Information Security Violations Research Articles

Regulatory frameworks for securing electoral processes in Ukraine: managing information security challenges

The administrative and legal framework for managing the information security of electoral processes in Ukraine includes regulations, various measures and procedures that are primarily aimed at ensuring the reliability and security of the electoral process due to the negative impact of external information, manipulation and illegal interference. Cyberattacks, media manipulations, and imperfect legal frameworks in the electoral sphere can lead to the invalidation of election results and the loss of confidential information. The main purpose of the domestic legislation is to strengthen the relevant protection of information from cyber threats. The relevance of studying this issue is primarily related to the administrative and legal framework for managing the information security of electoral processes in the spectrum of modern technological capabilities and external influences connected with the digital sphere. The purpose of the academic paper is to determine the administrative and legal framework for managing the information security of electoral processes in Ukraine. The academic paper the problems caused by the violation of information security in the process of electoral activity have been revealed. The features of the administrative and legal framework for managing the information security of electoral processes have been established. The legal and regulatory framework for information security management during elections has been studied. The academic paper also emphasizes the inexpediency of holding elections during the period of martial law and identifies the causes and consequences.

Understanding Shadow IT usage intention: a view of the dual-factor model

PurposeDespite the growing concern about security breaches and risks emerging from Shadow IT usage, a type of information security violation committed by organizational insiders, this phenomenon has received little scholarly attention. By integrating the dual-factor theory, unified theory of acceptance and use of technology (UTAUT) and social control theory, this research aims to examine facilitating and deterring factors of Shadow IT usage intention.Design/methodology/approachAn online survey was performed to obtain data. As this study aims at investigating the behavior of organizational insiders, LinkedIn, an employment-oriented network site, was chosen as the main site to reach the potential respondents.FindingsThe results show that while performance expectancy, effort expectancy and subjective norms considerably impact intention to use Shadow IT, personal norms and sanctions-related factors exert no influence. Besides, an organizational factor of ethical work climate is found to significantly increase individual perceptions of informal controls and formal controls.Originality/valueThis work is the first attempt to extend the generalizability of the dual-factor theory and UTAUT model, which primarily has been utilized in the context of system usage, to the new context of information security. This study is also one of few studies that simultaneously take both organizational and individual factors into consideration and identify its impacts on user's behaviors in the information security context.

Analysis of the Risks of Information Security Violations from Computer Attacks with an Increasing amount of Damage from Their Implementation

Analysis of the Risks of Information Security Violations from Computer Attacks with an Increasing amount of Damage from Their Implementation

Analysis and features of the functioning of protected automated systems of internal affairs bodies under the influence of threats of unauthorized access

Objective. The purpose of the study is to analyze the features of the functioning of protected automated systems and develop a structural diagram of a typical ATS AS, which includes various structural elements.Method. As a fundamental method of conducting research is the method of system analysis.Result. Based on the developed typical structural diagram of the ATS AS, threats to web servers were identified in accordance with the official website of the FSTEC, and, in accordance with them, potential vulnerabilities (weak points in terms of information security) were identified; a classification of all potentially dangerous threats to the information resource of protected ATS automated systems was developed and presented.Conclusion. The materials of the article can be used to analyze and develop a methodology for quantitatively assessing the risks of information security violations of the web servers of the ATS of the Russian Federation; methods for assessing the level of security of the ATS of the Russian Federation; methods of access of regular users of the RF ATS AS to the information resource of these systems based on semantic analysis.

Problems of evaluating the organization’s information security culture

Nowadays, digitization of all areas of human activity leads to an increase in the number of information security incidents in organizations. From this point of view, the problem of information security culture in organizations becomes very relevant in modern times. Obviously, the majority of incidents related to information security violations in organizations are associated to the human factor. To overcome this problem, the research in the field of the evaluation of information security culture is urgent. Measuring and evaluating information security culture can enable an organization to identify its weaknesses in this area and take measures to eliminate them. This article examines various approaches to the concept of information security culture, and analyzes the affecting factors within the organization (management’s attitude towards information security, information security policy, information security awareness and employee’s behaviors). It also studies the documents adopted in the field of development and evaluation of information security culture in the European Union countries and the United States, and implemented projects. It analyzes proposed methods for measuring the information security culture in the organization using various methods. Moreover, the article reveals existing problems in this field and provides certain recommendations for their elimination. The methods of analysis and synthesis, comparison, generalization and systematic approach are used in this research.

