Search

Public Acceptance is a prerequisite forgaining the intended benefits of Connected and Au-tonomous Vehicles (CAVs). This paper proposes anidea of digital labels for CAVs so as to increaseconsumers trust and awareness regarding the se-curity level of their vehicle. We come up with anarchitecture named Cybersecurity Box (CSBox) inwhich digital labels display and inform the CAVconsumers and passengers about its cybersecurityhealth status. We also highlight requirements andchallenges in developing digital security labels forCAVs

Our previous work selected for Top Picks in Hardware and Embedded Security 2020 demonstrates that it is possible to reverse engineer neural networks by using side-channel attacks. We developed a framework that considers each part of the neural network separately and then, by combining the information, manages to reverse engineer all relevant hyper-parameters and parameters. Our work is a proof of concept (but also a realistic demonstration) that such attacks are possible and warns that more effort should be given to developing countermeasures. While we have used microcontrollers for our experiments, the attack applies to other targets like FPGAs and GPUs. National Research Foundation (NRF) Accepted version This research is partly supported by the National Research Foundation, Singapore, under its National Cybersecurity Research & Development Programme / Cyber-Hardware Forensic & Assurance Evaluation R&D Programme (Award: NRF2018NCR-NCR009-0001)

Purpose Nascent firms and startups are often subject to challenges that their more mature counterparts can avoid. While cybersecurity is an issue that all firms contend with, it is especially challenging for new entrepreneurial ventures who lack the resources and capabilities of established firms. The purpose of this paper is to seek to delve deeper into the cybersecurity and risk management needs of small firms and startups. Design/methodology/approach Extant literature and available tools are explored to develop a usable framework applicable to small firms and new entrepreneurial ventures. Findings The liabilities of newness and smallness make entrepreneurial ventures a unique context in which to study the significance of cybersecurity and data privacy risk management. The authors offer an overview of issues and potential solutions relevant to entrepreneurial ventures. Research limitations/implications While offering practical insights, the work is a theoretical framework. The framework will enable researchers to develop more nuanced theory when it comes to cybersecurity and data privacy risk management. Practical implications The framework illustrates four distinct contexts for cybersecurity and risk management when it comes to the needs of small firms and startups. Adoption levels are explained, and small business operators and entrepreneurs can thus use the framework to determine the most appropriate approach for their enterprise. Originality/value The authors develop a framework illustrating adoption of different security and risk management practices by entrepreneurial ventures based on their specific needs and context. The authors thus offer practical solutions for startups and nascent firms regarding cybersecurity and privacy management.

Digital currency is primarily designed on problems that are computationally hard to solve using traditional computing techniques. However, these problems are now vulnerable due to the computational power of quantum computing. For the postquantum computing era, there is an immense need to reinvent the existing digital security measures. Problems that are computationally hard for any quantum computation will be a possible solution to that. This research summarizes the current security measures and how the new way of solving hard problems will trigger the future protection of the existing digital currency from the future quantum threat.

Authentication, Authorization, security and confidential information are number of foremost topics part in the Digital cyber - security Area. There are multiple solutions available in this virtualize cyber world that are presented to user’s strength as per digital security. Username and password base are common factor authentication methods. The growing-up popularity with compliance of second factorized methods those driven by the improvement of privacy and security as per the requirement during this digitalization of technological trend. The recognition and success of digital security various measures are big deal to obsessed with simple convenience. Its need more and more implementation for the user privacy, data confidentiality and network security’s system. mainly focus on this research Article into dealing with and analysing the implications of security part of 3FA proposal model for additional security in way of systematic manner to improvements of digital security in web-based Application. This paper will be presenting as web-based Application. so, we can create potentially ensure systems are authorized with authentication of user's assurance without loss of convenience between user-system data communication in network.

