Research on Trusted Programming Technology in Information Security

With increasing dependence on information technology and information system, enterprises are confronting with a more and more complicated information security environment. Thus, information security has become an intractable problem for many enterprises. Generally speaking, there are two methods to improve enterprises’ information security level, that is, technology and management means. Technology means mainly settle software and hardware security of computers and networks, while management means mainly regulate and restrain the entire enterprise system including software, hardware, and employees. At present, a lot of enterprises mostly employ the technology means to solve information security problems. However, the lack or imperfection of information security institutions leads to bad enterprise information security situation. Therefore, technology and management means to solve information security are complementary to each other. As such, it is urgent and necessary to establish and improve information security institutions for many enterprises. In fact, enterprise information security is a complicated activity which needs different sectors to get involved in. More specifically, the information security departments play the very critical role in the implementation of information security institutions, and all employees should comply with the information security policy. Therefore, only the top management teams have the ability to coordinate the relationship between different departments, determine the introduction of information technology, and deploy the information systems. In response, top management support has an important impact on the construct of information security institutions and the effectiveness of information security management. So far, few studies have investigated the mechanism that how top management support affects information security legitimation, and legitimation information security management. Therefore, it has great theoretical and practical significance to the exploration of whether the legitimation supported by top management can improve the effectiveness of information security management. The objective of the current study is to explore whether legitimation prompted by top management team can improve the effectiveness of enterprise information security management. By doing so, the data was collected from the enterprises which have passed the certification of information security management system, and analyzed by using PLS-SEM. The results indicate that information security awareness can improve top management support（including top management belief and top management participation）and the effectiveness of information security management respectively. In addition, top management belief can improve implementation（the first stage of legitimation）and internalization（the second stage of legitimation）. Moreover, implementation can improve the effectiveness of information security management. This paper analyzes the way to enhance effectiveness of information security management, which has a reality-oriented meaning for prompting information security management of enterprises from the standpoint of institution.

Data visualization in the field of information security (IS) is becoming an urgent task. The more informative the visual display for the analyst, the faster and better he will be able to get the result. The visualization method is described in the article, which allows to reduce the time needed for determination the actual IS threats when processing the IS threat model. In the classic way of displaying, threat models are a list or a table of several tens of printed pages. To process such a volume of data, information security analysts need to spend a lot of time. It remains likely that the analyst will lose sight of important data. The article proposes a method for visualizing the spatio-temporal model of IS threats in three-dimensional and two-dimensional form. When visualizing a threat model, a surface with axes is used: time, risk, information asset. The proposed visualization of the IS threat model allows the analyst to identify current threats in less time. Scope - management of information security. The result of this work is a way to visualize the IS threat model, taking into account the spatio-temporal factor.KeywordsInformation securitySpatio-temporal modelVisualization

The Government and industry are currently using information and communication technology a lot. The Government and companies in Indonesia have regulations on operational standards and management procedures for information and communication systems security at Government regarding implementing information system security. Information security is essential because there are many threats to information security. Information security in this era of Information and Communication Technology (ICT) is fundamental. Information Exchange Environment (IEE) vulnerabilities have increased as threats become more widespread and complex; therefore, information security has become a fundamental problem for businesses, organizations, and governments. So, in this paper, we will explain the review of the impact of Information Security For Government and companies in terms of threats and types of information security. Some security system methods are analyzed, among others—application Security, cloud security, Cryptography, security infrastructure, Incident response, and vulnerability management. The results of this review analysis, it known threat has several solutions, each depending on the type of threat for both the Government and the Company. Furthermore, Information Security is considered very important, especially for data stored in Government and companies.

У статті представлено результати дослідження асоціативного поля концепту «інформаційна безпека». Теоретико-методологічною основою роботи стали новітні підходи до інформаційної безпеки як складової психологічної та інформаційної захищеності суспільства. Метою дослідження є виявлення асоціативного поля концепту «інформаційна безпека» за даними асоціативного експерименту з бакалаврами освітніх програм «Журналістика», «Міжнародна журналістика», «Реклама та зв’язки з громадськістю», «Видавнича справа та редагування», діяльність яких безпосередньо пов’язана з інформаційною сферою.Аналіз концепту «інформаційна безпека» як такого, що формується у свідомості споживача інформації через певне усвідомлення інформаційної та особистісної захищеності в площині соціальних комунікацій у мережі Інтернет, а також такого, що презентує мовну картину світу індивіда в інформаційну епоху, здійснювався на міждисциплінарному рівні.Зокрема, у дослідженні подано аналіз асоціативного поля концепту «інформаційна безпека» відповідно до отриманих логічних і граматичних реакцій ста вісімнадцяти респондентів. Аналіз за логічним компонентом виявив сім тематичних груп асоціацій: сфера захисту особистої інформації; сфера засобів масової інформації / соціальних мереж; сфера технологій; сфера державної інформаційної безпеки; соціальна сфера; психологічна захищеність; сфера захисту авторської інформації.Важливість поняття «інформаційна безпека» для цілої низки сфер інформаційної діяльності зумовлюється подальшим розвитком інформаційних технологій та технічних засобів обробки та захисту інформації, тому незаперечною є перспектива подальшого дослідження поняття в контексті виявлення рівня усвідомлення інформаційної безпеки як підґрунтя інформаційного та особистісного комфорту, а також для вивчення специфіки кореляції асоціативних полів концептів «інформаційна безпека», «інформаційна культура», «інформаційний комфорт», «інформаційний дискомфорт» тощо.