Exploring Personal and Environmental Factors that Can Reduce Nonmalicious Information Security Violations

ABSTRACT Employee engagement in nonmalicious information security violations (NISVs) is a threat to organizations. The Social Cognitive Theory was used to investigate the effects of personal and environmental factors on the intention to engage in NISVs. Data of 204 working professionals in Germany were used for analysis. Key results showed that personal goal setting, employee organizational commitment, and vicarious learning reduced employees’ intentions to engage in NISVs. Implications of the findings for research and practice were discussed.

Cyber–Information Security Compliance and Violation Behaviour in Organisations: A Systematic Review

Cyber and information security (CIS) is an issue of national and international interest. Despite sophisticated security systems and extensive physical countermeasures to combat cyber-attacks, organisations are vulnerable due to the involvement of the human factor. Humans are regarded as the weakest link in cybersecurity systems as development in digital technology advances. The area of cybersecurity is an extension of the previously studied fields of information and internet security. The need to understand the underlying human behavioural factors associated with CIS policy warrants further study, mainly from theoretical perspectives. Based on these underlying theoretical perspectives, this study reviews literature focusing on CIS compliance and violations by personnel within organisations. Sixty studies from the years 2008 to 2020 were reviewed. Findings suggest that several prominent theories were used extensively and integrated with another specific theory. Protection Motivation Theory (PMT), the Theory of Planned Behaviour (TPB), and General Deterrence Theory (GDT) were identified as among the most referred-to theories in this area. The use of current theories is discussed based on their emerging importance and their suitability in future CIS studies. This review lays the foundation for future researchers by determining gaps and areas within the CIS context and encompassing employee compliance and violations within an organisation.

COMPENSATION FOR DAMAGES CAUSED BY THE VIOLATION OF INFORMATION SECURITY

The article analyzes the issue of determining and ordering compensation for damage caused by information security violations. As a result of the analysis of normative-legal acts and scientific positions in the area concerned, it is established that the primary statutory base on prevention and cessation of offenses in the information sphere is almost formed, in particular, civil-law, disciplinary (including material) administrative and criminal liability for committing offenses and crimes in the information sphere, numerous laws and bylaws in the information sphere have been developed and are in force. However, their practical application is rather weak: there are no specific mechanisms for applying and complying with the law in practice, there are difficulties in imposing penalties for violating it, there is no systematization of law enforcement actions to exercise their responsibilities and rights in the information sphere. It is determined that for violation of information security, a person may receive compensation for tangible and non-pecuniary damage caused to him. The civil legislation of Ukraine also provides for compensation to a person as a result of the violation of his civil right. A separate role is played by administrative and criminal liability in the field of information security violations. It is concluded that in the current development of information society and digitalization, information security is significant in the field of private law. As a result, violations of information security may result in administrative and criminal liability. The option of civil liability is also necessary, in particular, compensation for tangible and non-pecuniary damage, which requires filing a lawsuit. At the same time, it should be noted that the actual compensation can occur only if the fact of damage is properly proved and the amounts contained in the claim are justified.

Methodology of information security risk analysis based on quantitative assessment of damages in information and technical systems bodies of the internal affairs

Objective. Assessment of the consequences of the occurrence of damage cases in the information and technical systems (ITS) of the internal affairs bodies (ATS) requires the use of an analysis of the risks of damage as a result of the implementation of information security threats.Method. In order to analyze the processes occurring in the ITS, as a rule, mathematical modeling is used. For ITS, due to the high technological complexity, high costs for the acquisition, maintenance of equipment and payment of wages to employees, it is necessary to apply the procedure for analyzing the risks of ITS ITS. The security of the functioning of the ITS ITS is normative, since at the moment the method of quantitative assessment of damages is insufficiently developed. The development of this scientific application would make it possible to establish the appropriate value of the indicator of the permissible risk of the implementation of threats to information security. Analytical and mathematical modeling using the apparatus of queuing systems. Result. A technique for analyzing the risks of information security violations based on a quantitative assessment of the damages of the ITS of ATS is given. Conclusion. The direction of this study is relevant and requires further elaboration in order to improve the method for assessing the occurrence of damage in the ITS of the internal affairs bodies.

