Types Of Breaches Research Articles

A Generalized Linear Mixed Model for Data Breaches and Its Application in Cyber Insurance

Data breach incidents result in severe financial loss and reputational damage, which raises the importance of using insurance to manage and mitigate cyber related risks. We analyze data breach chronology collected by Privacy Rights Clearinghouse (PRC) since 2001 and propose a Bayesian generalized linear mixed model for data breach incidents. Our model captures the dependency between frequency and severity of cyber losses and the behavior of cyber attacks on entities across time. Risk characteristics such as types of breach, types of organization, entity locations in chronology, as well as time trend effects are taken into consideration when investigating breach frequencies. Estimations of model parameters are presented under Bayesian framework using a combination of Gibbs sampler and Metropolis–Hastings algorithm. Predictions and implications of the proposed model in enterprise risk management and cyber insurance rate filing are discussed and illustrated. We find that it is feasible and effective to use our proposed NB-GLMM for analyzing the number of data breach incidents with uniquely identified risk factors. Our results show that both geological location and business type play significant roles in measuring cyber risks. The outcomes of our predictive analytics can be utilized by insurers to price their cyber insurance products, and by corporate information technology (IT) and data security officers to develop risk mitigation strategies according to company’s characteristics.

Online Attacks Types of Data Breach and Cyber-attack Prevention Methods

Online Attacks Types of Data Breach and Cyber-attack Prevention Methods

Online Attacks Types of Data Breach and Cyber-attack Prevention Methods

Online Attacks Types of Data Breach and Cyber-attack Prevention Methods

Analysis of Insider Threats in the Healthcare Industry: A Text Mining Approach

To address rapidly growing data breach incidents effectively, healthcare providers need to identify various insider and outsider threats, analyze the vulnerabilities of their internal security systems, and develop more appropriate data security measures against the threats. While there have been studies on trends of data breach incidents, there is a lack of research on the analysis of descriptive contents posted on the data breach reporting website of the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). Hence, this study develops a novel approach to the analysis of descriptive data breach information with the use of text mining and visualization. Insider threats, vulnerabilities, breach incidents, impacts, and responses to the breaches are analyzed for three data breach types.

Security management of BYOD and cloud environment in Saudi Arabia

The increasing trend of Bring Your Own Device (BYOD) to work has led to a significant surge in the risks related to network security. This trend is very beneficial to employers and employees alike in any organisation. The wide infiltration of spyware, malware and similarly suspicious downloads into personal devices has forced the government to reconsider its policies regarding data security. The malicious programs get downloaded onto the personal devices without the user even realising. This could disastrously affect the individuals and the governments. In the case of such an event, the BYODs become risky as they can make unauthorised policy changes and leak sensitive data into the public domain. This type of privacy breach leads to a domino effect with major legal and financial implications, and a decreased productivity for the organisations and governments. This presents a huge challenge as the governments have to consider the user rights and privacy laws and also protect the networks from these attacks. In this study, the researchers have proposed a novel technical framework that could assist the Saudi government. This framework was designed after determining the challenges that were faced by the government, based on the citizen perspectives, to control all risks challenging the use of the BYODs. This framework decreased the number of system restrictions and enforced access control policies for BYODs and cloud environments. The preliminary results of this study were positive and indicated that the framework could decrease the problems related to access control.

THE FUNDAMENTAL BREACH OF CONTRACT OF SALE UNDER THE CISG

While a breach of contract implies the failure of one party to fulfil the obligations arising from the contract, the fundamental breach of contract is an aggravated form of breach of contract. The concept of the fundamental breach of contract of sale is recognized in Article 25 of the CISG (UN Convention on Contracts for the International Sale of Goods, 1980). In an ordinary breach of contract of sales, the applicable legal remedies are ordinary legal remedies (such as substitution of goods, damages). In case of a fundamental (substantial) breach, the unilateral declaration of termination of the contract of sale is used as the last resort (to void the contract). Given that it is perceived as a special aggravated type of breach of contract of sale, the fundamental breach has to be carefully analysed in more detail.

