Unauthorized Disclosure Research Articles

A aula como objeto da proteção dos Direitos de autor: um guia para professores contra a divulgação não autorizada de suas aulas

The intent of recording classes as a means to consubstantiate claims against teachers and professors for so-called “indoctrination” has recently gained legal relevance. Inciting the recording and unauthorized public exposure of classes is one of the tactical expedients adopted by the “Escola Sem Partido” (ESP) – School Without Parties – movement, which pursues a multilevel agenda of statutory change geared towards restricting academic freedom. ESP is presented as non-partisan by its partisans, who attempt to cover their strong denial of political pluralism embodied in the Brazilian Constitution of 1988. The Brazilian legal system protects classes as copyright property pertaining to teachers/professors, to which moral and material entitlements ensue. Such legal protection means unauthorized public disclosures of videos or recordings of classes violate author’s entitlements and implicate civil liability of those responsible for unduly recording and disclosing them. This paper intends to highlight procedures available to teachers and professors whose copyright entitlements over classes have been breached. The main objective is to provide answers to the question: that rights do teachers and professors whose classes have been recorded and divulged without their authorization have, especially in a context of persecutory incentives carried out by political movements such as the ESP?

A Systems Approach to Information Security for the Twenty-First Century Organization

A crisis resulting from disruptive events that threaten to harm the organization or its stakeholders can originate from a plethora of sources. Data breaches, unauthorized disclosures of confidential information, and data leaks, are on the news almost daily. Most guidelines and standards published by prominent International Standards Organizations hold that risk-based thinking supports public, private, and community enterprises (referred for convenience in this work by the generic term “organization”) in determining the forces that could cause their key and enabling processes to deviate from planned arrangements, to apply preventive measures to modify risk, and to take advantage of opportunities as they arise. A well-structured Information Security Management System that is developed, implemented, and maintained through sound risk-based thinking, enables the organization to take appropriate actions to address the risks and opportunities associated with its information resources, in a manner that is commensurate to the complexity of its socio-technical infrastructure and the external environmentassociated with its activities. In this work we explore the Risk Management Process that is outlined in the ISO 31000 international standard, through the requirements/guidelines defined in the ISO/IEC 27000-series of international standards. The knowledge gained is applied to develop a systems driven conceptual structure thatcan be employed by any organization operating on the complexities of an interconnected environment, for the purpose of designing, implementing, monitoring, reviewing and continually improving a structured Information Security Management System.

‘Collateral Damage’: Consent, Subjectivity and Australia’s #MeToo Moment

Australia’s #MeToo moment has witnessed the publication of women’s experiences of sexual violence without their knowledge, involvement or consent. Focusing on Eryn Jean Norvill, Catherine Marriott and Ashleigh Raper, this article explores relationships between consent and subjectivity within the unauthorised public disclosure of women’s experiences of sexual violence that target high-profile alleged male perpetrators. These cases reveal that the absent presence of consent signifies a denial or repudiation of subjectivity, and responses by the women at their centre highlight discursive relationships between narrative, consent and subjectivity. The article explores the failure of recent and proposed law reform to protect women from such harms, and the conceptual efficacy of consent in enabling women’s subjectivity in #MeToo storytelling.

Computational Intelligence for Information Security: A Survey

Information security is the set of processes that protect information away from unauthorized access, disclosure, replication, modification, or destruction. Recently, more and more real-world systems such as smart cities, wireless sensor networks, biometric systems, and surveillance, require the assurances of information security. Thus, many different techniques based on computational intelligence have been developed for information security in the past decades. However, there are no comprehensive surveys that summarize these techniques. Thus, this paper reviewed computational intelligence approaches published in journals and conferences for information security in the last decade. This paper is a brief, but a comprehensive survey to review numerous computational intelligence approaches and applications for information security. A discussion of the existing challenges of computational intelligence approaches and techniques for information security is also presented.

Healthcare Data Breaches: Insights and Implications.