World is getting digital at an exponential rate. Commonplace activities are accomplished increasingly over digital platform to bring in requirement of digital security in place of only physical security. Security (physical or digital or both) is essential for safe storage, retrieval and exchange of physical or digital data and documents. As data/information/knowledge leading to wisdom are increasingly getting endowed with economic values the risk for such assets being pilfered are also increasing. This requires methods for their security being augmented continuously. Society from past to present days are putting their best efforts in this end. Generally, it is achieved through hiding the message from predator’s greedy glare and ensuring its temper-free safe passage to desired destination with deception in various forms. Associated processes are complex and during initial days were executed with various forms of arts and riddles. Over years technology driven solutions were evolved to ensure today’s digital security requirements [7],[8]. Motivation/Background: Presently occurrence of digital security disasters is not few and far between, instead they are alarmingly many, though technology for digital security is improving by leaps and bounds. More often than not, in case of a digital catastrophe dominant foot prints of human involvement are found along with technical snags. It may be noted that technical failure can be assessed and rectified in an organized way though causes of human involvement are difficult to judge as they are much abstract in nature and difficult to measure. Thus, this effort to explore human role in digital disaster. Method: In present text traditional to most current practices of securing data storage, retrieval and disbursal are touched upon. During earlier days data hiding technique from predator’s glare had been more of an artistic than scientific form. Over years mathematical and statistical approach were induced to make the system more robust though secrets are exposed even today at an alarming rate and at times by their own creators to usher security disasters. As the discussion progressed results from secondary sources are presented to make a broad statement on current scenario. Finally, indicators like NCSI (National Cyber Security Index) and DDL (Digital Development Level) from NCSI site and HDI (Human Development Index) from Human Development Report of 2019, produced by UNDP, are considered for analysis to have better insight. These figures are available on public domain for general referral [24],[25]. Results: It has been observed that beyond technical complications, human factors play a dominant role in ensuring security.

We present a novel web-based attack that identifies a Tor user’s guard in a matter of seconds. Our attack is low-cost, fast, and stealthy. It requires only a moderate amount of resources and can be deployed by website owners, third-party script providers, and malicious exits—if the website traffic is unencrypted. The attack works by injecting resources from non-existing onion service addresses into a webpage. Upon visiting the attack webpage with Tor Browser, the victim’s Tor client creates many circuits to look up the non-existing addresses. This allows middle relays controlled by the adversary to detect the distinctive traffic pattern of the “404 Not Found” lookups and identify the victim’s guard. We evaluate our attack with extensive simulations and live Tor network measurements, taking a range of victim machine, network, and geolocation configurations into account. We find that an adversary running a small number of HSDirs and providing 5 % of Tor’s relay bandwidth needs 12.06 seconds to identify the guards of 50 % of the victims, while it takes 22.01 seconds to discover 90 % of the victims’ guards. Finally, we evaluate a set of countermeasures against our attack including a defense that we develop based on a token bucket and the recently proposed Vanguards-lite defense in Tor.

In this paper, we present Xoodyak, a cryptographic primitive that can be used for hashing, encryption, MAC computation and authenticated encryption. Essentially, it is a duplex object extended with an interface that allows absorbing strings of arbitrary length, their encryption and squeezing output of arbitrary length. It inherently hashes the history of all operations in its state, allowing to derive its resistance against generic attacks from that of the full-state keyed duplex. Internally, it uses the Xoodoo[12] permutation that, with its width of 48 bytes, allows for very compact implementations. The choice of 12 rounds justifies a security claim in the hermetic philosophy: It implies that there are no shortcut attacks with higher success probability than generic attacks. The claimed security strength is 128 bits. We illustrate the versatility of Xoodyak by describing a number of use cases, including the ones requested by NIST in the lightweight competition. For those use cases, we translate the relatively detailed security claim that we make for Xoodyak into simple ones., IACR Transactions on Symmetric Cryptology, Volume 2020, Special Issue 1

Deep learning has been established in the last few years as the gold standard for data processing, achieving peak performance in image, text and audio understanding. At the same time, digital security is of utmost importance in this day and age, where everyone could get into our personal devices like cellphones or laptops, where we store our most valuable information. One of the possible ways to prevent this is via advanced and personalized security: biometrics. In this survey, it is considered how the scientific advances in the field of deep learning are applied to biometrics in order to enhance the protection of our data.

