Information risk and security modeling

Measuring the security of business processes of enterprises has become essential in the wake of different threat scenarios. During the last two decades, a lot of research has been done on metrics for the network security, software system security, attack severity, situation assessment, etc. In the process level, business impact analysis models and security maturity models, as well as well-established risk analysis methods, exist. With the all-pervasive IT implementation of business processes, it has become imperative for the chief information security officers to come up with metrics for the security of business processes in the context of the relevant threat scenario. This paper introduces a novel security metric to assess the business process security, viz., Security Concern. The metric quantitatively measures the “concern” due to various attributes of the security of a business process in the context of the threat scenario and asset sensitivity. We present the model of the business process, its assets, their dependencies, exploits, and impacts on assets in a top–down fashion. Based on the model, security concern as a metric has been defined. The bottom–up method of the computation of the metric is explained. It is also demonstrated how the proposed metric can be of practical utility for the horizontal and temporal comparison of the business process security.

Purpose of the study: development of the theoretical foundations of information security through sound systematization, methods and means of information security based on the concept of interoperability. Methods of research: analysis of information interaction and threats in information interaction based on a standardized reference model of interoperability and synthesis of a systematic structured model of information security methods and tools in the context of the concept of interoperability. Result's: based on the analysis of scientific areas of interoperability and information security, it is proposed to supplement the field of interests of information security with a semantic level, in accordance with the reference model of interoperability. The analysis of information security threats to the object of protection implemented at the semantic level of information interaction has been performed. In the course of research, the need for information security at the semantic level has been proved to ensure the completeness of information interaction protection and to satisfy the interests of the information protection object. An information model for the development and implementation of information security methods is proposed to help achieve the objectives of the object of protection. A model of information security based on a reference model of interoperability is proposed. A model of information security audit and risk assessment based on a reference model of interoperability is proposed. Scientific novelty: It consists in a new approach to systematization of methods, means and increasing the sphere of interests of information security based on modern scientific ideas about the levels of information interaction in accordance with the concept of interoperability.

This chapter introduces the Metrics Based Security Assessment (MBSA) as a means of measuring an organization’s information security maturity. It argues that the historical (i.e., first through third generations) approaches used to assess/ensure system security are not effective and thereby combines the strengths of two industry proven information security models, the ISO 17799 Standard and the Systems Security Engineering Capability Maturity Model (SSE-CMM), to overcome their inherent weaknesses. Furthermore, the authors trust that the use of information security metrics will enable information security practitioners to measure their information security efforts in a more consistent, reliable, and timely manner. Such a solution will allow a more reliable qualitative measurement of the return achieved through given information security investments. Ultimately, the MBSA will allow professionals an additional, more robust self-assessment tool in answering management questions similar to: “How secure are we?”

As companies continue to invest in information security, human weaknesses continue to remain a root cause of data breaches in organisations. Several security models have been proposed in the literature but largely remain ineffective at addressing this human vulnerability. In this paper, a policy-driven, human-oriented information security model is proposed. By adopting an information security policy, organizations set strong foundations on which sound security practices can be disseminated and enforced within the organisation. Instead of viewing human as the source of problem, it is a model that put human as the primary source of effectiveness to implement security policy. In this model, staffs in an organization will collectively secure an organisation from attacks. From existing literature and interviews conducted with selected banks in UAE, three primary factors, namely information security policy awareness, security training, and computer & security technology proficiency have been identified and incorporated into the new security model.

A multifaceted evaluation of the reference model of information assurance & security

In order to better understand the information security performance in products, processes, technical systems or organizations as a whole, and to plan, control, and improve it, security engineers, system developers and business managers must be able to get early feedback information from the achieved security situation. Systematic security metrics provides the means for managing security-related measurements comprehensively. We reflect on the use of information security metrics by presenting the results of an interview study carried out in Finnish industrial companies and State institutions. Furthermore, we discuss the application of security measurements from the business process and technical points of view. The role of technical security metrics is analyzed using mobile ad hoc networks as a case example.

