The Distributed Computing Environment: Issues of Secure Networks

Digitalization forces manufacturing companies to shift towards customer-oriented, highly data-driven forms of value creation. This results in a changing IT security risk landscape as data becomes an attractive target for adversaries leading to an increasing number of attacks. In order to successfully protect data, it is essential that it is assessed in an integrated manner. Although IT security and data-based value creation have been studied by large research bodies, the existing literature fails to provide guidance on IT security risk analysis in data-based value chains. To contribute to the closure of this research gap, we propose a modeling approach which allocates different data types to value activities and analyses the data types in relation to the properties of relevant IT security risks. The evaluation, conducted with industry experts, reveals that it is not only a company’s primary assets that are of concern but also less important data types subject to significant levels of exposure that bear considerable IT security risks.

To maintain the cyber security, nuclear digital Instrumentation and Control (I&C) systems must be analyzed for security risks because a single security breach due to a cyber attack can cause system failure, which can have catastrophic consequences on the environment and staff of a Nuclear Power Plant (NPP). Attack trees have been widely used to analyze the cyber security of digital systems due to their ability to capture system specific as well as attacker specific details. Therefore, a methodology based on attack trees has been proposed to analyze the cyber security of the systems. The methodology has been applied for the Cyber Security Analysis (CSA) of a Bistable Processor (BP) of a Reactor Protection System (RPS). Threats have been described according to their source. Attack scenarios have been generated using the attack tree and possible counter measures according to the Security Risk Level (SRL) of each scenario have been suggested. Moreover, cyber Security Requirements (SRs) have been elicited, and suitability of the requirements has been checked.

“Nobody ever got fired for buying IBM,” was a widely used cliché in the 1970s in the corporate IT (information technology) world. Since then, the traditional process of purchasing software has dramatically changed, challenged by the advent of open source software (OSS). Since its inception in the 1980s, OSS has matured, grown, and become one of the important driving forces of the enterprise ecosystem. However, it has also brought important IT security risks that are impacting the OSS IT adoption decision-making process. The recent Heartbleed bug demonstrated the grandeur of the issue. While much of the noise relates to the amplification of perceived risks by the popular mass media coverage, the effect is that many enterprises, mainly for risk reasons, have still chosen not to adopt OSS. We investigated “how do information security related characteristics of OSS affect the risk perception and adoption decision of OSS” by conducting an online survey of 188 IT decision-makers. The proposed Open Source Risk Adoption Model offers novel insights on the importance of the perceived risk antecedents. Our research brings new theoretical contributions, such as understanding the perceived IT security risk (PISR) relationship with adoption intention (AI) in the OSS context, for researchers and important insights for IT information professionals. We have found that IT security risk has a significant role in OSS adoption intention. Our results offer possible future research directions and extend existing theoretical understanding of OSS adoption.

Electronic health records are becoming increasingly common in the health care industry. Although information technology (IT) poses many benefits to improving health care and ease of access to information, there are also security and privacy risks. Educating health care providers is necessary to ensure proper use of health information systems and IT and reduce undesirable outcomes. This study evaluated employees' awareness and perceptions of the effectiveness of two IT educational training modules within a large publicly funded health care system in Canada. Semi-structured interviews and focus groups included a variety of professional roles within the organisation. Participants also completed a brief demographic data sheet. With the consent of participants, all interviews and focus groups were audio recorded. Thematic analysis and descriptive statistics were used to evaluate the effectiveness of the IT security training modules. Five main themes emerged: (i) awareness of the IT training modules, (ii) the content of modules, (iii) staff perceptions about differences between IT security and privacy issues, (iv) common breaches of IT security and privacy, and (v) challenges and barriers to completing the training program. Overall, nonclinical staff were more likely to be aware of the training modules than were clinical staff. We found e-learning was a feasible way to educate a large number of employees. However, health care providers required a module on IT security and privacy that was relatable and applicable to their specific roles. Strategies to improve staff education and mitigate against IT security and privacy risks are discussed. Future research should focus on integrating health IT competencies into the educational programs for health care professionals.

