Research on Information Security Model

2012 ◽  
Vol 488-489 ◽  
pp. 1684-1688
Author(s):  
Yu Juan Hu ◽  
Qing Wei Meng
Keyword(s):  
Information System ◽  
Information Security ◽  
Computer System ◽  
System Security ◽  
Security Assessment ◽  
Security Model ◽  
Comparison Analysis ◽  
Security Models ◽  
Computer Information System

Security of computer information system more and more aroused people’s attention, and information security assessment and computer system security model is closely related to information security model which is patricularly important. This article describes the security model of the characteristics and uses, and several security models are compared, these models were from a different perspective considering system security, through comparison Analysis, Establishment of information security model obtained several important aspects to consider.

scholarly journals Phát triển Framework ứng dụng AI hỗ trợ tự động khai thác lỗ hổng bảo mật

2022 ◽  
Vol 1 (13) ◽  
pp. 80-92
Author(s):  
Nguyễn Mạnh Thiên ◽  
Phạm Đăng Khoa ◽  
Nguyễn Đức Vượng ◽  
Nguyễn Việt Hùng
Keyword(s):  
Information System ◽  
Reinforcement Learning ◽  
Information Security ◽  
Vulnerability Assessment ◽  
Large Scale ◽  
Learning Technology ◽  
Security Assessment ◽  
Security Vulnerability ◽  
Different Levels

Tóm tắt—Hiện nay, nhiệm vụ đánh giá an toàn thông tin cho các hệ thống thông tin có ý nghĩa quan trọng trong đảm bảo an toàn thông tin. Đánh giá/khai thác lỗ hổng bảo mật cần được thực hiện thường xuyên và ở nhiều cấp độ khác nhau đối với các hệ thống thông tin. Tuy nhiên, nhiệm vụ này đang gặp nhiều khó khăn trong triển khai diện rộng do thiếu hụt đội ngũ chuyên gia kiểm thử chất lượng ở các cấp độ khác nhau. Trong khuôn khổ bài báo này, chúng tôi trình bày nghiên cứu phát triển Framework có khả năng tự động trinh sát thông tin và tự động lựa chọn các mã để tiến hành khai thác mục tiêu dựa trên công nghệ học tăng cường (Reinforcement Learning). Bên cạnh đó Framework còn có khả năng cập nhật nhanh các phương pháp khai thác lỗ hổng bảo mật mới, hỗ trợ tốt cho các cán bộ phụ trách hệ thống thông tin nhưng không phải là chuyên gia bảo mật có thể tự động đánh giá hệ thống của mình, nhằm giảm thiểu nguy cơ từ các cuộc tấn công mạng. Abstract—Currently, security assessment is one of the most important proplem in information security. Vulnerability assessment/exploitation should be performed regularly with different levels of complexity for each information system. However, this task is facing many difficulties in large-scale deployment due to the lack of experienced testing experts. In this paper, we proposed a Framework that can automatically gather information and automatically select suitable module to exploit the target based on reinforcement learning technology. Furthermore, our framework has intergrated many scanning tools, exploited tools that help pentesters doing their work. It also can be easily updated new vulnerabilities exploit techniques.

Metric Based Security Assessment

2008 ◽  
pp. 1396-1415
Author(s):  
James E. Goldman ◽  
Vaughn R. Christie
Keyword(s):  
Information Security ◽  
Assessment Tool ◽  
Maturity Model ◽  
Security Assessment ◽  
Self Assessment ◽  
Security Metrics ◽  
Capability Maturity ◽  
Security Models ◽  
Organization's Information Security ◽  
Systems Security Engineering

This chapter introduces the Metrics Based Security Assessment (MBSA) as a means of measuring an organization’s information security maturity. It argues that the historical (i.e., first through third generations) approaches used to assess/ensure system security are not effective and thereby combines the strengths of two industry proven information security models, the ISO 17799 Standard and the Systems Security Engineering Capability Maturity Model (SSE-CMM), to overcome their inherent weaknesses. Furthermore, the authors trust that the use of information security metrics will enable information security practitioners to measure their information security efforts in a more consistent, reliable, and timely manner. Such a solution will allow a more reliable qualitative measurement of the return achieved through given information security investments. Ultimately, the MBSA will allow professionals an additional, more robust self-assessment tool in answering management questions similar to: “How secure are we?”

Computer System Security Models

1983 ◽  
pp. 63-123
Author(s):  
Richard DeMillo ◽  
George Davida ◽  
David Dobkin ◽  
Michael Harrison ◽  
Richard Lipton
Keyword(s):  
Computer System ◽  
System Security ◽  
Security Models

scholarly journals MODERN TOOLS FOR INFORMATION SECURITY SYSTEMS

2021 ◽  
Vol 335 (1) ◽  
pp. 14-18
Author(s):  
N. Baisholan ◽  
K.E. Kubayev ◽  
T.S. Baisholanov
Keyword(s):  
Information System ◽  
Risk Management ◽  
Information Systems ◽  
Information Security ◽  
Information Technologies ◽  
Business Processes ◽  
Security Audit ◽  
Security Systems ◽  
Security Models ◽  
Methods And Techniques