KAMU YÖNETİMİNDE ETİK KAVRAMININ İZİNİ SÜRMEK: KAMU GÖREVLİLERİ ETİK KURULU ÜZERİNE BİR İNCELEME

Bu çalışmanın temel amacı, Kamu Görevlileri Etik Kurulu’nun, yapısı, mevzuatı ve kararları çerçevesinde, kamu yönetiminde etik kültürün gelişmesindeki yerini ve etkinliğini tartışmaktır. Çalışma üç bölümden oluşmaktadır. Birinci bölümde çalışmanın kuramsal çerçevesi “yönetişim anlayışı” çerçevesinde tartışılmıştır. Çalışmanın ikinci bölümünde Kamu Görevlileri Etik Kurulu’nun tarihsel gelişimi anlatılmıştır. Çalışmanın üçüncü bölümünde, Kamu Görevlileri Etik Kurulu’ndan alınan veriler ışığında, Türkiye’de 2017-2019 yıllarını içeren 3 yıllık dönemde hangi konularda etik davranış ihlalleri yapıldığı, Kurul’a kaç başvuru yapıldığı, başvuruların kaç tanesinin kabul edilip/edilmediği, başvuru içerikleri, etik ihlal başvurularının konulara göre dağılımı, başvurular sonucu hangi etik ilkelerin ihlal edildiği ve etik kültürün gelişmesi için yapılan faaliyetler incelenmiştir. Çalışmanın sonuç bölümünde elde edilen veriler çerçevesinde Kamu Görevlileri Etik Kurulu’nun etkinliği tartışılarak, Kurul’un daha etkin olabilmesi için çeşitli öneriler sunulmuştur.

Breaches of integrity in teacher administration in Ghana

AbstractThe study examines one type of breaches of integrity, namely using one’s authority in public office for personal gain (Hallak J & Poisson M. Corrupt schools, corrupt universities: what can be done? 2007), in the administration of teachers in Ghana. It was executed using an embedded mixed methods design with a population of 667 teachers employed by the Ghana Education Service (GES). A sample of 270 respondents was chosen by simple random sampling for the study. The questionnaire containing open-ended and closed-ended items was administered to the respondents. Data generated by the close-ended items were analysed using frequencies and percentages and data obtained from the open-ended items were analysed in themes. The study found that integrity breaches were prevalent in GES and occurred under the watch of superior officers in the service. It was more pronounced in teachers’ requests for upgrading and promotion, and salary processing. Victims did not report the act because they believed nothing would happen and because they fear victimisation. Integrated Personnel and Payroll Database (IPPD) coordinators and Human Resource Managers at the district and regional levels of GES were found to be the most corrupt officers in the service. It is recommended that character references on GES staff be sought; the processing of salaries, transfer, upgrading, promotion, among others, at the GES offices should be automated; and effective whistleblower hotlines should be instituted.

A retrospective observational insight into COVID-19 exposures resulting from personal protective equipment (PPE) breaches.

BackgroundHealthcare workers (HCWs) stand the risk of acquiring infection directly, while attending to patients or indirectly while handling and testing patient specimens. Considering this, the present study was planned to assess Personal Protective Equipment (PPE) breaches and exposures among HCWs working in COVID-19 wards/ screening areas and to evaluate their COVID-19 positivity rates post-exposure concerning the level of exposure, type of PPE breach, and the cadre of HCWs exposed in COVID-19 wards.MethodsThis retrospective cross-sectional study involved the analysis of all instances of PPE breaches which occurred during a period of nine months from June 2020 to February 2021 at a tertiary care level hospital in Central India. The analysis included all exposures involving any cadre of HCWs that occurred while handling the patients or while doffing the contaminated PPE in COVID -19 wards.ResultsA total of 347 PPE breaches were analyzed from the available records of the Hospital Infection Control team repository. Amongst the 347 breaches, 268 (77.2%) were classified as low-risk exposures and 79 (22.8%) as high-risk exposures. Cadre wise distribution of high and low-risk exposures revealed that, PPE breaches occurred most commonly in the category of nursing officers (n = 174, 50.1%). Among all of the breaches, 15.2% of high-risk exposures and 2.6% of low-risk exposures resulted in COVID-19 positivity with a cumulative positivity of 5.4%. Collectively, non-mask related breaches accounted for the majority (63.2%) of the positive COVID-19 cases.ConclusionAppropriate use of PPE by HCWs is vital for their protection. However, breaches in the use of PPE may occur while managing COVID-19 patients due to physical and mental exhaustion among HCWs resulting from work overload. Early identification and appropriate management of HCWs with high-risk exposures can help prevent transmission to other hospital staff and patients, thus preserving resources and workforce.

