JSON Web Tokens Lifecycle-Based Threat Classification

Template-Protection-Techniken stellen eine wichtige Ergänzung zu biometrischen Systemen, um das gewünschte Sicherheitsniveau zu erreichen und die Anforderungen an den Schutz der Privatsphäre zu erfüllen. Diese Techniken ermöglichen Erneuerung und Widerruf der Referenzendaten in biometrischen Systemen. In dieser Arbeit wird ein systematisches Evaluierungsframework entwickelt, das sich an die wesentlichen Kriterien und Anforderungen an biometrische Template-Protection-Verfahren festhält. Seine Anwendbarkeit wird durch die Analyse der verschiedenen Algorithmen demonstriert. Die in dieser Arbeit präsentierte Evaluierung ist grundlegend für eine vollständige Analyse. Darüber hinaus ermöglicht es einen Nachweis der Sicherheit und Einhaltung der Privatsphäre. Es schafft eine Basis für Zertifizierung und Benchmark der Template-Protection-Verfahren.

An Information System (IS) security programme consists of several essential security controls. In order to verify and maintain the effectiveness of an IS security programme, it is pertinent to identify how security controls are compared to each other in terms of their practical implications. This study reports the results from an experience survey to offer insights of the roles of security controls in IS security programmes. Four clusters of security controls were identified with technical security controls (such as authentication and confidentiality) being high on respondents' perceived importance. An approach to develop SAI with weighted security controls is explained to help security administrators conduct security assessments. The results of this study contribute to IS security budget planning and resource allocation. Managerial implications are also reported.

Approaches to the application of methods of system analysis to solve problems related to information security of enterprises in transport, which have a complex IT structure with a large number of components. It is shown that the active expansion of the areas of informatization of the transport industry, especially in the segment of mobile, distributed and wireless technologies, is accompanied by the emergence of new threats to information security. It is shown that in order to build an effective information security system, the selection and implementation of adequate technical means of protection should be preceded by a stage of description, analysis and modeling of threats, vulnerabilities, followed by calculation of risks for IS and determining the optimal strategy for information security system. After evaluating the different NIB options according to several criteria, a decision is made: if the recommendations coincide, the optimal solution is chosen with greater confidence. If there is a contradiction of recommendations, the final decision is made taking into account its advantages and disadvantages, for example, the strategy of information security system development is chosen, which turned out to be optimal for at least two criteria. If different NIB development strategies are obtained for all three criteria, it is necessary to vary the values of pessimism-optimism in the Hurwitz criterion or change the data, for example, about possible threats to IP or automated enterprise management system. An algorithm for modeling the decision-making process for selecting the optimal strategy for managing investment design components of the information security system for the transport business entity is proposed

The article focuses on the problem of the assessment of the state of industrial enterprise’s economic and information security. The purpose of the research is to develop an scoring matrix for information and economic security of an industrial enterprise. The paper presents the necessary economic indicators and their normative values. It also presents the criteria for assessing information security, illustrates the developed matrix and defines development strategies for each element. More over, it describes the algorithm for the use of the matrix. The scientific novelty of the paper is in the development of a matrix that assesses both the economic activity and information of an industrial enterprise in order to determine the priority direction of the development. As a result of the work, the authors present a matrix of information and economic security of an industrial enterprise with individual development strategies for each element. The results of the study will be useful for industrial enterprises not only to analyze their activities, but also to determine the directions of further development.

Information system security in a company is an important element that every company should pay more attention due to the attacks against the security of the data that may not be inevitable. Probably every company knows how to protect their data even though this paper proposes something new which is more efficient. One of the ways that can be used to determine the security status of the company is by doing a risk assessment. This study proposes an expert system to determine the position or the level of the security system of a company by doing a risk assessment. The standard of risk assessment is based on the ISO 27002. Forward chaining method is used for the determination of rules and scoring in this expert system. The conclusion of this study is that the integration between the risk assessment and expert system helps in determining the position of a company-level security and also determining whether the company needs to do an audit of their information systems security or not.