Efficiency of business processes in modern organizations depends on the capabilities of applied information technologies. The article describes and analyzes the role and features of audit tools and other methodological tools and models in ensuring the quality and security of information systems. The standard’s principles are reviewed, as well as the importance of meeting business needs. In order to protect virtual values in a company’s system environment, the importance of using information security models is revealed. Practical proposals in risk management and information security in information technology are analyzed through the COBIT standard. Measures for protecting the information system of an organization from accidental, deliberate or fake threats are considered. The possibility of using one of the real information security models by the information recipient or provider in accordance with the requirements of external processes is reported. Furthermore, in connection with increase in the number of attack methods and techniques and development of their new tools and vectors, the need to improve and ways to ensure information security are being considered. The essential tasks of security audit are considered, and the stages of their implementation are described. With regard to security of information systems, an analytical model is proposed for determining vulnerability’s numerical value.

scholarly journals Analisis Keamanan Website dengan Information System Security Assessment Framework (Issaf) dan Open Web Application Security Project (Owasp) di Rumah Sakit Xyz

2021 ◽  
Vol 2 (4) ◽  
pp. 506-519
Author(s):  
Agus Rochman ◽  
Rizal Rohian Salam ◽  
Sandi Agus Maulana
Keyword(s):  
Information System ◽  
Web Application ◽  
Web Server ◽  
System Security ◽  
Security Assessment ◽  
Assessment Framework ◽  
Web Application Security ◽  
Application Security ◽  
Information System Security

Sistem keamanan komputer semakin dibutuhkan seiring dengan meningkatnya pengguna yang terhubung ke jaringan internet, hal ini dapat memicu terjadinya tindak kejahatan cyber oleh orang yang tidak bertanggung jawab. Penelitian ini dilakukan pada Sistem Informasi sebuah Rumah Sakit. Salah satunya web server untuk informasi HRD. Sistem ini berisikan data karyawan dan data absensi karyawan. Keamanan webserver biasanya merupakan masalah bagi administrator. Sering kali permasalahan tersebut terabaikan dan permasalahan dapat ditelusuri ketika terjadi bencana. Tanpa sistem keamanan yang baik, sehebat apapun teknologi sistem informasi akan membahayakan suatu instansi atau organisasi itu sendiri. Berdasarkan latar belakang tersebut, maka dibutuhkan evaluasi mengenai adanya celah keamanan (vulnerability) dan kelemahan dari website sistem informasi HRD.  Metode penelitian menggunakan Information System Security Assesment Framework dan Open Web Application Security Project dengan menggunakan tools nikto untuk mencari celah keamanan (vulnerability), owas zap dan sistem operasi menggunakan linux. Hasil Pengujian disimpulkan dapat menjadi solusi untuk mengatasi permasalahan terhadap kelemahan webserver Sistem Informasi HRD. Pengujian  sebaiknya dilakukan lebih dari 1 kali secara mendalam, melakukan proses maintenance terhadap hardware, software, maupun jaringan, melakukan filter port dan melakukan peningkatkan keamanan server secara berkala, baik dengan cara menggunakan antivirus original maupun scanning secara berkala.

scholarly journals Maturity Framework Analysis ISO 27001: 2013 on Indonesian Higher Education

2020 ◽  
Vol 9 (2) ◽  
pp. 429
Author(s):  
IGN Mantra ◽  
Aedah Abd. Rahman ◽  
Hoga Saragih
Keyword(s):  
Higher Education ◽  
Information System ◽  
Information Security ◽  
Security Management ◽  
System Security ◽  
Maturity Level ◽  
Information Security Management ◽  
Security Practices ◽  
Level 3 ◽  
Iso 27001

Information Security Management System (ISMS) implementation in Institution is an effort to minimize information security risks and threats such as information leakage, application damage, data loss and declining IT network performance. The several incidents related to information security have occurred in the implementation of the Academic System application in Indonesian higher education. This research was conducted to determine the maturity level of information security practices in Academic Information Systems at universities in Indonesia. The number of universities used as research samples were 35 institutions. Compliance with the application of ISO 27001:2013 standard is used as a reference to determine the maturity level of information system security practices. Meanwhile, to measure and calculate the level of maturity using the SSE-CMM model. In this research, the Information System Security Index obtained from the analysis results can be used as a tool to measure the maturity of information security that has been applied. There are six key areas examined in this study, namely the role and importance of ICT, information security governance, information security risk management, information security management framework, information asset management, and information security technology. The results showed the level of information security maturity at 35 universities was at level 2 Managed Process and level 3 Established Process. The composition is that 40% of universities are at level 3, and 60% are out of level 3. The value of the gap between the value of the current maturity level and the expected level of maturity is varied for each clause (domain). The smallest gap (1 level) is in clause A5: Information Security Policy, clause A9: Access Control, and clause A11: Physical and environmental security. The biggest gap (4 levels) is in clause A14: System acquisition, development and maintenance and clause A18: compliance.   

Sign in / Sign up

Export Citation Format

Share Document