Attīstoties informācijas tehnoloģijām un digitālajiem risinājumiem, pieaug iedzīvotāju vēlme saņemt pakalpojumus elektroniski – vai tie būtu sadzīviska rakstura pakalpojumi vai valsts un pašvaldības iestāžu piedāvātie elektroniskie pakalpojumi. Lai persona varētu saņemt attālinātus iestāžu pakalpojumus, tai ir nepieciešams elektroniski identificēties. Personas veiksmīgas elektroniskās identifikācijas būtiskākās komponentes ir abu pušu saistību izpilde personas datu drošības jautājumos un pakalpojumu sniedzēja spēja tehniski nodrošināt personas elektronisko identifikāciju. Rakstā tiek apskatīti elektroniskās identifikācijas veidi, to raksturojums un tiesiskie aspekti, izvērtējot tiesisko regulējumu, pieejamo literatūru un aktuālo tiesu praksi elektroniskās identificēšanas jautājumos. Raksts ir balstīts uz autores izstrādāto maģistra darbu, kurā tika pētīti personas elektroniskās identifikācijas riski un tiesiskā regulējuma problemātika. With the development of information technologies and digital solutions, desire of people to receive services electronically increases – whether it is a domestic or an electronic service offered by state or municipal authorities. In order to receive services of authorities remotely, a person needs to be identified electronically. The most important components of a person’s successful electronic identification are the fulfillment of both parties’ obligations on personal data security issues and the ability of the service provider to technically secure the person’s electronic identification. The Author of the paper has analysed types of person’s electronic identification, their characterisation and legal aspects, evaluating legal regulation, available literature and current court practice in electronic identification issues. The article is based on the author’s Master’s thesis, which explored the risks of electronic identification of a person and the issues of legal regulation.

Intimate partner abusers use technology to track, monitor, harass, and otherwise harm their victims, and prior work reports that victims have few resources for obtaining help with such attacks. This paper presents a qualitative analysis of data from a field study of an approach to helping survivors of intimate partner violence (IPV) with technology abuse. In this approach, called clinical computer security, a trained technologist performs a face-to-face consultation with an IPV survivor to help them understand and navigate technology issues. Findings from consultations with 31 survivors, as well as IPV professionals working on their behalf, uncovered a range of digital security and privacy vulnerabilities exacerbated by the nuanced social context of such abuse. In this paper we explore survivor experiences with, and reactions to, the consultations, discussing (1) the ways in which survivors present their tech concerns, (2) the cooperative work required to guide survivors towards understanding probable causes of tech insecurity, (3) survivors' reactions to the consultations, particularly when security vulnerabilities or spyware are discovered, and (4) the role we play as consultants and interventionists in the complex socio-technical systems involved in mitigating IPV. We conclude by discussing some of the broad ethical and sustainability challenges raised by our work, and provide design opportunities for tech platforms to better support survivors of IPV.

The SameSite cookie attribute was introduced to prevent Cross-site Request Forgery (CSRF) attacks. Major browsers support SameSite functionality since 2016. Since 2020, browsers enforce it by default. These developments sometimes have been celebrated as the end of CSRF. In this paper, we have a closer look into the potential of SameSite mechanism to effectively fight CSRF in practice. Our measurements and evaluations over most popular websites indicate that, if properly deployed, the SameSite mechanism can be effective against the major CSRF attack scenario. Still, like any other countermeasure, it is not likely to be a silver bullet to end CSRF, due to various scenarios that require additional protection. We refactor our findings in a set of guidelines for the web community on how to make best use of SameSite and what it is left to do to fight CSRF.

Traffic analysis attacks against the Tor network are a persisting threat to the anonymity of its users. The technical capabilities of attacks against encrypted Internet traffic have come a long way. Although the current state-of-the-art predicts high precision and accuracy for website fingerprinting and end-to-end confirmation, the concepts of these attacks often solely focus on their technical capabilities and ignore the operational requirements that are mandatory to get access to transmissions. In this work, we introduce three novel stepping-stone attacks that enable an adversary to (i) gain additional information about monitored connections, (ii) manipulate the Tor connection build-up, and (iii) conduct a targeted Denial-of-Service attack within the Tor infrastructure. All attacks exploit core defensive features of Tor and, consequently, are hard to patch. At the same time, our attacks are in line with standard attacker models for traffic analysis attacks. We demonstrate the feasibility of all three attacks in simulations and empirical case studies and emphasize their pivotal role in preparing a realistic setting for end-to-end confirmation attacks.

A blockchain is an emerging technology in the age of the Internet and is employed in different areas such as fintech, healthcare, finance, pharmaceuticals, insurance, and digital security. A blockchain is an emergent list of registers termed as blocks that are connected utilizing cryptography. In the state-of-the-art system, the dealing of legal property documents for buying and selling property is accomplished through the government offices. However, these systems result in various frauds due to the middle intermediaries and also have to pay for lawyers. The government had started many applications for finding the property, but in nature, these systems are very complex. In this chapter, we have proposed the 7/12 asset tracking system using blockchain technology. This system is developed to monitor, enhance, and develop secure, trustless, and fraud-free property document handling. In this work, we have designed a shared organization where non-believing mediators can collaborate without a trusted intermediary. In this work, we have proposed a secure system and provide distributed data on the computer of every customer. This will help find the legal property papers and avoids the need for any third parties for property deals in between. This system will tap the fingerprint of the person who was going to sell a property, and the customer will have access to the server. All the property information is going to be displayed using a centralized system in government offices. Finally, this system provides secure and fraud-free handling of property documents.

