Ransomware: Emergence of the cyber-extortion menace

As the cyber threat landscape is constantly becoming increasingly complex and polymorphic, the more critical it becomes to understand the enemy and its modus operandi for anticipatory threat reduction. Even though the cyber security community has developed a certain maturity in describing and sharing technical indicators for informing defense components, we still struggle with non-uniform, unstructured, and ambiguous higher-level information, such as the threat actor context, thereby limiting our ability to correlate with different sources to derive more contextual, accurate, and relevant intelligence. We see the need to overcome this limitation in order to increase our ability to produce and better operationalize cyber threat intelligence. Our research demonstrates how commonly agreed upon controlled vocabularies for characterizing threat actors and their operations can be used to enrich cyber threat intelligence and infer new information at a higher contextual level that is explicable and queryable. In particular, we present an ontological approach to automatically inferring the types of threat actors based on their personas, understanding their nature, and capturing polymorphism and changes in their behavior and characteristics over time. Such an approach not only enables interoperability by providing a structured way and means for sharing highly contextual cyber threat intelligence but also derives new information at machine speed and minimizes cognitive biases that manual classification approaches entail.

The aim of the article is to present the results of research into how the degree of threat to the security of information resources resulting from human factors is perceived by employees of marketing departments at universities in Poland, Ukraine and the Czech Republic. The theoretical part of the article lists and describes the most common factors, mentioned in the relevant literature on the subject, stemming from the behaviour, characteristics and competences of employees and affect the security of information management. The empirical part presents the results of research conducted in Poland, Ukraine and the Czech Republic between November 2021 and June 2023 inclusive.

The national security of the Russian Federation depends essentially on information security. The article is devoted to the issues of information security of executive bodies at the present stage. The notion of information security and the meaning of information security regime with regard to executive bodies are hereby considered by the author along with the analysis of its elements, the ways to ensure information security in the light of changing situation, new challenges and threats. The author concludes that information security of executive bodies includes the provision of their information needs within their competence and frameworks which are necessary to fulfill the tasks assigned to them; Also necessary for security of information and information resources; security of telecommunications and information exchange.

