Modeling and Controlling Downgrading Operations in Information Systems

Objective: the purpose of the entire work is to help system analysts involved in assessing the quality of information sys tems (IS) operation during their creation, operation, modernization, development, to form the appearance of a comprehensive probabilistic prediction methodology applicable in the interests of ensuring quality and safety, justifying acceptable risks, identifying significant threats and supporting the adoption of scientifically rational system decisions to proactively counter threats in IS life cycle. The purpose of the 3rd part of the work is to complete the detailing of the general methodological provisions on the probabilistic prediction of the quality of IS operation quality (taking into account the enlarged description of the approach in the 1st part of the article [1] and the presentation of the basics of detailing modeling using «black boxes» in the 2nd part of the article [2]) by proposing: • the formalization of complex modeled systems consisting of parallel-sequential structures formed from «black boxes» and combined using logical connections «AND», «OR»; • the methods of system analysis of the IS operation quality; • the main components of the appearance of a comprehensive methodology for the probabilistic predicting IS operation quality, used by system analysts in the interests of ensuring quality and safety, justifying acceptable risks, identifying significant threats and supporting the adoption of scientifically based system decisions to proactively counter threats in the life cycle of specific IS. Research methods include: methods of probability theory, methods of system analysis. The modeled system is formally represented by «black boxes» and complex systems in the form of parallel-sequential structures formed from «black boxes» combined using logical connections «AND», «OR». The obtained results of mathematical modeling are used in the interpretation of the original IS, in the interests of which the corresponding calculations are carried out. The result of the work as a whole is: based on the research results presented in [1, 2], methodological provisions have been created that form the main components of the appearance of a complex methodology for probabilistic prediction of IS operation quality in accordance with GOST R 59341-2021 «System engineering. Protection of information in system information management process». The use of the proposed methodological provisions is intended to help system analysts form the appearance of a versatile complex methodology of probabilistic prediction, applicable in the interests of ensuring quality and safety, justifying acceptable risks, identifying significant threats and supporting the adoption of scientifically sound system decisions to proactively counter threats in the life cycle of specific IS. Scientific novelty of the work: with the widespread introduction of modern information technology tools and systems, the problems associated with a comprehensive study of the IS operation quality remain acutely relevant. Despite the fact that many system engineering standards have appeared that recommend the use of probabilistic system analysis for various types of systems, in practice, the formation of a set of techniques applicable to predicting quality measures, justifying acceptable risks, identifying significant threats and supporting the adoption of scientifically sound system decisions in IS life cycle causes practical difficulties for system analysts. These difficulties and the use of subjective assessments are related not only to the versatility of the very concept of IS operation quality, but also to the complexity of mathematical formalization, taking into account the specifics of each system. As a result, many important aspects are beyond the analyst's field of consideration, specific quality measures turn out to be incommensurable on a single quantitative scale, and the inverse analytical tasks of proactive threat management in IS life cycle and constituent elements are not solved. I.e., in practice, there is a contradiction between the needs for system analysis of IS and the possibilities for solving urgent problems of system analysis. To overcome this contradiction, the proposed methodological provisions formulate the general purpose of IS operation in various areas applications – to ensure the reliability and timeliness of providing the necessary information, completeness, validity and safety of the information used for subsequent intended use. The main proposed components of the complex methodology of probabilistic prediction of IS operation quality have determined the scientific novelty of this work, focused precisely on achieving this general formulated goal of IS operation.

approaches to computer securit,y lia.ve concentrated on defining securit.y in t,erms of a.ccess t,o resources implemented by locally imposed and ma,naged constraints on simple access modes (e.g., read and write) to system resources (e.g., files a.nd direct,ories). It is now becoming accept,ed t,hat. tellis view of security is inadequa.te for ma.na.giug securit,y in a federation of administrative domains where local policies may conflict with global object,ives and some negot,iation is required to adjust multiple loca.1 policies in order to prevent loca.1 policy conflicts from hindering the achievement of a globa. policy. This new securit.y requirement demands not so much new implementation technology as new concepts t,o be elabora.ted. We shall argue that issues of security policy need to be derived from understanding the wa.y that responsihility and a.uthority work in an ent,erprise, a.nd that t,he conventiona.