Diverse forms of artificial intelligence (AI in further text) are at the forefront of triggering digital security innovations, based on the threats that are arising in this post COVID world. On the one hand, companies are experiencing difficulty in dealing with security challenges with regard to a variety of issues ranging from system openness, decision making, quality control and web domain, just to mention a few. On the other hand, in the last decade, research has focused on security capabilities based on tools such as platform complacency, intelligent trees, modeling methods and outage management systems, in an effort to understanding the interplay between AI and those issues. The dependence on the emergence of AI in running industries and shaping the education, transports and health sectors is now well known in literature. AI is increasingly employed in managing data security across economic sectors. Thus, a literature review of AI and system secu-rity within the current digital society is opportune. This paper aims at identifying research trends in the field through a Systematic Bibliometric Literature Review (LRSB) of research on AI and system security. The review entails 77 articles published in Scopus® database, presenting up-to-date knowledge on the topic. The LRSB results were synthesized across current research subthemes. Findings are presented. The originality of the paper relies on its LRSB method, together with extant review of articles that have not been categorized so far. Implications for future re-search are suggested.

Digital disruptions have led to the integration of applications, platforms, and infrastructure. They assist in business operations, promoting open digital collaborations, and perhaps even the integration of the Internet of Things (IoTs), Big Data Analytics, and Cloud Computing to support data sourcing, data analytics, and storage synchronously on a single platform. Notwithstanding the benefits derived from digital technology integration (including IoTs, Big Data Analytics, and Cloud Computing), digital vulnerabilities and threats have become a more significant concern for users. We addressed these challenges from an information systems perspective and have noted that more research is needed identifying potential vulnerabilities and threats affecting the integration of IoTs, BDA and CC for data management. We conducted a step-by-step analysis of the potential vulnerabilities and threats affecting the integration of IoTs, Big Data Analytics, and Cloud Computing for data management. We combined multi-dimensional analysis, Failure Mode Effect Analysis, and Fuzzy Technique for Order of Preference by Similarity for Ideal Solution to evaluate and rank the potential vulnerabilities and threats. We surveyed 234 security experts from the banking industry with adequate knowledge in IoTs, Big Data Analytics, and Cloud Computing. Based on the closeness of the coefficients, we determined that insufficient use of backup electric generators, firewall protection failures, and no information security audits are high-ranking vulnerabilities and threats affecting integration. This study is an extension of discussions on the integration of digital applications and platforms for data management and the pervasive vulnerabilities and threats arising from that. A detailed review and classification of these threats and vulnerabilities are vital for sustaining businesses’ digital integration.

Unit testing is an essential part of computer science education. Students leaving the university should be able to test at a high quality. Traditionally, teaching assistants or teachers themselves check projects and assignments manually. Clearly, this does not scale well. Furthermore, such methods are not suitable to easily get an overview of the overall student performance. A more efficient approach is the so-called all-pairs method, applied by the study of Edwards and Shams (ITiCSE, 2014). Each student implements both the unit (e.g. a class) and a corresponding test suite. Additionally, the teacher creates a reference implementation. The measurement is done by running all tests against all implementations. The present study builds on that research. Our fundamental question is how teachers can get insight into the testing ability of their students. In particular, we develop a software framework and a replicable method. Students have to solve an implementation assignment. Assembling the results, the software provides an overview to the teachers about the test quality of each student's work as well as of the overall testing ability of students. In this study, we replicate and improve the method of Edwards and Shams. We perform measurements to get a better understanding of the testing ability of our students ($N=98$). Additionally, we lay the foundations to make the measurement of students test quality replicable; this enables us later to compare different study programs or the same student population before and after a given course.