The article deals with the principles of creating a special theory of administrative and legal regulation of information security, analyzes the process of its analogy with physical laws, analyzes the threats and dangers to interests and all information security that affect the process of modeling, determines the principles of constructing and researching models of information security of social systems.It was noted that the administrative and legal regulation of information secu- rity is due to the need for state management of the processes of formation and use of information resources, the creation and application of information systems and the provision of information security of social systems. It is proved that to a large extent information security is caused by the need for administrative regulation of information relations in various spheres that form the system itself and maintain its integrity. It is determined that the administrative and legal basis of information security of social systems should provide an ideal state of activity of subjects, system and its models. Selected concrete administrative and legal principles of information security, such as physical formulas, create its model. Of course, for each social system, the model of information security is individual. However, there are also general patterns of modeling, for example — the construction of the model should be based on the simple and optimal (as we are referred to by the flow of light), administrative and legal principles.It is proved that high rates of development of information technologies, create new requirements to the sphere of security in general and to information security in particular. The reform of the legislation regulating activity in the field of infor- mation security should be based on the proper scientific theory. What is urgent is the need to create a General Security Theory, which would explain and regulate the set of processes of ensuring the safety of society.

The article deals with the principles of creating a special theory of administrative and legal regulation of information security, analyzes the process of its analogy with physical laws, analyzes the threats and dangers to interests and all information security that affect the process of modeling, determines the principles of constructing and researching models of information security of social systems. It was noted that the administrative and legal regulation of information security is due to the need for state management of the processes of formation and use of information resources, the creation and application of information systems and the provision of information security of social systems. It is proved that to a large extent information security is caused by the need for administrative regulation of information relations in various spheres that form the system itself and maintain its integrity. It is determined that the administrative and legal basis of information security of social systems should provide an ideal state of activity of subjects, system and its models. Selected concrete administrative and legal principles of information security, such as physical formulas, create its model. Of course, for each social system, the model of information security is individual. However, there are also general patterns of modeling, for example — the construction of the model should be based on the simple and optimal (as we are referred to by the flow of light), administrative and legal principles. It is proved that high rates of development of information technologies, create new requirements to the sphere of security in general and to information security in particular. The reform of the legislation regulating activity in the field of information security should be based on the proper scientific theory. What is urgent is the need to create a General Security Theory, which would explain and regulate the set of processes of ensuring the safety of society.

Finding relevant metrics in information security is an important but difficult problem. In this paper, we propose to empirically investigate the relevance of different security metrics that could be derived from intrusion prevention system (IPS) alert events and computer security incident data. Based on the data provided by the University of Maryland, we show that IPS metrics are linked to security incidents, and also that different types of security incidents have different significant metrics. These results can be used for identifying possible candidates for security incident indicators, developing methods to improve incident prevention and helping organizations interpret their IPS's better in the future.

There have been several attempts made in literature to develop access control techniques to stem data security problems. Many of these techniques had been found to have one deficiency or other. Hence, this study developed a Symbolic Attribute-Based Access Control (SABAC) system for data security in the cloud service environment. SABAC system was implemented by developing Hash-tag Symbol Authentication (HSA) algorithm using the Message Digest-5 encryption. SABAC utilizes a 3-Tier continuous authentication method by combining the use of username and password, HSA code, and real-time image monitoring and verification. HSA code is generated by combining 5-tuple user attributes and the string generated from the user’s image using Obfuscation Technique. The concatenated string is converted to hexadecimal which serves as input to MD5 to produces a unique HSA code. SABAC was evaluated using three major security metrics of confidentiality, integrity, and avail-ability. The result of security metrics tests showed a confidence level of 99.993%, integrity threshold of 99.998%, and availability throughput of 150 users/second. This implies that SABAC is highly efficient for cloud data security. It shows that hackers would find it impossible to match any fake identity with valid HSA in the database. The study concluded that SABAC could be used for access control in a cloud environment for assuring data security. It was recommended that the SABAC system should be adopted by Cloud Solution Providers and Security Specialists.