The Computer Security Foundations Workshop VI was held during June 15-17, 1993 in Franconia, New Hampshire. This is an annual workshop with the purpose of "bring[ing] together researchers to explore fundamental issues in computer security" [13]. Every year since its inception, the workshop has been limited to forty participants, the majority of whom present papers or speak on panels. The setting is informal with plenty of time for technical discussion.

Comparing the expressive power of access control models is a fundamental issue in computer security. A better solution to this problem is helpful for understanding the limitations and potential capabilities of models, improving models and selecting appropriate security models for different applications. The existing comparison theories either do not consider the security properties when comparing, or the semantics of the security properties considered are too weak, or the comparison methods are vague and difficult to operate. In this paper, we define a mapping between models whose security properties are preserved based on temporal logic, and propose a more scientific and standard comparison method of expressive power with operability based on the mapping. On this basis, we demonstrate that the DIFC has better expressive power than the BLP model.

The article investigates the legal regulation of cross-border information systems that operate within the Schengen area. These information systems are the Schengen Information System, Visa Information System and the European Travel Information and Authorisation System. The information systems provide the opportunity of free access to the database of border and law enforcement authorities of the Schengen area member states. These authorities are able to quick and efficient collaboration as well as in interaction in support of national security, public order and effective fight against organized crime, border-crossing of illegal immigrants, drug trafficking etc. The article defines that in addition to cooperation between the competent and relevant authorities of the Schengen area member states the information systems are to be the instruments of the freedom of movement of persons, contributing at the same time of public order and national security of each of the European countries. The article analyses the main tasks and purposes of a new European travel information and authorization system. In particular, the system concerns those countries that have already signed agreements on visa-free regime with the EU. In practice, it means that the citizens of "visa-free" countries will be able to travel to the Schengen area member states without a visa, but they are required to be authorized through this system before the trip. The research also analyzes the regulations of the European Union, western and national doctrine in respect of the operation of cross-border information systems within the Schengen area.

Numerous vulnerabilities have a tendency to taint modern real-world web applications, allowing attackers in retrieving sensitive information and exploiting genuine web applications as a platform for malware activities. Moreover, computing techniques are evolved from the large desktop computer systems to the devices like smartphones, smart watches and goggles. This needs to be ensure that these devices improve their usability and will not be utilized for attacking the personal credentilas (such as credit card numbers, transaction passwords, etc.) of the users. Therefore, there is a need of security architecture over the user's credentials so that no unauthorized user can access it. This chapter summarizes various security models and techniques that are being discovered, studied and utilized extensively in order to ensure computer security. It also discusses numerous security principles and presents the models that ensure these security principles. Security models (such as access control models, information flow models, protection ring, etc.) form the basis of various higher level and complex models. Therefore, learning such security models is very much essential for ensuring the security of the computer and cyber world.

