Identification of Information Security Controls for Fitness Wearable Manufacturers

2020 ◽  
pp. 112-128
Author(s):  
Sophia Moganedi ◽  
Dalenca Pottas
Keyword(s):  
Information Security ◽  
Security Controls

scholarly journals Improving Forensic Triage Efficiency through Cyber Threat Intelligence

2019 ◽  
Vol 11 (7) ◽  
pp. 162 ◽  
Author(s):  
Nikolaos Serketzis ◽  
Vasilios Katos ◽  
Christos Ilioudis ◽  
Dimitrios Baltatzis ◽  
Georgios Pangalos
Keyword(s):  
Information Security ◽  
Digital Forensics ◽  
Incident Response ◽  
Security Controls ◽  
Digital Forensic ◽  
Threat Intelligence ◽  
Cyber Threat ◽  
Series Of Experiments ◽  
Cyber Threat Intelligence ◽  
Security Incidents

The complication of information technology and the proliferation of heterogeneous security devices that produce increased volumes of data coupled with the ever-changing threat landscape challenges have an adverse impact on the efficiency of information security controls and digital forensics, as well as incident response approaches. Cyber Threat Intelligence (CTI)and forensic preparedness are the two parts of the so-called managed security services that defendants can employ to repel, mitigate or investigate security incidents. Despite their success, there is no known effort that has combined these two approaches to enhance Digital Forensic Readiness (DFR) and thus decrease the time and cost of incident response and investigation. This paper builds upon and extends a DFR model that utilises actionable CTI to improve the maturity levels of DFR. The effectiveness and applicability of this model are evaluated through a series of experiments that employ malware-related network data simulating real-world attack scenarios. To this extent, the model manages to identify the root causes of information security incidents with high accuracy (90.73%), precision (96.17%) and recall (93.61%), while managing to decrease significantly the volume of data digital forensic investigators need to examine. The contribution of this paper is twofold. First, it indicates that CTI can be employed by digital forensics processes. Second, it demonstrates and evaluates an efficient mechanism that enhances operational DFR.

scholarly journals On the Analogy of the Problems of Optimizing the Choice of Information Security Controls with Some Problems of Communication Theory

2021 ◽  
pp. 30-35
Author(s):  
Vadim Gribunin ◽  
◽  
Andrey Timonov ◽  
Keyword(s):  
Information Security ◽  
Communication Theory ◽  
Rate Distortion ◽  
Budget Allocation ◽  
Optimal Choice ◽  
Automated System ◽  
Optimal Placement ◽  
Rate Distortion Theory ◽  
Security Controls ◽  
Theory Research

Purpose of the article: optimization of the choice of information security tools in a multi-level automated system, taking into account higher levels, quality indicators of information security tools, as well as the general financial budget. Demonstration of analogies of solving these problems with known problems from communication theory. Research method: optimal choice of information security tools based on risk analysis and the Lagrange multiplier method; Optimal bit budget allocation based on the Waterfilling optimization algorithm. Optimal placement of information security tools in a multilevel automated system based on bisectional search. Obtained result: the article shows analogies between some problems of communication theory and the optimal choice of information security tools. The well-known problem of the optimal choice of information security tools is solved using the rate-distortion theory, the well-known problem of the optimal budget allocation for their purchase is solved by analogy with the problem of distributing the power of transmitters. For the first time, the problem posed for the optimal placement of information security tools in a multilevel automated system was solved by analogy with the problem of distributing the total bit budget between quantizers.

Information Security Management

2009 ◽  
pp. 675-681
Author(s):  
Mariana Hentea
Keyword(s):  
Information Security ◽  
Information Assurance ◽  
Security Management ◽  
Management Model ◽  
Information Security Management ◽  
Security Controls ◽  
Security Models ◽  
Emerging Trends ◽  
Design Selection ◽  
Training Habits

