Search

The research presented in this paper is aimed at determining how emerging technology and specifically blockchain can be deployed to improve the reliability of medical device supply chains. As the current pandemic crisis has clearly demonstrated, global supply chains have become highly efficient and cost-effective at the cost of agility. As the pandemic developed into a global crisis, the vulnerability of supply chains became apparent in the shortage of personal protective equipment (PPE) due to overreliance on a limited number of sources coupled with the challenge of stepping up production on short notice. In 2021, the shortage of medical oxygen in India revealed another vulnerability in that precious time was lost in pivoting the existing oxygen supply from industrial to medical usage. Over the centuries, and still today in military scenarios, supply chain security has hinged on stockpiling of goods and materials, an extremely costly and inefficient practice. If the global medical device industry can learn from these shocks and adapt global supply chains for greater reliability and resilience, the end result will be positive – an antifragile response (Taleb, Nassim Nicholas 2012). We hypothesize that it is indeed possible to enhance supply chains without massive stockpiling based on distributed ledger technology (DLT) and blockchain. A real-life example in Colombia with plans for rollout across Latin America demonstrates what this can look like in practice and adds weight to our hypothesis. However, more research and broader adoption of DLT and blockchain across medical device supply chains are required to realize the potential of technology to improve reliability, resilience and robustness.

This paper studies how disclosure of bank-specific information can mitigate systemic bank runs by reallocating systemic risk across different banks. We find that disclosure of information about vulnerability to systemic risk loads more of the constant aggregate systemic risk to less vulnerable ones. This improves the survival probability of all banks. Thus, the optimal disclosure should maximize informational heterogeneity there, provided that all banks are run simultaneously if inevitable. However, disclosure of other bank-specific information does not generate heterogeneity in such vulnerability, making the reallocation of systemic risk and thus the disclosure unbeneficial.

The vulnerability of web-based applications has increased manifold primarily due to the ever-increasing time spent on the web. Cross site scripting (XSS) attack are one of the most prominent attacks that are executed when the attacker get success over API key authentication and successfully execute their malicious script code at server end. Of the two types of XSS that are popular in the hacking world i.e. server side XSS and client side XSS, server-side attacks are more frequent and vulnerable. Various methodologies have been developed in the recent past to handle XSS attacks API authentication based techniques, handling access at server end etc. However, these methodologies suffer from one or more limitation of handling the attack from one perspective. In this paper, we demonstrate a multi-layer prevention technique wherein we defend the attacker hit at API key authentication level using an encrypted that prevents the attacker easy access to API directly. In the next layer we convert the script code execution request into plain text which is coming from any untrusted party, so that plain text will not execute over browser. Thus, our proposed framework provides an effective solution to protect our environment from XSS attacks.

We introduce a novel framework to study targeted policy interventions. Agents: 1) differ both in their likelihood of and loss from interaction, 2) exert negative externalities through interaction, and 3) can exert costly effort to isolate. Additionally, a planner can select a subset of agents to isolate from interaction at zero cost. Our main result is a full characterization of optimal policies when costly isolation is either voluntary or mandatory. When voluntary, optimal policy is non-monotone -- agents with intermediate vulnerability are selected more. Moreover, we uncover a novel form of risk compensation -- voluntary behavior implies that selection is redirected toward the vulnerable away from the interactive, to maintain incentives for self-isolation. We extend our insights to a setting with positive externalities, and apply our results to applications including vaccine allocation, platform design, and information aggregation.

DevSecOps is a combination of development, security, and operations that ensure security integrated with DevOps. There have been many new advances in IT that make it easier to include the DevOps methodology into application design, but these innovations come with a downside. As a result, many compliance monitoring tools have not kept pace with the new developments. Threat problems manifest after app release, where the public as well as the client is affected and the company’s reputation takes a hit. Continuous Integration and continuous deployment do not embrace security checks which impose threat to application. So, there is a need to convert CI/CD (Continuous Integration/Continuous Deployment) to CI/CD/CS (Continuous Integration/Continuous Deployment/Continuous Security).This can be implemented by integrating the AppSec pipeline to DevOps pipeline. Introducing security after Integration Testing in DevOps pipeline provides the facility to detect any vulnerability existing in the product.

Bank runs are a natural phenomenon for financial institutions that issue fixed value liabilities (e.g. money) that are backed by assets with uncertain value. I analyze Iron Finance, a decentralized finance (DeFi) protocol that issues stablecoin (a token with fixed nominal exchange rate: IRON) liabilities in exchange for a basket of other tokens (including a token issued by the protocol itself: TITAN). A combination of mathematical algorithms and incentive to arbitrage is used to maintain the exchange rate peg, but a shock to the protocol sent it into a downward spiral – much like a bank run. The incentives built into the protocol to defend the peg exacerbated its unravelling, raising the challenge of how DeFi protocols can address this vulnerability while remaining decentralized.

Direct to consumer (DTC) genetic testing has recently become a popular trend in the United States. There are countless private actors that could have an interest in the genetic data that has been collected and interpreted by DTC genetic testing companies, such as 23andMe. For instance, what would happen if a private entity were to acquire this genetic information through mergers and acquisitions, contracts of adhesion, or a data breach? This expansive violation of privacy will not only directly affect those who have voluntarily provided online genetic testing sites with their genetic information, but blood relatives who inherently share similar DNA will be implicitly affected as well. Modern genomics now allows researchers to “fill in the blanks” of a family tree based on one family member’s genetic sequence. This article seeks to focus on civil remedies and regulatory protections regarding familial third parties' privacy implications in the event of the access, sharing, or disclosure of the contributing sample owner's genetic information. With the last landmark piece of federal legislation pertaining to genetic privacy being passed nearly 12 years ago, these relatives of the contributing sample owner may only be left with ineffective civil remedies for the nonconsensual use, obtention, and/or public disclosure of an appreciable amount of their genetic information. This Article tracks the evolution of DTC genetic testing and the vulnerability of the private and sensitive health information that has been acquired and analyzed for millions of consumers. It also highlights the feasibility and inadequacies of civil remedies for third party relatives in the event that their genetic information is implicitly shared as a result of the disclosure of the contributing owner's genetic sample.

