Petri Net Approach for Estimation the Information Systems Security Level in Any Logic Environment

HOW MUCH ICT SECURITY HAS IMPROVED DURING THE LAST DECADE

Automation of production processes of enterprise today has enormous scales. The spread of automated control systems of technological processes (ACSTP) and their integration with corporate information systems have led to increase in proportion of successfully implemented malicious impacts on ACSTP. Occurrence of new types of attacks and increase in number of successfully implemented attacks cause the need to form protection systems of industrial systems. Designing protection system of ACSTP is multi-stage process, starting with collection of data on object of protection, its main components, information assets, links with other systems, and identification of relevant information security threats to the system. In this article analysis of structure of typical automated control system of technological process is carried out. The most important components of ACSTP from the point of view of information security are identified. The article defines the need to form project of protection system of ACSTP on the basis of monitoring data of events that occur in ACSTP. Main classes of system events from the point of view of information security are defined. The most typical information security threats for this type of automated systems are considered. Neutralization of groups of threats relevant to ACSTP is carried out by means of forming effective protection system. The typical composition of data protection system of ACSTP is defined. According to results of analysis, the correspondence between security events of ACSTP, current threat groups and typical means of information protection is determined. Choosing the composition of information security tools is complex task that requires a lot of time. To achieve greater efficiency in its solving, it is proposed to use decision support system and system of artificial intelligence. Authors developed functional model of selection of protection system's project using intelligent method of decision support with neural network in it.

Ensuring information security in public sector information systems is now more important than ever. Advances in technology and information have not only made daily life easier, but also made the opportunities for cybercrimes vast and inevitable. This study aims to create a framework for evaluation that measure the maturity level of information security in information systems by integrating existing frameworks, NIST Cybersecurity Framework (CSF) and COBIT 2019. The result of this framework development is implemented in a public sector organization called PT XYZ, which has an information system as a tool to assist in the implementation of public services. The Capability Maturity Model Integration (CMMI) method is used to calculate the maturity level. The implemented approach resulted in information security maturity evaluation framework for information systems. This framework includes 118 activities which are divided into 23 categories. The distribution of the integration of the two frameworks contributes 61% activities, the NIST CSF contributes 8% and the COBIT 2019 framework contributes 31% activities. The measurement result of the information security maturity level in the information system at PT XYZ shows that all functions are at level 1 or the initial level. PT XYZ's low information security maturity reveals the critical need for stronger data protection and system resilience. This study introduces a novel approach to demonstrating a practical methodology for integrating two frameworks. The resulting framework enables public sector organizations to assess their security posture, identify areas for improvement, and enhance resilience against cyber threats, strengthening public service and safeguarding data.

The purpose of information systems (IS) security behavior, represented by the difference between work and personal purpose, has been neglected in the research of user's IS security behavior. This is especially important for the organizations that allow or inevitably allow their employees to do personal tasks during work hours, because it may bring big threats to an organization's IS. Unfortunately, few empirical studies have examined if different behavioral purpose, typically, work/personal purpose, affects users' IS security behavior decision. Based on boundary theory and the idea of multidimensional rationality, we argue that people demarcate a psychological boundary for work and personal usages of IS and thus apply different rationalities to make IS security-related decisions. Our empirical investigation indicates that in a work usage context, people apply rule-based rationality and therefore are more influenced by mandatoriness and facilitating conditions. Whereas in a personal usage context, people apply outcome-based rationality and therefore are more concerned with task benefits and costs. The findings imply that organizations and vendors may devise different measures to ensure users' IS security behavior in different contexts.

The article considers the legal mechanisms for ensuring information security. It has been proven that today, more than ever, when there is a war in Ukraine, the issue of ensuring information security becomes especially relevant and significant, as the information space becomes a “battlefield” on a par with the war front. Enemy forces actively use informational and psychological operations to destabilize the situation inside our country, create panic, spread fakes and undermine trust in state institutions. In these conditions, the state’s policy becomes important, which should be integral and effective in countering these threats. An effective state policy in the field of information security will help ensure society’s resilience to information threats, strengthen trust in state institutions, and maintain stability in crisis conditions. The author’s understanding of information security is offered as a state of security of information resources and information systems, which ensures their confidentiality, integrity, availability and reliability, as well as protection against unauthorized access, disclosure, modification, destruction and other forms of abuse that may lead to a violation of national security, economic stability and social order. The main components of information security, which are the basis for information security for the state as a whole, individual bodies or private enterprises, are called confidentiality, integrity and availability. The main components of the mechanism for ensuring information security, in the opinion of the author, should be: technical (creation of appropriate technical infrastructure to ensure the functioning of information security), political (development of state policy aimed at ensuring information security) and legal (adoption of high-quality normative legal acts that will determine all information security measures). These three components complement each other and are key to creating an effective system of protection against information threats.