АНАЛІЗ ПРОБЛЕМ БЕЗПЕКИ ПІРИНГОВИХ МЕРЕЖ

The basic concepts of peer-to-peer networks are analyzed. The current areas of their use are indicated, namely file-sharing services, teleconferencing systems, gaming and trade services, etc. The types of structural organization are considered, and their advantages and disadvantages are determined. According to the degree of centralization, pure, hybrid and federal architectures are distinguished. The classification of peer-to-peer peer networks by connection method and function is also given. Analysis of the prevalence of peer-to-peer networks in the modern world has proved the demand and relevance of the use of decentralized network technology, especially in the field of finance. Possible types of attacks on peer-to-peer networks are analyzed. Both general and specific attacks are highlighted. Specific attacks are oriented on user, application or network. Methods and mechanisms of protection for each of the studied types of attacks are given. The results of the analysis are systematized, namely for each attack the impact on the data, the degree of danger and the level of protection is determined. It also indicates the direction of violation of information security of each attack, namely the integrity, accessibility, confidentiality. It turned out to be no less interesting for malefactors, as evidenced by the significant number of hacks. The research of attacks on P2P networks showed a wide range of both general and specialized. At the same time, attacks are differentiated according to the degree of danger and the aspect of security breach. The most dangerous were attacks that could violate the confidentiality and integrity of data. These include the following attacks: distributed denial of service, index poisoning, sibyl attack, eclipse attack, botnets, masquerade. The research is the basis for further study of the shortcomings of the protection of peer-to-peer networks and the development of new secure mechanisms for data exchange in decentralized structures.

Exploring Employees’ Computer Fraud Behaviors using the Fraud Triangle Theory

Background: Employee computer fraud is a costly and significant problem for firms. Using the fraud triangle theory, this study explores the extent to which an employee’s perception of opportunity, rationalization, and work pressure will contribute to their likelihood of committing computer fraud (i.e., intentional, malicious, or while motivated through a self-interest gain of information systems (IS) security policy non-compliance behaviors). Method: A model is proposed and empirically validated through survey data collected from various industries from 213 computer-using employees with financial responsibilities within their organizations in the U.S. Results: This study’s findings suggest when individual employees experience high levels of work pressure, they may be more likely to commit computer fraud. Organizations can guard against this behavior by monitoring their employees’ assigned workload and performance expectations to prevent these unwanted behaviors. This study demonstrates a need for future research to investigate further the motivations employees may have besides financial greed when committing different types of computer abuse behaviors. Conclusion: This study, based upon the fraud triangle theory, empirically reveals the importance of monitoring general work pressure to guard against employees committing computer fraud behaviors. Computer fraud behaviors should be considered a distinct type of information security violation behavior.

Neural variability fingerprint predicts individuals’ information security violation intentions

As the weakest links in information security defense are the individuals in an organizations, it is important to understand their information security behaviors. In the current study, we tested whether the neural variability pattern could predict an individual's intention to engage in information security violations. Because cognitive neuroscience methods can provide a new perspective into psychological processes without common methodological biases or social desirability, we combined an adapted version of the information security paradigm (ISP) with functional magnetic resonance imaging (fMRI) technology. While completing an adapted ISP task, participants underwent an fMRI scan. We adopted a machine learning method to build a neural variability predictive model. Consistent with previous studies, we found that people were more likely to take actions under neutral conditions than in minor violation contexts and major violation contexts. Moreover, the neural variability predictive model, including nodes within the task control, default mode, visual, salience and attention networks, can predict information security violation intentions. These results illustrate the predictive value of neural variability for information security violations and provide a new perspective for combining ISP with the fMRI technique to explore a neural predictive model of information security violation intention.