Mobile Ad Hoc Network (MANET) is a kind of wireless network where a number of mobile nodes are wirelessly connected without any fixed infrastructure. Several attacks or intrusions may occur because of the presence of selfish or malicious nodes in MANETs while performing data transmission from one mobile node to another. Vulnerability occurs in the mobile nodes of the MANETs, when an intruder node easily captures the traffic pattern of the network. A Cooperative Bait Detection Scheme is introduced for detecting the selfish node and malicious node in MANET. CBDS contains the more benefit for proactive and reactive protection constructions using routing scheme to identify the black hole attacks in MANETs. With the design of CBDS, the source node selects the adjacent node address which is taken as bait destination address for transmitting bait malicious node to reply message. Then the malicious nodes are detected from participating the routing operation based on reverse tracing technique for providing better security.

In this work try to understand the micro-implications of the COVID shock at the level of households Using CMIE database, create a metric of vulnerability a

Cryptocurrencies including Bitcoin are known to be vulnerable to so-called “doublespending” attacks, where the same digital currency is used to execute multiple different transactions simultaneously. Little is known, however, about the underlying reasons for this vulnerability. Here we develop an agent-based model to study how features of cryptocurrency networks contribute to their vulnerability to double-spending attacks. Perhaps surprisingly, we find neither the number of network nodes nor its path length seem to influence the probability of successful attacks. We find robust evidence that the network’s clustering coefficient has substantial influence. In particular, scale-free networks, with their small clustering coefficients, are more than twice as likely to succumb to double-spending attacks than are networks with larger coefficients, such as regular networks. The implication is that cryptocurrency networks, which are scale-free, may be uniquely susceptible to double-spending attacks.

Summary Dense surface glycosylation on the HIV-1 envelope (Env) protein acts as a shield from the adaptive immune system. However, the molecular complexity and flexibility of glycans make experimental studies a challenge. Here we have integrated high-throughput atomistic modeling of fully glycosylated HIV-1 Env with graph theory to capture immunologically important features of the shield topology. This is the first complete all-atom model of HIV-1 Env SOSIP glycan shield that includes both oligomannose and complex glycans, providing physiologically relevant insights of the glycan shield. This integrated approach including quantitative comparison with cryo-electron microscopy data provides hitherto unexplored details of the native shield architecture and its difference from the high-mannose glycoform. We have also derived a measure to quantify the shielding effect over the antigenic protein surface that defines regions of relative vulnerability and resilience of the shield and can be harnessed for rational immunogen design., Graphical Abstract, Highlights • HIV-1 Env soluble BG505 SOSIP glycoprotein ensemble modeled with native glycosylation • Cryo-EM comparison suggests core fucose may lead to subtle glycan orientation changes • Native glycan shield topology modeled as a network of glycan-glycan volume overlaps • Glycan Encounter Factor developed to quantify the shielding effect on Env surface, Molecular Modeling; Virology

The first and most important link in the security is to restrict access to system and the data resources to authenticated users only. Biometric identification is the term that matches the digital image of a part of a body with the previously saved image in the system. The benefit of using this to confirm the authenticated user over using passwords, biometric comprise of fingerprints, face recognition voice patterns retina scan, the authentication of a user is the most crucial part to the protection of any information system. However, it is revealed by the recent research that the biometric technology can be defeated with the cheap materials. People are encouraged to use this technology to improve their network security and this shows a challenge at this time, biometrics are not secreting but there may be risk of being copied, forged and captured by the fake users. In this paper we describe the biometric authentication vulnerability to various attack is analyzed and efforts to defeat the spoofing attack, and the threats that can be confront by biometric identification. It is becoming increasingly clear that the usage of this technique is stymied by less understanding that how biometric pattern should recognize efficient, how to know that sensed data is not fraudulent. This paper represents an overview of the weakness of the biometric identification, the attacks that can be encountered by biometric system.

This study measures the evolution of the anonymous marketplaces Silk Road, Silk Road 2.0, Agora, Evolution, Nucleus, Abraxas, and AlphaBay, which were the seven leading and most active dark web marketplaces. We identify that all the seven marketplaces use the same software to manage Bitcoin by investigating transactions in these marketplaces. However, the software was no longer used since May 2016 because of its vulnerability to protect anonymity. It indicates that dark web marketplaces advanced to the next stage with anonymity-enhancing tools around in March 2016. Using simple heuristics to identify and trace Bitcoin addresses associated with these marketplaces, purchases on these marketplaces are identified and evaluated. Our method provides evidence on market size, development, and fluctuation over time to fill a gap in previous studies. Dark web marketplaces continue to thrive because users migrate to new marketplaces after the existing ones are shut down. The total sales volume on Silk Road was 192.7 million US dollars between June 2012 and October 2013. The corresponding figures for Silk Road 2.0, Agora, Evolution, Nucleus, and Abraxas were 112.9, 220.7, 69.7, 88.3, and 35.6 million US dollars, respectively. The figures for AlphaBay was 166.0 million US dollars between December 2014 and February 2016.

International information security – or cybersecurity, to use the more popular but grossly oversimplified term – is now high on the agenda of global challenges. But back at the time, things were different. It wasn’t an obscure issue by any means, but discussions were mostly confined to the expert community, and they were usually overshadowed by more pressing concerns. And then 9/11 happened, whereupon international terrorism eclipsed all other threats for years to come.

In the cyber world more and more cyber-attacks are being perpetrated. Hackers have now become the warriors of the internet. They attack and do harmful things to compromised system. This paper will show the methodology use by hackers to gained access to system and the different tools used by them and how they are group based on their skills. It will identify exploits that can be used to attack a system and find mitigation to those exploits. In addition, the paper discusses the actual implementation of the hacking phases with the virtual machines use in the process. The virtual machines specification is also listed. It will also provide means and insights on how to protect one system from being compromised.