The features of the functioning of the on-board information systems of a car are considered. Threats to their security are analyzed, and methods for ensuring information security and functional security of on-board information systems are proposed. The design of road networks in the organization of road traffic is one of the factors in ensuring the functional security of modern intelligent transport systems, that is, compliance with such information security attributes as data confidentiality, integrity, availability, authenticity and novelty of data. The security of on-board vehicle information systems is a critical issue in the modern world, as more and more vehicles are equipped with electronic systems that may be vulnerable to cyber attacks. One of the main challenges of protecting on-board information systems is the wide range of devices and technologies used in modern vehicles. Different systems may have different security requirements and vulnerabilities. They may interact with each other in a complex way. Another challenge is that many of these systems were not designed originally with security in mind. They may lack basic security features such as encryption and authentication and use outdated software and protocols that are vulnerable to known attacks. The main types of attacks and threats to the elements of the transportation system that interact with the VANET were identified to analyze the information security of vehicle in-vehicle systems. Based on the theory of fuzzy sets under conditions of uncertainty and using the Fuzzy Logic Toolbox in the integrated Matlab environment, the level of information security of the OBU-VANET system was modeled. The obtained results allowed us to formulate the degree of information security of vehicle operation elements against unauthorized access to data. The results of the study showed that technical communication systems have the highest security level (> 0.7), and vehicles become the most vulnerable in public places.

Nowadays, information protection and cybersecurity are one of the urgent tasks defined by the normative documents of our country in the field of national security and defence. In a state of tense foreign policy conditions, information protection is an urgent problem of our society. This article presents a unified approach to the systematization of cyber threats. The essence of this approach is to eliminate uncertainties regarding the description of cyber threats. Based on the results of the analysis of existing works on this topic, the advantages and disadvantages of existing approaches are identified. It is important to note that the classification of vulnerabilities in information systems is currently developing rapidly, but the problem of classification of threats remains relevant. The vulnerability remains only a tool for realizing the existing threat. Given the possible risks of information security and cybersecurity of information systems and process control systems at critical infrastructure facilities, a study of known cyberattacks has been conducted. Based on the experience of the world community in the field of cybersecurity and information technology, the classification of methods of intrusion and types of attacks on information systems. Using a formalized approach with the help of drawings and diagrams, the vectors of attacks, the structure of the attack and the development of the information security incident are presented. The description of possible approaches to the development of cyber threat taxonomy is investigated and presented. The definition of key concepts is given. The results of this study can be useful for assessing information security risks, in particular in determining the criticality of the organization’s assets, in creating information security management systems and developing appropriate technical regulations to ensure the continuity of business processes of the organization.KeywordsCybersecurityTaxonomyVulnerabilityCyber threatClassificationAttack

Protection motivation theory (PMT) is one of the most commonly used theories to examine information security behaviors. Our systematic review of the application of PMT in information systems (IS) security and the comparison with its application for decades in psychology identified five categories of important issues that have not yet been examined in IS security research. Discussing these issues in terms of why they are relevant and important for IS security, and to what extent IS research has not considered them, offers new research opportunities associated with the study of PMT and IS security threats. We suggest how future studies can approach each of the open issues to provide a new road map for quantitative and qualitative IS scholars.

Information security awareness is important among users because it can influence user's behavior towards complying with organization information security policies. Therefore, the current study was conducted to examine information security awareness factors affecting user's compliance behavior towards Health Information System (HIS) security policies based on extended Health Belief Model. The questionnaires were distributed to the respondents at selected public hospitals in Malaysia (N = 454). Statistical results confirm that perceived work experience, perceived severity, perceived benefit, cues to action, self-efficacy and perceived barrier were significant predictors of health information system's security policies compliance behaviour while perceived susceptibility was insignificant. Our findings will prove to be beneficial to fellow researchers and policy makers, especially related to the medical sectors in improving user's behavior toward practicing information security.

The Government and industry are currently using information and communication technology a lot. The Government and companies in Indonesia have regulations on operational standards and management procedures for information and communication systems security at Government regarding implementing information system security. Information security is essential because there are many threats to information security. Information security in this era of Information and Communication Technology (ICT) is fundamental. Information Exchange Environment (IEE) vulnerabilities have increased as threats become more widespread and complex; therefore, information security has become a fundamental problem for businesses, organizations, and governments. So, in this paper, we will explain the review of the impact of Information Security For Government and companies in terms of threats and types of information security. Some security system methods are analyzed, among others—application Security, cloud security, Cryptography, security infrastructure, Incident response, and vulnerability management. The results of this review analysis, it known threat has several solutions, each depending on the type of threat for both the Government and the Company. Furthermore, Information Security is considered very important, especially for data stored in Government and companies.

