Search

Modern organizations have migrated from localized physical offices to work-from-home environments. This surge in remote work culture has exponentially increased the demand for and usage of Virtual Private Networks (VPNs), which permit remote employees to access corporate offices effectively. However, the technology raises concerns, including security threats, latency, throughput, and scalability, among others. These newer-generation threats are more complex and frequent, which makes the legacy approach to security ineffective. This research paper gives an overview of contemporary technologies used across enterprises, including the VPNs, Zero Trust Network Access (ZTNA), proxy servers, Secure Shell (SSH) tunnels, the software-defined wide area network (SD-WAN), and Secure Access Service Edge (SASE). This paper also presents a comprehensive cybersecurity framework named Zero Trust VPN (ZT-VPN), which is a VPN solution based on Zero Trust principles. The proposed framework aims to enhance IT security and privacy for modern enterprises in remote work environments and address concerns of latency, throughput, scalability, and security. Finally, this paper demonstrates the effectiveness of the proposed framework in various enterprise scenarios, highlighting its ability to prevent data leaks, manage access permissions, and provide seamless security transitions. The findings underscore the importance of adopting ZT-VPN to fortify cybersecurity frameworks, offering an effective protection tool against contemporary cyber threats. This research serves as a valuable reference for organizations aiming to enhance their security posture in an increasingly hostile threat landscape. [ABSTRACT FROM AUTHOR]

The article studies some aspects of specialized polygraph device application in the process of personnel recruitment in corporate structures. The authors cite the sociological surveys results that reflect the attitude of employers and employees towards polygraph checks at the stage of their employment. The methods and spheres of polygraph application for professional-psychological selection have been analyzed. The special psychophysiological research procedure with the use of the polygraph has been described, including recommendations on the questions formulation to obtain reliable results. The legislation of the Russian Federation regulating the conduct of such research has also been considered. The authors concluded that the use of the polygraph device is a relevant and promising tool, which is increasingly used in the personnel recruitment in corporate structures, as evidenced by the sociological surveys results. However, the research peculiarity on the polygraph tests prospects in personnel recruitment is currently complicated by the lack of open data from the companies themselves, since such data constitute commercial secrets and are not subject to public disclosure in accordance with the Federal Law “On Trade Secrets”.

Purpose. To analyse the methodological approaches to enterprise security management with the allocation of traditional ones and those transformed to modern uncertain conditions of functioning. Methodology. The methodological basis of the study was the scientific works by domestic and foreign scholars to identify the main theoretical provisions on approaches to security management, which were further analysed for their essence and feasibility of use in specific conditions of enterprise functioning. By combining the methods of analysis, synthesis, morphological analysis, and generalisations, the authors have managed to identify traditional approaches to enterprise management and those transformed to modern conditions which are inter-integrated and complementary. Findings. A map of the integration of traditional methodological approaches of enterprise security management and those transformed to modern conditions was formed and proposed, which can be used by enterprises to find effective approaches to security management depending on the object to which the management vector is immediately directed. Originality. The authors analyse a number of approaches to enterprise security management, starting with traditional approaches and moving towards their change depending on the conditions and environment of enterprise functioning. The authors trace the layering of several approaches on the traditional ones simultaneously, which is explained by the complication of the conditions of functioning of enterprises. The importance of finding approaches to management depending on the conditions of functioning of the enterprise and the security object to which security management is focused is emphasised. Practical value. The analysis and the results obtained are of practical value in terms of the feasibility of application at enterprises regardless of their industry, in addition to the effectiveness of the proposed map of approaches, which is variably integrated, taking into account the conditions and the object of management. This will allow one to broadly cover security issues and methodically solve them using a specifically selected approach. [ABSTRACT FROM AUTHOR]

The article is devoted to the issue of security, which is currently in sight as the most demanded and necessary need for the functioning of economic entities, the population, and the world. The etymology of the concepts of «risk» and «threat» is analyzed, arguments on the need for a clear distinction between these categories are provided. It is noted that risk is the probability of occurrence of an event and does not always lead to negative consequences. The threat is the result of the realization of the risk, the degree of its impact on the results of activities is significant, and sometimes destructive, which can lead to significant losses on the part of the enterprise. Definitions of the concepts of security and danger, which correlate and are a reflection of each other, are provided. It is emphasized that security and danger are opposite in their meanings, since security consists in the absence of danger, in addition, the enterprise is secure when it is really protected from dangers. It is found that both concepts are states, while security is characterized by development, and danger is characterized by decline and stagnation. It is proposed to consider security and danger in the formed plane to eliminate the confusion of the concepts of risks and threats. The areas of display of the state of security (danger) under the influence of risks and threats are allocated, their graphical representation is provided. The reflection of the difference between the impact of risks and threats, their action in the form of the results of changes in the signs of security with the formation of prerequisites for danger is presented. It is proposed to consider the features of enterprise through the following results of activity: ability to develop, competitiveness, sustainability, solvency, profitability and profitability, interests of stakeholders. The plane of security along the vector of movement of risks and threats depending on the strength of their action is outlined. In this way, the state of security varies, starting from the traditional absolutely sustainable; followed by sustainable and conditionally sustainable – up to the states that will be destructive. The key features of the security status are defined by reflecting the difference in the impact of risks and threats. The importance of the obtained results of the study, in particular the differentiation of risks and threats, for the formation of the security plane of the enterprise and the choice of effective approaches to security management depending on the location of the enterprise in a specific plane is proved.