Grid computing provides integrated high-end compute resources across administrative domains. More and more grid infrastructures are being used for mission-critical scientific and engineering applications. Ensuring security and safety of grid environment is a key challenge faced by grid community. First step towards grid security is to be aware of vulnerabilities and weaknesses in the entire grid. In this paper, we address this particular aspect wherein we firstly present a system called Security Assessment System (SAS) that is being used in the Indian Grid Computing Initiative GARUDA. This system is built with capabilities of carrying out periodic assessment of the entire grid resources and providing security assessment of each entity such as hosts, applications. Secondly, we present the architecture and internals of SAS where we have seamlessly integrated our solution in a framework by interfacing it with widely used Globus grid middleware. Finally, we present our results based on live deployments in the Indian Grid environment.

Security testing is a necessary first step for organizations whose goal is to determine the level of information security and enhance it for strengthening the protection. There are various methodologies and standards. Each individual methodology describes a process that an organization can perform to detect vulnerabilities. Companies can either create their own internal methodology or use an existing methodology, but most often specialists conduct security testing according to well-known methods. The article deals with a comparative analysis of methods and standards for testing the security of systems, networks, and web applications. The following were considered: OWASP WSTG web application security testing methodologies, NIST SP 800-115 Technical Information Security Testing and Evaluation Manual, PTES Penetration testing standard, ISSAF information system security assessment methodology, OSSTMM open source security testing methodology, BSI penetration testing model study methodology, Positive Technologies methodology. Their strengths and weaknesses have been identified. Based on the analysis, a methodology is proposed that focuses on efficiency, ease of implementation and adaptation to various projects. The practical significance of the work lies in the possibility of its application to increase the level of security in information systems. The results of the study may be useful to information security specialists and organizations seeking to minimize the risks of cyber attacks

Data visualization in the field of information security (IS) is becoming an urgent task. The more informative the visual display for the analyst, the faster and better he will be able to get the result. The visualization method is described in the article, which allows to reduce the time needed for determination the actual IS threats when processing the IS threat model. In the classic way of displaying, threat models are a list or a table of several tens of printed pages. To process such a volume of data, information security analysts need to spend a lot of time. It remains likely that the analyst will lose sight of important data. The article proposes a method for visualizing the spatio-temporal model of IS threats in three-dimensional and two-dimensional form. When visualizing a threat model, a surface with axes is used: time, risk, information asset. The proposed visualization of the IS threat model allows the analyst to identify current threats in less time. Scope - management of information security. The result of this work is a way to visualize the IS threat model, taking into account the spatio-temporal factor.KeywordsInformation securitySpatio-temporal modelVisualization

Information security is one of the most important attributes of distributed systems that often operate on unreliable networks. Enabling security features during the development of a distributed system requires the careful analysis of potential attacks or threats in different contexts, a process often referred to as «threat modeling». Information protection should be comprehensive, but it is also necessary to take into account the possibility of the emergence of threats specific to a certain information system. Many public and private organizations are still trying to implement system models and the threats directed at them on their own. The main reason for this is the lack of useful and high-quality methodologies that can help developers design system models. This review explores a variety of the literature on confidentiality- and integrity-aware system design methodologies, as well as threat classification methods, and identifies key issues that may be referenced by organizations to make design system processes easier. In particular, this article takes a look at the extent to which existing methodologies cover objects of protection and methods of classifying threats, as well as whether there are such models of systems in which the object itself and the threats directed at it are described. This includes whether the compiled models exhibit symmetry or asymmetry. This literature research shows that methodologies appear to be heterogeneous and versatile, since existing methodologies often only focus on one object of protection (a system). Based on the given analysis, it can be concluded that the existing methodologies only relate superficially to the description of system models and threats, and it is necessary to develop a more complete abstract model of the protected object and threats aimed at it in order to make this model suitable for any organization and protect it against most threats.