The preponderant dilemma organisations confront currently is which way to homologate and superintend access for a broad mass of services and products and in parallel to preserve security and privacy. Information technology is rapidly changing, is inherently complex, and complexity kills security. There is an ongoing technical race to maintain security that does not take into account the human factors. The new technological infrastructure affects the degree of anonymity and confidentiality in mass-market computer-based systems and basically determines the evolution of democratic-political culture. Thus, in examining the issue of security, cryptography, privacy in the use of computers and Internet, forms the primary interest form the moral side of view, about what is the right and wrong thing to do, rather than in a legal frame, about what is legal and illegal. Security and privacy are not ethical or moral issues. They are fundamental human rights. In this societal change, the challenges of the information society are many but foremost is the protection of human rights. Addressing the critical question of how technological trends are both helping and hindering the advancement of human rights is essential in the specific digital environment. The democratic key concept is the efficient use of digital resources. We do not only need a culture of security (information), we further need to ensure the security of cultures, meaning that everyone should be able to freely exercise their constitutional rights. The role of this chapter is to bring to the surface the rights (human) implications of ICT and the information society. It enlightens the technical community, which designs, implements, and secures information and communication systems, with an understanding of human rights principles and foundational underpinnings. It highlights the role of government implications, identifies the role and relationship between the stakeholders, and indicates the balance between information security and freedom in order to understand that security, freedom, and rights (human), are not opposite concepts but coexist and progress in parallel.

Size, complexity, and human dependency on software--based products have grown dramatically during past decades. Software developers are struggling to deliver reliable software with acceptable level of quality, within given budget and schedule. One measure of software quality and reliability is the number of residual faults. Therefore, researchers are focusing on the identification of the number of fault presents in the software or identification of program modules that are most likely to contain faults. A lot of models have been developed using various techniques. A common approach is followed for software reliability prediction utilizing failure data. Software reliability and quality prediction is highly desired by the stakeholders, developers, managers, and end users. Detecting software faults early during development will definitely improve the reliability and quality in cost-effective way.KeywordsSoftware ReliabilityFault PredictionSoftware MetricsCapability Maturity ModelTest Case PrioritizationThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The purpose of this paper is to inquire if the young and future financial auditors are fully aware of the impact that information security has on audit missions, focusing also on the responsibilities of the participants in financial audit missions, regarding the assessment of the risks derived from information security. To determine the extent to which audit risk might be influenced by information security, a literature review was conducted, that has focused on this current concern, as expressed by different researchers, professional bodies, Big Four companies and the regulators. In order to assess the current level of awareness regarding the impact of information security on the audit risk, 25 young professionals have participated to a survey and with their answers have proven that they realize the impact of information securing on audit missions and the necessity of having sufficient knowledge regarding information technology in order to identify the risk from the information security area which might affect the financial statements and the activity of the organization. Moreover, young and future financial auditors are aware of the fact that the audit profession will suffer modifications due to the changes in the information technology field, which will affect the approaches in audit missions and in this regards the financial auditors must develop new working skills such as understanding information systems and information security and possessing skills in analysis and data modelling. Besides the survey used, five auditors who work in Big Four companies were interviewed, in order to highlight the way in which the profession is adapting to technological changes, especially in the case of assessing controls of information technology systems and information security. From the results of the interview it can be concluded that within the Big Four companies, there is a high level of awareness regarding the necessity of solid knowledge in the information technology field. The paper is the first to examine the perception of young and future financial auditors from Romania, regarding the impact that the information security has on audit missions.

