Search

The article explores the cybersecurity practices of businesses and the necessity of a federal government cyber insurance program in the U.S. Topics discussed include the liability that companies may face for failing to implement effective cybersecurity solutions under a negligence theory, the challenges in establishing professional cybersecurity standards, and the financial and economic risks associated with cyberattacks.

The article describes the case of the creation of an enterprise security operations center (SOC) and risk management function at a U.S.-based fast-food franchise. It mentions the focus of the security program on risk reduction. It explains the challenges encountered by the security operations team due to the fact that it is responsible for corporate security but not the information technology of franchises. Also noted is the use of business impact analysis by the team to formalize the program.

In this paper, a novel one-time password authentication scheme based on the negative database ( NDB ) is proposed. The authentication data, which involve a user password and random number, are converted to an NDB before they are transmitted to the network. Recovering the original database ( DB ) from an NDB is an NP -hard problem. Even if the data transmitted in the network have been intercepted by an attacker, the attacker cannot recover the password due to the hardness of reversing the NDB . The proposed scheme is the first one-time password authentication scheme based on the NDB . Following the method used in this paper, the NDB can be added to other authentication schemes as an extra layer to further improve security. The proposed scheme can be adopted into other applications such as business management, network-based consumer electronics, and intelligent household systems. [ABSTRACT FROM AUTHOR]

With the pervasive use of wireless sensor networks (WSNs) within commercial environments, business privacy leakage due to the exposure of sensitive information transmitted in a WSN has become a major issue for enterprises. We examine business privacy protection in the application of WSNs. We propose a business privacy-protection system (BPS) that is modeled as a hierarchical profile in order to filter sensitive information with respect to enterprise-specified privacy requirements. The BPS aims at solving a tradeoff between metrics that are defined to estimate the utility of information and the business privacy risk. We design profile, risk assessment, and filtration agents to implement the BPS based on multiagent technology. The effectiveness of our proposed BPS is validated by experiments. [ABSTRACT FROM AUTHOR]

The article focuses on the data privacy laws for the business's objectives. Topics discussed include data privacy laws in India and Brazil for the prevention of data breaching, regulations proposed in each country since the U.S. National Security Agency (NSA) revelations and effects of the laws on individuals and businesses. It also mentions a solution to the disjoined Internet privacy laws on an international scale.

How do organizations make strategic choices concerning information privacy and security practices? Focusing onorganizational privacy strategy,this study describes patterns in response to information privacy threats, firms’ organizational strategy, and responses to institutional pressures. Two theoretical views are converged: Oliver’s (1991) strategic responses framework to institutional processes and Miles and Snow’s (1978) typology of organizational strategy, structure, and processes. Drawing on a healthcare industry study, variations, predictions, and illustrations of four quadrants ofconformist, entrepreneur, transformer,anddefenderprivacy strategies are provided. This work’s major contribution is the analysis and conceptualization of organizational privacy strategies, providing an umbrella-like theoretical perspective. Practical implications extend beyond the illustrative setting of the healthcare industry. [ABSTRACT FROM PUBLISHER]

Copyright of HMD: Praxis der Wirtschaftsinformatik is the property of Springer Nature and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Author-supplied Abstracts.)

The article discusses a survey on global information security titled '"Get Ahead of Cybercrime" in which companies belonging to various sectors participated. Topics discussed include management of cyber-security threats by business enterprises, a survey based on internal information security threat and external information security threat, and methods to achieve cyber-security.

Cloud computing is rapidly emerging as an attractive IT option for businesses. As a concept cloud computing is well received because of the benefits it offers but many users are not clear about the scope of security in cloud computing. Many surveys point out that security in the cloud remains the top concern for many businesses in their decision making consideration in spite of the cost advantages it offers. In order to identify the security concerns we analyzed over 50 research articles and industry white papers published over the past five years. In this paper we focus on the question "Is security realistic in cloud computing?" In presenting the justification that it is possible to expect adequate security features in the cloud we address several related issues. In this context we first briefly describe the three types of cloud services -- SaaS, PaaS and IaaS. Then we focus on the security aspects that businesses must pay attention to in order to succeed. Next, we consider the importance of trust in the service providers and how they could build customer trust in their services. This discussion leads to service reliability in the cloud and what the cloud providers have learned from cloud outages in order to build trust. Also, we highlight how the security features offered in the cloud support compliance requirements. We conclude the paper with some relevant information on the legal aspects related to cloud computing. [ABSTRACT FROM AUTHOR]

Performative hactivism is the use of the Internet for expressing extreme political dissent online. It differs from cyber harassment in that performative hactivism is politically motivated. We found that there are contagion and other social effects among hactivists and that hactivism exhibits feature patterns that define them as subcultures. To conduct our research, we created a provocative Website and blog and then promoted it on the Internet. Using sentiment analyses and logistic regression, we identified features associated with performative hactivism. We then studied the blog remarks and used Website analytics to gain a better understanding of the implications for business security. The results from this work should help business and information security researchers (especially in social engineering), as well as business practice managers, strategists, and security analysts, to predict the lifecycles and impacts of hactivism on their operations and assist them in the creation of interventions. [ABSTRACT FROM AUTHOR]

