Information System Vulnerabilities Research Articles

The Design of Information System Vulnerability Management Software Based on CVSS

The purpose of information system vulnerability analysis is to find loophole and to prevent endangering the information system security. Based on principles of information security risk assessment and Common Vulnerability Scoring System (CVSS), this paper presents a system model for information system vulnerability management. The function models are analyzed respectively; the technology features are also summarized in this paper.

Limiting Answers to Queries to Enhance Security of Mobile Database

While mobile computing has seen tremendous growth and popularity, it has also introduced vulnerabilities in information systems. When a mobile personal computing device is stolen or misplaced, a great amount of data obtained from database servers can be compromised; hence, it is useful to limit the amount of sensitive data on mobile clients. In a number of applications, it is necessary to limit the amount of answers in response to a user query in order to enhance the security of a database; for example, an army base can answer queries asking for the phone numbers of its residents and yet, it should not reveal the whole book. Since databases are large and dynamic in content and structure, and the results of queries are unpredictable, it is not feasible to manually specify exactly which tuple should be suppressed for which user. In this paper, our approach is based on declarative specifications: the Database Administrator specifies the secrecies, i.e., the queries whose answers need to be limited, and the user privileges, i.e., the number of tuples that can be revealed when a user query intersects with a secrecy. The output of every query that intersects with one of the secrecies will be limited in the number of tuples revealed.

비즈니스 위험관리를 위한 정보보호제도 분석 프레임웍에 관한 연구

정보원천의 다양화와 정보시스템 취약성의 증가는 비즈니스 위험을 증가시킨다. 성공적인 비즈니스는 적정한 비즈니스 위험관리를 통해서 가능하다. 그러나 비즈니스 위험관리는 재무적 관점에서 시행되고 있고, 정보보호관리제도는 정보보호의 관점에서만 이루어져 통합적인 비즈니스 위험관리를 수행하기에 부적절하다. 본 연구는 통합적인 비즈니스 위험관리기법을 개발하기 위하여 정보보호관리제도인 ISMS, EA, ISO27001, COBIT, SPICE, 정보시스템감리, SSE-CMM 등을 비즈니스 위험관리관점에서 분석하였다. 본 연구에서 분석된 정보보호관리제도는 비즈니스 위험관리를 위한 원천으로 활용가능하다. Various information sources and the increasing vulnerabilities of information systems could increase the risks of a business. The successful management of business risks depends on appropriate level of risks in business. Business risk management would be conducted in terms of financial risk management and information security management. The financial management and the information security management could not achieve an integrated business risk management. For developing the integrated business risk management, this study analyzes the various information security management systems such as ISMS, EA, ISO27001, COBIT, SPICE, Auditing. This study analyzes information security systems, which could be utilized in developing business risk management.

Password Authentication from a Human Factors Perspective: Results of a Survey among End-Users

Considering that many organizations today are extremely dependent on information technology, computer and information security (CIS) has become a critical concern from a business viewpoint. CIS is concerned with protecting the confidentiality, integrity, accessible information, when using computer systems. Much research has been conducted on CIS in the past years. However, the attention has been primarily focused on technical problems and solutions. Only recently, the role of human factors in CIS has been recognized. End-user behavior can increase the vulnerability of computer and information systems. In this study, using a large questionnaire survey among endusers, we examine password behavior of end-users.

Password Authentication from a Human Factors Perspective: Results of a Survey among End-Users

Considering that many organizations today are extremely dependent on information technology, computer and information security (CIS) has become a critical concern from a business viewpoint. CIS is concerned with protecting the confidentiality, integrity, accessible information, when using computer systems. Much research has been conducted on CIS in the past years. However, the attention has been primarily focused on technical problems and solutions. Only recently, the role of human factors in CIS has been recognized. End-user behavior can increase the vulnerability of computer and information systems. In this study, using a large questionnaire survey among endusers, we examine password behavior of end-users.