A device is traitorous when it acts against interests of its users. Within 10 years, electronic glasses with holographic-like overlays are projected projected to become supplant smart phones [Gurman 2017; Mundy 2016]. A backdoor in electronic glasses would enable an I-see-and-hear-you-and-what-you-do capability that would provide extraordinary insight into what wearers are thinking as well as how they have been communicating with others. According to FBI former Director James Comey: “There is no such thing as absolute privacy in America.” continuing with “Even our memories aren’t private.” [Borger 2017] According [Barr 2019] “We are talking about consumer products and services such as messaging, smart phones, email, and voice and data applications” [which are also widely used by government and enterprise employees in their professional work] that he advocates should be openable for self-incrimination. Furthermore, Barr warned: “I think it is prudent to anticipate that a major incident may well occur at any time that will galvanize public opinion on these issues.” In order to enable a Nothing is Beyond Our Reach [NIBOR] system. [Burr and Feinstein 2016; O’Neill 2017] proposed the following legislation: “covered entities must provide unencrypted information and technical assistance to the government pursuant to a court order.” NIBOR[Hewitt “Erlang Lecture” 2017; Hewitt “They See What You See” 2017; Hewitt 2018] is a further development beyond a previous proposal[Rotenberg 2015] in order to implement [Burr and Feinstein 2016], which addresses the following issues identified in [Abelson, et. al. 2015; US National Academy of Sciences 2018; Encryption Group 2019]: • Keys: A NIBOR public/private key pair piece is created in a Faraday cage by special hardware in multiple, independent government command posts in such a way that the private key never leaves the Faraday cage in which it was created (except for hardware secured backup). Encryption/decryption is performed in the Faraday cage invisibly to all software of its command post. A combined public key to be installed in every device used in a country is created so that all of the private key slices are necessary in order to encrypt a message for the corresponding combined pubic key. (In some countries to take over a device, a piece of the private key may have to be obtained from the connecting Internet Service Provider. See discussion in this article.) • Internet: In order to connect with the public Internet, a device must pass a challenge-response test to ensure that if it receives a packet that decrypts using its public key, then it immediately uses the packet as a bootloader to take over the device without disrupting its ongoing activities using a hard-to-detect virtual machine. A visitor to a country could be issued a domestic rental covered by the price of their visa. The deposit on the rental would be refunded when it is returned when exiting the country. Many foreign diplomats and professionals could use satellite phones to diminish surveillance. [Flickinger 2019]. • Universal Intelligent Systems: Public keys are distributed to certified manufactures for installation in their Internet products. In order to be certified, a product must be certified that it has hardware that guarantees that if it connects to another device electrically or by radio then if it receives a packet that decrypts using the public key, then the decrypted packet is used as a bootloader for a (hard-to-detect) Virtual Machine that takes over the product while it is in operation. • State Security: A government could instantly take over any device used domestically on the Internet. A virtual operating system backdoored into a device can limit its own vulnerability by only communicating with security command posts. Even if cyberattackers root the government virtual machine for a device that has been taken over by the government, the attackers gain no lasting advantage in hacking additional devices. If necessary, the government can repeatedly take over a device using NIBOR. In order to protect information exfiltrated from taken-over devices, NIBOR operating environments will ultimately need to use more secure software than is currently available that is based on strongly-typed every-word-tagged architectures. [Hewitt 2016]. Security dangers of NIBOR come after a government has exfiltrated information from backdoored devices in their own country because a government cannot both widely use the exfiltrated information within the government and keep the exfiltrated information secure. • Economic Costs: It will not be inexpensive to create and operate NIBOR. However, the incremental hardware cost per device is negligible and the cost of distributing and installing a public key in each device is also negligible. The cost of multiple-command-post crypto security system for NIBOR private keys can be partially defrayed by also using them for other national security operations such as securing nuclear weapon keys. NIBOR could make government enforcement more efficient by enormously increasing the ability to surveil citizen activities at the cost of obtaining surveillance software and hiring people to supervise surveillance. • Social Costs: Social costs of massive surveillance could include enormous damage to human relationships as well as corruption including corporate, political, and sexual surveillance and blackmail. Experiences in Communist East Germany [Funder 2011], UK [Asthana 2016], etc. illustrate costs in loss of civil liberties. A possible compromise is for courts to hold a piece of the private key for each device. Mass surveillance by the government could be prevented if the government does not have access to court pieces of device private keys en masse. ISPs could be able to go to court to limit government takeovers of devices of journalists, lawyers, judges, government officials, and politicians. Also, device takeovers could be made public when a court determines that secrecy is no longer required.

The digital difference in online information has transformed personal identity and privacy creating a world where you are your information. This transformation of the information environment has fundamental implications for the rights and responsibilities of digital citizens in accessing justice online and for courts if they are to retain control of personal information disclosed in judgments. The benefits promised by online access to justice have paradoxically also created risks and regulatory challenges. Technology in the courts has increased access by facilitating procedures for example electronic filing, which save time and costs. However, those same procedures similarly make more personal information permanently and easily available. This has directly heightened the vulnerability of litigants. Striking the correct balance between open justice and privacy in the digital age will require the courts to engage in a more effective and comprehensive regulatory framework to preserve the principle of open justice while responding to the increasing social and economic significance of privacy. While newer regulations, such as the right to be forgotten in the EU, begin to tackle these issues, they do not yet provide a comprehensive solution nor account for the complex digital framework connecting information and identity with access and privacy as facets of human dignity.

Since the end of 2000, there are lot of revolutions occurs in the field of Internet of Things (IoT), that affect tremendously on the world internet infrastructure. Smart Home is a dwelling which incorporates the key electrical appliances of a home connected to each other in a network, so that it can be easily accessed through remote device. The complexity of a smart home lies in the fact that it comprises of many heterogeneous networks which works simultaneously in order to achieve common task. Since each and every network has some sort of vulnerability associated with it, the same lies with Smart home network. Each of the layers of a smart home architecture is associated with some vulnerability. These Vulnerability could be dangerous and can exploit the network if not properly handled. This Paper discussed a secure framework based on Token Sharing mechanism using Squid Authentication for Access Control in a Smart Home Networks.

Correct aggregation of individual preferences into collective one is central problem of nowadays Social Choice theory. After the Arrow’s and Gibbard–Satterthwaite impossibility theorems it became clear that our desire to justify an electoral procedure is doomed to failure. At the same time a lot of scholars continued exploring different properties of existing voting rules and constructing the new ones. Contemporary research in this area explore two main properties of aggregation procedures their degree of manipulability and computational complexity of manipulation. Quantitative evaluations of these properties tend to be main criteria of voting procedure selection. But last decades it turned out that another threat for theory of voting is incompatibilities and unexpected outcomes of different kind, usually called paradoxes. This article provides complete systematization of voting paradoxes known for today. We also presented an attempt to formulate a complete proof of the (in)stability of seven most common used voting rules to paradoxes of any type, which had not been undertaken before. Our results show that different voting procedures are qualitatively different in the sense of vulnerability to voting paradoxes which makes reasonable to propose additional criteria of voting procedure selection and opens the gate for further quantitative research.