Digital data are critical to people and companies, acting as a crucial element in the decision-making process in different areas. Accordingly, logs can track how this data changes over time and are essential to enable auditing. The traditional approach to ensure log integrity is to store them on well-kept servers, both from a physical and a digital security standpoint. However, this approach assumes that it is difficult to exploit these servers’ vulnerabilities and that these systems’ administrator is honest. Distributing trust is an alternative that does not rely on these assumptions, and blockchain-based approaches are promising in that aspect. A method that stands out for providing post-storage integrity guarantees at low transaction costs is the proof of existence, which consists of sending the hash of an object to a public blockchain, proving that the object existed before its hash became included in the blockchain. However, although this method is viable, no other works generalize the concept nor make it accessible, making its wide adoption difficult. Therefore, this work aims to propose an architecture to assure log integrity through proof of existence and develop an application for consuming logs indexed using Elasticsearch: the Auditchain. We present here a case study with qualitative and quantitative data collection. As a result, we obtained a comparison of PoE fulfillment APIs, an architecture to simplify PoE of logs, and an implementation of the proposed architecture.

The essence and content of digital technologies in the framework of judicial reform have been studied. The issue of information security security is considered. The peculiarities of digital services in the judicial system are studied.

We analyze the authenticated encryption algorithm of ORANGE, a submission to the NIST lightweight cryptography standardization process. We show that it is practically possible to craft forgeries out of two observed transmitted messages that encrypt the same plaintext. The authors of ORANGE have confirmed the attack, and they discuss a fix for this attack in their second-round submission of ORANGE to the NIST lightweight cryptography competition.

Two-factor authentication has been available to technology consumers for a long time, and a few years ago businesses and institutions began implementing optional two-factor authentication to improve digital security. Now more universities and hospitals are moving from optional to mandatory two-factor authentication, and employees used to two-factor authentication for their personal digital life must adjust to using two-factor authentication in their work flow. This column will review some of the ongoing and emergent aspects of two-factor authentication to enhance security in an ever-changing digital landscape.

Cyber Emergency Response Team (CERT) is one of the very important component at the national level for the protection and monitoring of cyber domain across the country. As the digital contents are increasing in Bangladesh so is its vulnerability. CERT has been included in the National Cyber Security Strategy and Digital Security Act 2018 but its existence is only at the rudimentary stage with the absence of its footprint at the operational level. This study presents a framework of CERT for Bangladesh considering its application at operational level. The factors considered in this model are status of readiness for CERT, the parties involved in the response mechanism and the procedures involved. The proposed model will present an effective CERT in the domain of digitization and information sharing and will guide to a comprehensive approach to address any cyber incident. This would not only help taking effective measures to mitigate the effect of any cyber-attack but also to increase the cyber readiness profile of the nation to detect, prevent or minimize the occurrence of cyber incidents.

Due to the constant increase and versatility of IoT devices that should keep sensitive information private, Side-channel Analysis (SCA) attacks on embedded devices are gaining visibility in the industrial field. The integration and validation of countermeasures against SCA can be an expensive and cumbersome process, especially for the less experienced ones. Additionally, current certification procedures require to attack the devices under test using multiple SCA techniques and attack vectors, often implying a high degree of complexity. The goal of this paper is to introduce a new automatic way to ease one of the most crucial and tedious steps of profiling attacks i.e. the points of interest (POI) selection and hence assist the SCA evaluation process. To this end, we propose the usage of Estimation of Distribution Algorithms (EDAs) in the SCA field to perform the point of interest selection step together with the profiling and key recovery steps. This contribution allows an automated optimization of the attack, avoiding the need to manually perform various types of analyses with different POI combinations. We showcase our approach on several experimental use cases, including attacks on unprotected and protected AES implementations. In addition, we introduce a new public dataset containing power traces taken from distinct copies of the same device and perform attacks over this dataset using our method, dismissing in this way the portability issue.

Verification strategies are wont to handle an extremely significant issue, the digital security. It assists with keeping away from the unlawful use or abuse of touchy information. Totally Automated Public Turing Test to Tell Computer and the Humans Apart (CAPTCHA) is the programmed security component which is utilized to decide if the client is a human or the robot. In this paper, we specialize in this various sorts of CAPTCHAs which are often simply broken due to its style purpose. We have a tendency to address this downside by presenting a replacement CAPTCHA style principle to differentiate human (robot) from human (user). The core plan is that the challenge method of the CAPTCHA ought to contain the distinctive info with a private attribute. The perception of this paper is to show our plan is based on the data imbalance between humans.

