Background. The object of the research is information security event logs. The subject of the research is the methods of signature analysis and profiling of information security events. The purpose ...of the research is to identify the shortcomings of the above methods in identifying information security incidents and to develop a method that eliminates the identified shortcomings. Materials and methods. The analysis of information security events was carried out using the methods of signature analysis, digital profiling and a new graphic-analytical method proposed in the framework of the study. Results. The shortcomings of the methods of signature analysis and profiling of information security events are determined. Identified types of information security incidents that are not included in the visibility of the above methods. The application of the proposed graphic-analytical method makes it possible to eliminate the identified shortcomings, identify unknown types of information security incidents, and expand the functionality of information security monitoring systems in general. Conclusions. The use of the proposed graphic-analytical method for analyzing information security events makes it possible to identify information security incidents that are not included in the visibility zone of signature methods and profiling methods, and also to use them to gain knowledge about the system under study, which is impossible with a visual analysis of the journal itself. The results of applying the method can be further used to identify information security incidents in real time.
Individuals and organizations rely on social media to share files and knowledge. On the other hand, criminals find social media applications a rich place to attack through techniques like phishing, ...fraud, and blackmail. While the rate of blackmail is growing, there is a lack of literature on the subject. This study aims to examine the impact of information security regulation factors such as information security awareness, policies, and culture towards avoiding online blackmail threats. The study proposes a model constructed from technology threat avoidance theory (TTAT), the theory of planned behavior (TPB), and organizational control (OC). A quantitative approach based on an online survey was conducted to collect data from 547 employees and students from different industrial backgrounds. The results show that information security culture and information security awareness have an impact on users’ motivation to avoid online blackmail threats through attitude and subjective norms. Furthermore, perceiving a mandated policy significantly impacts avoidance behavior. In addition, apathy and anticipated regret play a significant role in avoidance motivation. These results provide evidence on the importance of social factors on impacting avoidance motivation using the TTAT model. Further, the study encourages organizations to focus more on specifying policies and building an information security culture in order to ensure users avoid these threats through compliance and motivation.
•Examined the Effect of regulatory factors on avoiding Online Blackmail Threats on Social Media.•We developed a model based on technology threat avoidance theory and organizational control model.•Culture and awareness have an impact on users' motivation through SN and Attitude.•Apathy and anticipated regret play a significant role in avoidance motivation.
Full text
Available for:
GEOZS, IJS, IMTLJ, KILJ, KISLJ, NLZOH, NUK, OILJ, PNG, SAZU, SBCE, SBJE, UILJ, UL, UM, UPUK, ZAGLJ, ZRSKP
The term cyber security is often used interchangeably with the term information security. This paper argues that, although there is a substantial overlap between cyber security and information ...security, these two concepts are not totally analogous. Moreover, the paper posits that cyber security goes beyond the boundaries of traditional information security to include not only the protection of information resources, but also that of other assets, including the person him/herself. In information security, reference to the human factor usually relates to the role(s) of humans in the security process. In cyber security this factor has an additional dimension, namely, the humans as potential targets of cyber attacks or even unknowingly participating in a cyber attack. This additional dimension has ethical implications for society as a whole, since the protection of certain vulnerable groups, for example children, could be seen as a societal responsibility.
Full text
Available for:
GEOZS, IJS, IMTLJ, KILJ, KISLJ, NUK, OILJ, PNG, SAZU, SBCE, SBJE, UL, UM, UPUK
Information security is a critical aspect and plays a significant role in protecting an organization's business. Organizations are required to safeguard their information and assets to sustain their ...value and reputation. The systematic literature review presented in this paper aims to introduce information security governance as a comprehensive solution for alignment between information security policies and the organization's objectives. The review identified the need for developing a holistic framework for the information security governance that (1) connects the organization's objectives and its protection, (2) addresses each aspect of strategy, control, and regulation, (3) ensures compliance of procedures and guideline with policies, and (4) ensures continuous evaluation and compliance. The analysis of the literature revealed the main challenges to the adoption of an information security governance program. The review identified seven information security governance domains with 27 critical success that should be considered when developing an effective information security governance framework.