Computers and internet have become critical today. The boom of smart gadgets has given a big push to apply of wi-fi gadgets like Bluetooth and Wifi. We are within the technology of SMART devices starting from smartphones, smartTVs and various different tools which represent the Internet of Things. However, like they are saying, with extraordinary strength comes tremendous responsibility, within the same way with brilliant smartness (clever devices) comes outstanding vulnerability. In current years, attackers were growing greater sophisticated methods to attack systems. Huge quantity of safety-related statistics coming on to the community from an everwidening array of related devices, Difficulties faced by Security professionals in tracking statistics that gets exchanged and therefore potential threats may work ignored. These conditions make contributions to safety analysts’ time being taken up wading via fake positives and pretend alarms, detracting from their potential to locate and fight real threats. Thus, spotting those attacks is getting more complex in time. There is need to use machine getting to know by itself and AI principles to Cyber Security to keep up with the rate and pace of attack. This paper presents a brief survey on special methods that can be used to solve cybersecurity attacks and how they're associated with machine learning models.

Now a days new web application tools generated day by day so the security of web is most important. From the few years back the web attacks was increasing so it is a big problem. But now various scanner vulnerability tools are available so we can find out the attack if it is any in the web application if we aware the attack then able to find the solution of the problem and protect them from the attackers. With the help of tools we can find the type of vulnerability is occur mostly SQL-injection attack and cross site scripting attacks are possible in the web application.

Risk assessment really a complex decision-making process in the domain of in-formation security areas. There are a lot of unclear model of software domain and the lack of associated uncertainty are two main reasons that directly affect individual decisions making regarding risk assessment . When artificial enabled social engineering attacks are effectively may happening in every levels of domain. On the other hand, the risk assessment conducted on the safety requirements on artificial enabled social engineering attacks. So the simple meaning of social engineering is to refers to the psychologically and mentality use people to give secret information in the context of information security. A strategy of self-confidence for information collection, fraud, or access to the system, is different from a traditional "con" that it is often one of the more complex fraudulent schemes. That is why in this paper we proposed theoretical framework, which can not only demonstrate its potential for the risk assessment, but it can be sensitive and effective in analyzing a critical and uncertain operational environment that can address the extreme effects of information security.

The WannaCry ransomware attack began on May 12, 2017, and is unprecedented in scale—quickly impacting nearly a quarter-million computers in over 150 countries. The WannaCry virus exploits a vulnerability to Microsoft Windows that was originally developed by the U.S. National Security Agency and operates by encrypting a victim’s data and demanding payment of a ransom in exchange for data recovery. Security experts have indicated that a North Korea-linked group of hackers—who have also been implicated in cyberattacks against Sony Pictures in 2014, the Bangladeshi Central Bank in 2016, and Polish banks in February 2017—is behind the attack. Ransomware threatens institutions worldwide, but the risks for businesses are all the starker—potentially catastrophic. This article provides corporate executives with much of what they need to know about the evolving threats of malware and ransomware like Cryptolocker, Kelihos Botnet, Locky, Nymain, Petya, NotPetya, and WannaCry. First, we provide a brief definition and history of ransomware. Second, we look at the history of hospitals as ransomware targets. Third, we offer a description of the WannaCry virus, what is known about its development, method of action, and those who are believed to have deployed it; in this section, we also discuss methods to defend against this particular virus. Fourth, we discuss the Petya and NotPetya attacks. Fifth, is a discussion of municipal ransomware attacks. Sixth, we review the myriad and unique risks that ransomware poses for corporations—including expected refinements of the technique, such as to effect corporate sabotage. Seventh, we discuss the duties and responsibilities of corporate directors and the Ormerod-Trautman data security economic model. Eighth and finally, we review the current cybersecurity legal landscape with a particular focus on corporate best practices and how business executives protect themselves against cybersecurity-related liability. We believe this Article contributes to the sparse existing literature about ransomware and related cyber threats posed to corporate boards and management.

This book is one of the recommended books for investigating on the historical cyber wars and the establishment of cyber security protocols. This investigation will help the national security officials to protect the national security. Thus, this book has the useful information for the national security authorities and related cyber warriors for extending their understanding about the background context of cyber war and how to protect their national security. This book also provides the details of cyber wars for each case studies in the book together with the interesting perspective on national security and cyber intelligence management issues. Both authors have been recognized as the international security experts in two different generations - Clarke is a representative of the nuclear generation and Knake is a representative of the cyber generation. Both authors have shared their studies of the evolution of technological development and cyber warfare. They believed that the impacts of cyber warfare will ruin the confidentiality of people and destroy the national security. For national and international policy-makers, this book also can be used for starting a real discussion about substantive policies to cope the impacts of cyber warfare and its consequences on national security. The authors also give a good discussion about the nature of cyber warfare in different terms of cyber espionage, cyber crime and cyber terrorism as the insight into how governmental authorities dealt the existing and recurring problems. One part of the introduction to cyber warfare, the United States (US) is considered as a good example of the cyber warfare but actually, it is far the most vulnerable national security and the authorities seek the adaptable techniques to cope the problems of cyberwar attacks. The authors have reviewed various case studies to understand the roots of cyber warfare problems. Their analysis also included their perspectives on information technology development, social security and political complexity of each country. They also stated that the cyber war also leads to the damage to civil infrastructure (railroads, airlines and distribution systems) and the very harmful nuclear weapon which works faster and hard to detect. Therefore, the cyber war prevention strategy has shared some of the specific protocols to the nuclear prevention plans which were developed since the 1960s. Since over last decade, the cyber weapons can be highly disruptive and there is a need to create a new convention of what is the use of the cyber weapon. As a result, the occurrence of cyber war creates the unavoidable fear and the new challenges to human societies because of no common platform or lawful protocols to deal with hackers and attackers or document to ask many governmental organizations to cut off the with hackers and attackers from the internet networks. In the fact that, the authors mentioned that the US is one of the vulnerable countries to cyber-attacks because US government cannot firmly protect most important civil and banking systems but only protects the military. Over the last decade, the US has developed cyber offensive units and many countries have developed their capabilities and engaged in cyber warfare. The authors also mentioned that the US, China, and Russia have developed their cyber warfare capabilities as well as their leadership in this field. However, they concerned that information systems have been developed much faster than security measures to protect all part of personal and national security. Due to security systems will be falling behind, there is need of a special team of experts to assess the security of software and hardware regularly. Additionally, some specific software to detect the malware and suspicious lines of harmful codes in early stages. The gist of this book also mentioned that “internet of things” (IoT) era have made us rely more and more on the utilization of computer, software, social networks and cyber technologies that increases the opportunity of the vulnerability of personal and national securities. One example in this book, many power grids in the US is on the cyber net controlling computer which the distance access to their systems are not only turn on and shut down the power but also the ability to destroy them. This is the same results of remote controlling such as oil refineries, air traffic control systems and many automobiles, as for the negative impacts of cyber warfare can be led to devastating damage in each nation and worldwide. Therefore, this book was recommended for a quick read for the informative ideas of cyber warfare and the ways of handling the insecurity of nation which caused by cyber terrorism as a part of mass social crimes.