Information security is the sum of the processes and technologies used to protect information assets from unauthorized acquisition, disclosure, manipulation, modification, or damage and loss. Information security underlines the importance of trust and trust building in everyday economic and civic life. Economic activities, such as trade or financial transactions, may be critically dependent on information security, as globalization encourages and directs remote or mutually unfamiliar firms and individuals to interact. As e-business becomes part of the everyday experience of large numbers of firms, who will on average tend to be more risk-averse than early adopters of technology, security in all its dimensions becomes crucially important (UNCTAD, 2003).

"This book offers insightful articles on the most salient contemporary issues of managing social and human aspects of information security" - Provided by publisher

The article is devoted to the research of legal and organizational principles of ensuring information security of states in the modern conditions of development of information society. Theoretical approaches to the definition of the essence of «information security» and «national security» are analyzed and their interrelation is proved. The urgency of the chosen topic of scientific research is caused by the fact that confrontation in the information sphere becomes a fundamentally new sphere of competition between the states. The rapid pace of development of information and communication technologies, creation of a global information space has led to many cybernetic threats in important spheres of political, economic, social and cultural life of society. The paper presents the results of the analysis of information security of the state as a factor of influence on the national security of the state as a whole, and thus defines information security as an integral part of national security. Given the magnitude of the global information challenge, the inability to address these issues through the efforts of individual states, the article explores the issue of international cooperation in providing international information security within the United Nations. The contents of the basic international legal acts adopted by the UN General Assembly, which indicate the threats to the international security of the information space and the need for the states to take joint action to counter the challenges in the field. Particular attention is paid to the peculiarities of regional cooperation of states in providing information security within the European Union. It is determined that this area of EU activity is one of the priorities for today. The main EU normative acts are analyzed, which present the European approach to the problem of information security. The general characteristics of the activities of the special bodies of the EU (European Union Agency for Network and Information Security - ENISA, European Cybercrime Centre), whose activities are aimed at providing information security, are given. The article explores the issues of guaranteeing information security of Ukraine and protection of the national information space. The types of real and potential information threats to the information space of Ukraine are revealed, as well as practical recommendations are given on improving the state information policy and creating an effective system of counteracting cyberspace threats. Emphasis is placed on the fact that state information policy should reflect urgent issues that have arisen in the international information and information security sphere. Effective implementation of strategic priorities, basic principles and tasks of the state information security policy requires improvement of legal and organizational mechanisms of information security management.

Information security is the bedrock of any information risk-management system, and oil and gas companies are becoming more adept at minimizing risk by bolstering these systems across their organizations. Information technology (IT) is becoming such an important facet to these businesses and their disaster-recovery and business-continuity planning that the security issues now often spread to the upper echelons of many organizational charts, even to boards of directors and audit committees. In fact, the industry is seeing an increase in the number of executives in charge of company IT assets. Such arrangements play a powerful role in IT security and can result in strategically aligning IT-security issues with business objectives. Oil and gas companies should evaluate the following as global priorities when assessing information security:Integrating information security within the organizationExtending the impact of complianceManaging the risks of third-party relationshipsFocusing on privacy and personal-data protectionDesigning and building information security Some of the regulatory changes that have taken place over the last few years, particularly related to the Sarbanes-Oxley Act in the United States, have caused companies to move from a reactive to a more proactive mode. While many energy companies still would rather spend capital on commodity assets than on information assets, they are slowly shifting as they recognize that information security is a top business driver. IT security is becoming a part of the discussion in the context of a company's priorities. Whether those priorities include adding new acreage or adding rigs, E&P companies are leveraging technology more and more, and, as that technology is leveraged, the need for IT security rises. As Technology Is Leveraged, Risk Rises As companies grow through expansion or from mergers and acquisitions, computer networks can multiply and expand like cell division. Gradually adding bits and pieces to a network, especially when knowingly or unknowingly commingling sensitive data, increases risks and elevates the need for IT security. Not long ago, petroleum engineers, for example, examined geology assets in a back room, working safely within a secured computer network. Today, more and more of these professionals are performing such work on broader company networks, a move that saves companies money, but also elevates the possibility of data being compromised. The notion of E&P companies leveraging communications technologies is not new, but they are constantly breaking new ground where applications are concerned. Fiber-optic networks, for example, are commonplace, and energy companies are now investing billions of dollars to lay these systems in the Gulf of Mexico and at other offshore asset locations. They know that as they go out into deeper water, the fiber-optic network will offer better communications capabilities for current and future processing facilities and drilling activities.

