Метод назначения прав доступа к приложениям в корпоративной мобильной сети

The competency to use mobile devices for work-related tasks gives advantages to the company productiveness and expedites business processes. Thus Bring Your Own Device (BYOD) setting emerge to enable work flexibility and technological compatibility. For management, employees’ productivity is important, but they could not jeopardise the security of information and data stored in the corporate network. Securing data and network becomes more complex tasks as it deals with foreign devices, i.e., devices that do not belong to the organisation. With much research focused on pre-implementation and the technical aspects of mobile device usage, post-implementation advancement is receiving less attention. IS audit as one of the post-implementation mechanisms provides performance evaluation of existing IS assets, business operations and process implementation, thus helping management formulating the best strategies in optimising IS practices. This paper discusses the feasibility of IS audit in assessing mobile device security by exploring the risks and vulnerabilities of mobile devices for organisational IS security as well as the perception of Information system management in mobile device security. By analysing related literature, authors pointed out how the references used in the current IS audit research address the mobile device security. This work serves a significant foundation in the future development in mobile device audit.

Healthcare service delivery, especially in terms of safeguarding personal data, requires ensuring the confidentiality of information. In this regard, establishing cybersecurity systems that ensure information security is highly necessary. The rapid advancement of technologies increases the likelihood of cyberattacks, and particularly, AI-supported threats can cause serious harm in service delivery. In the current era, attacks not only come from humans but also from AI tools, posing threats to information security. Considering that AI technology is expected to further advance in the future, it's evident that this technology could become even more menacing. This is especially pertinent to the healthcare sector. Cyberattacks can lead to breaches in healthcare system data and disrupt service delivery to the extent of paralyzing the healthcare system. Our study, which includes case examples, is a compilation-type research. Within the scope of our research, searches were conducted using the keywords healthcare sector, information security, and cybersecurity on Google Scholar and Web of Science. The most current topic headings intersecting information security with the healthcare sector were examined based on the articles found on the subject. Our study evaluates the following topics in order: information and cyber security concepts, cyber threats and public services, electronic health records and security, major cyber-attacks in the health sector, why healthcare data is attractive for cyberattacks, information security in the artificial intelligence era, and information security policies for Türkiye and other countries in the world. Ransomware holds a significant place among cyberattacks. Therefore, users within the healthcare system are advised to pay particular attention to this issue. Attacks generally occur via email, starting with enticing the user into a cyber-threat through email. Artificial intelligence can also be used to get rid of such spam mails. Hence, it is strongly recommended that users in the healthcare sector undergo training on this matter. These trainings should be conducted regularly and continuously, with the institution's IT center offering an institutional approach in this regard.

Subject. In the modern information society, ensuring information security is one of the key tasks of organizations, especially in the context of growing cybersecurity threats. Every year, companies face increasingly complex and diverse threats that can cause significant damage to both the financial resources and reputation of the organization. In this context, ensuring information security becomes an important strategic task for enterprises in various fields of activity. Information security plays a critical role in protecting information confidentiality, ensuring the integrity and availability of information, as well as the security of information systems and networks. Goal. The main goal of the research in this work is a comprehensive study of the technology for ensuring the protection of information, preventing unauthorized actions with it, in particular, its use, disclosure, distortion, modification, research and destruction, as well as the correct strategy for information protection of data from external and internal threats. Method or methodology. The research is based on general scientific methodology, which involves the use of a systematic approach and general scientific methods of cognition. The results of the work. In the course of the study, the authors of the article tried to resolve the problem of the interdependence of information security and the strategy for information protection of data from external and internal threats by structuring the subject area of information security policy, which made it possible to set priorities in solving the problems of ensuring the required level of security of information resources and supporting infrastructure in the context of the development of digital technologies. When analyzing problems related to information security, the authors note the importance of mechanisms for generating new solutions that allow, at a minimum, to adequately respond to threats to information security or to anticipate new threats and be able to resist them. Conclusions. The study found that information security plays a critical role in the modern world, ensuring data protection, privacy and sustainability of business processes. In an environment of constantly changing and evolving threats, maintaining a reliable information security system becomes an integral part of the success of organizations and personal security. This is an important step towards creating an information security management system at the enterprise, with the help of which constant and effective monitoring of the effectiveness of security measures is carried out, timely correction of actions taken and revision of existing provisions to ensure maximum security.