Responding to human population and economic growth in Indonesia, high-rise building as supporting infrastructures has increased significantly in numbers in many big cities. Designing high-rise building, earthquake load shall be considered to create an earthquake-resistant building. However, the civil engineering practices in Indonesia are inappropriate to the current provisions. Many existing buildings, which were built based on previous earthquake-resistant building provisions, are not evaluated to adjust to the current earthquake-resistant building provisions. There is also inconsistency among civil engineers while applying provisions in design practices. Hence, a question arises whether the existing buildings which were designed using an inappropriate procedure are adequate enough to fulfill the necessary requirements of structural behavior and performance level as an earthquake-resistant building in high seismicity area. This paper presents structural analysis to evaluate impacts of various levels of detailing on ductility in high-rise reinforced concrete frame buildings. In the study, 20 story office buildings located in region with high seismicity area were designed. Five detailing levels of building designs were studied: one building used appropriate design while others not. The variations were differed by combining types of moment frame system (ordinary, intermediate, and special) and several values of response modification coefficient, R. The seismic performances of the buildings were then investigated by performing nonlinear time history analysis using seven pairs of scaled ground motions. From this analysis, ductility of five buildings were compared and evaluated. The evaluations were presented by performance level result and limited maximum story drift ratio result. Based on the findings, dynamic behavior for inappropriate designed buildings indicated vulnerable behavior of structure which was dominated with brittle behavior and exceed maximum drift limit. Due to the vulnerability, this paper proposes the necessity of immediate evaluation and retrofit for existing high-rise buildings which have inappropriate design in high seismicity area in Indonesia.

This paper attempts to introduce an alternative multidimensional graphical approach to visualize the oil prices behavior by stages. Hence, this research presents a new graphical method is entitled “The Infinity Physical Space (I-Physical Space).” The I-Physical Space can show the expansion or contraction of oil prices into a fixed period. In our case, we are using ten years per period. Subsequently, this research paper is evaluating five periods follow by Period-I: 1960s; Period-II: 1970s; Period-III: 1990s; Period-IV: 2000/2009; Period-V: 2010/2019 respectively. In the same study, we can find how the oil prices vulnerability in different periods of time through the application of the I-Physical Space. According to this research, the vulnerability of oil prices is affected by various socio-economic-political events simultaneously in the short run. The evaluation of oil prices in this study is under two categories are (i) the stable oil prices range or (ii) the unstable oil prices range.

In a time of rapid development in privacy and data protection laws, the state of urban life has much to tell us about their long run effectiveness. Compared to even the recent past, major cities have largely lost the definitive public anonymity and obscurity that has characterised urban life for centuries. Saturated with sensors networked to powerful data analytics, they are at the epicentre of an ongoing revolution in governmental and commercial surveillance. In short, the future radical transparency of all human life is already emerging in our major cities. This paper addresses a crucial question. Given a hundred years of privacy and then data protection law, how did this happen? In this paper, I argue that the explanation for this long running failure lies substantially in the wider political economy of information law, which continues to shape and limit the capacities of privacy and data protection law. The prevailing liberal democratic model of information law is structured around two key concerns: protecting the state’s powers of ultimate access to information and ensuring that all information remains potentially marketable. The particular vulnerability of personal information to demands for state and market access is, however, much more than a matter of political and economic power imbalances. Information law has developed through a dynamic relationship between governmental and commercial information uses and the continuous application of new technologies that render information more accessible and usable. Over the long history of privacy and data protection laws, technologies have thus played a uniquely important role in catalysing the erosion of existing personal information protections and creating opportunities for strengthening access rights. The formidable privacy of physical circumstances, which was an ordinary and often unremarkable feature of life, has been gradually eroded away. The contested re-construction of that privacy through law has been, in comparison, porous and compromised. I explain this claim through three illustrations: First, in the transformation of the concepts of public space and public domain, which are frequently used to justify access to personal information with minimal safeguards; Second, in the conflict within the principles of individual consent and choice, which provide the cornerstone for both personal autonomy and marketability of information; and, Third, in the comparative structural weaknesses of privacy and data protection laws as a field within the wider sphere of information law. Whether societies find more effective boundaries against further transparency or even change the governance of how personal information is accessed and used in conditions of transparency are primarily political and economic questions. Constructive changes in law and regulation can, however, feed into those wider processes of decision making. In its final part, the paper discusses ways in which important elements of privacy and data protection laws could be used more effectively. This includes current efforts to use diverse forms of collaborative public scrutiny and accountability to challenge information law’s embedded preferences towards access and use. Cities, not surprisingly, remain the test bed for success or failure.

Cyber and sophistication of cyber adversaries grow, so too must the US power system’s defenses, situational awareness, and response and recovery strategies. Traditionally power dedicated communication channels to large generators and utility-owned assets but network connectivity in today’s industrial entities, including electrical utilities, has exposed many digital communication and control aspects to the threat of cyber-attacks.When forward-looking improvements including smart grid, smart meters and other advancements are considered, security is of foremost concern. In fact, governments around the world have recognized the existing vulnerability and need to protect the grid infrastructure. To solve the problem, regulations and standards are being developed to ensure that the proper security steps are taken. In addition, cyber attackers have targeted crude oil and natural gas (O&G) companies, with attacks growing in frequency, sophistication and impact as the industry employs ever more connected technology. But the industry’s cyber maturity is relatively low, and O&G boards show generally limited strategic appreciation of cyber issues. research paper documents the current spread throughout US, highlights required security enhancements and recommendations to foster Cyber-secure, resilient energy is paramount to the prosperity of the United States. As the experience additionally, power systems were operated with control aspects to the threat of cyber companies, with attacks growing in frequency, sophistication, and Cyber security gaps across Energy, Oil & Gas sector systems Security & Resiliency of our Critical Infrastructure.