Principles of secure information systems design with groupware examples

Due to digitalization and technological advancement, systems and their requirements are changing, and there is an increasing use of Cyber-Physical Systems (CPS) with a direct connection between the physical and the digital world. These systems process data and have integrated functions and a real-time requirement. There is a great need for security, protection of data, and reliability. The use of digital systems in the energy sector is increasing and changing, as are consumers and generators. This requires a secure IT, communications infrastructure, and highly performing data platforms. The new systems being created are called CPS, which are highly scalable, dynamic, and volatile and process many data of various kinds. One significant aspect of a CPS is security. Personal data and business-sensitive data may be processed, or mission-critical processes may be mapped. Risk analysis and security assessments based on conventional methods and guidelines (for example, BSI IT Basic Protection) have revealed drawbacks. Present security assessment methods focus on analyzing corporate information systems or are applied for software development life cycles. CPS criteria and their impact on security have not yet been accounted for in today’s security assessments and their corresponding frameworks. This thesis concentrates on modeling CPS security and deriving a framework for CPS security assessments. The considered criteria are data security as conventional, expanded by scalability, and real-time. The underlying framework is process-oriented. CPS use cases will be broken down into (atomic) processes and the security assessed based on each process’ data security, scalability and real-time model. Eventually, this will mean security measures can be mapped at the process level. Conducting this research, the focus was on smart grid systems as one example of CPS. For the discussion of mapping security measures, authentication was selected. The result analysis shows an added value in the security assessment of CPS based on the criteria of data security, scalability, real-time, and the breakdown at the process level. The underlying model allows to cope with the complexity of CPS and more precisely assess the security of CPS. The overall approach of CPS security modeling and provision by using a process-oriented framework is highly innovative and provides a concept for developing future CPS security assessment tools.

The paper considers the issue of countermeasures selection for ongoing computer network attacks. The suggested technique is based on the countermeasure model that was defined on the base of the open standards, the family of interrelated security metrics and the security analysis technique based on attack graphs and service dependencies. The technique was implemented in a security assessment and countermeasure selection system. This technique was validated on case studies. It is applicable for security information and event management systems.

HOW MUCH ICT SECURITY HAS IMPROVED DURING THE LAST DECADE

Ensuring information security in public sector information systems is now more important than ever. Advances in technology and information have not only made daily life easier, but also made the opportunities for cybercrimes vast and inevitable. This study aims to create a framework for evaluation that measure the maturity level of information security in information systems by integrating existing frameworks, NIST Cybersecurity Framework (CSF) and COBIT 2019. The result of this framework development is implemented in a public sector organization called PT XYZ, which has an information system as a tool to assist in the implementation of public services. The Capability Maturity Model Integration (CMMI) method is used to calculate the maturity level. The implemented approach resulted in information security maturity evaluation framework for information systems. This framework includes 118 activities which are divided into 23 categories. The distribution of the integration of the two frameworks contributes 61% activities, the NIST CSF contributes 8% and the COBIT 2019 framework contributes 31% activities. The measurement result of the information security maturity level in the information system at PT XYZ shows that all functions are at level 1 or the initial level. PT XYZ's low information security maturity reveals the critical need for stronger data protection and system resilience. This study introduces a novel approach to demonstrating a practical methodology for integrating two frameworks. The resulting framework enables public sector organizations to assess their security posture, identify areas for improvement, and enhance resilience against cyber threats, strengthening public service and safeguarding data.

To address the challenges of assessing information security risks in smart energy systems, this study proposes a multi-attribute decision support method based on interval type-2 fuzzy numbers (IT2TrFN). First, expert questionnaires were designed to gather insights from eight specialists in the fields of smart energy and safety engineering. Linguistic terms associated with IT2TrFN were employed to evaluate indicators, converting expert judgments into fuzzy numerical values while ensuring data reliability through consistency measurements. Subsequently, a decision hierarchy structure and an expert weight allocation model were developed. By utilizing the score and accuracy functions of IT2TrFN, the study determined positive and negative ideal solutions to rank and prioritize the evaluation criteria. Key influencing factors identified include the rate of excessive initial investment, regulatory stringency, information security standards, environmental pollution pressure, and incident response timeliness. The overall risk index was calculated as 0.5839, indicating a moderate level of information security risk in the evaluated region. To validate the robustness of the model, sensitivity analyses were conducted by varying IT2FWA (Weighted aggregated operator) and IT2FGA (Weighted geometric operator) operator selections and adjusting weight coefficients. The results reveal that key indicators exhibit high risk under different scenarios. This method provides an innovative tool for the scientific evaluation of information security risks in smart energy systems, laying a solid theoretical foundation for broader regional applications and the expansion of assessment criteria.