The article analyzes the existing legal mechanisms for managing critical information infrastructure in Ukraine. The instruments for their improvement are proposing in this article. An important component of critical infrastructure is its information component – a critical information infrastructure. The sphere of protection of critical information infrastructure in Ukraine is at the initial stage of formation. The current legislation defines only certain objects of socio-economic sphere, in which extraordinary events can lead to socially dangerous consequences. In view of the fact, that the term “critical information infrastructure” does not having a consistent interpretation in different countries, we propose our opinion. “Critical information infrastructure is a system of information management of critical facilities and information and communication networks that provide defense capabilities and security of public and private institutions, whose operation may flow to the national security of Ukraine” (KII). In the KII we can identified information and network components. Information environment of KII is a system for information management of critical objects, including computing and information resources that form automated control systems (ACS). The network component of KII consists of a set of telecommunication devices, communication lines and network equipment, systems of open protocols for the exchange of information between elecommunication devices, global system of digital addresses and digital identifiers, software. The Internet network can be considered as a technological add-on over a telecommunication network that provides the provision of data transmission and processing services (e-mail, teleconferencing, file transfer, access to computing and information systems in local area networks). The main threat to the safety of ACS of critical information infrastructure objects is targeted actions on information systems, information and telecommunication networks by software and hardware. KII legal security include two main components – national and international. The national component may be forming by a set of principles, legal institutions and norms, which are enshrined in the national legislation regulating public relations in Ukraine in the area of counteracting the security threats of the ACS of critical objects. In order to protect the most important objects of KII, it is necessary to identify these objects. The current legislation defines such categories of objects, for which special conditions for ensuring their protection and functioning are established. Some of them, in whole or in part, may be classifying as objects of critical infrastructure. The specificity of providing information security was reflecting in such Ukraine laws like “On the Fundamentals of National Security of Ukraine”, “On the Concept of the National Program of Informatization”, “On the National Program of Informatization”. As well as the Concept of Development of the Security and Defense Sector of Ukraine, the National Security Strategy of Ukraine, the Strategy of Cybersecurity Of Ukraine. The National Security Strategy identifies actual threats to national security and sets priorities for information security, cyber security and security of information resources and critical infrastructure. At the same time, the implementation of the state policy in the field of security of KII requires the further development of legal principles and norms governing the relevant social relations, that is, the national component of the legal security of KII. Ukraine should ensure the establishment of a nationwide system for assessing risks and threats to critical infrastructure, and after the legislative definition of the main terms, the implementation of the Identification of Critical Information Infrastructure objects. Identification of objects of critical information infrastructure can be accomplishing by introducing the certification of objects of critical information infrastructure. Such passports must contain general data about the facility, data on the main sources of danger, data on hazardous natural conditions, technological processes and response to threats. The international component of the legal security of KII provides for the regulation of a set of principles and norms defined by international treaties and recognized by the state, regulating issues of international cooperation in this area. Ukraine has signed the Convention on Cybercrime together with the member states of the Council of Europe and other States. It is aiming at stopping actions against the confidentiality, integrity and availability of computer systems, networks and computer data, as well as abusing such systems, networks and data by installing the criminal responsibility for such behavior, the provision of powers sufficient to combat criminal offenses, and the conclusion of agreements on rapid and reliable international cooperation. In addition, the plan of measures for 2017 on implementation of the Cybersecurity Strategy of Ukraine provides for the implementation of Directive 2008/114/EC on the protection of critical infrastructure, in particular on cybersecurity and cyber defense of critical infrastructure objects. Development of the system of international information security, the following main groups of international relations that requirenormative legal regulation within the framework of the legal security of KII: definition of the boundaries of the national KII in the global information and communication infrastructure and fixing signs of computer incidents in the control system of critical objects information infrastructure. The absence of generally recognized borders of state sovereignty of States in this space is a significant obstacle to the application of international law to the actions of other states. In particular, this impedes the establishment of limits of responsibility of states for violating the security of the KII and organizing international cooperation in the field of countering computer crime. The urgency of the legislative consolidation of signs of computer incidents in the automated control system of critical information infrastructure objects suggests the widespread use of the concept of “incident” in international law. An incident in cyberspace usually associated with a violation of the functioning of the components of cyberspace – an electronic collection environment and automated processing of information that determines the processes of the implementation of these operations, as well as information systems and automated control systems. The essence of the general definition of the “international incident” in the field of KII will be determining, firstly, by the nature of international relations between states that are violating by the “incident”. This event may be the result of unforeseen actions of the state, including actions that harm the interests of public bodies of one or more states, or, conversely, be one of many intentional but minor provocations carried out by agents of one state against another state. Given that international relations in the field of incidents in the field of KII are not regulating by international treaties, the main and, in fact, the only source of international law in this case serves as an international custom, however, its application to the sphere of KII is accompanying by considerable difficulties. For Ukraine, it is possible to introduce the positive experience of other states in the security of the KII. In particular, the problem of security of information technologies has been enshrined in the international standard ISO / IEC 15408 “General criteria for assessing the safety of information technology”.

The security of information resources is an extremely critical problem. The network infrastructure that enables internet access, in particular, may be targeted by attackers from a variety of national and international locations, resulting in losses for institutions that utilize it. Anomaly detection systems, sometimes called Intrusion Detection Systems (IDSs), are designed to identify abnormalities in such networks. The success of IDSs, however, is limited by the algorithms and learning capacity used in the background. Because of the complex behavior of malicious entities, it is critical to adopt effective techniques that assure high performance while being time efficient. The success rate of the boosting algorithms in identifying malicious network traffic was studied in this study. The boosting approach, one of the most used Ensemble Learning techniques, is accepted as a way to cope with this challenge. In this work, Google Colab has been used to model well-known boosting algorithms. The AdaBoost, CatBoost, GradientBoost, LightGBM, and XGBoost models have been applied to the CICID2017 dataset. The performance of the classifiers has been evaluated with accuracy, precision, recall, f1-score, kappa value, ROC curve and AUC. As a result of the investigation, it was discovered that the XGBoost algorithm produced the greatest results in terms of f1-score, with 99.89 percent, and the AUC values were extremely near to 1, with 0.9989. LightGBM and GradientBoost models, on the other hand, have been shown to be less effective in detecting attack types with little data.