Basic Security Concepts - Why is Computer and Network Security Important. Background and History. The Security Trinity. Information Security. Risk Assessment. Security Models. Basic Terminology. More Basic Terminology. Threats, Vulnerabilities and Attacks - Protocols. The OSI Reference Model. TCP/IP Protocol Suite. Useful Web Sites. Search Engines. Mailing Lists. Encryption, Digital Signatures and Certification - Cryptography. Stream Ciphers. Breaking Ciphers. Block Ciphers. Encryption. Public Key Cryptosystems. Message Integrity. Authentication. Digital Signatures. Competing Standards. Digital Certificates. Limitations of Digital Certificates. Certificate Authorities. Public Key Infrastructure. The Future. The Limitations of Encryption. Kerberos - How Kerberos Works. Kerberos- Limitations. Encryption on the WWW - The World Wide Web. Secure Sockets Layer (HTTPS). Secure HTTP (SHTTP). Microsoft's Internet Explorer. Viewing Digital Certificates with Internet Explorer. Viewing the Encryption Strength of IE5. Viewing Certification Authorities with IE5. Netscape Navigator. Viewing Digital Certificates with Navigator. Authenticode Certificates. E-Mail - E-Mail Issues. E-Mail Issues. Secure E-Mail Protocols. Web-Based E-Mail Services. Security of Stored Messages. Identity: Spoofing and Hiding. E-Mail as a weapon. E-Mail Policies. E-Mail Privacy. Auto-Responses. Operating System Security -- Passwords. Password Attacks. Onetime Passwords. Access Control. Data Redundancy. General Recommendations. Modems. Useful Tools. LAN Security - LAN Guidelines. Controlling End-User Access. Concurrent Logins. Available Disk Space. Restrictions to Location or Workstation. Time/Day Restrictions. Access to Directories and Trustee Rights. File Attributes. Other Privileges. Single Sign-On. Policy-Based Network Management. Honeypot Systems. Network Segmentation. Static IP Addresses vs. DHCP. Media and Protocols - Network Media. Plenum Cabling and Risers. WANs. Redundancy and Alternative Connections. Routers and SNMP - Router Issues. SNMP. Virtual Private Networks - Encryption on the Network. Node-to-Node Encryption. End-to-End Encryption. Where to Encrypt. Virtual Private Networks. PPTP. L2TP. IPSec. SOCKS. Firewalls - Firewalls Pros and Cons. Types of Firewalls. Packet Filters vs. Proxies. Firewall Configurations. Restricting Users' Access to the Internet. Firewall Products. Personal Firewalls. Biometrics - Identification and Authentication. Biometric Identification and Authentication. Biometric Identification Reliability. Backup Authentication. Environmental Conditions. User Acceptance. Security of the Biometric System. Interoperability. Costs vs. Savings. Policies and Procedures - Policies vs. Procedures. Information Security Policy Objectives. Developing Security Policies. Policy and Procedure Manuals. Policy Awareness & Education. Policy Enforcement. Policy Format. Security Policy Suggestions. Information Protection Team. Crisis Management Planning. Sources for Information Policies. Auditing and Intrusion Detection - What is an Audit. Operational Security Audits. System Security Auditing. Activity and Usage Auditing. Audit Mistakes. Deficiencies of Traditional Audit Techniques. Intrusion Detection. Intrusion Detection Systems. Host-Based Intrusion Detection Systems. Network-Based Intrusion Detection Systems. Knowledge-Based Intrusion Detection Systems. Statistical-Based Intrusion Detection Systems. Defense In-Depth Approach . Future Directions. Crisis Management Planning - Crisis Management. Disaster Recovery Planning. Computer Security Incident Response Plan. Browser Security - Cookie Files. Cache Files. Autocomplete.

Introduction In every working area, assets are exposed to risk of various harms. In the information technology area, there is risk of damaging or losing resources. Risk assessment is a process that determines what information resources require protection, and it documents potential risks from IT security failures that may cause loss of information confidentiality, integrity, or availability. The purpose of risk assessment is to help management create appropriate strategies and controls for the steering of information assets (BSI Standard 100-1,2,3), (ENISA Regulation). IT resources are tangible assets (such as hardware, equipment, buildings), data, documents, software, users, and intangible resources (reputation, confidence, etc.) Management of the information system (IS) is a component of the company management and makes its inherent part. The planning of the continuity of IS operation and development must be entirely coordinated with the same activities on the company level. Both short-term and long-term strategies must be harmonized within the framework of business, development, changes, and planning. Risk management and its maintenance on an acceptable level is part of the work process and its development. Its basic characteristic must be continuity (Nikolic, 2007). The chosen acceptable risk level after the implementation of particular measures also means a decision on balance referring to costs concerning the achievement of the selected risk level and benefits, i.e., profit of the company. Methodology The methodology of risk assessment implies recognized procedure (Macdonald, 2004), detailed system description, identification of hazards, defining causes of emphasized hazards, risk assessment, measures for risk reduction and mitigation, risk reassessment according to remaining hazards, and conducting measures for maintaining risk at an accepted level. Figure 1 displays the methodology of risk assessment with elements of the risk management system. Risk assessment in the IT area can be conducted by way of various methods. We use the method established and developed by our expert team (Nikolic & Laban 2008). The method was created for the occupational health and safety area, and is successfully applied in the IT area as described in Nikolic and Ruzic-Dimitrijevic (2009). This method enables the achievement of one of the main goals of risk assessment: risk assessment for every employee, workplace, and work environment, i.e., the assessment of all risks. The work environment can be a company, building, floor, or office. It can also be a plant, building site, park, field, or any system, as well as an information system and its components, such as hardware, communication equipment (network), and system software. The workplace in an information system is application software with data as final products, and it can be considered in the same way as in the occupational health and safety area. IT resources are buildings, hardware, communication equipment, software, data, and, of course, people who take part in IT processes. Risk assessment is carried out on more levels (items in the work environment). Software also has several levels--environmental software, operating system, program supported application, and finally a single application--as well as the data used and gained in application executing. Risk assessment of each level involves conducting appropriate protective measures in order to obtain the layered protection. Therefore, the risk assessment of an information system (IS) is conducted through the risk assessment of every application and through the evaluation of the system's state. Risk identification involves the knowledge about the organization (internal and external), as well as earlier experiences about risk issues. The evaluation of risk classifies risk in certain categories (quantitative and/or qualitative) according to which adequate measures are carried out. …