Legacy applications based on the Distributed Computing Environment (DCE) are subject to several significant limitations. As the development and support of DCE wanes, object‐oriented development becomes more desirable, and transmission over HTTP is established as the preferred protocol over the Internet, DCE application managers and developers are pressed to find extensions and alternatives to DCE. This paper briefly discusses several alternative targets for migration of DCE systems, then proceeds to detail, compare, and contrast two preferred candidates: CORBA and SOAP. Although we have found that developing a general migration solution for legacy DCE applications to CORBA or SOAP to be a non‐trivial, long‐term project, developing specific solutions that are based on a general architecture is feasible. Given a short list of reasonable premises, many DCE applications may be ported to technologies such as CORBA and SOAP. Copyright © 2002 John Wiley & Sons, Ltd.

As cloud services become mature and provide capabilities for elastic computation and data management, hosting services become increasingly prevalent such as Amazon Web Services, Microsoft Azure, or RedHat OpenStack. Workloads are hosted in these platforms using hypervisors running on physical machines which host virtual machines (VMs) presented to the customer. Software-defined network (SDN) technologies move many of the network functions into the hosts. Accordingly SDN-based VM placements have received significant attention as a way to minimize network traffic between VMs and hosts. Careful placement of VMs can generate a significantly lower amount of network traffic to the hosting provider. Further, it may impact the level of security risk exposed by the VM placement as each VM may have a different level of security risk. In this work, we consider these two conflicting goals by presenting a Software-Defined Network based VM Placement, called SDNVMP, to minimize both network traffic between VMs (and hosts) and security risk by grouping VMs with similar security scrutiny needs. Our results show that the proposed placement algorithm outperforms the baseline counterparts in terms of network traffic overhead and security risk in each VM introduced by such algorithms.

PurposeThis study aimed to identify the main keywords and research topics used in research on problematic smartphone use (PSU) among children (6-12 years old), including parental factors.MethodsThe publication period for the literature was set from January 2007 to January 2022, as smartphones were first released in 2007. In total, 395 articles were identified, 230 of which were included in the final analysis. Text network analysis was performed using NetMiner 4.5.ResultsResearch on this topic has steadily increased since 2007, with 40 papers published in 2021. Eight main research topics were derived: group 1, parental attitudes; group 2, children's PSU behavior and parental support; group 3, family environment and behavioral addiction; group 4, social relationships; group 5, seeking solutions; group 6, parent-child relationships; group 7, children's mental health and school adaptation; and group 8, PSU in adolescents.ConclusionParental factors related to PSU have been studied in various aspects. However, more active research on school-age children's PSU needs to be conducted due to the paucity of research in this population compared to studies conducted among adolescents. The results of this study provide useful data for selecting research topics in the field of PSU.

Mobility as a Service (MaaS) is anticipated to revolutionize transport by integrating conventional public transport with on-demand and shared services. This innovation promises enhanced convenience, flexibility, and sustainability in urban mobility, drawing interest from both researchers and industry. However, those systems heavily rely on the collection and sharing of personal data among various stakeholders, introducing security and privacy risks. To understand the scale and scope of cyber security and privacy concerns and risks associated with MaaS, we conducted a systematic literature review (SLR) covering 87 relevant research papers published between 2017 and April 2025. Our review represents the most comprehensive examination focusing on cyber security and privacy issues of MaaS systems. Our findings reveal three themes discussed within the MaaS literature: (i) cyber security and privacy risks inherent to MaaS systems, alongside proposed solutions to mitigate such risks; (ii) users’ concerns about these risks and how they affect MaaS adoption; and (iii) laws and policies that govern cyber security and privacy aspects of MaaS systems and solutions. As such, our research serves to not only inform MaaS service providers and users but also advise policymakers and legislators on the potential risks involved and the regulatory measures required to address them.

