultado não afetam o desempenho de tarefas, pois precisam de revisão para alinhamento ao contexto de teletrabalho ou, alternativamente, que os servidores não precisam desse tipo de controle para apresentar bons desempenhos.