Honeypots, which are traps designed to resemble easy-to- compromise computer systems, have become essential tools for security professionals and researchers because of their significant contribution in disclosing the underworld of cybercrimes. However, recent years have witnessed the development of several anti-honeypot technologies. Botmasters can exploit the fact that honeypots should not participate in illegal actions by commanding the compromised machine to act maliciously against specific targets which are used as sensors to measure the execution of these commands. A machine that is not allowing the execution of such attacks is more likely to be a honeypot. Consequently, honeypot operators need to choose the optimal response that balances between being disclosed and being liable for participating in illicit actions. In this paper, we consider the optimal response strategy for honeypot operators. In particular, we model the interaction between botmasters and honeypots by a Markov Decision Process (MDP) and then determine the optimal policy for honeypots responding to the commands of botmasters. The model is then extended using a Partially Observable Markov Decision Process (POMDP) which allows operators of honeypots to model the uncertainty of the honeypot state as determined by botmasters. The analysis of our model confirms that exploiting the legal liability of honeypots allows botmasters to have the upper hand in their conflict with honeypots. Despite this deficiency in current honeypot designs, our model can help operators of honeypots determine the optimal strategy for responding to botmasters’ commands. We also provide simulation results that show the honeypots’ optimal response strategies and their expected rewards under different attack scenarios. [ABSTRACT FROM AUTHOR]

White-collar crime (WCC) has reached epidemic proportions worldwide. Unfortunately, the growth of WCC has been facilitated by information technology (IT) advances that have made it easier to commit WCC by using the computer. The authors of this article present a checklist of measures for management to help prevent and detect IT-related WCC. © 2012 Wiley Periodicals, Inc. [ABSTRACT FROM AUTHOR]

Critical infrastructure means many things to many people. Adrian Davis, principal research analyst with the Information Security Forum (ISF), explains why determining which infrastructure elements are critical to a business is the first step in keeping them safe [ABSTRACT FROM AUTHOR]

Abstract: With the wide spread use of e-transactions in enterprises, information security risk management (ISRM) is becoming essential for establishing a safe environment for their activities. This paper is concerned with presenting a comprehensive ISRM framework that enables the effective establishment of the target safe environment. The framework has two structural dimensions; and two procedural dimensions. The structural dimensions include: ISRM “scope” and ISRM “assessment criteria”, while the procedural dimensions include: ISRM “process” and ISRM “assessment tools”. The framework uses the comprehensive STOPE (strategy, technology, organization, people, and environment) view for the ISRM scope; while its assessment criteria is considered to be open to various standards. For the procedural dimensions, the framework uses the widely known six-sigma DMAIC (define, measure, analyze, improve, and control) cycle for the ISRM process; and it considers the use of various assessment tools. It is hoped that the framework would be widely used in the future as an open reference for ISRM. [Copyright &y& Elsevier]

Abstract: In these years, the company budgets are raised dramatically for eliminating the security problems or mitigating the security risks in companies, but the numbers of incidents happening on computer systems in intranet or internet are still increasing. Many researchers proposed the way–to isolate the computers storing sensitive information for preventing information on these computers revealed or vulnerability on these computers exploited. However, there are few materials available for implementing network isolation. In this paper, we define ways of network isolation, “physical isolation” and “logical isolation”. In ISO-17799, there is no implementation guidance for practicing network logical isolation but auditing network physical isolation. This paper also provides the implementation guidance of network isolation in two aspects. One is for the technique viewpoints. The other aspect is for management viewpoints. These proposed implementation outlines and security measures will be considered in revising the security plan, “The Implementation Plan for Information Security Level in Government Departments” [“The implementation plan for information security level in government departments,” National Information and Communication Security Taskforce, Taiwan R.O.C., Programs, Jul. 20 2005]. [Copyright &y& Elsevier]

The article discusses the cyberdefense mechanism used to secure the electronic data and computerized information systems in cyberspace of business enterprises. It mentions the major elements of cyberdefense that constitutes like a fortress such as an observation tower, fortified walls, and gates which respectively monitors any incoming threats, guide the servers, and manipulates the access protected by fortified walls. Moreover, it mentions several actions to be taken in assuring the development of a comprehensive security program which include vulnerability management, business continuity planning (BPC), and security awareness training.

Abstract: In today’s dynamic and distributed markets a large spectrum of services is delivered through information and communication technologies. Emerging markets of e-services lie at the intersection of non-traditional user behaviour, and cyber-partnerships of enterprises to deliver innovative services. Current approaches to manage and control security demonstrate lacks in terms of security policy matching and integration in heterogeneous e-service environments. In this paper, we introduce a framework to support role-based access control for distributed services focusing on the integration of customer preferences. The framework aims to collect and generate policy-based security measures in cross-organisational scenarios. In addition to catering to specifications of security and business policies, the ability to integrate contextual information and user preferences make the role-based framework flexible and express a variety of access policies that provide a just-in-time permission activation. [Copyright &y& Elsevier]

Green IT has gone mainstream. The last year has seen corporations such as Citigroup establishing their environmental credentials by opening green data centres. But how do the separate disciplines of green IT and security come together? Robin Arnfield reports [Copyright &y& Elsevier]

Security and related contingency recovery plans ensure a business' survival when it is faced with potential information systems breakdowns. Its primary objective is to prevent a calamity from occurring and to limit the impact of destructive events related to computer- based information systems. Most disaster recovery plans, when put into effect, fail to serve the intended purpose. The value of a properly implemented security is to prevent external intrusions before they start, and have an internal recovery plan to restore service so that assets are not adversely affected. This paper provides some insight regarding security as well as identifying some of the pitfalls or weakness in this part of an organization's communication network. Emerging technologies such as the use of biometrics, authentications, steganography, and data encryption used for security will be the focus of the paper. [ABSTRACT FROM PUBLISHER]

States that businesses must consider computer security when extending their office computer network environment to employees' homes. Assumptions and limitations of secure identity-based loading (SIBL); Techniques in securing the integrity of firmware; Information on Smart-card integration; Goals on integrating a workstation into a particular network environment; Other applications of SIBL.