What's Wrong with Hazard‐Ranking Systems? An Expository Note

Two commonly recommended principles for allocating risk management resources to remediate uncertain hazards are: (1) select a subset to maximize risk-reduction benefits (e.g., maximize the von Neumann-Morgenstern expected utility of the selected risk-reducing activities), and (2) assign priorities to risk-reducing opportunities and then select activities from the top of the priority list down until no more can be afforded. When different activities create uncertain but correlated risk reductions, as is often the case in practice, then these principles are inconsistent: priority scoring and ranking fails to maximize risk-reduction benefits. Real-world risk priority scoring systems used in homeland security and terrorism risk assessment, environmental risk management, information system vulnerability rating, business risk matrices, and many other important applications do not exploit correlations among risk-reducing opportunities or optimally diversify risk-reducing investments. As a result, they generally make suboptimal risk management recommendations. Applying portfolio optimization methods instead of risk prioritization ranking, rating, or scoring methods can achieve greater risk-reduction value for resources spent.

Quantitatively assessing the vulnerability of critical information systems: A new method for evaluating security enhancements

This paper proposes a new approach for assessing the organization's vulnerability to information-security breaches. Although much research has been done on qualitative approaches, the literature on numerical approaches to quantify information-security risk is scarce. This paper suggests a method to quantify risk in terms of a numeric value or “degree of cybersecurity”. To help quantitatively measure the level of cybersecurity for a computer-based information system, we present two indices, the threat-impact index and the cyber-vulnerability index, based on vulnerability trees. By calculating and comparing the indices for various possible security enhancements, managers can select the best security enhancement choice, prioritize the choices by their relative effectiveness, and statistically justify spending resources on the selected choice. By qualifying information security quantitatively, the method can also help managers establish a specific target of security level that they can track. We illustrate the use of the proposed methodology on the security of supervisory control and data acquisition (SCADA) systems using data from the SCADA system test bed implemented at the University of Louisville as a case study, and then show the use of the proposed indices on this information system before and after two security enhancements.

Toward a safer and more secure cyberspace

Given the growing importance of cyberspace to nearly all aspects of national life, a secure cyberspace is vitally important to the nation, but cyberspace is far from secure today. The United States faces the real risk that adversaries will exploit vulnerabilities in the nation's critical information systems, thereby causing considerable suffering and damage. Online e-commerce business, government agency files, and identity records are all potential security targets.Toward a Safer and More Secure Cyberspace examines these Internet security vulnerabilities and offers a strategy for future research aimed at countering cyber attacks. It also explores the nature of online threats and some of the reasons why past research for improving cybersecurity has had less impact than anticipated, and considers the human resource base needed to advance the cybersecurity research agenda. This book will be an invaluable resource for Internet security professionals, information technologists, policy makers, data stewards, e-commerce providers, consumer protection advocates, and others interested in digital security and safety.

User Behaving Badly

In its formative years and during the 1990s, 1Global Energy PLC (GE) went through a series of structural changes precipitated by the deregulation of the electricity industry in the UK. The severity of these changes had a disruptive effect on its enterprise information systems, which were found unable to adapt to the new and constantly emerging organizational realities. GE’s experiences illustrate the vulnerability of information systems in turbulent environments, provide for a rich description of the causes of misfit due to contextual change, and establish the ability of a system to flex and adapt as a dependent success variable. In addition, the idiographic details of this interpretive field study raise interesting questions about a number of assumptions we hold regarding the development of information systems and the means by which flexibility can be attained.

Conclusion

Advances in information technologies and their adoption in all sectors of modern life are not problem-free. This study examines the negative impact of those technologies on the central infrastructure systems on which societies depend for the delivery of essential services such as communication, electric power, transportation, and on the information systems that enable governments to function and economic enterprise to flourish. The underlying technologies of networked computer hardware and software are susceptible to massive failure. But unlike physical networks that can be engineered to be robust against natural events, random failures and even local sabotage, information systems are particularly susceptible to malicious acts. Attacks can exploit the connections that are a major virtue and failures in one part can propagate widely. This global character of information system vulnerabilities constitutes severe challenges to both national governments and the private owners of such critical systems. This Adelphi Paper examines the national strategies designed to cope with the emerging societal vulnerabilities and offers appropriate roles for both public and private sectors.

Chapter 5: Strategic Options

Advances in information technologies and their adoption in all sectors of modern life are not problem-free. This study examines the negative impact of those technologies on the central infrastructure systems on which societies depend for the delivery of essential services such as communication, electric power, transportation, and on the information systems that enable governments to function and economic enterprise to flourish. The underlying technologies of networked computer hardware and software are susceptible to massive failure. But unlike physical networks that can be engineered to be robust against natural events, random failures and even local sabotage, information systems are particularly susceptible to malicious acts. Attacks can exploit the connections that are a major virtue and failures in one part can propagate widely. This global character of information system vulnerabilities constitutes severe challenges to both national governments and the private owners of such critical systems. This Adelphi Paper examines the national strategies designed to cope with the emerging societal vulnerabilities and offers appropriate roles for both public and private sectors.

Chapter 1: The Vulnerabilities of National Infrastructures

Advances in information technologies and their adoption in all sectors of modern life are not problem-free. This study examines the negative impact of those technologies on the central infrastructure systems on which societies depend for the delivery of essential services such as communication, electric power, transportation, and on the information systems that enable governments to function and economic enterprise to flourish. The underlying technologies of networked computer hardware and software are susceptible to massive failure. But unlike physical networks that can be engineered to be robust against natural events, random failures and even local sabotage, information systems are particularly susceptible to malicious acts. Attacks can exploit the connections that are a major virtue and failures in one part can propagate widely. This global character of information system vulnerabilities constitutes severe challenges to both national governments and the private owners of such critical systems. This Adelphi Paper examines the national strategies designed to cope with the emerging societal vulnerabilities and offers appropriate roles for both public and private sectors.

Chapter 3: Implementing National Strategies: Actions and Actors

Advances in information technologies and their adoption in all sectors of modern life are not problem-free. This study examines the negative impact of those technologies on the central infrastructure systems on which societies depend for the delivery of essential services such as communication, electric power, transportation, and on the information systems that enable governments to function and economic enterprise to flourish. The underlying technologies of networked computer hardware and software are susceptible to massive failure. But unlike physical networks that can be engineered to be robust against natural events, random failures and even local sabotage, information systems are particularly susceptible to malicious acts. Attacks can exploit the connections that are a major virtue and failures in one part can propagate widely. This global character of information system vulnerabilities constitutes severe challenges to both national governments and the private owners of such critical systems. This Adelphi Paper examines the national strategies designed to cope with the emerging societal vulnerabilities and offers appropriate roles for both public and private sectors.

Chapter 2: Strategic Defence Options

Advances in information technologies and their adoption in all sectors of modern life are not problem-free. This study examines the negative impact of those technologies on the central infrastructure systems on which societies depend for the delivery of essential services such as communication, electric power, transportation, and on the information systems that enable governments to function and economic enterprise to flourish. The underlying technologies of networked computer hardware and software are susceptible to massive failure. But unlike physical networks that can be engineered to be robust against natural events, random failures and even local sabotage, information systems are particularly susceptible to malicious acts. Attacks can exploit the connections that are a major virtue and failures in one part can propagate widely. This global character of information system vulnerabilities constitutes severe challenges to both national governments and the private owners of such critical systems. This Adelphi Paper examines the national strategies designed to cope with the emerging societal vulnerabilities and offers appropriate roles for both public and private sectors.

Chapter 7: The Broader Applicability of the Strategic Framework

Advances in information technologies and their adoption in all sectors of modern life are not problem-free. This study examines the negative impact of those technologies on the central infrastructure systems on which societies depend for the delivery of essential services such as communication, electric power, transportation, and on the information systems that enable governments to function and economic enterprise to flourish. The underlying technologies of networked computer hardware and software are susceptible to massive failure. But unlike physical networks that can be engineered to be robust against natural events, random failures and even local sabotage, information systems are particularly susceptible to malicious acts. Attacks can exploit the connections that are a major virtue and failures in one part can propagate widely. This global character of information system vulnerabilities constitutes severe challenges to both national governments and the private owners of such critical systems. This Adelphi Paper examines the national strategies designed to cope with the emerging societal vulnerabilities and offers appropriate roles for both public and private sectors.

Introduction

Advances in information technologies and their adoption in all sectors of modern life are not problem-free. This study examines the negative impact of those technologies on the central infrastructure systems on which societies depend for the delivery of essential services such as communication, electric power, transportation, and on the information systems that enable governments to function and economic enterprise to flourish. The underlying technologies of networked computer hardware and software are susceptible to massive failure. But unlike physical networks that can be engineered to be robust against natural events, random failures and even local sabotage, information systems are particularly susceptible to malicious acts. Attacks can exploit the connections that are a major virtue and failures in one part can propagate widely. This global character of information system vulnerabilities constitutes severe challenges to both national governments and the private owners of such critical systems. This Adelphi Paper examines the national strategies designed to cope with the emerging societal vulnerabilities and offers appropriate roles for both public and private sectors.

Chapter 6: Protecting Infrastructures in the US and the UK

Advances in information technologies and their adoption in all sectors of modern life are not problem-free. This study examines the negative impact of those technologies on the central infrastructure systems on which societies depend for the delivery of essential services such as communication, electric power, transportation, and on the information systems that enable governments to function and economic enterprise to flourish. The underlying technologies of networked computer hardware and software are susceptible to massive failure. But unlike physical networks that can be engineered to be robust against natural events, random failures and even local sabotage, information systems are particularly susceptible to malicious acts. Attacks can exploit the connections that are a major virtue and failures in one part can propagate widely. This global character of information system vulnerabilities constitutes severe challenges to both national governments and the private owners of such critical systems. This Adelphi Paper examines the national strategies designed to cope with the emerging societal vulnerabilities and offers appropriate roles for both public and private sectors.

Chapter 4: Selecting a Strategy

Advances in information technologies and their adoption in all sectors of modern life are not problem-free. This study examines the negative impact of those technologies on the central infrastructure systems on which societies depend for the delivery of essential services such as communication, electric power, transportation, and on the information systems that enable governments to function and economic enterprise to flourish. The underlying technologies of networked computer hardware and software are susceptible to massive failure. But unlike physical networks that can be engineered to be robust against natural events, random failures and even local sabotage, information systems are particularly susceptible to malicious acts. Attacks can exploit the connections that are a major virtue and failures in one part can propagate widely. This global character of information system vulnerabilities constitutes severe challenges to both national governments and the private owners of such critical systems. This Adelphi Paper examines the national strategies designed to cope with the emerging societal vulnerabilities and offers appropriate roles for both public and private sectors.

Call for papers-special section on: quality/reliability engineering of information systems

THE objective of this special section is to present imperative needs for important advances in developing quality/reliability engineering approaches to dependable information systems. As people increasingly rely on information systems to support critical operations in defense, banking, telecommunication, transportation, electric power, etc., the security & dependability of information systems are necessary. However, information systems have encountered many quality/reliability problems caused by both internal factors (e.g., system vulnerabilities) and external factors (e.g., intrusions by malicious hackers). Special characteristics of information systems have presented both considerable challenges and unique opportunities for researchers in the quality/reliability engineering. This special section will help researchers gain a better understanding of quality/reliability problems with information systems, and thus draw the attention and interest of researchers in this new frontier. Focus: • Design of software programs (including mobile code) and information infrastructures (including network architectures) to overcome security vulnerabilities of information systems. • Detection of intrusions into information systems, in a scalable & robust manner to provide early and reliable warnings. • Tolerance of intrusions and their negative impacts on information systems, to maintain the timely & correct functioning of information systems. Of special interest are research papers that extend conventional quality/reliability engineering theories & techniques, e.g.: • Statistical process control • Risk analysis and assessment • Probabilistic reasoning • Quality/reliability modeling of systems and activities • Engineering design for quality/reliability, or that apply innovative quality/reliability engineering approaches for these topics. Papers not falling in these topics but relating to quality/reliability engineering of information systems are also welcome.

Safeguarding databases

The thrust of management information system (MIS) operations is to keep an information system running smoothly and to ensure services are delivered in an uninterrupted, reliable and secure fashion. This poses a special challenge in today′s environment of computer misuses. Focuses on four main areas normally addressed when protecting a company′s most vital asset – its database. These are: information system vulnerability; computer crime; employee access; and personnel policies. Examines research pertaining to safeguarding data, software and hardware from deliberate computer‐based information security breaches.