The Internet of Medical Things, Smart Devices, Information Systems, and Cloud Services have led to a digital transformation of the healthcare industry. Digital healthcare services have paved the way for easier and more accessible treatment, thus making our lives far more comfortable. However, the present day healthcare industry has also become the main victim of external as well as internal attacks. Data breaches are not just a concern and complication for security experts; they also affect clients, stakeholders, organizations, and businesses. Though the data breaches are of different types, their impact is almost always the same. This study provides insights into the various categories of data breaches faced by different organizations. The main objective is to do an in-depth analysis of healthcare data breaches and draw inferences from them, thereby using the findings to improve healthcare data confidentiality. The study found that hacking/IT incidents are the most prevalent forms of attack behind healthcare data breaches, followed by unauthorized internal disclosures. The frequency of healthcare data breaches, magnitude of exposed records, and financial losses due to breached records are increasing rapidly. Data from the healthcare industry is regarded as being highly valuable. This has become a major lure for the misappropriation and pilferage of healthcare data. Addressing this anomaly, the present study employs the simple moving average method and the simple exponential soothing method of time series analysis to examine the trend of healthcare data breaches and their cost. Of the two methods, the simple moving average method provided more reliable forecasting results.

Practical Considerations for Implementing Virtual Care in Physical Medicine and Rehabilitation: For the Pandemic and Beyond.

This article outlines a practical approach to quickly implementing virtual care for physiatrists. This skill is relevant not only during times of a pandemic, when face to face care is impossible, but is also valuable when caring for patients who have physical, financial, logistic, or other challenges to on-site care. Key themes covered in this article include selecting appropriate virtual care platforms, consenting patients for virtual care and conducting successful virtual visits. It also reviews strategies for performing virtual physical examinations and engaging learners in virtual care.

Personal Data Protection as an Element of Competitive Advantage

Abstract The article presents results of research on the information flow between the client and the company, inside the company, and the problems encountered by both parties in the data exchange process. Also included are methods of securing information through unauthorized disclosure, disclosing ideas to other clients. The basis of the study was a survey directed to 75 customers ordering in the examined enterprise and a survey among 40 employees of that enterprise. The study was also based on an in-depth conversation with employees of the examined company employed at various levels. The survey shows that the clients and employees of the surveyed company are aware of the high value of information, and its security is considered one of the priorities. The survey clearly shows that customers praise data protection activities, they treat it as an element used to care for the interests of the customer, as a further environment of the product or service they purchase. However, there are often errors due to customer ignorance, communication problems, and lack of knowledge of employees. The study covered the importance of information in an enterprise as part of its competitive advantage, the reasons for investing in information protection, the occurrence of incidents, the degree of information security, and actions taken to protect information in an enterprise.

A Review of Asset-Centric Threat Modelling Approaches

The threat landscape is constantly evolving. As attackers continue to evolve and seek better methods of compro-mising a system; in the same way, defenders continue to evolve and seek better methods of protecting a system. Threats are events that could cause harm to the confidentiality, integrity, or availability of information systems, through unauthorized disclosure, misuse, alteration, or destruction of information or information system. The process of developing and applying a representation of those threats, to understand the possibility of the threats being realized is referred to as threat modelling. Threat modelling approaches provide defenders with a tool to characterize potential threats systematically. They include the prioritization of threats and mitigation based on probabilities of the threats being realized, the business impacts and the cost of countermeasures. In this paper, we provide a review of asset-centric threat modelling approaches. These are threat modelling techniques that focus on the assets of the system being threat modelled. First, we discuss the most widely used asset-centric threat modelling approaches. Then, we present a gap analysis of these methods. Finally, we examine the features of asset-centric threat modelling approaches with a discussion on their similarities and differences.

Teoria i praktyka ochrony informacji niejawnych – wybrane zagadnienia dotyczące bezpieczeństwa informacji

A key issue for every state is the protection of information about its resources that should not be made public for various reasons, including national security reasons in particular. The article discusses the problem of its lawful protection against unauthorised disclosure in relation to emergency situations. The author claims that the discrepancies in this area result from both the provisions of the Act on the Protection of Classified Information, which allows for excessive arbitrariness, and the shortages caused by the actions of persons working in the public administration sector. A slight amendment to the current legislation, combined with training on the marking of materials that require actual protection, may ensure the systemic enhancement of the protection of classified information and thus, national security, without excessively limiting the transparency of public life.