Cutting the vicious circle: Addressing the inconsistency in teachers’ approaches to academic integrity breaches

Dysfunctional educational system has been identified as one of the causes of academic dishonesty in Eastern Europe. This case study combines quantitative self-reported data and qualitative data from students and teachers with hard data from the disciplinary committee, collected at one Czech university. We analyse cases and types of breaches, identify characteristics of students that incline them toward cheating and investigate some of the reasons why. Our research confirms that the inconsistent approach of teachers is a contributing factor to students’ propensity to violate academic integrity rules and identifies reasons for such behaviour. Teachers play a key role in prevention, it is their duty to report cases of suspected misconduct, but they need tools to improve the culture of academic integrity. The contribution of this paper is to provide an inspiration for policy makers how to tackle the inconsistency of teachers’ approaches to student misconduct.

Bayesian vine copulas for modelling dependence in data breach losses

AbstractPotentialdata breach losses represent a significant part of operational risk and can be a serious concern for risk managers and insurers. In this paper, we employ the vine copulas under a Bayesian framework to co-model incidences from different data breach types. A full Bayesian approach can allow one to select both the copulas and margins and estimate their parameters in a coherent fashion. In particular, it can incorporate process, parameter, and model uncertainties, and this is very important for applications in risk management under current regulations. We also conduct a series of sensitivity tests on the Bayesian modelling results. Using two public data sets of data breach losses, we find that the overall dependency structure and tail dependence vary significantly between different types of data breaches. The optimally selected vine structure and pairwise copulas suggest more conservative value-at-risk estimates when compared to the other suboptimal copula models.

One Parameter Defense—Defending Against Data Inference Attacks via Differential Privacy

Machine learning models are vulnerable to data inference attacks, such as membership inference and model inversion attacks. In these types of breaches, an adversary attempts to infer a data record’s membership in a dataset or even reconstruct this data record using a confidence score vector predicted by the target model. However, most existing defense methods only protect against membership inference attacks. Methods that can combat both types of attacks require a new model to be trained, which may not be time-efficient. In this paper, we propose a differentially private defense method that handles both types of attacks in a time-efficient manner by tuning only one parameter, the privacy budget. The central idea is to modify and normalize the confidence score vectors with a differential privacy mechanism which preserves privacy and obscures membership and reconstructed data. Moreover, this method can guarantee the order of scores in the vector to avoid any loss in classification accuracy. The experimental results show the method to be an effective and timely defense against both membership inference and model inversion attacks with no reduction in accuracy.

Amplitude-reduction alert criteria and intervention during complex paediatric cervical spine surgery

ObjectiveTo determine the utility of widely used intraoperative neuromonitoring (IONM) alert criteria and intervention for predicting postoperative outcome following paediatric spinal surgery. MethodsRetrospective analysis of somatosensory evoked potentials (SSEP) and motor evoked potentials (MEP) in consecutive cervical spine fixations. An intervention protocol followed amplitude-reductions in SSEPs (≥50 %) and/or MEPs (≥80 %). Alert breaches were reversed when SSEP/MEP amplitude was restored to > 50 %/20 % of baseline. Sensorimotor function was assessed preoperatively and 3-months postoperatively via the Modified McCormick Scale score (MMS). We explored associations between postoperative outcome, demographic/surgical and IONM variables. ResultsForty-five procedures in 38 children (mean age:9 ± 4 years;55 % female) were monitored, 42 %of which breached alert criteria. Instrumentation (6/19,32 %) and hypotension (5/19,26 %) were common causes for alert and the majority (13/19,68 %) were reversed following intervention. There was an association between pre- and post-MMS and the type of breach (p = 0.002). All children with worse postoperative MMS (3/38,8%) had irreversible breaches. ConclusionsIONM in this small sample accurately detected neurological injury. The majority of breaches reversed following an intervention protocol. Irreversible breaches frequently led to worse postoperative sensorimotor function. SignificanceAn intervention protocol which reversed IONM alerts never resulted in postoperative worsening of sensorimotor function.