Considering the importance and need for efficient preservation and security of medical records in the federal university Otuoke, it is imperative to employ the use of technology to achieve this purpose. The use of technology will save funds, time, and space and prevent health hazards. The lack of technology in this digital age will lead to poor management of health records, which will invariably lead to health hazards. It is on this premise that this study seeks to investigate the preservation and security of information in the digital age at the Federal University Otuoke Healthcare Centre. The study identifies the records generated and kept, examines the factors militating against effective preservation, and determines the strategies that could be employed in preserving medical records. A descriptive research method was adopted; total enumeration sampling techniques were used as the study population of 70 was not large. A questionnaire was used for data collection, and the data was analysed using frequency count and simple percentages. The study revealed that major records generated include observations and administration of drugs and therapies, test results, x-rays, and reports, among others. Factors militating against the preservation and security of medical records indicated by respondents include lack of ICT, poor power supply, and lack of skilled manpower, among others; strategies employed for the preservation of medical records, as revealed by respondents, include shelving, cabinets, drawl air conditioning, etc. The study recommends employing a professional librarian to effectively manage the electronic facilities used to deploy electronic records.

Since mid-1992, the National Aeronautics and Space Administration (NASA) Mission Control Center (MCC) in Houston has pursued commonality and consolidation of facilities and equipment to reduce the implementation costs associated with the modernization of the control center, as well as the on-going operations and sustaining costs. In December of 1993, a management team, comprised almost entirely of individuals with manned spaceflight operations experience, was given the charter of completing the development. Past practices and conventional thinking have been set aside in an effort to deliver the new control center “better, faster, and cheaper”. This new paradigm has carried-over to the engineering associated with securing the control center's information resources. The group originally tasked with ensuring the security of the MCC's information resources was not directly associated with development or operations of the MCC, and thus had lost sight of the fact that the MCC's mission is the command and control of space vehicles, not the pursuit of information security. Under the new paradigm for control center development, responsibility for ensuring system security and integrity has been brought into the development organization. Old methods and approaches to security have been replaced by a new approach which emphasizes the implementation of an automated information systems security architecture that is both logical and cost effective.In both Government, and industry, it is common for those tasked with information security responsibilities to be separated from the mainstream of engineering. This separation often results in conflict during requirements definition, design, implementation and testing. The following is a case study of such an information security organization, and process, run amok. It also discusses the steps required to bring the process back into line with the goals of cost-effective development and operation.

The object of the research is a new methodological approach to solving the problem of interval analysis 
 of the security of information and telecommunication resources of critical infrastructures. This approach is one of the variants of practising the methods of the class midvalues (interval calculations). The approach characteristics were analyzed to determine its validity and usefulness for assessing the security indicators of such complex technical systems over a time interval. There have been considered theoretical aspects of building the algorithms for calculating the class midvalues of security levels of information and telecommunication resources of critical infrastructures, factors of calculating the upper and lower class midvalues of security levels. A sequence of calculations and analytical expressions for calculations on the example of a specific security indicator are proposed. The approach offers taking into account the modern requirements of security management subsystems of complex technical systems, the requirements of officials (auditors, security administrators) related to the inertia of decision-making processes, with the duration of cycles of security control and security management of systems of this class. It allows one to obtain not point (instantaneous), but interval estimates of security indicators, while the analysis is carried out with a predetermined frequency and takes into account the uncertainty of the initial data – observed and controlled security indicators. At the same time, interval analysis does not have great mathematical and computational complexity, but it allows one to obtain interval estimates of resource security adequate to control and management tasks, saves computing resources and, ultimately, works 
 to increase the reliability of security control of modern critical infrastructures

Possibility theory is an alternative to probability theory as a basis for security management in settings where information resources are elements of national information infrastructure. Probability theory is founded on the assumption that one cannot totally rule out an intrusion. Possibility theory operates under a contrasting assumption. While persistent, well-supported, and highly professional intrusion attacks will have a higher probability of success, operating instead against the possibility of intrusion places defenders in a theoretical framework more suitable for high-stakes protection. The purpose of this chapter is to introduce this alternative quantitative approach to information security evaluation. It is suitable for information resources that are potential targets of intensive professional attacks. This approach operates from the recognition that information resource security is only an opinion of officials responsible for security.