Maximal length test pattern generation for the cryptography application

Date security is the science and study of methods of protecting data in computer and communication systems from unauthorized disclosure and modification. With the introduction of hardware Trojans, data security becomes more critical. However Data security has evolved rapidly and have seen exciting developments in cryptography. Various algorithms are adopted for the data encryption and decryption processes for the higher level of security. Data is leaking by accessing the encrypted data over the medium of data transmission, so implementation of high security medium for data transmission has to be developed. Industries developing various techniques for verifying that programs do not leak confidential data. This paper explores a better understanding of the theoretical and practical limitations to security. By considering the pseudorandom property of cryptography, the Linear Feedback Shift Register (LFSR) based designs provides affordable intelligence security testing, facilitating their demand in VLSI chip design. It is analysed to generate maximal length random sequence to provide better cryptography. Pseudorandom sequence generator (PRSG) by LFSRs, encipherment and decipherment simulations are done using 180 nm CMOS process technology in ASIC flow, and validated using simulation results.

Innovatively securing the library materials

Library security is one of the most important aspects of library management. Materials in a library need to be kept safe in order to ensure continual services of patrons. InfoSec as it is called is the prevention of unauthorized use and the practice of defending information and information bearing materials from unauthorized access, disclosure, disruption, modification, perusal, inspection, recording or destruction of information From this study it was found out that security issues can only be resolved in the library if that book and information industry is taken seriously. Students and patrons and all who use the library should be barred from entering the library with their mobile phones, laptops, pamphlet exercise books, any other valuable assets etc. which they risk losing if they should send them into the library. Notices should be placed at every corner of the library including the entrance of the library to warn patrons from entering the library with their valuables.

CYBER SECURITY FRAMEWORK FOR NIGERIAN CIVIL AVIATION AUTHORITY, HEADQUARTERS

The practice of defending assets from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction is as ancient as man’s existence on earth. Cybersecurity, information security, and computer security arefurther attempts of man to continue the same ancient practice. This is due to the unavoidably prevalent need and use of information and communication technologies in this century, which has left the man with such vulnerability and insecuritythrough its devices and infrastructures. The aviation industry, being one of the most economic and leisure viable industry in theworld has been at the top-notch of the use of these technologies for better services to man. Nigeria Aviation industry is one of thelargest and most viable in Africa is opened to the vulnerabilities and cyber threats that comes with these advanced technologies.However, several methods and programs have been employed by various organizations and stakeholders, but, the Nigerian CivilAviation Authority (NCAA), been the apex governing body that control, monitor and regulate the economic and safety oversight ofthe entire Aviation industry in Nigeria seems not to have gotten it right with the recent trends of cyber warfare in the industry asopposed to their counterparts in the world over. Therefore, this research study attempts to employ data from existing literatureand questionnaires to analyze the existing practices of cyber/information security programs (if any) within the NCAA and todesign an adaptable cybersecurity framework that is robust enough for its safety. By using version 3.9.3 of Waikato Environmentfor Knowledge Analysis (WEKA) software, Naive Bayes, Bayes Net, Decision Table, IBK (Linear NNSearch), REP Tree, J48, SMO, Simple Logistic, and Bagging are the nine algorithms employed to determine and predict tier classes as existing profile and target profile respectively for NCAA within the framework. SMO emerge best fit to predict the target profile while the Bagging algorithm emerges best fit to determine the current profile. Gaps and implementable action plans were deduced. Thereafter, the RNA Cyber Security Framework (RNA-CSF) is conceptually developed, analyzed and proposed for NCAA and for any other organization that has the need to use it.

Data Leak Identification in Social Networks using K Means Clustering & Tabu K Means Clustering