Information assurance is a continuous crisis in the digital world. The attackers are winning and efforts to create and maintain a secure environment are proving not very effective. Information assurance is challenged by the application of information security management which is the framework for ensuring the effectiveness of information security controls over information resources. Information security management should “begin with the creation and validation of a security framework, followed by the development of an information security blueprint” (Whitman & Mattord, 2004, p. 210). The framework is the result of the design and validation of a working security plan which is then implemented and maintained using a management model. The framework serves as the basis for the design, selection, and implementation of all subsequent security controls, including information security policies, security education and training programs, and technological controls. A blueprint can be designed using established security models and practices. The model could be proprietary or based on open standards. The most popular security management model is based on the British Standard 7999 which addresses areas of security management practice. The recent standards, called ISO/IEC 27000 family, include documents such as 27001 IMS Requirements (replaces BS7799:2); 27002, Code of Practice for Information Security Management (new standard number for ISO 17799); and 27006, Guidelines for the accreditation of organizations offering ISMS certification, and several more in development. Similar security models are supported by organizations such as NIST, IETF, and VISA. From one point of view, information security management evolved on an application of published standards, using various security technologies promoted by the security industry. Quite often, these guidelines conflict with each other or they target only a specific type of organization (e.g., NIST standards are better suited to government organizations). However, building a security control framework focused only on compliance to standards does not allow an organization “to achieve the appropriate security controls to manage risk” (ISM-Community, 2007, p. 27). Besides technical security controls (firewalls, passwords, intrusion detection systems, disaster recovery plans, encryption, virtual private networks, etc.), security of an organization includes other issues that are typically process and people issues such as policies, training, habits, awareness, procedures, and a variety of other less technical and nontechnical issues (Heimerl & Voight, 2005; Tassabehji, 2005). All these factors make security a complex system (Volonino & Robinson, 2004) and a process which is based on interdisciplinary techniques (Maiwald, 2004; Mena, 2004). While some aspects of information security management changed since the first edition of the chapter (Hentea, 2005), the emerging trends became more prevalent. Therefore, the content of this chapter is organized on providing an update of the security threats and impacts on users and organizations, followed by a discussion on global challenges and standardization impacts, continued with information security management infrastructure needs in another section, followed with a discussion of emerging trends and future research needs for the information security management in the 21st century. The conclusion section is a perspective on the future of the information security management.

A Hybrid Tabu Genetic Metaheuristic for Selection of Security Controls

2021 ◽  
pp. 1513-1534
Author(s):  
Sarala Ramkumar ◽  
Zayaraz Godandapani ◽  
Vijayalakshmi Vivekanandan
Keyword(s):  
Information Systems ◽  
Information Security ◽  
Easy Access ◽  
Modern World ◽  
Counter Measures ◽  
Security Controls ◽  
Security Personnel ◽  
Intelligent Approach ◽  
The Cost ◽  
Selection Of

In the modern world, globalization has made way for easy access to information systems for running businesses effectively. The misuse of information systems may lead to loss of productivity, revenue, and sometimes to legal liabilities. Therefore, information security is a major concern for running the business successfully. It is the responsibility of the information security personnel of an organization to develop strategies, and identify the suitable controls to mitigate the risks to which the organization is exposed to. Selection of a suitable set of security controls depends upon, the risks to be addressed, the impact of the risks in terms of revenue, and the cost incurred in implementing the selected controls. To assist in the selection of optimal security controls a hybrid intelligent approach combining the tabu search technique and genetic algorithm has been proposed. The obtained results prove that the proposed approach provides better results in the selection of optimal counter measures.

Information security in supply chains: a management control perspective

2015 ◽  
Vol 23 (5) ◽  
pp. 476-496 ◽  
Author(s):  
Sindhuja P N ◽  
Anand S. Kunnathur
Keyword(s):  
Supply Chain ◽  
Information Security ◽  
Organizational Context ◽  
Security Management ◽  
Management Control ◽  
Organizational Level ◽  
Information Security Management ◽  
Content Type ◽  
Security Controls ◽  
Management Controls

Purpose – This paper aims to discuss the need for management control system for information security management that encapsulates the technical, formal and informal systems. This motivated the conceptualization of supply chain information security from a management controls perspective. Extant literature on information security mostly focused on technical security and managerial nuances in implementing and enforcing technical security through formal policies and quality standards at an organizational level. However, most of the security mechanisms are difficult to differentiate between businesses, and there is no one common platform to resolve the security issues pertaining to varied organizations in the supply chain. Design/methodology/approach – The paper was conceptualized based on the review of literature pertaining to information security domain. Findings – This study analyzed the need and importance of having a higher level of control above the already existing levels so as to cover the inter-organizational context. Also, it is suggested to have a management controls perspective for an all-encompassing coverage to the information security discipline in organizations that are in the global supply chain. Originality/value – This paper have conceptualized the organizational and inter-organizational challenges that need to be addressed in the context of information security management. It would be difficult to contain the issues of information security management with the existing three levels of controls; hence, having a higher level of security control, namely, the management control that can act as an umbrella to the existing domains of security controls was suggested.

Sign in / Sign up

Export Citation Format

Share Document