Problem description . One of the areas of digital transformation of Russian society is the development and implementation of the National Digital Ruble System (DR) in the credit and financial sphere (CFS) of the economy of the Russian Federation. The National DR system should be based on the information technology infrastructure (ITI) for ensuring information security (IS). In fact, the ITI for ensuring IS is a trust infrastructure (ITIT) based on the public key infrastructure (PKI). ITIT should have a number of functional properties, including identification and authenti­cation of objects and subjects of electronic financial transactions, protection of the integrity and confidentiality of data and the electronic financial transactions themselves, implementation of the principle of non-repudiation of the parties to information interaction. At the same time, the absence of ITIT in the National DR System can completely discredit the very idea of digitalization of the CFS, associated with the absence of any guarantees of reliability and trust in the National DR System, based on the implementation of the entire range of methods and means of cryptographic protection of information (electronic financial transactions), including systems for managing cryptographic keys. The absence of comprehensive protection of the National DR System will entail risks and problems in ensuring IS, which can negatively affect individuals, groups, organizations, sectors of the economy and society as a whole. G oals . To propose and analyze a heuristic model of DR and a model of functional and structural ITIT, which solves the main problems of ensuring IS of the National DR System, associated primarily with confirmation of the authenticity and ownership of DR, as well as the protection of electronic payment transactions and the possibility of withdrawing (withdrawing from circulation) DR immediately (on-line) after detection of its compromise. R esults . The article presents a heuristic (hypothetical) model of C₽ and describes the DR format (as an information object) that includes cryptographically linked information blocks and public key certificates issued by accredited certification authorities using electronic signatures. A functional and structural model of the ITIT of the National DR System is proposed. The composition, main elements of the ITIT structure, as well as their goals and implemented functions are described. The results of the analysis of trust assurance based on the PKI of the Bank of Russia (BR) are presented. Practical significance . The heuristic (hypothetical) model of DR, the functional and structural model of the ITIT of the National DR System and the results of the analysis of trust assurance based on the PKI of the BR are of great practical significance in the development and implementation of the National DR System in the CFS of the Russian Federation economy. C onclusions . The results obtained will increase the level of security and trust in the National DR System of the citizens, businesses and credit and financial institutions.

TOLIMAC is a research project funded by the Telematics for Libraries Programme of the EU and is developing a system to provide controlled access to, and management of, networked information resources and other services in a library environment. The system is based on smart cards and encryption technology integrating management functionalities ‐such as user identification, remote access control, electronic payment‐, and security requirements ‐such as secure information transfer and financial transactions, document integrity. The system also enables libraries to adjust user access rights, and charges for available electronic resources, whether local or remote, according to user categories. The system is based on standards. It has a Web interface. The pilot system will provide users from three university libraries with access to an electronic document delivery service based at INIST (France), including search, order and delivery of journal articles, as well as payment facilities by means of the electronic purse on the user's smart card.

The article considers the legal mechanisms for ensuring information security. It has been proven that today, more than ever, when there is a war in Ukraine, the issue of ensuring information security becomes especially relevant and significant, as the information space becomes a “battlefield” on a par with the war front. Enemy forces actively use informational and psychological operations to destabilize the situation inside our country, create panic, spread fakes and undermine trust in state institutions. In these conditions, the state’s policy becomes important, which should be integral and effective in countering these threats. An effective state policy in the field of information security will help ensure society’s resilience to information threats, strengthen trust in state institutions, and maintain stability in crisis conditions. The author’s understanding of information security is offered as a state of security of information resources and information systems, which ensures their confidentiality, integrity, availability and reliability, as well as protection against unauthorized access, disclosure, modification, destruction and other forms of abuse that may lead to a violation of national security, economic stability and social order. The main components of information security, which are the basis for information security for the state as a whole, individual bodies or private enterprises, are called confidentiality, integrity and availability. The main components of the mechanism for ensuring information security, in the opinion of the author, should be: technical (creation of appropriate technical infrastructure to ensure the functioning of information security), political (development of state policy aimed at ensuring information security) and legal (adoption of high-quality normative legal acts that will determine all information security measures). These three components complement each other and are key to creating an effective system of protection against information threats.

A company planning to implement a public cloud solution should be aware of the risks associated with cloud computing. This is due to the rapidly evolving threats to cloud security that are emerging at an increasing rate in recent years, also to multi-tenant and open nature of the public cloud. Cloud computing is a powerful technology in IT environment and to take advantage of all the benefits of cloud computing, it is necessary to have security and privacy requirements for the implementation and use of the cloud. A risk analysis must be done initially with a cloud provider in order to identify the existing vulnerabilities and to implement the measures to counter those threats. This paper explores the key issues surrounding cloud security, and passes on valuable guidance about not only information security and broadly risk. Also, it will help providers to make informed security decisions about their diverse cloud set-ups and better understand how to reap all the benefits of cloud without compromising their organizations’ security. As well, it discusses the security requirements, and various risks related to the public cloud.

The article defines the essence of information security as an essential component of the economic security of a credit institution on the basis of many definitions of the concepts of "information security" and "economic security" formulated by different researchers taking into account different points of view. Special attention is paid to new regulatory documents regulating the security of the critical information infrastructure of the Russian Federation, ensuring the information security of the credit and financial sector, improving the operational risk management system and comprehensive modernization of corporate risk management systems in credit institutions, taking into account the new conditions for ensuring information security and the functioning of the economic security system, on the effective functioning of which the ability to a credit institution's commitment to sustainable development.