Quantum computing is emerging as a significant threat to information protected by widely used cryptographic systems. Cryptographic methods, once deemed secure for decades, are now at risk of being compromised, posing a massive threat to the security of sensitive data and communications across enterprises worldwide. As a result, there is an urgent need to migrate to quantum-resistant cryptographic systems. This is no simple task. Migrating to a quantum-safe state is a complex process, and many organisations lack the in-house expertise to navigate this transition without guidance. In this paper, we present a comprehensive framework designed to assist enterprises with this migration. Our framework outlines essential steps involved in the cryptographic migration process, and leverages existing organisational inventories. The framework facilitates the efficient identification of cryptographic assets and can be integrated with other enterprise frameworks smoothly. To underscore its practicality and effectiveness, we have incorporated case studies that utilise graph-theoretic techniques to pinpoint and assess cryptographic dependencies. This is useful in prioritising crypto-systems for replacement.

Modern organizations have migrated from localized physical offices to work-from-home environments. This surge in remote work culture has exponentially increased the demand for and usage of Virtual Private Networks (VPNs), which permit remote employees to access corporate offices effectively. However, the technology raises concerns, including security threats, latency, throughput, and scalability, among others. These newer-generation threats are more complex and frequent, which makes the legacy approach to security ineffective. This research paper gives an overview of contemporary technologies used across enterprises, including the VPNs, Zero Trust Network Access (ZTNA), proxy servers, Secure Shell (SSH) tunnels, the software-defined wide area network (SD-WAN), and Secure Access Service Edge (SASE). This paper also presents a comprehensive cybersecurity framework named Zero Trust VPN (ZT-VPN), which is a VPN solution based on Zero Trust principles. The proposed framework aims to enhance IT security and privacy for modern enterprises in remote work environments and address concerns of latency, throughput, scalability, and security. Finally, this paper demonstrates the effectiveness of the proposed framework in various enterprise scenarios, highlighting its ability to prevent data leaks, manage access permissions, and provide seamless security transitions. The findings underscore the importance of adopting ZT-VPN to fortify cybersecurity frameworks, offering an effective protection tool against contemporary cyber threats. This research serves as a valuable reference for organizations aiming to enhance their security posture in an increasingly hostile threat landscape.

Wider use of cloud services leads to increased cyber attacks on data arrays in cloud storage. Ensuring privacy in the cloud comes at a cost, and businesses are willing to bear these costs for data security. However, there is still a high risk of data being tracked and stolen due to existing vulnerabilities in the Internet environment. The purpose of the article is to analyze threats to data in the cloud environment under conditions of uncertainty and to reveal their increase in the virtual IT infrastructure of the enterprise. The advantages and disadvantages of enterprises using cloud services for data storage were revealed. Considering the amount of financial losses and reputational risks, the issue of protecting networks and services in the cloud, especially when hosting confidential or secret information, is a priority for enterprises of all industries. According to Significant Cyber Incidents, cyber incidents against government, defence and high-tech companies in the world were analyzed during 2021-2022. It was found that the attacks were primarily aimed at critical infrastructure enterprises and government organizations. Analysis of data from the Future Risk Report 2022 shows that climate change, geopolitical tensions, cyber security risks, and energy risks will remain the most significant risks over the next decade. It was revealed that since the beginning of the full-scale invasion, the number of attacks on Ukrainian enterprises of critical infrastructure and the telecommunications sphere has increased significantly. This shows that hacker attacks are one of the tools of hybrid warfare, capable of causing significant damage to the country's economy. The revealed trend in Ukraine confirms the predictions of international experts that cyber threats will grow in conditions of uncertainty and geopolitical instability. The article provides a chronology of massive cyberattacks on Ukrainian enterprises and organizations in the IT sphere over the past two years. It was determined that the means of reducing risks in the field of cyber security, which lead to the saving of costs of enterprises for data security, are the tools of artificial intelligence of security and further automation of threat identification. Thus, cyber security becomes an integral component in ensuring the full functioning of the enterprise, and the ways and means of its achievement require further research.

Wider use of cloud services leads to increased cyber attacks on data arrays in cloud storage. