Information System Vulnerabilities Research Articles

Risk assessment methodology for information systems, based on the user behavior and IT-security incidents analysis

Obtaining trustworthy estimates for the reliability and security of corporate information systems is an urgent problem. It is not enough just to have estimations for security of software and hardware components. Constant monitoring of a user’s actions and a comprehensive analysis of his (her) behavior in the system are necessary. The novelty of the proposed approach consists in application of psychological profiling methods, models of neuro-fuzzy inference and mechanisms of multidimensional data analysis. Vulnerabilities of computer information systems are determined on the basis of a retrospective analysis of information security incidents. The user’s profile is based on the analysis of his (her) behavior. The patterns of this behavior in a particular computer information system are determined. The work studies the influence of intentional and unintentional user behavior on the probability of information security threats and identifies the threshold values of the number and frequency of the events indicating an information security incident. Such data helped to build a model to search for an intruder during an information security incident. The proposed method was tested in the MatLab software package. The experimental calculations of potential vulnerabilities were performed in the “1C: Enterprise 8.3” system of programs. As the initial data for the calculation, we used the log entries of the actions of more than 100 users with different roles for a period of one year. It is noted that the risk management policy should include a continuous analysis of user actions, as well as the consequences of these actions, in order to identify the goals of such behavior and prevent information security incidents. It is shown that when implementing the proposed methodology, it is necessary to constantly identify users who should not have access to sensitive information from the inside, assuming that a current violator is located within the boundaries of a computer information network. The application of the proposed methodology allows us to increase the level of information security with a constant change in the “working environment” of the information system. It will help to significantly simplify the process of making an objective and reasonable management decision about the most likely implementation of information security incidents. This allows one to take appropriate preventive measures in advance.

A Method for Determining the Potential of an Information Security Intruder and Realizable Software Vulnerabilities.

Currently, many methodological documents have been developed that regulate approaches to the development of models of threats to information security. for information systems that process information of a different nature. There are different methods of threat development and intruder model building proposed by information security regulators, depending on the direction of their activity. To support decision-making in the process of threat modeling, a databank of information security threats has been developed. However, there are a number of contradictions in existing approaches, while the methods for identifying threats and building a model of an intruder, in most cases, involve the involvement of experts to assess the factors and conditions for the emergence of threats. In the existing methods, there is no relationship between the violator of information security. and software vulnerabilities in information systems, which does not allow building an adequate threat model without the involvement of qualified experts. The purpose of this work is to determine the potential of an information security violator. depending on its capabilities and assessing the impact of this potential on the implementation of software vulnerabilities in information systems.

Vulnerability management of corporate information systems based on QUALYS solutions

The article analyzes the problem of cybersecurity of corporate information systems and defines the purpose and objectives of their protection. The analysis of technology of management of vulnerabilities of corporate information systems is carried out. Methods and tools for managing vulnerabilities of corporate information systems based on the Qualys solution are studied. The purpose, main functions and composition of Qualys solution software are defined. A variant of managing corporate information system vulnerabilities based on the Qualys solution has been developed.

Methods and tools for managing vulnerabilities of corporate information system based on machine learning

The article highlights the general concepts of IT infrastructure, corporate information system, cyberattacks and cyberattack statistics. Vulnerability management is also described as a process of harm reduction from the implementation of threats, what problems are faced by information security professionals and ways to solve them. The possibility of using artificial intelligence in the field of information security, advantages, disadvantages, problems are considered. A hypothetical solution is proposed by developing methods and tools for managing vulnerabilities in corporate information systems using machine learning technologies.

Защита информации для предотвращения отказов элементов автоматизированных информационно-управляющих систем энергетических объектов

Introduction. One of the most important tasks in achieving reliability and safety of power supply as an element of ensuring technospheric security is the modernization of automated information and control systems for the transmitting and receiving sides, which ensures resistance against known types of attacks. The aim of the study is to solve the problem of secure information exchange within the framework of automated information and control systems, taking into account the low security of technological communication channels of power facilities to achieve the reliability and safety of power supply as an element of ensuring technospheric security based on the development of intelligent methods for detecting dangerous influences and intrusions to neutralize information security threats in relation to commands to control power equipment. Research methods. Within the framework of the study, general scientific and special methods of scientific knowledge were used, including analysis, synthesis, generalization, which were based on the main provisions and patterns of behavior of systems and information theory. Research results. It is proposed to create innovative algorithms for controlling power equipment, built on the basis of libraries of reference commands and reference sequences of commands used to replace commands intentionally or accidentally distorted by erroneous bits, as well as diagnosing vulnerabilities of information and control systems to ensure the correctness of the process of controlling power equipment. Conclusion. The listed technologies will make it possible to create a new class of efficient algorithms for power equipment control, built on the basis of intelligent methods for detecting dangerous influences and intrusions to neutralize information security threats in relation to control commands based on the analysis of high-level behavioral characteristics of the protected information and control system with the function of controlling the transition of the controlled system to the next a condition that depends on the exact correspondence of the generated commands to the reference commands and the reference sequence of commands, which will ensure the correctness of the control process of power equipment. Key words: energy, information and control networks, reliability, security, power supply, algorithms, monitoring, protection, information.