Following the recent surge in adoption of machine learning (ML), the negative impact that improper use of ML can have on users and society is now also widely recognised. To address this issue, policy makers and other stakeholders, such as the European Commission or NIST, have proposed high-level guidelines aiming to promote trustworthy ML (i.e., lawful, ethical and robust). However, these guidelines do not specify actions to be taken by those involved in building ML systems. In this paper, we argue that guidelines related to the development of trustworthy ML can be translated to operational practices, and should become part of the ML development life cycle. Towards this goal, we ran a multi-vocal literature review, and mined operational practices from white and grey literature. Moreover, we launched a global survey to measure practice adoption and the effects of these practices. In total, we identified 14 new practices, and used them to complement an existing catalogue of ML engineering practices. Initial analysis of the survey results reveals that so far, practice adoption for trustworthy ML is relatively low. In particular, practices related to assuring security of ML components have very low adoption. Other practices enjoy slightly larger adoption, such as providing explanations to users. Our extended practice catalogue can be used by ML development teams to bridge the gap between high-level guidelines and actual development of trustworthy ML systems; it is open for review and contribution, Published at WAIN'21 - 1st Workshop on AI Engineering - Software Engineering for AI

Today’s organizations are exposed to high risk because the establisheddigital technologies are vulnerable to security attacks. The increased impact ofsecurity on business demands a strategic approach to information security, commonly referred to as digital security governance. While there is a growing understanding that digital security is one of the leading risks and challenges of today’s organizations, organizations still find it difficult to implement security governance as part of their regular organizing change activities. This study focuses on providing more empirical insight into “tensions that are present during the implementation of digital security governance”.We conducted an inductive study and interviewed 42 CISOs and CIOs oflarge organizations in the Netherlands. The study reveals the tensions that hinder the implementation of digital security governance. We draw from management theories to provide a fresh understanding of and guidance for how to unravel the tensions.

The recent Pegasus Project revelations of about half a lakh people across the world, including several in India, being targeted for cyber surveillance has firmly brought the spotlight on the Pegasus spyware, which is widely understood to be the most sophisticated smartphone attack tool. The revelations also mark the first time that a malicious remote jailbreak exploit had been detected within an iPhone. Pegasus is a spyware (Trojan/Script) that can be installed remotely on devices running on Apple’s iOS & Google’s Android operating systems. It is developed and marketed by the Israeli technology firm NSO Group. NSO Group sells Pegasus to “vetted governments” for “lawful interception”, which is understood to mean combating terrorism and organized crime, as the firm claims, but suspicions exist that it is availed for other purposes. Pegasus is a modular malware that can initiate total surveillance on the targeted device, as per a report by digital security company Kaspersky. It installs the necessary modules to read the user’s messages and mail, listen to calls, send back the browser history and more, which basically means taking control of nearly all aspects of your digital life. It can even listen in to encrypted audio and text files on your device that makes all the data on your device up for grabs. Since Pegasus hacks into the operating system, every activity within the phone can be monitored when the phone is switched on. It's as if someone is monitoring your phone activity over your shoulders. Pegasus operators can remotely record audio and video from your phone, extract phone messages, use GPS for location tracking, and recover passwords and authentication keys without the user even noticing. It's only when a device is sent for forensic screening, and experts look into the transfer of data to and from the phone, is when a potential attack can be confirmed. The dooming fact of it all is that since Pegasus exploits zero-day vulnerabilities, there is nothing that can be done regarding such breaches unless operating system developers proactively ship out an update to your phone, aimed to protect you from hi-tech malware like Pegasus.

Part 18: Smart Blockchain Applications/Cybersecurity; International audience; The complete transformation of the supply chain in a truly integrated and fully automated process, presupposes the continuous and endless collection of digital information from every stage of the production scale. The aim is not only to investigate the current situation, but also the history for every stage of the chain. Given the heterogeneity of the systems involved in the supply chain and the non-institutional interoperability in terms of hardware and software, serious objections arise as to how these systems are digitally secured. An important issue is to ensure privacy and business confidentiality. This paper presents a specialized and technologically up-to-date framework for the protection of digital security, privacy and industrial-business secrecy. At its core is Federated Learning technology, which operates over Blockchain and applies advanced encryption techniques.

Multi-Party Private Set Intersection (MPSI) is an attractive topic in research since a practical MPSI protocol can be deployed in several real-world scenarios, including but not limited to finding the common list of customers among several companies or privacy-preserving analyses of data from different stakeholders. Several solutions have been proposed in the literature however, the existing solutions still suffer from performance related challenges such as long run-time and high bandwidth demand, particularly when the number of involved parties grows. In this paper, we propose a new approach based on threshold additively homomorphic encryption scheme, e.g., Paillier, which enables us to process the bit-set representation of sets under encryption. By doing so, it is feasible to securely compute the intersection of several data sets in an efficient manner. To prove our claims on performance, we compare the communication complexity of our approach with the existing solutions and show performance test results. We also show how the proposed protocol can be extended to securely compute other set operations on multi-party data sets.