In contemporary conditions of globalization, there is a general informatization in all spheres of society. Informatization of the learning process has become the dominant direction in the modernization of the national system of higher education. The introduction of new information and communication technologies in the educational process leads to the emergence of completely new types of information threats and risks, ignoring which leads to destabilization of the learning process and students’ mental and physical health disorders. In this regard, ensuring information security is one of the main conditions for an effective educational process. Ensuring information security is based on the identification of real and potential threats in the information space. The classification of the main types of information threats is given. The identified threats, in conjunction with the provisions of the regulatory documents of the Russian Federation, provide for the development of a teacher’s competence in the field of information security. The content aspects of competence are revealed, which reflect the features of information threats and risks that are relevant at each stage of teaching. Based on the content aspects of competence, recommendations are formulated for teachers and students on ensuring information security as part of the process of foreign language teaching.

This chapter surveys security of mobile computing devices with focus on multimedia applications. Mobile computing devices are handheld devices such as PDAs (personal digital assistants) and smartphones with smaller size, processing, storage, and memory capacity compared to PCs (personal computers). The portability and various wireless network connection interfaces of the handheld devices greatly increase the risks of loss and theft of the device, exposure of confidential data, as well as the opportunities for unauthorized device, network, and network service access. The initial part of the chapter concentrates on discussing these basic security issues. Security requirements for wired and mobile multimedia network applications are outlined and network protocols (SIP, SRTP) for secure multimedia streaming services are presented. Mobile device security can be based on IPSec VPN technology and secure mobility is especially important in videoconferencing. Current research on roaming security and testbeds for mobile multimedia are also presented. In an appendix, commercially available mobile security solutions, mostly for basic mobile security requirements, are listed.

Mobile phone touch screen devices are equipped with high processing power and high memory. This led to users not only storing photos or videos but stored sensitive application such as banking applications. As a result of that the security system of the mobile phone touch screen devices becomes sacrosanct. The application of machine learning algorithms in enhancing security on mobile phone touch screen devices is gaining a tremendous popularity in both academia and the industry. However, notwithstanding the growing popularity, up to date no comprehensive survey has been conducted on machine learning algorithms solutions to improve the security of mobile phone touch screen devices. This survey aims to connect this gap by conducting a comprehensive survey on the solutions of machine learning algorithms to improve the security of mobile phone touch screen devices including the analysis and synthesis of the algorithms and methodologies provided for those solutions. This article presents a comprehensive survey and a new taxonomy of the state-of-the-art literature on machine learning algorithms in improving the security of mobile phone touch screen devices. The limitation of the methodology in each article reviewed is pointed out. Challenges of the existing approaches and new perspective of future research directions for developing more accurate and robust solutions to mobile phone touch screen security are discussed. In particular, the survey found that exploring of different aspects of deep learning solutions to improve the security of mobile phone touch screen devices is under-explored.

Extensible Component Platforms support the discovery, installation, starting, uninstallation of components at runtime. Since they are often targeted at mobile resource-constrained devices, they have both strong performance and security requirements. The current security model for Java systems – Permissions – is based on call stack analysis. This is very time-consuming, which makes it difficult to use in production environments.We therefore define the Component-Based Access Control (CBAC) Security Model, which emulates Java Permissions through static analysis at the installation phase of the components. CBAC is based on a fully declarative approach that makes it possible to tag arbitrary methods as sensitive. A formal model is defined to guarantee that a given component have sufficient access rights, and that dependencies between components are taken into account.A first implementation of the model is provided for the OSGi Platform, using the ASM library for code analysis. Performance tests show that the cost of CBAC at install time is negligible, since it is executed together with digital signature verification which is much more costly. Moreover, unlike Java Permissions, the CBAC security model does not have any runtime overhead.KeywordsAccess ControlSecurity ModelAccess Control PolicyAccess Control ModelJava Virtual MachineThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

This paper addresses the implementation of an eye detection mobile application for unlocking mobile devices using its built camera as an eye tracker. The implementation allows a real-time face and eye detection of a mobile phone user. The idea behind our development was the creation of a preventive model for the benefit and safety of mobile users, including disabled users (e.g., users with arthritis). The product is a visual application that detects the pupils and can simulate the mouse cursor on the screen to unlock the device. Although some screen lock methods have been already developed, our project aims to complement the security in mobile devices. Moreover, with a new mechanism to unlock mobile devices it would offer a more robust alternative in terms of safety of such devices. Evaluation results suggest our implementation is a promising alternative for security in these devices.

IS professionals’ information security behaviors in Chinese IT organizations for information security protection

Information security is one of the key areas of consideration to assure reliable and dependable information systems (IS). Achieving an appropriate level of IS security requires concurrent consideration of the technical aspects of IS and the human aspects related to the end users of IS. These aspects can be described in the form of information security requirements. We propose an approach that helps select and balance information security software requirements (iSSR) and information security training requirements (iSTR) according to the information security performance of end users. The approach was tested in an experiment involving 128 IS professionals. The results showed that using the proposed approach helps IS professionals with limited experience in information security make significantly better decisions regarding iSSR and iSTR.