A Comprehensive Study of Cybersecurity Threats and Countermeasures: Strategies for Mitigating Risks in the Digital Age

The digital age has ushered in a new era of connectivity and opportunity. However, it has also made us more vulnerable to cyber threats. In recent years, we have seen a rise in the number and sophistication of cyberattacks. These attacks can have a devastating impact on businesses, governments, and individuals. This paper provides a comprehensive overview of cybersecurity threats and countermeasures. It begins by discussing the different types of cybersecurity threats, including malware, phishing, denial-of-service attacks, and data breaches. The paper then discusses the different types of cybersecurity countermeasures, including firewalls, antivirus software, and intrusion detection systems. The paper concludes by discussing strategies for mitigating risks in the digital age including 1) Investing in cybersecurity solutions, 2) Educating employees about cybersecurity best practices, and 3) Having a plan in place to respond to cyberattacks. By following these strategies, businesses, governments, and individuals can help to protect themselves from cyber threats.

Secure and Anonymous Three-Factor Authentication Scheme for Remote Healthcare Systems

Wireless medical sensor networks (WMSNs) play a significant role in increasing the availability of remote healthcare systems. The vital and physiological data of the patient can be collected using the WMSN via sensor nodes that are placed on his/her body and then transmitted remotely to a healthcare professional for proper diagnosis. The protection of the patient’s privacy and their data from unauthorized access is a major concern in such systems. Therefore, an authentication scheme with a high level of security is one of the most effective mechanisms by which to address these security concerns. Many authentication schemes for remote patient monitoring have been proposed recently. However, the majority of these schemes are extremely vulnerable to attacks and are unsuitable for practical use. This paper proposes a secure three-factor authentication scheme for a patient-monitoring healthcare system that operates remotely using a WMSN. The proposed authentication scheme is formally verified using the Burrows, Abadi and Needham’s (BAN) logic model and an automatic cryptographic protocol verifier (ProVerif) tool. We show that our authentication scheme can prevent relevant types of security breaches in a practical context according to the discussed possible attack scenarios. Comparisons of the security and performance are carried out with recently proposed authentication schemes. The results of the analysis show that the proposed authentication scheme is secure and practical for use, with reasonable storage space, computation, and communication efficiency.

System End-User Actions as a Threat to Information System Security

As universities migrate online due to the advent of Covid-19, there is a need for enhanced security in information systems in the institution of higher learning. Many opted to invest in technological approaches to mitigate cybersecurity threats; however, the most common types of cybersecurity breaches happen due to the human factor, well known as end-user error or actions. Thus, this study aimed to identify and explore possible end-user errors in academia and the resulting vulnerabilities and threats that could affect the integrity of the university's information system. The study further presented state-of-the-art humanoriented security threats countermeasures to compliment universities' cybersecurity plans. Countermeasures include well-tailored ICT policies, incident response procedures, and education to protect themselves from security events (disruption, distortion, and exploitation). Adopted is a mixedmethod research approach with a qualitative research design to guide the study. An open-ended questionnaire and semi-structured interviews were used as data collection tools. Findings showed that system end-user errors remain the biggest security threat to information systems security in institutions of higher learning. Indeed errors make information systems vulnerable to certain cybersecurity attacks and, when exploited, put legitimate users, institutional network, and its computers at risk of contracting viruses, worms, Trojan, and expose it to spam, phishing, e-mail fraud, and other modern security attacks such as DDoS, session hijacking, replay attack and many more. Understanding that technology has failed to fully protect systems, specific recommendations are provided for the institution of higher education to consider improving employee actions and minimizing security incidents in their eLearning platforms, post Covid-19.

The concept and legal nature of abuse of special status opportunities in the criminal law of Ukraine

The article deals with the determining of the legal nature and definition of the concept of abuse of special status opportunities in the criminal law of Ukraine. Regarding given problem author notes following issues as deliberative: the legal nature of abuse of special status opportunities in criminal law; the scope - what can be misused; the matter of the relevant prohibition under criminal law and the adequacy of its legal enshrinement; the correlation between abuse and excess as forms of illegal behavior of a special subject; proposals for improving the law regulation of criminal liability for abuse of special status opportunities.Author makes an attempt to formulate rationale for general abstract prohibition of abuse of special status opportunities as a type of breach of trust in a broad sense. Currently there are three adjacent corpus delicti which are provided for in Articles 364, 364-1 and 365-2 of the Criminal Code of Ukraine. Own considerations on the discussed issues are also given. Prohibition of the abuse of special status opportunities, which now exists in the criminal law of Ukraine, should be seen as a general norm of criminal offense and it can be defined as “the use by an official or a person, who provides public services (special subject), of special status opportunities contrary to the interests of the state, a legal entity, or the provision of public services in order to gain an undue advantage either for themself or for any other person, where such action caused significant damage to a person, legal entity, interests of the state or public interests”.Author rejects the proposal to exclude general norm(s) of prohibition of abuse of special status opportunities from the Criminal Code of Ukraine. There were given some arguments concerning necessity of the preserving of the abstract norm.