The invention of Bitcoin in 2008 as a new type of electronic cash has arguably been one of the most radical financial innovations in the last decade. Recently, developer communities of blockchain technologies have started to turn their attention towards the issue of governance. The features of blockchain governance raise questions as to tensions that might arise between a strictly “on-chain” governance system and possible applications of “off-chain” governance. In this paper, we approach these questions by reflecting on a long-running debate in legal philosophy regarding the construction of a positivist legal order. First, we argue that on-chain governance shows striking similarities with Kelsen’s notion of a positivist legal order, characterised by Schmitt as the machine that runs itself. Second, we illustrate some of the problems that emerged from the application of on-chain governance, with particular reference to a calamity in a blockchain-based system called the DAO. Third, we reflect on Schmitt’s argument that the coalescence of private interests is a vulnerability of positivist legal systems, and accordingly posit this as an inherent vulnerability of on-chain governance of existing blockchain-based systems.

We propose a statutory safe harbor from the CFAA and DMCA §1201 for security research activities. Based on a responsible disclosure model in which a researcher and vendor engage in a carefully constructed communication process and vulnerability classification system, our solution would enable security researchers to have a greater degree of control over the vulnerability research publication timeline, allowing for publication regardless of whether or not the vendor in question has effectuated a patch. Any researcher would be guaranteed safety from legal consequences if they comply with the proposed safe harbor process.

The lack of training and awareness about phishing is the number one reason why phishing attacks are so successful. This study aims to investigate if a person’s college major influences how vulnerable a person is to a phishing attack. The current study argues that computers majors are going to be less vulnerable to phishing attacks compared to other majors. One hundred and fifty-five participants were asked to take an online anonymous survey that asked questions about phishing. The results provide the demographics and correlations between computer majors and non-computer majors. The results indicate a person’s major should be considered as an individual factor for phishing in future research. This study provides insight on how a person’s major can make them more vulnerable to phishing emails.

The proliferation of connected devices and technology provides consumers immeasurable amounts of convenience, but also creates great vulnerability. In recent years, we have seen explosive growth in the number of damaging cyber-attacks. 2017 alone has seen the Wanna Cry, Petya, Not Petya, Bad Rabbit, and of course the historic Equifax breach, among many others. Currently, there is no mechanism in place to facilitate understanding of these threats, or their commonalities. While information regarding the causes of major breaches may become public after the fact, what is lacking is an aggregated data set, which could be analyzed for research purposes. This research could then provide clues as to trends in both attacks and avoidable mistakes made on the part of operators, among other valuable data. One possible regime for gathering such information would be to require disclosure of events, as well as investigations into these events. Mandatory reporting and investigations would result better data collection. This regime would also cause firms to internalize, at least to some extent, the externalities of security. However, mandatory reporting faces challenges that would make this regime difficult to implement, and possibly more costly than beneficial. An alternative is a voluntary reporting scheme, modeled on the Aviation Safety Reporting System housed within NASA, and possibly combined with an incentive scheme. Under it, organizations that were the victims of hacks or “near misses” would report the incident, providing important details, to some neutral party. This database could then be used both by researchers and by industry as a whole. People could learn what does work, what does not work, and where the weak spots are.

This paper critically reviews and evaluates stress-testing frameworks and practices of supervisory authorities in a dual banking system namely Malaysia, Indonesia and Pakistan. The analysis suggests that similar to single banking system, there are two main designs to stress testing -bottom-up and top-down - depending on the institutional responsibilities and computational capabilities, while relying on two main techniques of stress tests, sensitivity tests and scenario tests (historical or hypothetical). None of these countries differentiates the stress testing design and approach between conventional and Islamic banking industry. The application of stress testing in these countries follows similar approach to conventional banking system. The analysis also suggests that stress-testing approach for Islamic banking system should be developed capturing the unique balance sheets structure and risks of Islamic banking so that it provides accurate assessments of vulnerability in the Islamic banking system.

Many software systems have evolved to include a Web-based component. One of these attacks is SQL injection, which can give attackers unrestricted access to the databases that underlie Web applications and has become increasingly frequent and serious. SQL injection is an attack that occur in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. SQL Injection is one of the most common application layer attack techniques used today. Here is a POC (Proof of Concept) by Scanning Tool: Web Cruiser-Web SQL-injection attacks exploit weak validation of textual input used to build database queries. The objective of this project is to prevent SQL injection while injecting queries to database and to make the database secured. The system uses SQL Injection mechanism prevention to keep the data safe and secure from SQL injection attacks.

How often do multiple, independent parties discover the same vulnerability? There are ample models of vulnerability discovery, but little academic work on this issue of rediscovery. The immature state of this research and subsequent debate is a problem for the policy community, where the government’s decision to disclose a given vulnerability hinges in part on that vulnerability’s likelihood of being rediscovered and used maliciously by another party. Research into the behavior of malicious software markets and the efficacy of bug bounty programs would similarly benefit from an accurate baseline estimate for how often vulnerabilities are discovered by multiple independent parties. This paper presents a new dataset of more than 2,600 vulnerabilities, and estimates vulnerability rediscovery across different vendors and software types. It concludes that rediscovery happens more often than the 1% to 9% range previously reported. The aggregate rediscovery rate for our dataset is 12.7%, ranging between 10.8% for Chrome between 2009 and 2017, to 21.9% for Android between 2016 and 2017. For Android and Chrome, more than 60% of all rediscovery takes place in the first month after the original vulnerability’s disclosure. These results are largely in line with those of the original version of this paper published in July 2017, and indicate that the information security community should map the impact of rediscovery on the efficacy of bug bounty programs, and policymakers should more rigorously evaluate the costs and requirements for non-disclosure of software vulnerabilities.

This paper presents analytical models for optimizing firm's cybersecurity spending and cyber insurance based on the effectiveness of spending in reducing cyber threats , vulnerability and impact , respectively. At the macro-level, the paper shows how private-sector contribution toward countering cybercrimes can reduce the overall cyber loss and create economic value. At the micro level, a firm's effectiveness of security spending in addressing specific cyber threats can be reduced when other co-dependent security measures are not put in place. The paper derives an optimal mix of cybersecurity investments in “knowledge and expertise” versus “deploying mitigation measures”. The paper proposes customizing cyber insurance for firms with itemized threat-specific coverage with a portion of the premium used to help clients with risk knowledge and nudge clients in implementing risk mitigation measures. Small and Mid-sized Enterprises can stand benefit the most from such innovative cyber insurance.