The prevention of leakage of data has been defined as a process or solution which identifies data that is confidential, tracks the data in a way in which it moves in and out of its enterprise to prevent any unauthorized data disclosure in an intentional or an unintentional manner. As data that is confidential is able to reside on various computing devices and move through several network access points or different types of social networks such as emails. Leakage of emails has been defined as if the email either deliberately or accidentally goes to an addressee to whom it should not be addressed. Data Leak Prevention (DLP) is the technique or product that tries mitigating threats to data leaks. In this work, the technique of clustering will be combined with the frequency of the term or the inverse document frequency in order to identify the right centroids for analysing the various emails that are communicated among members of an organization. Every member will fit in to various topic clusters and one such topic cluster can also comprise of several members in the organization who have not communicated with each other earlier. At the time when a new email is composed, every addressee will be categorized to be a potential leak recipient or one that is legal. Such classification was based on the emails sent among the sender and the receiver and also on their topic clusters. The work had investigated the technique of K-Means clustering and also proposed a Tabu - K-Means (TABU-KM) technique of clustering to identify points of optimal clustering. The proposed TABU-KM optimizes the K-Means clustering. Experimental results demonstrated that the proposed method achieves higher True Positive Rate (TPR) for known and unknown recipient and lower False Positive Rate (FPR) for known and unknown recipient.

Why Snowden and not Greenwald? On the Accountability of the Press for Unauthorized Disclosures of Classified Information

In 2013, following the leaks by Edward Snowden, The Guardian published a number of classified NSA documents. Both leaking and publishing leaks violate the law prohibiting unauthorized disclosures. Accordingly, there are two potential targets for prosecution: the leakers and the press. In practice, however, only the leakers are prosecuted: Snowden is facing a threat of 30 years’ imprisonment; no charges have been made against The Guardian. If both leaking and publishing leaks violate the law, why prosecute only the leakers and not the press? I consider and reject two arguments. The first claims that the press has special moral claims by virtue of its rights (press freedom) or its role (the Fourth Estate; conduit for information). The second argument states that the leakers commit a greater wrong than the press. I conclude that the current prosecution practice is inconsistent: prosecutors should either prosecute both or neither.

Providing the confidentiality requirements in the course of the audit of compliance with the enterprise’s continuity principle

The article investigates and systematizes the requirements for maintaining confidentiality in carrying out the audit of compliance with the principle of continuity of activity by the management personnel of the company during the preparation of financial statements. The components of the audit quality assurance system have been researched and further developed, in particular in the context of ensuring confidentiality. Particular attention has been paid to the specifics of the audit evidence database, to the identification of key financial indicators and the associated risks of unauthorized disclosure. When verifying that the principle of business continuity is audited, the auditor is confronted with information that is the consequence or prerequisite for making strategic management decisions. This information is valuable to competitors of the company being verified, which in turn can provoke its disclosure by the auditor - that is, there is a risk of disclosure of trade secrets. The purpose is to develop a methodology for building a system for preventing the disclosure of information by the auditor, obtained when checking compliance with the principle of business continuity. An analysis of current practice indicates that there is a significant risk of misuse of auditors by information obtained during the audit, which violates professional secrecy, in particular, when checking compliance with the principle of business continuity. Based on the problem, we have proposed a number of policy recommendations for the development of an internal corporate policy of non-disclosure and confidentiality of information at the audit firm, in particular in the aspect of strategic information used in the continuity audit. This made it possible to obtain a sufficient level of staff awareness of the nature of the breach of the principle of confidentiality and future liability.

A lightweight CLAS scheme with complete aggregation for healthcare mobile crowdsensing

The vast increase in the deployment of smart devices and the ubiquity of the Internet have evolved a new technology referred to as mobile crowdsensing (MCS). In healthcare MCS (HMCS), mobile devices can collect and upload medical data to the cloud server where authorized healthcare providers can access the relevant data for proper diagnosis and treatments. However, since this process is directly connected with patient’s sensitive health information, any unauthorized disclosure may have serious consequences on the patient’s wellbeing, hence privacy and security are serious issues in HMCS. To achieve data privacy and integrity, some certificateless aggregate signature (CLAS) schemes have been proposed. Very recently, four independent CLAS schemes were proposed for healthcare application. The authors claimed that their schemes were semantically secure in the security model. In this work, we analyze these schemes and find them to be insecure since there exists an adversary who can always forge a valid signature. Afterwards, we put forward a new CLAS scheme for HMCS application based on Elliptic Curve Cryptography (ECC) and hash function. In the proposed scheme, an aggregator can perform complete aggregation of certificateless signatures, resulting in improved performance. The proposed scheme satisfies all the security and privacy requirements of HMCS and can prevent possible attacks. Moreover, we show that the scheme is semantically secure with the assumption that the Discrete Logarithm Problem (DLP) is intractable. Extensive performance analysis and comparison show that the scheme is much more efficient than the state-of-the-art schemes.