Defending digital supply chains: Evidence from a decade-long research program

Digital Supply Chains (DSCs) are highly integrated global internet communities of customers, distributors, producers, and suppliers. DSCs have increasingly incorporated Internet of Things (IoT) innovations such as field sensors and real time condition monitoring; and have served as effective platforms for IoT technology diffusion. However, as IoT has become more pervasive, pushing the edges of networks further out, new cyber threat windows have opened everywhere. More recently, Cyber-Supply Chain Risk Management (C-SCRM) has emerged as a critical discipline combining expertise from cybersecurity, supply chain management and enterprise risk management; and designed to stem the proliferation of digital supply chain attacks seeking illicit access to corporate networks for competitive espionage, financial and intellectual property theft, and disruption of operations. Yet to date, there has been little evidence that C-SCRM practices are actually effective in containing all or even some types of breaches. Our decade-long research provides the first statistical analysis of the effects on an organization’s breach profile based on the extent of its adoption of policies and practices defined within the U.S. National Institute of Standards and Technology (NIST) ‘s Cybersecurity Framework, increasingly the de-facto global C-SCRM standard. Our analysis determined that there were specific Framework activity areas and sets of policies/practices within those activity areas that strongly correlated with more effective control of specific breach types. Our findings lay the foundation for an evidence-based approach to mastering IT network vulnerabilities and defending global digital supply chains.

Stock market reactions to favorable and unfavorable information security events: A systematic literature review

The rapid digital transformations across every industry sector, accelerated partly due to the COVID-19 pandemic, have increased organizations’ use of information systems for operational and strategic purposes. These organizational responses have led to a confluence of digital, biological, and physical technologies that are revolutionizing business practices and workflows. But accompanying the pervasive use of digital technologies and the evolutionary nature of digital assets, is a shifting world of cyberattacks and information security (ISec) cybercrimes. Dynamic cybercrimes make it increasingly difficult for managers and researchers to anticipate the types, magnitude, and severity of future information security (ISec) breaches. Thus, we perform a systematic literature review (SLR) that explores, gathers, and categorizes event studies to examine the influence of favorable and unfavorable ISec events on stock markets. We extend the research conducted by Spanos and Angelis (2016) and provide a comprehensive understanding of the market’s efficiency to process public information released about ISec events, ISec contingency factors, and the influence of ISec events on stock prices and factors other than price. Our systematic search reveals 58 relevant papers that include 80 studies. We find that in 75% of the studies ISec events can significantly affect a company’s stock market performance, and that such effects are primarily exhibited within two days before and after the event day. Further, the magnitude of abnormal returns is higher in studies examining unfavorable ISec events, such as ISec breaches, compared to abnormal returns from favorable events, such as ISec investments and ISec certifications. In the end, our SLR serves as a foundation for ISec and management communities to build upon to keep industry and academia apprised of continually developing trends, new attack vectors and types of data breaches, protective ISec behaviors and programs, and their subsequent influences on stock market values and returns.

Ethics on the Beat: An Analysis of Ethical Breaches Across News Beats from 1999 to 2019

ABSTRACT This article examines press ethics across different news beats. Traditionally, studies of news beats have focused on the development, output or routines of a particular news beat, but few studies have focused on press ethics. In Denmark, the debate on press ethics began in the 1930s and has often focused on the crime beat. Today, the “Advisory rules of sound press ethics” apply to all content produced by leading news media and are under the supervision of the Press Council. We analyse rulings from the Press Council from 1999 to 2019 to investigate if and how breaches of press ethics differ across news beats. We find that out of 3406 complaints, 764 have led to rulings that criticise specific news media for ethical violations. We code each violation according to news beat, finding that breaches most often concern the business beat, the crime beat, and the health and social beat. We also find that the types of ethical breaches differ across beats. Thus, the most common breach within the business beat is not following up on a ruling from the Press Council, whereas the most common breach in crime reporting is the unnecessary identification of persons mentioned in crime stories.