This article focusses phishing, an un-patchable vulnerability, where an attacker can take advantage of human weakness which is primarily due lack of proper awareness and training in cyber security. Do you often wonder about such questions as those listed below? v As an individual: Am I vulnerable to phishing? v Is my enterprise capable of withstanding today's phishing attacks? v How can I test and train my employees? v How can I ensure user awareness & training to tackle phishing attacks? If the above are questions bothering you, then read on…

Cloud computing has changed technological landscape. It provides immense potential by leveraging resources to their maximal capacity. The cost efficiencies gained by using cloud platforms have spurred hundreds of new companies revolutionizing the IT space. Though cloud offers numerous benefits to customers and individual users, it presents a dark side of personal data vulnerability. The present paper aims at studying the Nature of Personal data at various layers and stages in a Cloud Environment. It argues that laws should be complimentary to the societal design thus aiding progress of the civilization. With 78% of Europe hooked on Internet and using some form of cloud application, the societies desire should be furthered rather than constrained by strict and overarching rules. The paper presents various intricate, complex and technical possibilities of cloud, which are not in sync with present regulatory system: suited for Client-Server Models. The paper argues that the present regulations look into privacy issues with a binary vision (0 or 1 view) and provide for omnibus provisions. A fresh new perspective of viewing different entities of cloud in their modular nature might be needed for a vibrant cloud environment.

This paper presents mathematical models for cyber breach probability as function of security spending in protecting a firm’s ICT systems. We derive optimal level of security investment as percentage of value-at-risk. We show that the upper bound of optimal investment can be 1/e, 1/√2π or other percentages of value-at-risk, depending on the cyber breach probability model. We apply the models to derive optimal security budget allocation for protecting ICT systems with multiple areas of vulnerability and multiple data assets. Our analysis highlights the importance of security measures to cover the full spectrum of areas of vulnerability; neglecting one area of vulnerability can render the security investment ineffective and wasteful. Moreover, optimal economic value can be achieved by differential treatment of a firm’s high-value data assets.

Since the financial crisis in 2007–2008, the vulnerability of a financial system has become a major concern in financial engineering. In this paper, we analyze the vulnerability of a financial network based on the linear optimization model introduced by Eisenberg and Noe [Eisenberg L, Noe TH (2001) Systemic risk in financial systems. Management Sci. 47(2):236–249.], in which the right-hand side of the constraints is subject to market shock and only limited information regarding the liability matrix is exposed. We develop a new extended sensitivity analysis to characterize the conditions under which a bank is solvent, in default, or bankrupted and estimate the probability of insolvency and the probability of bankruptcy under mild conditions on the market shock and the network structure. Particularly, we show that although an increment in the total asset may not be able to improve the stability of the financial system, a larger asset inequality in the system will reduce its stability. Moreover, under a certain assumption on the market shock and the network structure, we show that the least stable network can be attained at some network with a monopoly node, which also has the highest probability of insolvency. The probability of bankruptcy in the network when all the nodes receive shocks is estimated. We also estimate the impact of bankruptcy of the monopoly node in a well-balanced network and explore the domino effect of bankruptcy when the network has a tridiagonal structure. Numerical experiments are presented to verify the theoretical conclusions. This paper was accepted by Melvyn Sim, optimization.

Internet of Things (IoT) aims at providing connectivity between every computing entity. However, this facilitation is also leading to more cyber threats which may exploit the presence of a vulnerability of a period of time. One such vulnerability is the zero-day threat that may lead to zero-day attacks which are detrimental to an enterprise as well as the network security. In this article, a study is presented on the zero-day threats for IoT networks and a context graph based framework is presented to provide a strategy for mitigating these attacks. The proposed approach uses a distributed diagnosis system for classifying the context at the central service provider as well as at the local user site. Once a potential zero-day attack is identified, a critical data sharing protocol is used to transmit alert messages and reestablish the trust between the network entities and the IoT devices. The results show that the distributed approach is capable of mitigating the zero-day threats efficiently with 33% and 21% improvements in terms of cost of operation and communication overheads, respectively, in comparison with the centralized diagnosis system.

We present a comprehensive study for the optimal sourcing strategy of a firm where the market selling price is endogenously determined by the total output and suppliers face correlated disruptions that are difficult to estimate. We develop a distributionally robust (DR) model for a single group of correlated suppliers that maximizes the firms' expected profit under the worst-case disruption distribution. Our model only requires the marginal disruption probabilities and accommodates both yield and capacity uncertainty. We derive simple expressions that allow the firm to eliminate less reliable suppliers on the combined basis of cost and reliability when yield is uncertain. In the case capacity uncertainty, we show the cheapest supplier influences the orders placed with more reliable suppliers, if the cheapest supplier receives no order. We incorporate the DR model in a more general model where the available suppliers are grouped based on common sources of vulnerability. This model accommodates cases where correlations exist between all or no suppliers as special cases. The model allows decision-makers to tailor the sourcing strategy based on their risk tolerance. We introduce new measures for supplier efficiency that accounts for both supplier costs and reliabilities. These measures are incorporated in a solution procedure that provides the optimal supplier selection and order allocation. The measure of efficiency serves as an extension of the commonly cited insight that "cost is an order qualifier and reliability is an order winner" for the case of correlated suppliers. We end the paper by studying the impact of buyer competition on the optimal sourcing strategy. We present equilibrium solutions for cases of symmetric information and study the information sharing behavior of a better-informed firm under information asymmetry.

Can states control malware? It is a radical asymmetry: the power of a modern nation-state arrayed against a few hundred thousand bytes of code and its creators, but an imbalance whose counterintuitive nature impacts the security of citizens, corporations, and governments alike. This paper evaluates export controls found in the Wassenaar Arrangement targeting malware in the context of the research into the malicious software ecosystem. The article highlights that export controls place burdensome restrictions on research and commercial information security efforts. Looking at the market for malicious software, incentivising the discovery of new vulnerabilities to reduce their availability to attackers would be more effective in curtailing malicious activity.

This article employs a novel setup to study the vulnerability of an incumbent to entry in markets with asymmetric information. The free-entry equilibrium of Rothschild and Stiglitz (1976) and the reactive equilibria of Wilson (1977) and Riley (1979) can be recast using this setup. A larger than Rothschild and Stiglitz (1976) set of markets is characterised in which the incumbent is vulnerable to free-entry for every possible menu of contracts she offers. An alternative, simple restriction in the set of feasible menus of an entrant is proposed that is easily implementable and consistent with the fundamental principle of competitive markets. Under this restriction, the incumbent is invulnerable to entry if she offers an efficient menu but vulnerable if she does not.