Approach of the information properties destruction risks assessing based on the color scale

One of the urgent tasks of today is information protection as defined by the regulations of our state in the field of information security and cybersecurity. The protection of information is to ensure the preservation of its properties such as confidentiality, integrity, and accessibility. In the process of assessing the information security, the priorities of its protection are determined, taking into account the degree of restriction of access to it. Information security risks are assessed to select effective measures and remedies. The existing assessment methods are analyzed, based on estimates of the magnitude of possible damage from the occurrence of an information security incident and the probability or probability of its occurrence. However, none of the forms of formalizing the risk level reflects which properties may be violated within the incident. That is, the general presentation of the risk does not allow its prompt processing. With the use of modern computer technology, it has become possible to create dynamic images of the level of risk. The basis of computer graphics is an additive model of the transfer of red, green, and blue. With this in mind, a method has been developed to assess the risks of violating the properties of information. Its use will distinguish the properties of information by the set color. With the advent of information about new vulnerabilities in information and telecommunications systems, the color may change, which will signal a change in the level of risk for a particular property of information. This approach to information security risk management facilitates prompt decision-making on risk management and maintains the information security process at the appropriate level. At the same time, the use of the proposed method will allow to record changes in the numerical values of colors and, as a consequence, to find the rate of change of the level of information security risk. Its average value can be used to predict the resilience of the protection system to information security incidents. Therefore, the speed of change in the level of information security risk can expand the list of parameters for determining the index of information system development and the basis for updating the planned costs of the organization to ensure information security.

CYBERSECURITY OF "SMART CITIES": SOCIAL ASPECTS, RISKS OF DEANONYMIZATION AND DOXING

The paper analyzes possible risks and threats posed by the transition from modern cities to smart cities. The concept and scheme of doxing implementation are analyzed. Moreover, the essence of deanonymization is revealed and threats to the privacy and security of smart city residents associated with these processes are identified. Furthermore, the reasons for the growth of doxing practice are clarified. The social aspect of the cybersecurity of a smart city is seen primarily in the increased risks of privacy disclosure, which can lead to deanonymization, which can later be used for doxing, cyberbullying, blackmail or social engineering schemes. This demands that personal data must not only be protected by reliable cryptographic and technical measures but also - where it allows by work tasks - be specifically or partially impersonalised. Also, when planning personal data protection in smart city informational ecosystems, it should be considered that such protection will be existing in the context of an overall eco-information system of the city. Therefore, the one's always set priorities balanced between data protection, identify threats, measures and mechanisms for their implementation and daily routine tasks of system administration. The article analyzes cases and schemes of deanonymization, shows the vulnerability of modern information and communication systems to obtain data that can be used by an attacker. Based on the analysis and taking into account the specifics of the functioning of information ecosystems of smart cities, the main recommendations for protecting data stored in information systems are developed and systematized, which will reduce the risks of hacking such data and minimize harm from deanonymization and doxing. Finally, the authors proved that deanonymization is a sequential hacking process, and doxing is a hacking process and publishing private information. Such information can be obtained by collecting and analyzing open ("white"), stolen ("black") and stolen by third parties, but conditionally freely available ("Gray") sources of information. With the development of the smart city infrastructure, the amount of information collected, stored and processed will grow. This will lead to an increase in the "digital footprint" of every user of information system, that is, almost everyone who lives in the city.

Network Parameter Coordinated False Data Injection Attacks Against Power System AC State Estimation

False data injection (FDI) attacks have recently been introduced as an important class of cyber-attacks against power system state estimation. Utilizing vulnerabilities in information systems, attackers can inject well-constructed false data and stealthily misguide results of state estimation. However, only measurements, such as power flows and bus injections, are coordinately modified in FDI attacks, which may result in a larger number of modified measurements in constructing such attacks. In this article, we propose a network parameter coordinated false data injection (NP-FDI) attack to reduce the number of attacked measurements, where expected changes of system states and modifications of network parameters are well coordinated. Analysis of minimal attack set at a single line gives feasible conditions in reducing the number of attacked measurements. A sparse attack strategy is designed to obtain the minimal attack set of the whole grid, which can also be applied to cases with incomplete topology information. An extension to NP-FDI attacks with incomplete line impedance is presented, where the required line impedance can be estimated from local measurements adjacent to the targeted branch. Based on simulations in the IEEE 14-bus and IEEE 118-bus test systems, performance of the proposed NP-FDI attacks on sparsity and stealth are evaluated.

Construction and Research of Comprehensive Management Platform for Network Security of China University Information System

As China moves rapidly toward the country with strong information technology. Colleges and universities, as an important part of the country, are accelerating the realization of a more convenient and fast information-based intelligent campus. The degree of informatization has also become an important stander for measuring the world "Double-First Class" universities. Faced with the increasing information system of colleges and universities, how to achieve unified security management has become an important issue that colleges and universities need to solve urgently. This article based on the information environment of Beijing Jiaotong University and the current operation and maintenance status of information systems. Through the methods and strategies used in daily work, this article combines the information system filing, hierarchical management, system vulnerabilities, web application vulnerabilities, security notice into one single platform. The information system with security risks is notified to the responsible person by SMS or email. This platform has realized a complete process from information system construction, filing, affiliated units, functions, open ports, vulnerability scanning, system operation, system rectification and upgrading. It reducing the switching of security devices from multiple platforms and improving the accuracy of detecting vulnerability.

Vulnerabilities of Information Systems

Vulnerability of Information Systems is a major concern these days in all spheres of financial, government and even private sectors. There have been limited attempts in addressing the people who use the computers though they are the greatest loophole in information systems security. Even though most of the organizations have realized the value of information and the part it plays in the success of the business, yet only a few take adequate measures in ensuring the security of their information, preventing unauthorized access, securing data from intrusion and unapproved disclosures etc. This paper examines and addresses the threats end-users pose to systems security and provides solutions for two of the most dangerous vulnerabilities: Buffer Overflow, SQL Injection.

Linkboost: A Link Prediction Algorithm to Solve the Problem of Network Vulnerability in Cases Involving Incomplete Information

The vulnerability of network information systems has attracted considerable research attention in various domains including financial networks, transportation networks, and infrastructure systems. To comprehensively investigate the network vulnerability, well-designed attack strategies are necessary. However, it is difficult to formulate a global attack strategy as the complete information of the network is usually unavailable. To overcome this limitation, this paper proposes a novel prediction algorithm named Linkboost, which, by predicting the hidden edges of the network, can complement the seemingly missing but potentially existing connections of the network with limited information. The key aspect of this algorithm is that it can deal with the imbalanced class distribution present in the network data. The proposed approach was tested on several types of networks, and the experimental results indicated that the proposed algorithm can successfully enhance the destruction rate of the network even with incomplete information. Furthermore, when the proportion of the missing information is relatively small, the proposed attack strategy relying on the high degree nodes performs even better than that with complete information. This finding suggests that the nodes important to the network structure and connectivity can be more easily identified by the links added by Linkboost. Therefore, the use of Linkboost can provide useful insight into the operation guidance and design of a more effective attack strategy.

INFORMATION TECHNOLOGIES - THE CHALLENGE OF THE TIME

This article focuses on information technologies and gives their classification. The advantages and disadvantages of the introduction of the latest information, telecommunication and cybernetic technologies are highlighted. The authors draw attention to the necessity to unite efforts of all countries regarding information security. It is emphasized that in modern conditions the information systems of one country are part of the global system, which in turn leads to the vulnerability of information systems and the possibility of external influence on politics and the economy. Purpose of the article: to show the positive and negative consequences of the achievements of information exchange. Methods: general scientific methods of theoretical knowledge, as well as general logical methods and research techniques are used. Results: In modern conditions of globalization and integration of various world systems, information security issues should remain a priority and be considered in close cooperation of all countries.