The modern development of high technologies and computer technology greatly enhanced the development of automated banking systems of banking sector organizations and allowed the synthesis of information and communication technologies for their formation. However, the era of high technology has increased the range of threats to banking information resources; threats have gained signs of hybridity and synergy. In these conditions, the current issue in shaping the information security management system in banking sector organizations is the formation and analysis of modern threats. In order to generalize the approach of classification of hybrid cyber threats to the components of security: information security, cybersecurity, security of information banking information resources in the work proposed an advanced classification of threats to banking information resources. The classifier takes into account ISO / OSI model levels in automated banking systems, the targeting of threats to security services and their criticality of damage. The article analyzes contemporary international standards and normative documents of the National Bank of Ukraine on security issues of banking information resources. On the basis of this analysis, we propose estimates of the level of danger to intruders and the degree of implementation of protective measures under the conditions of modern hybrid cyber threats.

Information security is a component of the state national security. In this regard, the urgent issue today is to ensure the security of state information resources, protection of vital interests of society in the information sphere.The aim of the study is to analyze the main measures CSTO member states to organize and conduct joint operations in the informational area.The activities of the CSTO is to conduct joint operations in cyberspace, aimed at identifying and blocking the sources of destructive and manipulative information.For seven years this cooperation suspended the activities of a significant amount of resources. The authorities state that took part in them, have considerable experience of joint coordinated action in this area.As a result of the conducted research were selected three basic directions of joint activity of states-members of CSTO in informative space: counteraction terrorism, extremism, narcotrade; improvement of mechanism of defence of population from negative informatively psychological influence and creation of Centers of reacting on ciberincident.As an example of such activity is a general operation "PROXIES-SOUTH-2010", conducted during interethnic contradictions on the south of Kyrgyzstan in summer in 2010 . It follows to mark the fact of bringing in of powerful scientific and analytical institutes of states-members of CSTO to work in the area of providing of informative safety and conduct informatively propagandist to activity.

Background and purpose: With the advancement of science and the increase of electronic resources, the need to create libraries to collect, organize and disseminate these types of resources is felt. With the growth of electronic resources, resource management has gained special importance and is one of the important areas and issues in the discussion of digital libraries. In this study, the aim is to examine the issues and challenges facing the management of digital libraries and provide solutions to solve the challenges and issues facing digital libraries and digital library management. Research method: The current research is applied in terms of purpose and survey research in terms of method. The current research has been conducted by field method and using library techniques, and the researchers have presented digital library management approaches by reviewing the published texts on digital libraries and digital library management issues. Findings: The results of the research showed that the most important components of digital library management include human resources, management of shared resources, author's right to update resources, cataloging and maintaining the technical structure. Also, the surveys showed that the most important challenge facing digital libraries is the issue of intellectual property and compliance with copyright laws. Conclusion: The results of the research showed that in digital libraries, as in traditional libraries, measures must be taken in the field of collecting, organizing, storing and disseminating information, and it is not possible to carry out the above-mentioned activities without a competent manager. Digital library management leads to the creation of coordination between different parts of the digital library and helps the library to achieve the desired goals. The digital library is facing many issues and challenges, including financial and budget issues, issues related to expert human resources, issues related to digital equipment and internet infrastructure, issues related to author's right and copyright, issues related to the lack of devices. Digitization and security of important information resources and documents and finally issues related to the protection and maintenance of digital resources are faced, which cannot be solved except with the presence of a capable manager and strong human resources of the library.