Inspired by the literature on side-channel attacks against cryptographic implementations, we describe a framework for the analysis of location privacy. It allows us to revisit (continuous) re-identification attacks with a combination of information theoretic and security metrics. Our results highlight conceptual differences between re-identification attacks exploiting leakages that are internal or external to a pseudonymised database. They put forward the amount of data to collect in order to estimate a predictive model as an important – yet less discussed – dimension of privacy assessments. They finally leverage recent results on the security evaluations/certification of cryptographic implementations to connect information theoretic and security metrics, and to formally bound the risk of re-identification with external leakages.

This article proposes an information technology governance model that facilitates the direction, control and fulfillment of the objectives of the implementation and maintenance of the information security and privacy program proposed by the Ministry of Information Technology and Government Communications Colombian to state organizations in the framework of the digital government policy. Based on the identification of the regulations of the Colombia state for the implementation of the information security and privacy model, the analysis of the existing information technology governance frameworks that converge on the governance and management objectives of the information security and privacy model is continued and finally the model is structured of governance. contributes to the technological development of the Colombia society through the construction of an innovative tool that facilitates the direction, control and rapid adoption of the management system of information security and privacy defined by the Colombia State, which results in the assurance and privacy of information of all Colombian that is in the hands of state entities, reducing frauds, the exposure of our personal information among other risks.

Moving Target Defence (MTD) has been recently proposed and is an emerging proactive approach which provides an asynchronous defensive strategies. Unlike traditional security solutions that focused on removing vulnerabilities, MTD makes a system dynamic and unpredictable by continuously changing attack surface to confuse attackers. MTD can be utilized in cloud computing to address the cloud's security-related problems. There are many literature proposing MTD methods in various contexts, but it still lacks approaches to evaluate the effectiveness of proposed MTD method. In this paper, we proposed a combination of Shuffle and Diversity MTD techniques and investigate on the effects of deploying these techniques from two perspectives lying on two groups of security metrics (i) system risk: which is the cloud providers' perspective and (ii) attack cost and return on attack: which are attacker's point of view. Moreover, we utilize a scalable Graphical Security Model (GSM) to enhance the security analysis complexity. Finally, we show that combining MTD techniques can improve both aforementioned two groups of security metrics while individual technique cannot.

Smart Grid is one of the critical technologies that provide essential services to sustain social and economic developments. There are various cyber attacks on the Smart Grid system in recent years, which resulted in various negative repercussions. Therefore, understanding the characteristics and evaluating the consequences of an attack on the Smart Grid system is essential. The combination of Graphical Security Model (GrSM), including Attack Tree (AT) and Attack Graph (AG), and the Common Vulnerability Score System (CVSS) is a potential technology to analyze attack on Smart Grid system. However, there are a few research works about Smart Grid attack analysis using GrSM and CVSS. In this research, we first conduct a comprehensive study of the existing research on attack analysis using GrSM and CVSS, ranging from (1) Traditional Networks, (2) Emerging Technologies, to (3) Smart Grid. We indicate that the framework for automating security analysis of the Internet of Things is a promising direction for Smart Grid attack analysis using GrSM and CVSS. The framework has been applied to assess security of the Smart Grid system. A case study using the PNNL Taxonomy Feeders R4-12.47-2 and Smart Grid network model with gateways was conducted to validate the utilized framework. Our research is enriched by capturing all potential attack paths and calculating values of selected security metrics during the vulnerability analysis process. Furthermore, AG can be generated automatically. The research can potentially be utilized in Smart Grid cybersecurity training.KeywordsSmart GridGraphical Security Model (GrSM)Common Vulnerability Score System (CVSS)Attack analysisAttack treeAttack graph

The paper considers the issue of countermeasures selection for ongoing computer network attacks. The suggested technique is based on the countermeasure model that was defined on the base of the open standards, the family of interrelated security metrics and the security analysis technique based on attack graphs and service dependencies. The technique was implemented in a security assessment and countermeasure selection system. This technique was validated on case studies. It is applicable for security information and event management systems.