ANALYSIS OF MATHEMATICAL MODELS OF INVESTMENT STRATEGIES IN THE UNIVERSITY ON CYBER SECURITY SYSTEMS

The article provides an overview and analysis of mathematical models for choosing investment strategies in cybersecurity systems of informatization objects (IO) as a particular example of educational information systems (IS). The purpose of the work is the analysis and comparison of known and new investment models for the IO protection. It is shown that previous researches have often purely economic nature and do not take into account the trends relating to the introduction of innovative information technologies in the control and decision-making procedures of the IO cybersecurity tasks. It is shown that the optimal value of resources allocated for the IO protection and cybersecurity depends not only on the vulnerabilities of IS, but also on the cost of information should be protected. All this makes it relevant to develop new models for the decision-making support on the IO protection and cyber-security investment. The task, in particular, can be solved through the use of new information technologies and computer-based decision support systems (DSS). As a variant, it was proposed to use as a basic mathematical model for DSS the models based on game theory.

A General Framework to Understand Vulnerabilities in Information Systems

Firms and organizations are increasingly facing security issues related to vulnerabilities in their information systems. Firms, especially small and medium-sized enterprises, usually have very limited security resources and thus have difficulty understanding vulnerabilities and fixing them accordingly. This study aims to build a general framework that can help firms understand the characteristics of vulnerabilities in information systems: for instance, what category a specific vulnerability belongs to, what potential risks it poses, and what the key clues are to addressing it. To this end, we collect data on real vulnerabilities that have emerged in firms’ information systems from a popular vulnerability report platform. Features are extracted at four different levels, namely, the word, phrase, topic, and record levels. The experimental results show that the general framework helps characterize the modes and patterns of various types of vulnerabilities. This study contributes to the security literature by providing a deeper understanding of the characteristics of vulnerabilities and their related suggested solutions. Firms can apply this framework to ensure information security.

ЕТИЧНИЙ ХАКІНГ У БІЗНЕС-КОМПАНІЯХ ТА ВИЯВЛЕННЯ ВРАЗЛИВОСТЕЙ В ІНФОРМАЦІЙНИХ СИСТЕМАХ ДЕРЖАВНИХ ОРГАНІВ УКРАЇНИ

Urgency of the research. The rapid development of IT technologies and intensive informatization of all spheres of society leads to the emergence of new information threats, so information security is one of the most important tasks of the IT industry. An important element in the development of new methods of information protection is the search for vulnerabilities in information systems. Target setting A promising area in the field of information security is the development of active methods of providing protection, among which we can highlight the search for vulnerabilities of information systems. Actual scientific researches and issues analysis. Ethical hacking and penetration testing play a significant role in modern information security research, leaving in the shadows such an effective tool as volunteer research into the vulnerabilities of public information resources. Uninvestigated parts of general matters defining. Currently, in the works of domestic and foreign scientists, insufficient attention is paid to the opportunities for volunteers to study the vulnerabilities of state information resources. The research objective. The purpose of the article is to highlight the differences between approaches to cybersecurity in business structures and government agencies of Ukraine. The statement of basic materials. Customers are providing more and more personal information to IT companies, and companies need to protect it. But virtually every program has vulnerabilities, so personal customer data can end up in the hands of criminals. Conclusions. An indicator of the work of cyberpolice is the detection of crimes. Yes, cyberpolice does a lot of good, such as catching fraudsters and distributors of child porn. However, specific computer crimes have been uncovered. That is, the level of protection by the state of both its own resources and citizens from criminal encroachments is still low.

Data Security

Data security in the information age is a critical facet in the integrity and reliability of the various information systems making up value structures of businesses, organizations etc. Aside from professionals directly involved with securing data within these systems, the importance of data security is not readily apparent to the everyday user of devices in the information systems. The purpose of this literature review is to highlight challenges related to data security and business information systems in conjunction with digital literacy. An extensive literature review was conducted with the aim of identifying and describing scenarios of technology misuse as well as vulnerabilities in vital business information systems. A gap in awareness continues to plague those who leverage information systems for its myriad uses because everyday users will in most cases dismiss data security advice as alarmist or jargon-laden. This falls in line with a 2018 cyber security survey from Statista which showed that 22% of data security tasks was preventing malware while 17% of tasks were dedicated to preventing social engineering and phishing attacks. This literature review will describe possible data insecurity solutions as well as potential areas of further research. The paper will point out the importance of digital literacy as well as recommendations for its improvement in society and also ongoing research in that regard. The essence of this literature review is to identify certain everyday information systems such as decision support systems and transaction processing systems; while pointing out vulnerabilities and threat nature i.e. technical or non-technical and also demonstrating the importance of digital literacy and lack thereof.