THE PROBLEM OF ENSURING INFORMATION SECURITY AT ENTERPRISES IN MODERN CONDITIONS

Today, an urgent problem is the proper provision of information security in organizations and enterprises, since access to protected information can cause significant damage to the company and its financial position. Based on the fact that the greatest attention and protection is required for information in enterprises, this article will consider, of various kinds, the causes of information security violations, as well as the means and methods of protecting this information. The need to protect information is caused by the increase in its importance in recent years, which explains the relevance of this article.

Threats model of information and technical interac tion in the integrated information protection system

The article describes a model of threats arising from information and technical interaction between subsystem modules after their integration into a unified information protection system. The terminological base used in this subject area is defined. An ontological model is given that determines the relationship between the basic concepts. A description of the six main threats of interaction that make up the model is given, indicating the following characteristics: the source of the threat’s vulnerability, the method of its implementation, the object of the attack, the consequences of implementation in terms of violation of internal information security and damage to the performance of the integrated information protection system. The differences of this model from the typical ones used in organizations are given.

ДИСТАНЦИОННОЕ ОБУЧЕНИЕ И ИНФОРМАЦИОННАЯ БЕЗОПАСНОСТЬ

The article considers an issue of information security of the distance education systems. It analyzes the functions and architecture of the typical distance education system. With considering the requirements of information security it also discusses the university information system for solving the distance learning problems. The author defines valuable assets and information resources and describes the existing security threats. The subjects of interaction in the distance learning mode are presented. There is a consideration of the principal directions of the university’s activity in the distance learning system, requiring constant monitoring of information security. A threat model is worked out and the main security vulnerabilities are highlighted. The analysis of the causes and consequences of information security violation in the distance learning system is carried out and most vulnerable and critical nodes were identified. The hardware and software requirements for the remote mode work are regarded. A recommended list of hardware and software tools that ensure compliance with safety requirements is presented. The major lines of protection for distance learning systems are highlighted. The article proves the necessity of conducting a regular security assessment as a means for monitoring an effectiveness of the protection system.

Моделювання роботи групи реагування на інциденти інформаційної безпеки в умовах зростання інтенсивності кібератак

Modeling of the Information Security Incident Response Team (ISIRT) functioning and decision-making in the process cyberattacks requires the simultaneous use of parameters and characteristics at, on the one hand, directly characterize cyberattacks and their deployment over time, and, on the other hand, require taking into account the parameters and indicators that characterize the activities of specialists in a stressful situation. ISIRT’s activities are to counter cyberattacks aimed at destabilizing the social state of society by disseminating harmful information. The paper builds a model to describe the features of the ISIRT, taking into account the impact of the parameter of increasing the intensity of information security incidents on the quality of analysis of the system in real time, using the functions of responding to information security violations. The peculiarity of the constructed model is that for the first time the overload mode is taken into account, i.e. the influence of the introduced parameter of increasing the intensity of information security event identification is taken into account. The conditions under which the ISIRT is transitioning to a regime that does not meet the sufficient criterion of ergodicity, when the group will not be able to effectively cope with the deployment of cyber attacks in time. Simulation modeling of ISIRT activity is carried out and the presence of transition to the mode, which is caused by the lack of ergodic property of the system functioning, when changing the parameter of increasing the intensity of information security event identification, is shown. The obtained results allow predicting the appearance of the overload mode caused by the lack of ergodic properties of the system operation, in the conditions of which the activity of this ISIRT ceases to be effective. This allows you to set certain thresholds for the time of effective operation of this ISIRT during a cyber attack. As a result, the existing set of ISIRT can be characterized by certain quantitative indicators that characterize the time of effective operation of this ISIRT, depending on the identified characteristics of the cyber attack. Based on the developed model, new methods of countering cyberattacks can be developed, which will be based on identifying the required characteristics of the temporal deployment of cybersecurity incidents and on their basis redirecting control from one ISIRT to another during the incident. This will require the creation of a database with the necessary characteristics for those ISIRTs that may be involved in the process of countering cyberattacks.