In the modern world automation technologies of industrial processes have found wide application. Automated process control systems have become an important part of enterprises that operate in different economic fields and life support facilities all over the world. Nevertheless, the high growth of automation means raises the acute problem of providing APCs information security from external and internal threats. There are systematic reports in the media about new critical vulnerabilities in industrial equipment and attacks based on the exploitation of such vulnerabilities. When designing such systems it is necessary to estimate possible information security threats that already exist in the system or that are predicted to appear. That is why threat modeling is an important part of providing information security at industrial facilities using automation. In this work the author investigates the methodology of estimating threats to software security TRIKE. The research is aimed at finding general approaches to determine threat sources, tactics, and techniques for making implementation scenarios of threats to software information security, for applying them to provide cyber security of automated process control systems. In the frameworks of the subject mainstreaming, the research gives a description of cyber-attacks at big industrial facilities, and their basic vulnerabilities are emphasized. In the article the analysis of TRIKE methodology has been done. It is aimed at determining basic threat modeling stages applicable to industrial automation systems. The approach of TRIKE methodology to generating a list of threats to information security is formalized. To achieve the aims the author constructs DFD data flow diagrams with the decomposition of peculiar elements of the algorithm for modeling threats to information security of automated process control systems using TRIKE methodology.KeywordsAutomated process control systemsInformation securityThreatThreat modelTRIKEData flow diagramsAttack library

This article provides the modern cybersecurity trends directly related to aim ant tasks of criminals. It reflect the assessment of global technological risks discussed at 2020 World Economic Forum. The article covers estimations on increase on negative impact of geopolitical sharpness elements on economic potential of next generation technologies. Data fraud and cyberattacks are considered as priority key indicators at assessment of the most possible global risks, and attacks at informational infrastructure are equal to the cyberattacks risks at the rating of the most possible risks. Forecast indicates that cyberattacks are the most likely to be used as indirect conflicts between countries which look forward to expand their range on influence. In such situation the cybersecurity issues can`t stay on the second place or be the issues which should be solved at existence of direct cyber threats to the modern informational systems, IoT systems and SCADA. Obviously, we should revise the approaches to creation and development of modern informational technologies and cybersecurity issues should be considered as constituent element in development of modern informational systems from the very moment of its initiation, projecting, and on all stages of production and support. Reorientation of informational system developers to creation of new integrated platforms with cybersecurity constituent elements demands the research and implementation of new approaches to its development, as well as engagement of the world community at elaboration of relevant standards and protocols, which ensure the secure functioning of informational systems at world net. The article provides the basic requirements to constituent elements at development of concept of informational and cyber security in conditions of hybrid threats especially provides recommendations on organizational structure for informational security department and general principles to organize the activities and controls on informational and cyber protection. The article defines tasks for informational security department, provides the list of basic actions to secure information, and formulates the tasks, which should be ensured by technical infrastructure, organizational, procedural and hardware and technical actions to manage the informational security, and other principles to ensure informational security in development of concept of informational security within the hybrid threats conditions.

One of information security management elements is information security awareness program. Usually, this programs only involve the employees within the organization. Some organizations also consider security awareness for some parties outside the organization like providers, vendors, and contractors. This paper add consumers as variable to be considered in information security awareness program as there are also some threats for organization through them. Information security awareness will be measured from user's knowledge and behavior of five information security focus areas in telecommunication, especially related with smartphone users as one segment of telecommunication provider. In other researches, information security measurement from outside an organization is focused in Internet use by end-user. In telecommunication industry, information security threats for consumers not only from Internet, but also by phone call or texting. This research used CFA for data analysis method. The result showed that the indicators of knowledge dimension is not good enough to measure dimensions of knowledge where most of them are not significant. Meanwhile, behavior dimension gave different result with high significant value for measuring security awareness level. Indicators of behaviour dimension is good for measuring dimension of behaviour because only one indicator that isn't significant.

Local governments are dealing with student information more and more frequently, resulting in the risk of student information being leaked, so it is necessary to introduce relevant policies, laws and regulations to standardize information collection activities and improve the level of social information governance. Therefore, this study proposes three hypotheses: on the one hand, whether the information policy issued by the local government can guide students' information collection activities, and on the other hand, whether the introduction of local laws and regulations can provide protection for students' information security; Finally, whether public participation can provide supervision for student information collection and governance, and create a good public management environment. The results show that local information laws and regulations can regulate the behavior of students' information collection and clarify the purpose and direction of students' information collection. At the same time, laws and regulations such as privacy protection and local codes of conduct can improve the security of student information and ensure the legal collection of information. The active participation of the public is conducive to the public information collection environment and ensures the overall security of student information. Therefore, local government policies, laws, and regulations can provide assurance and support for students' information security and promote the sustainable development of digital education.