Prevention is better than cure”, in every way we can think of, Information security is not different. We all know networks are vulnerable, but we all don't know where and how; that's why risks assessment comes in. This paper designed and implemented a unified and intelligent tool for quantitative security risk level measurement of an organization. Development of Network Security Risk Level Estimation Tool (NSRLET) involves two steps; construction of vulnerability analysis database and measurement of security risk level of organization. Analysis of organization's network environment using automated tool resulted vulnerability database. For risk level estimation a new approach is proposed that identifies the probability of attacks in user's network environment. The proposed tool is evaluated in Vikram University Ujjain, India's computing environment for security risks measurement. The tool predicts the probability of exploit and computes the risk level to improve security of existing system and to minimize adverse effect from these probable exploits. The proposed approach for risk level estimation can be used to assess how much one should believe in system trustworthiness.

Enterprise cybersecurity is undergoing significant transformation due to the widespread adoption of agile development and self-steering teams, particularly in large organizations. Traditionally, cybersecurity governance has been centralized, relying on structured coordination across people, processes, technologies, and compliance mechanisms. However, agile methodologies—marked by decentralized, autonomous teams—have shifted organizational dynamics from hierarchical to distributed models. While this enhances responsiveness and innovation, it also introduces fragmentation in cybersecurity responsibilities, complicating unified decision-making and the enforcement of security controls.This study explores how large agile enterprises can effectively manage cybersecurity, with a specific focus on ransomware threats. Through qualitative interviews with nine cybersecurity professionals from a highly digitalized public organization in the Netherlands, the research identifies two core organizational tensions: (1) balancing agility and cyber security in decision making about security controls and risk management, and (2) balancing operational business requirements with cybersecurity improvement.The first tension stems from the fragmentation of cybersecurity responsibilities across agile teams. Respondents reported weakened accountability, inconsistent policy enforcement, and an over-reliance on tools to bridge communication gaps. These challenges are linked to mechanistic thinking—an outdated organizational mindset that views departments as isolated units. This leads to siloed operations and a narrow focus on technical solutions. To address this, the study advocates for a systems thinking approach, which views organizations as dynamic networks of interdependent elements. Systems thinking emphasizes holistic understanding, collaboration, and feedback loops.A key recommendation is the introduction of boundary spanners—individuals who bridge communication gaps between teams and align local actions with enterprise cybersecurity goals. These roles facilitate cross-team coordination, support unified decision-making, and help integrate cybersecurity efforts across the organization.The second tension involves the misalignment between the steady rhythm of operational teams and the dynamic pace of cybersecurity innovation. Operational teams prioritize stability, while innovation efforts require flexibility and rapid iteration. This mismatch is exacerbated by Out-Group Bias, where teams resist adopting solutions developed externally, leading to inconsistent security practices and delayed implementation of improvements.To overcome these challenges, the study proposes a programmatic approach to cybersecurity improvement. A program, defined as a coordinated set of related projects, ensures strategic alignment, resource allocation, and effective decision-making. The approach incorporates short-cycled project phases—explore, experiment, pilot, and scale—each with clear objectives and standardized methods. This structure accommodates operational constraints while ensuring timely progress and shared ownership.A successful example of this method is found in the Dutch financial sector, where the Partnership for Cyber Security Innovation (PCSI) implemented a four-month cycle with joint steering committees. This setup promoted inclusivity, countered Out-Group Bias, and enhanced cross-organizational cybersecurity awareness.In conclusion, the study underscores the need for systemic thinking and structured program management to align agile practices with robust cybersecurity strategies. By addressing internal tensions and fostering collaboration across teams, organizations can enhance their resilience against complex cyber threats while maintaining the benefits of agility. Future work will involve field-testing these models, including training boundary spanners and implementing short-cycled programs, with a one-year implementation horizon recommended for optimal impact.

Emerging smart manufacturing technologies combine physical production networks with digital IT systems, resulting in complex smart factory networks, which are especially vulnerable to IT security risks, such as IT component non-availabilities. Companies must employ extensive IT security measures to secure their production facilities. However, complex network structures and inherent dependencies of smart factory networks complicate corresponding investment decisions and increase the need for appropriate decision support. We develop a risk assessment model that supports companies in the investment decision-making process regarding IT security measures by identifying and evaluating the most critical areas of the information network while considering the underlying production network. For this purpose, IT availability risks are quantified by means of graph theory, matrix notation, and value-at-risk. Our model provides a structured approach and considers network structures and interdependencies. The insights gained by our model present a profound economic basis for investment decisions on IT security measures. By applying our model in an exemplary real-world setting, we analyze various IT security measures and their risk reduction effect.

Software Defined Networking (SDN) is a new paradigm that has shown significant advantages and increased profit for the private network industry. Research and Educational Networks (RENs) started adopting SDN, but there is a lack of understanding of the factors persuading RENs to adopt SDN. The goal of this study is to examine how the SDN technology factors (e.g., advantage, compatibility, testability, observability, complexity, and IT security risk) facilitate RENs’ adoption of SDN. A research model was developed based on the Diffusion of Innovation theory. The study used a positivist approach and collected 216 survey data. The Structural Equation Modeling Partial Least Square (SEM-PLS) was used to analyze the data and the results showed that relative advantage, compatibility, and observability had significant positive effects on the adoption of SDN by RENs. The complexity and testability of the SDN technology did not show significant effects. IT security risk had a positive effect on complexity and a negative effect on SDN adoption. This study provides insights on SDN adoption decision making when it comes to implementing SDN or not in newly formed RENs.KeywordsSoftware Defined Networking (SDN)Research and Educational Networks (RENs)AdoptionSecurityPartial Least Squares (PLS)

The article considers main methods to use intelligent techniques and algorithms, synthesized on their basis, as well as examinesdata presentation of network monitoring for IT security risk management of secure multiservice networks. The mathematical model of intelligent data presentation is developed and examined for IT security risk investigation and assessment.

In the context of military operations on the territory of Ukraine, the issue of organizing a safe educational environment has become particularly relevant. The creation of safe infrastructure of educational institutions is considered a strategically important task not only during the wartime period, but also in the context of the country’s post-war recovery. The authors reviewed international documents, in particular the Safe Schools Declaration, as well as reports of organizations working in the field of education in emergencies and conflict situations. Articles by foreign and Ukrainian researchers on the impact of war on education and basic strategies for preserving learning, on the mental health of children during wartime, on the effectiveness of school support programs, the organization of education during displacement, and security protocols were analyzed. The support provided to Ukraine by international organizations and the private sector is described, in particular the company Palantir, with whose participation security risk assessment at the level of territorial communities is conducted in Ukraine. The "Methodology for Assessing Security Risks in the Education System Related to the Armed Aggression of the russian federation against Ukraine" for educational institutions and territorial communities was studied, the calculations for which are performed using the technologies and software of the above-mentioned company. Information materials were prepared regarding the number of territorial communities, general secondary education institutions (GSEIs), the number of pupils and teachers by levels of security risk of the education system. Determining the affiliation of GSEIs to the corresponding level of security risk contributes to the implementation of the state policy "Offline School", enables more effective and well-grounded decisions on prioritizing territorial communities for the construction of protective structures (shelters), and also creates a basis for the gradual restoration of full-time or blended forms of education in educational institutions. Within the framework of the study, the prospects for using analytical data prepared with the help of the "Palantir Foundry" platform were outlined, and recommendations were provided regarding a rational interval for updating these data, which will ensure their relevance, applicability, and practical value for educational policy planning and operational budgetary response.

In the world of computer networking, cloud computing makes a technical shift of computing services being provided locally to being provided remotely by third party service providers. The data which was previously kept under control of users now under the control of service providers cloud computing brings many financial and functional benefits as well as serious security concerns that may threaten business continuity and corporate reputation. The definition of cloud computing is still blurry in a large part, because of the magnitude of the security risks and the virtually unlimited amount of information being published over the unsecure platform. The purpose of this paper is to assess how security risk factors are affecting the existing and prospective cloud users’ cloud usage strategies. Are they simply betting that financial benefits will surpass security risks, or are they confident that cloud providers are capable of assuring an equal or higher level of security than on-premise systems? This survey, through the examination of published materials and studies, analyzes existing issues along with available countermeasures in order to evaluate the overall assurance level of cloud security. The primary goal of the survey is to assess how security concerns have affected or will affect the respondents’ decision on adopting cloud and its services. This study includes basics of cloud computing by adding its characteristics, models and their categories. Analysis also embraced the existing security concerns faced by researchers and their imposed methodologies.