Application of internal point methods in cybersecurity problems of intelligent energy systems

The paper considers approaches to the creation of intelligent energy systems based on WAMS monitoring systems, using information technology in metrology, in the means of receiving, processing and transmitting information and determining parameters in control tasks. The paper analyzes the existing cyberattacks on the SCADA and WAMS system and considers possible ways to solve control problems in terms of information security violations of intelligent energy systems. DoS-attacks are considered in more detail, which lead to the failure of devices that measure currents, voltages and capacities, as well as to the disruption of information processing equipment. The paper proposes an algorithm for estimating the state of cyber defense of the intelligent energy system based on mathematical modeling of the internal states of the system, which allows to obtain the required accuracy of calculations in terms of incomplete information, which is the inability to access measurement data.

Оценка риска нарушения кибербезопасности в коммерческом банке (на примере атак на банкоматы “Brute force” и “Black box”)

Abstract. During the XX–XXI century there was a development of technologies, which resulted in the creation of a global financial system that allows you to quickly make money transactions in opposite points of the Earth. The progress of digital transformation of society and, in particular, financial and economic systems leads to the complication of the problems of information security of competing entities. By focusing on scientific research, we can achieve success in these areas. The purpose of the study: to increase the level of security of banking services for individuals and legal entities in accordance with the recommendations of information security standards by analyzing the risk of information security violations in electronic banking technologies (on the example of the “Brute force” and “Black box” attacks). Research methods: empirical methods of scientific knowledge (observation, measurement, experiment), theoretical methods (analysis, synthesis, induction, deduction, abstraction, formalization), graphical interpretation of information, probability theory methods and computer programming. The result of the study: standards for effective management of information security management at the enterprise are considered. The advantage of social engineering methods over the “Brute force” method of PIN codes is shown quantitatively. The time characteristics of its commission and protective measures against attacks of the “Black box” type are analyzed. A method for improving the effectiveness of the response and protection of ATMS from attacks of the “Black box” type is proposed.

MODEL OF FUNCTIONAL HAZARD ASSESSMENT IN AIR TRAFFIC MANAGEMENT SYSTEM REGARDING INFORMATION SECURITY THREATS

The threat to information security for the air navigation service providers represents a potential violation of information security of the information infrastructure elements in the air traffic management system such as communications, navigation and surveillance equipment, and the information and telecommunication systems. Typically, a threat results from the presence of vulnerable components in the protection of information technology as part of air navigation service providers’ activity. Most of the approaches and techniques of international aviation organizations and best-practices of air navigation service providers are focused on developing risk methods and models regarding aviation safety. A well-known problem with aviation safety risk assessment is that it does not take into account the information and cyber security threats. The subject of the article is exploration of methods and models for risk assessment of air navigation service providers. The purpose is the development of model of functional hazard assessment and set of information security requirements for air navigation service providers. The proposed model of functional hazard assessment differs from the known by detailing of information security sphere. The software model of functional hazard assessment was developed via MATLAB Fuzzy Logic Toolbox. Practical significance is that the obtained results allow air navigation service providers to make better decisions regarding management systems maturity improvement.

Cyberattack Risk Assessment in Electronic banking Technologies (the Case of Software Implementation)

The authors investigate the risks of computer attacks on automated banking systems. The relevance of the study is due to the need to revise the approaches to risk assessment based on the technical components of banking business processes and the consequences of cyber-attacks aimed at banking automated systems in credit institutions. The aim of the study is to describe the developed methods for assessing cyber risks in a commercial bank and provide an option for assessing the risks of information security violations in electronic banking technologies. The methodology of the article includes the analysis of domestic and foreign literature on the research topic, the theoretical and probabilistic method of calculation, computer programming and graphic interpretation of information. The authors analysed the operational risk of a commercial bank to develop components of the operational risk management system in the context of developing electronic banking technologies. They designed a computer program to quantify risk probabilities of cyberattacks on electronic banking technologies (by means of Borland Delphi). The work presents a formalised probabilistic model for determining the most vulnerable segment of risk management techniques used by information security structures. The conclusion is that it is possible to develop a software package based on a mathematical model that reduces the number of checks of risk factors by several times. The research results may be of further use for the development of risk divisions in credit institutions using electronic banking technologies.