The presence of contemporary entities in the cyber-space shows that IT offers unlimited possibilities of running a business and developing an organisation. On the other hand, it involves a greater number of internal and external threats in the area of accounting information resources security. The objective of the paper is to diagnose the current level of accounting information resources security (AIRS) assurance in Polish business entities. The paper analyses two research hypotheses. In accordance with the first one, the AIRS assurance level in various entity groups may be different, even though all entities should have implemented the same requirements of the Accounting Act in the analyzed area. The identified differences may result from the effect of additional, industry-specific regulations. The other hypothesis claims that in the private business area, accounting and auditing companies adhere to AIRS regulations more strictly than other small and medium enterprises. The paper defines the fundamental factors affecting the functioning of corporate accounting systems in the three dimensions of the cyber-space. Subsequently, the author presents the results of empirical research on how corporate information security is ensured in the context of internal accounting control systems and the requirements of the Polish Accounting Act. The results of the empirical research show how the management of the analysed entities crafts the basic elements of their internal environment as well as internal communication and control processes connected with ensuring information resources security. The results also show the management’s approach to various aspects of risk management of accounting information resources security, as well as to adherence to organisational and administrative procedures, and to hardware and software safeguards in the IT environment of the accounting system. The issues analysed in the present paper open a scholarly discussion that should lead to the development of theoretical models, recommendation of efficient methods and tools, as well as indication of adequate legislative initiatives. Research methods used by the author include analysis of literature and legislation, analysis of survey results, deduction and inference.

The article considers the legal mechanisms for ensuring information security. It has been proven that today, more than ever, when there is a war in Ukraine, the issue of ensuring information security becomes especially relevant and significant, as the information space becomes a “battlefield” on a par with the war front. Enemy forces actively use informational and psychological operations to destabilize the situation inside our country, create panic, spread fakes and undermine trust in state institutions. In these conditions, the state’s policy becomes important, which should be integral and effective in countering these threats. An effective state policy in the field of information security will help ensure society’s resilience to information threats, strengthen trust in state institutions, and maintain stability in crisis conditions. The author’s understanding of information security is offered as a state of security of information resources and information systems, which ensures their confidentiality, integrity, availability and reliability, as well as protection against unauthorized access, disclosure, modification, destruction and other forms of abuse that may lead to a violation of national security, economic stability and social order. The main components of information security, which are the basis for information security for the state as a whole, individual bodies or private enterprises, are called confidentiality, integrity and availability. The main components of the mechanism for ensuring information security, in the opinion of the author, should be: technical (creation of appropriate technical infrastructure to ensure the functioning of information security), political (development of state policy aimed at ensuring information security) and legal (adoption of high-quality normative legal acts that will determine all information security measures). These three components complement each other and are key to creating an effective system of protection against information threats.

Subject. In the modern information society, ensuring information security is one of the key tasks of organizations, especially in the context of growing cybersecurity threats. Every year, companies face increasingly complex and diverse threats that can cause significant damage to both the financial resources and reputation of the organization. In this context, ensuring information security becomes an important strategic task for enterprises in various fields of activity. Information security plays a critical role in protecting information confidentiality, ensuring the integrity and availability of information, as well as the security of information systems and networks. Goal. The main goal of the research in this work is a comprehensive study of the technology for ensuring the protection of information, preventing unauthorized actions with it, in particular, its use, disclosure, distortion, modification, research and destruction, as well as the correct strategy for information protection of data from external and internal threats. Method or methodology. The research is based on general scientific methodology, which involves the use of a systematic approach and general scientific methods of cognition. The results of the work. In the course of the study, the authors of the article tried to resolve the problem of the interdependence of information security and the strategy for information protection of data from external and internal threats by structuring the subject area of information security policy, which made it possible to set priorities in solving the problems of ensuring the required level of security of information resources and supporting infrastructure in the context of the development of digital technologies. When analyzing problems related to information security, the authors note the importance of mechanisms for generating new solutions that allow, at a minimum, to adequately respond to threats to information security or to anticipate new threats and be able to resist them. Conclusions. The study found that information security plays a critical role in the modern world, ensuring data protection, privacy and sustainability of business processes. In an environment of constantly changing and evolving threats, maintaining a reliable information security system becomes an integral part of the success of organizations and personal security. This is an important step towards creating an information security management system at the enterprise, with the help of which constant and effective monitoring of the effectiveness of security measures is carried out, timely correction of actions taken and revision of existing provisions to ensure maximum security.