Design of Information System Vulnerability Governance Platform Based on Distributed Asset Acquisition and Vulnerability Verification Radar

There are a large number of information vulnerabilities in enterprise information systems. Many hackers use vulnerabilities to obtain enterprise or personal information, which greatly jeopardizes enterprise information security. This paper proposes a design method of integrated information system vulnerability governance platform based on distributed asset acquisition and vulnerability verification radar, discusses the business flow and architecture of the vulnerability governance platform, the logical relationship between modules, business function modules, and the technical framework for building platforms.

Risk and Vulnerability Analyses for the protection of Information for Future communication security Based Neural Networks

Information security risk analysis has increased the number of complex issues of information security, requiring the participation of specialists in different areas of knowledge. This leads to inability of such systems to evaluate the security state of computer system thoroughly.Present paper on the intellectual to risk analysis and vulnerability of information systems. The aim of the study is to eliminate subjectivity in the assessment of risks and reduction of time for the process of risk analysis and vulnerability of the computer system. The mathematical tools of artificial neural network and probabilistic attack tree were used in the research. In order to evaluate the efficiency of the developed system, the security assessment for the Windows systems was performed. As the result the conformity between the real security of the information system and the assigned evaluations was proved. © 2018 JASET, International Scholars and Researchers Association

Секрет успіху США у сфері інформаційної безпеки

У ході дослідження виявлено багато чинників, які сприяли проведенню успішної інформаційної політики США. Серед них виділено нормативно-правове регулювання, удалу політику державних органів й адміністрації президента, інформованість і довіру населення, кібер-страхування й міжнародну співпраця.
 Наголошено, що США має потужну законодавчу базу. Початок розвитку інформаційної безпеки закладено ще в першій половині ХХ ст. Виокремлено, що від адміністрації президента залежить подальший курс усієї держави, тому двоє останніх приділяли багато уваги проблемі кібертероризму. Вони визнавали, що кіберзлочин і кібершпигунство становлять загрозу національній безпеці країни.
 Охарактеризовано законодавство США у сфері зовнішньої інформаційної безпеки, що включає сукупність федеральних законів, законів штатів та нормативних актів, які разом створюють правову основу для утворення й здійснення державної політики у сфері інформаційної безпеки. Виокремлено основні з них: «Національну стратегію захисту кіберпростору» (2003), «Огляд з кібербезпеки» (Cyber Security Review, 2009), «Ініціативу зі всеосяжної національної кібербезпеки» (2010), Стратегію кібербезпеки США 2011 р., Закон CISPA 2012 р. («Cyber Intelliggence Sharring and Protection Act»).
 Проаналізовано п’ять основних напрямів діяльності з питань інформаційного захисту, які визначає Стратегія: постійний моніторинг і безперервна оцінка загроз та вразливих місць державних інформаційних систем; здійснення національних заходів зі зменшення загроз й уразливості кіберпростору; уживання заходів щодо захисту інформаційних систем органів влади; забезпечення якісної освіти та навчання з питань захисту кіберпростору; співробітництво з питань національної безпеки й безпеки міжнародного кіберпростору.
 Доведено, що кібер-страхування стає поширене в межах країни, тим самим зменшує шанси кіберзлочинців на проведення кібератак. Міжнародна співпраця є однією з важливих складових частин забезпечення інформаційної безпеки.

Hacking Our Securities Disclosure System: The Need For Federal Broker-Dealer Disclosure Requirements Vis-À-Vis Cyber Incidents

Broker-dealers provide investors with the platform to access security markets. To facilitate this access, clients entrust them with sensitive information, including their names, addresses, and social security numbers. Cyberattacks on the financial sector have advances in sophistication and grown more frequent due to technological advances, adjustments in firm business models, and changes in customer behavior, causing new vulnerabilities in firm information systems. However, even with this increase of cyberattacks against broker-dealers, the lack of public disclosure requirements means little is known about the extent of broker-dealer cyber safety. Under current SEC regulations, broker-dealers must take preventative action, such as establishing safeguards against cyber breached and maintaining security programs that can identify red flags. However, after a cyberattack occurs, firms are only required to file a Suspicious Activity Report to FinCEN, a bureau within the Treasury Department. Unlike public companies and banks, broker-dealers do not have any federal disclosure requirement to the general public for cybersecurity incidents. Addressing this gap requires a comprehensive examination of the tradeoffs involved in implementing broad new federal disclosure requirements for broker-dealers following cybersecurity incidents.