Contains fulltext : 230666.pdf (Publisher’s version ) (Open Access) Side-channel attacks (SCAs) are powerful attacks based on the information obtained from the implementation of cryptographic devices. Profiling side-channel attacks has received a lot of attention in recent years due to the fact that this type of attack defines the worst-case security assumptions. The SCA community realized that the same approach is actually used in other domains in the form of supervised machine learning. Consequently, some researchers started experimenting with different machine learning techniques and evaluating their effectiveness in the SCA context. More recently, we are witnessing an increase in the use of deep learning techniques in the SCA community with strong first results in side-channel analyses, even in the presence of countermeasures. In this chapter, we consider the evolution of profiling attacks, and subsequently we discuss the impacts they have made in the data preprocessing, feature engineering, and classification phases. We also speculate on the future directions and the best-case consequences for the security of small devices.

In this paper we present PQ-WireGuard, a post-quantum variant of the handshake in the WireGuard VPN protocol (NDSS 2017). Unlike most previous work on post-quantum security for real-world protocols, this variant does not only consider post-quantum confidentiality (or forward secrecy) but also post-quantum authentication. To achieve this, we replace the Diffie-Hellman-based handshake by a more generic approach only using key-encapsulation mechanisms (KEMs). We establish security of PQ-WireGuard, adapting the security proofs for WireGuard in the symbolic model and in the standard model to our construction. We then instantiate this generic construction with concrete post-quantum secure KEMs, which we carefully select to achieve high security and speed. We demonstrate competitiveness of PQ-WireGuard presenting extensive bench-marking results comparing to widely deployed VPN solutions.

The threats in cyberspace materialize big digital security threats for any organization. New computer incidents are permanently reported, visualizing the advanced technical skills of cybercriminals and the cybersecurity professionals’ response limitations. Most expensive digital security products are based on the treatment of known threats and are vulnerable to new threats known as zero-day attacks. Likewise, the human factor continues to be one of the main weaknesses when deploying IT security strategies and policies. In this way the tests or computer penetration tests are one of the most appropriate techniques to know and establish digital security mechanisms according to each organization. Therefore, the present work analyzes international standards to carry out computer vulnerability tests and proposes a methodology of ethical hacking under the postulates of gratuity and resources availability. Suggestions on the scalability of cybersecurity strategies are presented at the end of the document, considering that each organization is different and requires adaptability in the use of the available infrastructure to manage known and unknown digital risks. IRETE’s research is based on the management that must be carried out in the creation, distribution and appropriation of knowledge, through the methodology that guides the assurance of information through the PenTESTING phases. Likewise, it proposes a process that integrally integrates the collection of information from any operating system, indicating that IRETE generates information more simply and accurately from the inspection, track, examination, testing and exfiltration phases. IRETE presents a complete methodology to approach the knowledge management of a vulnerable system, which allows an in-depth review of the factors that affect the handling of information.

The main purpose of this article is to analyze the system of international legal regulators that ensure digital security. The author draws attention to the complexity of interpreting the content of the concept of "digitalization" and substantiates the impossibility of constructing a generally accepted definition. The paper identifies the features of digitalization risks. The analysis of the main international legal acts ensuring digital security has been carried out.

In the field of side-channel analysis, profiled attacks are one of the most powerful types of attacks. Nevertheless, major issues with profiled attacks are in sensitivity to noise and the high-dimensional nature of the signals used for training, generating a less efficient classifier to conduct the attack phase. Consequently, evaluating the security of cryptographic implementation in hardware devices like IoT becomes more complex as side-channel analysis evaluation easily falls into false-positive results. This paper assesses the efficacy of applying a feature reduction process to deal with high-dimensional signals. We propose a practical procedure to conduct feature reduction using autoencoders for profiled side-channel leakage evaluations. Two autoencoder architectures are compared while performing feature reduction showing that our proposed architecture keeps most of the relevant information. Our proposal is tested on the ASCAD random key database with a high desynchronization value and produced results that outperform other state-of-the-art techniques. The guessing entropy value converges to 1 after around 500 leakage traces.