Full text
Available for:
GEOZS, IJS, IMTLJ, KILJ, KISLJ, NLZOH, NUK, OILJ, PNG, SAZU, SBCE, SBJE, UILJ, UL, UM, UPUK, ZAGLJ, ZRSKP
•This research identified that human error proportions are higher than currently understood in the literature.•The IS-CHEC technique is applicable to information security, in a participating public ...sector organisation providing healthcare services.•The majority of information security incidents pertain to human error.•The use of IS-CHEC technique provides insight into the common causes of human error.•The IS-CHEC technique has been improved based upon a comparison of case study findings within public and private sector organisations.
The number of reported public sector information security incidents has significantly increased recently including 22% related to the UK health sector. Over two thirds of these incidents pertain to human error, but despite this, there are limited published related works researching human error as it affects information security.
This research conducts an empirical case study into the feasibility and implementation of the Information Security Core Human Error Causes (IS-CHEC) technique which is an information security adaptation of Human Error Assessment and Reduction Technique (HEART). We analysed 12 months of reported information security incidents for a participating public sector organisation providing healthcare services and mapped them to the IS-CHEC technique.
The results show that the IS-CHEC technique is applicable to the field of information security but identified that the underpinning HEART human error probability calculations did not align to the recorded incidents. The paper then proposes adaptation of the IS-CHEC technique based on the feedback from users during the implementation. We then compared the results against those of a private sector organisation established using the same approach.
The research concluded that the proportion of human error is far higher than reported in current literature. The most common causes of human error within the participating public sector organisation were lack of time for error detection and correction, no obvious means of reversing an unintended action and people performing repetitious tasks.
Full text
Available for:
GEOZS, IJS, IMTLJ, KILJ, KISLJ, NLZOH, NUK, OILJ, PNG, SAZU, SBCE, SBJE, UILJ, UL, UM, UPUK, ZAGLJ, ZRSKP
This paper aims at reviewing Information Security Awareness (ISA) practices in general and at Omani Government Agencies (OGA) in particular. It also explores the concerns and challenges that may ...affect their implementation, and the reasons why ISA practices remained problematic for more than a decade at the OGAs. To inform the aim of this research, the researchers employed a systematic process to review the publications that explored ISA practices in general and at OGAs in particular. As a sampling technique, the researchers created a research strategy to select relevant publications for the study. The grounded theory technique is adopted for data analysis since it provides an inductive and systematic interpretive approach to generate theoretical insights from the data. The review reveals that current ISA practices seem ineffective in meeting the needs of employees. Furthermore, a set of important ISA practices are either missing or undeveloped. The review also revealed the absence of a framework for the ISA process at OGAs. To the best of our knowledge, the present study is one of the first to conduct an in-depth review on ISA practices applied in general and at OGAs in particular. Therefore, this study contributed to the emerging field of information security by reviewing the current state of ISA practices. In addition, this research study contributed a comprehensive picture of sources dealing with vital issues of insider threats and human factors within OGAs that were indeed unclear and surrounded by various ambiguities in the past.
Full text
Available for:
EMUNI, FIS, FZAB, GEOZS, GIS, IJS, IMTLJ, KILJ, KISLJ, MFDPS, NLZOH, NUK, OILJ, PNG, SAZU, SBCE, SBJE, SBMB, SBNM, UKNU, UL, UM, UPUK, VKSCE, ZAGLJ
This research is devoted to one of the urgent problems in the field of security provision, implemented in various areas of human activity related to information systems. It is associated with a ...typical situation of discrepancy between the costs of improving security methods and the level of security achieved in this case. It is shown that one of the most promising methodological approaches aimed at finding a solution to this problem is related to the study of the prospects for adapting existing solutions with integration into the computing environment that implement the new technology. In accordance with this concept, the equivalent transition between information technologies should be implemented while maintaining the level of overall information security. The main research goal was determined – it concerns the development of an analytical model for controlling the equivalence of information technologies in information security systems. The current state in the field of information security was analyzed. It was revealed that the tools and mechanisms existing today and presented on the relevant market that prevent risks and threats to the functioning of information systems associated with data theft and distortion are “narrow”, that is, adapted to solving local problems facing attackers.