As companies continue to invest in information security, human weaknesses continue to remain a root cause of data breaches in organisations. Several security models have been proposed in the literature but largely remain ineffective at addressing this human vulnerability. In this paper, a policy-driven, human-oriented information security model is proposed. By adopting an information security policy, organizations set strong foundations on which sound security practices can be disseminated and enforced within the organisation. Instead of viewing human as the source of problem, it is a model that put human as the primary source of effectiveness to implement security policy. In this model, staffs in an organization will collectively secure an organisation from attacks. From existing literature and interviews conducted with selected banks in UAE, three primary factors, namely information security policy awareness, security training, and computer & security technology proficiency have been identified and incorporated into the new security model.

The number of cyber crimes is constantly increasing nowadays and the prevention of unauthorized access has become a key issue in computer security. Much of the research in cyber crimes focus on users' identification but little research has been carried out in hidden identification. This paper reveals the results of the experiment on hidden identification by heart rate variability (HRV).

Word sense disambiguation for spam filtering

This paper discuses a critical issue in computer security, intrusion detection. First we give an overview about the current stage of intrusion detection and existing intrusion detection system types. Then, we propose a new approach suitable to what future intrusion detection systems will have to provide in order to meet the requests presented by the computer security society. The approach named IDIAS (intrusion detection intelligent agent system) is meant to be a system capable of integrating several type of intelligent agents into the same environment providing a kind of defense if depth strategy into dealing with intrusions. The main goals of this approach, which distinguish it from other solutions, are its distributed architecture, scalability, efficiency and the use of intelligent agents.

Security policies are enforced through the deployment of certain security functionalities within the applications. Applications can have different levels of security and thus each security policy is enforced by different security functionalities. Thus, the secure deployment of an application is not an easy task, being more complicated due to the existing gap between the specification of a security policy and the deployment, inside the application, of the security functionalities that are required to enforce that security policy. The main goal of this paper is to close this gap. This is done by using the paradigms of Software Product Lines and Aspect-Oriented Programming in order to: (1) link the security policies with the security functionalities, (2) generate a configuration of the security functionalities that fit a security policy, and (3) weave the selected security functionalities into an application. We qualitatively evaluate our approach, and discuss its benefits using a case study.

Computer security issues are now commonplace in the business community. Incidents such as computer viruses, Web vandalism, computer theft, etc. are regularly highlighted by the media. Indeed, the drive towards E-Business has raised the profile of security incidents. Many stakeholders play an important part in counteracting these security breaches, including law enforcement, the business community, hardware and software vendors, and researchers. The purpose of this paper is to highlight the role of universities in the battle against computer security breaches and to show, through a case study, how one university used the Soft Systems Methodology (SSM) to develop a computer security module for its undergraduate students.Key wordsComputer SecurityComputer CrimeSoft Systems MethodologyRequirements Engineering

There are a number of techniques and pieces of hardware and software aimed at promoting information security. In the present paper it is presented a security system dynamically reconfigurable in FPGAs. SSDR presents a robust architecture, which enables the implementation of specific and general security policies in order to guarantee services such as confidentiality, authenticity, integrity, availability, access control, and information audit. The main purposes of SSDR include guaranteeing a great security level by reaching time performance acceptable to a conventional computer network, besides a greater flexibility in relation to a configuration of functionalities and to the security policies. In this paper it will be presented the reconfigurable firewall module, highlighting its architecture, functionalities and performance, as well as focusing on the impact on the reconfigurable time according the model of project adopted.