In the past few years, secure information sharing became very popular in the area of immigration, military applications, healthcare, education, foreign affairs, etc. As secure communication utilizes both wireless and wired communication mechanizations for exchanging sensitive information, so security and privacy of the information exchange cannot be easily compromised. To moderate the security, integrity, authenticity, and privacy issues related to information exchange, numerous authentication mechanisms have been recommended by different researcher in the literature in recent times, but are vulnerable to prospective security flaws such as masquerade, insider, replay, impersonation, password guessing, server spoofing, denial-of-service attacks and in addition failed to deliver mutual authentication. In the past few years, we have also seen a balanced growth in the acceptance of VoIP (Voice over IP) facilities, because the numerous Web and VoIP applications depend on huge and extremely distributed infrastructures to process requests from millions of users in an appropriate manner. Due to their extraordinary desires, these large-scale Internet applications have frequently surrendered security for other objectives such as performance, scalability, and availability. As a result, these applications have characteristically favored weaker, but well-organized security mechanisms in their foundations. Session Initiation Protocol (SIP) is an application and presentation layers signaling protocol that initiates, modifies, and terminates IP-based multimedia sessions. Implementing SIP for secure communication has been a topic of study for the past decade, and several proposals are available in the research domain. However, security aspects are not addressed in most of these proposals, because SIP is exposed to several threats and faces security issue at these layers. Probes for SIP (Session Initiation Protocol) servers have been conveyed for many years, and to gather more details about these activities we simply design a scheme for SIP servers in a network and composed data about some popular attacks. What will follow is an explanation of our interpretations and guidance on how to prevent these attacks from being successful. Biometrics a new field of research has also been materialized in this research, entitled “a three-factor authentication scheme" in which one factor is biometrics. In biometric cryptosystems, the benefits of biometric confirmation are presented to basic cryptographic key supervisory systems to enhance security. Anyhow, this research delivers a general outline of the basics, permitting to biometrics as well as cryptography. This work also gives biometric cryptosystems based on iris biometrics and using smart card as well as a password for authentication.

This article examines the transitory nature of cyber weapons. Shedding light on this highly understudied facet is important both for grasping how cyberspace affects international security and policymakers’ efforts to make accurate decisions regarding the deployment of cyber weapons. First, laying out the life cycle of a cyber weapon, I argue that these offensive capabilities are both different in ‘degree’ and in ‘kind’ compared to other weapons with respect to their temporary ability to cause harm or damage. Second, I develop six propositions which indicate that not only technical features, inherent to the different types of cyber capabilities – i.e. the type of exploited vulnerability, access and payload – but also offender and defender characteristics explain differences in transitoriness between cyber weapons. Finally, drawing out the implications, I reveal that the transitory nature of cyber weapon’s benefits great powers, changes the incentive structure for offensive cyber cooperation, and induces a different funding structure for (military) cyber programs compared to conventional weapon programs. I also note that the time-dependent dynamic underlying cyber weapons potentially explains the limited deployment of cyber weapons compared to espionage tools.

Over the past decade, the United States has compellingly demonstrated that states who are able to harness cyber capabilities to coordinate efforts across air, sea, land, and space domains can exercise highly effective coercive and deterrent threats. However, the US’ increasing reliance on cyber to enhance networked combat makes the US not only more lethal, but also potentially more vulnerable. How does this impact deterrence and crisis stability? This paper explores the role that cyber plays in the dynamics of conventional deterrence and argues that the true impact of cyber on deterrence is not cyber as a weapons system, but instead cyber as an enabler of offensive military operations. As the US continues to invest in cyber-dependent technologies and strategies like unmanned aerial platforms, precision weapons, and network-reliant joint planning, it can conduct strikes further away from the battlefield and with greater effectiveness. It also means, however, that the US will not be able to execute its planned operations if cyber key terrain, like satellite relay nodes, intelligence infrastructure, or GPS communication links are attacked by cross-domain weaponry. This paradox of capability and vulnerability makes cyber-enabled warfare a dangerous dependency for three reasons. First, states that are cyber-dependent and highly capable may perceive a first mover advantage to strike before their network capabilities are degraded. Secondly, a less capable cyber state may also see a first mover advantage in attacking the more capable/more cyber-dependent state before the cyber-dependent state is able to conduct a cyber-enabled highly effective, long range “blinding” attack. Finally, because the weapons and operations that cyber enables are increasingly long range, with little indications and warning, and with few defenses once employed, cyber has created at least a perception of offensive advantage. These findings indicate that cyber may both bolster deterrence and incentivize attack in a difficult paradox of capability and vulnerability.

We develop a macroprudential stress test to assess the resilience of banking systems. The proposed approach integrates liquidity risk and solvency risk and provides a convenient method to estimate the change in both of them based on the evolution of financial distress within the banking system. We estimate this evolution of financial distress using a new measure of systemic distress that incorporates microprudential as well as macroprudential risks in the banking system network. The proposed stress test provides output metrics that capture idiosyncratic as well as systemic economic risks at the level of an individual bank and the banking system as a whole. The empirical application of the stress test framework to the U.S. banking system shows how it can be effectively used to identify the systemic vulnerability of individual banks and the resilience of the system as a whole to economic risks. It also shows how the proposed approach can be effective for monitoring and assessing systemic interdependencies among banks.

Public warnings have the potential to be a powerful tool to mitigate the threat from terrorism: the public is alerted, and in response, the terrorist may defer or deflect his attack. Paradoxically, warnings can be a victim of their own success. The absence of an attack may be misconstrued by the warning recipients as a false alarm, leading to warning fatigue and a dampened response to future warnings -- also referred to as the "cry-wolf" effect. To capture this phenomenon, we model the interaction between the defender and the terrorist using a dynamic game-theoretic framework. We find that a more effective warning shifts emphasis from the direct benefit of mitigating losses from an attack, to the indirect benefit of inducing the terrorist to defer his attack to a later time. We examine the implications of this finding in the context of defending a single location, and two locations. For instance, we find that the frequent occurrence of false alarms does not necessarily imply political gamesmanship; an increase in the terrorist's readiness can result in a lower frequency of terrorist attacks; issuing a joint warning across two locations can be optimal even when the asymmetry in their vulnerability is high. Our results clarify conventional wisdom, and hence, have important policy implications.