E-government Use in Nepal: Issues of Database Management and Data Security

E-government uses information and communication technologies (ICTs) tools and systems to provide better public services. Database Management System (DBMS) is a very significant part in e-governance activities and process in the nation. Security of the data is a main concern of the organizations and private. Proper database management and data security are the major issues in present era. The aim of the paper is to try analyzing necessity of database management and data security. The author used survey methods during research to collect the data and analyze it. This paper concludes that the data backup is key profession while using computer in an institute or people. Hard disk, external hard disk, pen drive, memory card, server and open drive are the major storage Medias. People and employees don’t create backup of data due to lack of knowledge, device and don’t know about importance. The authors conclude that using Antivirus on computer, password on file and computer system, data and information backup, firewall, encryption and decryption technology are the data security tools. Data security protect against the unauthorized use, disclosure, access, destruction, modification and loss of data. Confidential password security and regular monitoring on password are very necessary to secure data. An online security system, as well as manual security systems, should be managed attentively.

CKMI: Comprehensive Key Management Infrastructure Design for Industrial Automation and Control Systems

Industrial Automation and Control Systems (IACS) are broadly utilized in critical infrastructures for monitoring and controlling the industrial processes remotely. The real-time transmissions in such systems provoke security breaches. Many security breaches have been reported impacting society severely. Hence, it is essential to achieve secure communication between the devices for creating a secure environment. For this to be effective, the keys used for secure communication must be protected against unauthorized disclosure, misuse, alteration or loss, which can be taken care of by a Key Management Infrastructure. In this paper, by considering the generic industrial automation network, a comprehensive key management infrastructure (CKMI) is designed for IACS. To design such an infrastructure, the proposed scheme employs ECDH, matrix method, and polynomial crypto mechanisms. The proposed design handles all the standard key management operations, viz. key generation, device registration, key establishment, key storage, device addition, key revocation, key update, key recovery, key archival, and key de-registration and destruction. The design supports secure communication between the same and different levels of IACS devices. The proposed design can be applied for major industrial automation networks to handle the key management operations. The performance analysis and implementation results highlight the benefits of the proposed design.

The Importance of Ethical Conduct by Penetration Testers in the Age of Breach Disclosure Laws.

Across the globe, there has been a noticeable increase in the adoption of breach disclosure laws that are designed to protect the privacy of individuals. To validate the security controls implemented by an organisation to protect sensitive data, penetration testers are often engaged to test the security of information systems and to report any vulnerabilities. Using an interpretivist, constructivist approach, this article reports on a pilot study that compares USA and Australian approaches to ethical hacking. The need for regulation of ethical hacking to help protect organisations from unethical conduct was a recurring theme. With the changes in privacy regulations across the world, unauthorised disclosure of personal and privileged information could result in significant consequences. This paper explores the importance of ethical conduct by penetration testers based on empirical research and the potential for misuse of information.

Cognitive security paradigm for cloud computing applications

SummaryThis article presents new paradigms of confidential data protection. New classes of paradigms are dedicated to enhancing the already‐known cryptographic solutions belonging to the group of data sharing schemes. Data sharing schemes are dedicated to executing data protection tasks by means of splitting data into parts (called shadows) and distributing those shadows among a group of secret trustees. This process is enriched by linguistic and biometric solutions to guarantee protection of the shared data by means of biometric labeling or by means of user verification with the application of meaning interpretation of individual secret parts. The novelty in this solution is in the application of cognitive algorithms to describe correctly the shared secret. Cognitive paradigms guarantee an execution of information concealment protocols and their division at various levels of knowledge held by individual protocol participants. The paradigms of cognitive description of the concealed data have been introduced into a new class of data sharing protocols, ie, into the linguistic‐biometric threshold schemes. A special feature of the proposed solution is its universality, which is a possibility to apply the here‐discussed threshold schemes in the processes of data concealment with varying importance. At the same time, this solution can be applied to execute data protection tasks against unauthorized acquisition or disclosure. This paper will present also the possibilities of application of the paradigms presented here to conceal data dedicated to the data management processes.