Deep learning is an artificial activity of perception which resembles the work of the human intellect in the handling of data and the development of designs to be used in the making of conclusions. This paper discusses developing a deep learning model that can detect Web attack in the system to increase accuracy of attack detection. The goal is to make a system totally secure from any assault by utilizing the deep learning model for digital security, by utilizing deep learning model with the dataset an assault can be distinguished and can be made completely secured. By proposing deep learning model and assessing those with the dataset for performing attack acknowledgment has given accuracy of 99.10%. It is fundamental to make a proficient intrusion identification structure that utilizes a profound learning mechanism to conquer assault issues in the framework. This convolution neural network is utilized with different convolution layers, and an accuracy is expanded.

Due to the COVID-19 epidemic, face-to-face team working has changed into distanced work from home. Modern, decentralized digital communication environments are changing with the availability of new technologies and the development of new real-world applications, which lead to novel challenges in security and privacy protection. 5G/6G mobile applications, the smart Internet of Things (IoT) devices, big data applications, and cloud systems are developing to better meet new requirements. Mobile–cloud architecture is emerging as 5G /6G mobile IoT devices are generating large volumes of data which need cloud infrastructure to process. Many IoT systems and cloud systems are decentralized, and new security and privacy protection solutions are emerging in decentralized networks. The increasing interdependence of IT solutions accepted by society has led to a sharp increase in data. As a result, the chances of data leakage or privacy infringement also increase, along with the need for new solutions for digital security and privacy protection.

Machine learning and the Internet of Things have gotten advancements in the everyday lives of a client, the eagerness and receptiveness of shoppers have fueled the producers to dole out new gadgets with more highlights and better style. While trying to stay aware of the challenge, the producers are not giving enough consideration to the digital security of these savvy gadgets. The gravity of security vulnerabilities is additionally bothered because of their associated nature. Subsequently, an undermined device would quit giving the planned help, yet could likewise go about as a host for malware presented by an assailant. Electrocardiogram information must appropriately be preprocessing. This chapter gives support to the research and relationship of the Internet of Things and machine learning for the smart impacts of three variables, including recurrence groups, spatial channels, and classifiers arrangement execution, to decide the best settings.

The advent of machine learning techniques and image processing techniques has led to new research opportunities in this area. Machine learning has enabled automatic extraction and analysis of information from images. The convergence of machine learning with image processing is useful in a variety of security applications. Image processing plays a significant role in physical as well as digital security. Physical security applications include homeland security, surveillance applications, identity authentication, and so on. Digital security implies protecting digital data. Techniques like digital watermarking, network security, and steganography enable digital security.

Two-dimensional code is widely used in daily life, and security issues are increasingly prominent. In order to improve the security and use of two-dimensional code information, the anti-counterfeiting technology based on encrypted two-dimensional code is studied. At first, this article discusses the security problems faced by two-dimensional code in the application process, and analyzes digital security technology, and compares the performance of different encryption algorithms. This algorithm not only effectively enhances the security of the system and reduces the chances of key information theft and tampering, but also ensures the generation and recognition speed of two-dimensional codes.

Выдвинута гипотеза, что с ростом цифровой грамотности снижается успешность кибератак. Исследовательская команда изучила мировой научнотеоретический опыт в области фишинговых атак. Для подтверждения идеи авторы провели опрос казахстанских интернет-пользователей, а также глубинные интервью с международными и отечественными экспертами в области цифровых технологий, психологии и права.

Outlier detection has been a generally examined issue and highly used in a varied range of spaces. For example, transaction fraud, certain rise and fall in share market, sudden changes in weather, interruption detection for digital security, and fraud detection in security design patterns in data. Data mining is the rule of dealing with big amounts of data and choosing the important. Outlier detection is data mining procedures that identify uncommon occasions and special cases. This paper discusses fundamental concepts of outlier detection, the outlier types and the challenges in their detection. An in-depth presentation of outlier detection techniques is given which are divided into three major categories: supervised, semi supervised, and unsupervised. Special attention is given to unsupervised outlier detection. The existing algorithms and techniques in this category are elaborated in detail and the advantages and shortcomings of these techniques are summarized. The analyses of the existing algorithms for outlier detection show that no one of them completely satisfies all the requirements for scalability, work on high dimensional datasets with satisfactory time complexity and efficient memory usage especially when applied on streaming data. This is why the study suggests that there is a need of a hybrid approach that combines classical algorithms and artificial intelligence algorithm to provide efficient solution for outlier detection of streaming data with good key performance indicators.