An Information System (IS) security programme consists of several essential security controls. In order to verify and maintain the effectiveness of an IS security programme, it is pertinent to identify how security controls are compared to each other in terms of their practical implications. This study reports the results from an experience survey to offer insights of the roles of security controls in IS security programmes. Four clusters of security controls were identified with technical security controls (such as authentication and confidentiality) being high on respondents' perceived importance. An approach to develop SAI with weighted security controls is explained to help security administrators conduct security assessments. The results of this study contribute to IS security budget planning and resource allocation. Managerial implications are also reported.

Мета дослідження полягає у визначенні основних аспектів і напрямів забезпечення безпеки інформаційних систем органів державної влади як чинника ефективності мережевого управління. Актуальність дослідження обумовлюється важливістю та необхідністю дослідження проблем за вказаним напрямом, зокрема щодо захисту мереж від несанкціонованого доступу, протидії витоку даних, попередження кібератак, запобігання поширенню вірусів, шкідливого програмного забезпечення тощо. Результати. Проаналізовано напрями досліджень зарубіжних вчених, які займаються науковим пошуком проблем функціонування інформаційно-аналітичних мереж у державному секторі, ролі інформації в мережевій економіці, управління державними інформаційними системами, аспектів кібербезпеки та проблем розбудови мережевої інфраструктури для суб’єктів державного управління. Досліджено підходи до сучасного аналізу стандартів і політик, які допомагають визначити вимоги до безпеки мереж та інформаційних систем. Висновки. Використання сучасних технологій, таких як хмарні обчислення, штучний інтелект, аналітика даних значно покращують функціонування державних інформаційних мереж, наголошують на важливості встановлення стандартів, принципів та правил регулювання в галузі інформаційних технологій та мереж з метою забезпечення сумісності та безпеки, підкреслюють важливість інтеграції сучасних технологій, кібербезпеки й ефективного управління інформацією для покращення мережевого управління та забезпечення якості надання послуг громадянам. З’ясовано, що науковці застосовують поняття «управління мережевою безпекою» та обґрунтовують підходи щодо удосконалення її архітектури, тлумачачи цей процес як набір рішень і стратегій, призначених для реалізації комплексного управління інформаційним обігом у мережах організації. Наголошено, що інформаційна та кібербезпека стають ключовими елементами сучасного державного управління в усіх сферах суспільного розвитку, а використання автоматизованої та інтегрованої архітектури її функціонування дозволяє забезпечити належну якість мережевого управління.

The article presents a dynamic model of the information security system (ISS) functionality from unauthorized access in automated information systems (AIS) created on the basis of Petri net machines. The authors developed a mathematical model for dynamic operating performance ratio assessment in ISS against the unauthorized access in AIS based on the Laplace transform method and a numerical technique of solving simultaneous linear algebraic equations (SLAE) by Givens method. They authors also suggest a calculation technique for dynamic operating performance ratio algorithm in ISS against the unauthorized access in AIS by applying the selected method for solving equations (SLAE) for further development of evaluation programs complex as far as for modeling and assessment of dynamic performance ratio in ISS against the unauthorized access in AIS. Selection and development of the operating performance ratio was based on the analysis of GOST (RF Standard-Setting Authority) 28195-89.

The article presents a detailed analysis of methods, methods, mechanisms, tools of decision theory for modeling information security systems. The basic terminological concepts are given, and their detailed definition is given. The combination of elements of decision theory with information security systems is shown. The connecting link for this is probability theory. The issue of decision-making procedure as a process is studied. Emphasis is placed on the qualitative parameters of the decision-making procedure that may be suitable for information protection purposes. Analogies have been made that indicate the applicability of decision theory methods to create a model of information security system. Implementation mechanisms are shown in decision-making algorithms. With the help of decision-making theory tools, it has been established that the modeling process can be formalized since both mathematical icons and verbalization. In general, the step-by-step process of designing an information security system is described. It is concluded that formalization as a type of symbolic modeling simultaneously with the application of decision theory is the best option for the descriptive part of the information security system. Modeling has been found to be the best scientific tool for combining theoretical calculations and the practical application of a wide range of research issues, including information security. To support the decision-making of the decision-maker, in other words the offender, in the field of information protection, it is important that the security officer or system administrator has experience and skills in regulated actions. Such actions are both well-known developments in this field of activity and a synthesis of already known algorithms to achieve the state of information security in general. Automation in decision-making is possible through the introduction of a decision support system that is widely used in automated systems: computer systems and networks, especially where there is a need to analyze significant data flows.

Cet article decrit, du point de vue d'un clinicien generaliste, une solution pour l'implementation de dossiers concernant les patients en toute securite, ainsi que les strategies mises en place pour cette implementation. Cet article souligne donc l'importance de la securite pour la confidentialite de ces dossiers, mais aussi la difficulte de mettre en place un systeme de protection de l'information sur