The rapid technological developments associated with the decrease in the cost of smartphones made the latter more accessible and convenient to be used. In an educational setting, students are ...increasingly bringing their smartphones to classrooms, this could have serious security implications, particularly when students are less aware of smartphone information security threats. This paper is set out to provide an empirical comparison in the level of information security awareness among college students in terms of knowledge and behavior. The main aim is to find the difference between students’ awareness level of information security using smartphones vs. computers. A descriptive research design was adopted and an online survey method was employed. Research findings showed that students were highly aware of some information security concepts, however, they behaved differently in protecting their smartphones compared to computers. Training campaigns are suggested to be conducted aiming to educate students with possible information security risks related to smartphone usage in educational settings.
Full text
Available for:
EMUNI, FIS, FZAB, GEOZS, GIS, IJS, IMTLJ, KILJ, KISLJ, MFDPS, NLZOH, NUK, OILJ, PNG, SAZU, SBCE, SBJE, SBMB, SBNM, UKNU, UL, UM, UPUK, VKSCE, ZAGLJ
Image encryption technology is one of the most important means of image information security. Most image encryption algorithms are based on a permutation−diffusion structure. However, some image ...cryptosystems based on this structure have been proved to be insecure. Thus, a new image encryption structure based on a lifting scheme is proposed in this study. In the proposed algorithm, the plain image is decomposed into low-frequency approximate components and high-frequency detailed components. Pseudo-random sequences generated by chaos are employed to sequentially disturb the two sets of components. Then a lifting scheme is used for image encryption. Compared to the currently popular permutation−diffusion structure, the proposed image cryptography requires fewer pseudo-random numbers, and it has a faster encryption speed and higher security. Simulations, performance analysis, and comparison tests show that the proposed method has the advantages of large key space, fast encryption and decryption speeds, strong system sensitivity, and excellent encryption security. The algorithm can be used in applications such as encryption of medical and cloud images.
Full text
Available for:
GEOZS, IJS, IMTLJ, KILJ, KISLJ, NLZOH, NUK, OILJ, PNG, SAZU, SBCE, SBJE, UILJ, UL, UM, UPUK, ZAGLJ, ZRSKP
Preserving the confidentiality, integrity and availability (CIA) of an organisation's sensitive information systems assets against attacks and threats is a challenge in this digital age. ...Organisations worldwide make huge investments in information security technological countermeasures. Nonetheless, organisations in many cases fail to protect their information assets as they rely mainly on technical solutions which are not contextually compatible and sufficient. As a matter of fact, a significant number of organisational information security incidents are due to the exploitation of human elements that directly and/or indirectly cause the majority of security incidents. Therefore, employees’ information security awareness (ISA) becomes one of the critical aspects of protection against undesirable information security behaviours. However, to date, there is limited synthesised knowledge about methods for enhancing ISA and integrated insights on factors affecting employees’ ISA levels. This study, therefore, provides a systematic review of the literature on ISA and puts forward a state-of-the-art collection of ISA methods and factors for enhancing employees’ ISA within both private and public sector organisations. The results indicate that various methods and factors are used to enhance employees’ ISA in organisations. Theoretical models and gamification are the methods widely used in both private and public organisations, whereas the constructivist approach and violation detections are some of the methods used only in private organisations. Furthermore, this study offers some insights into the latest trends in ISA content development methods and factors, and fosters good ISA practice by disseminating information and knowledge amongst Information Security professionals to help them build an overarching ISA development programme in their organisations.
Full text
Available for:
GEOZS, IJS, IMTLJ, KILJ, KISLJ, NUK, OILJ, PNG, SAZU, SBCE, SBJE, UL, UM, UPUK
PDF
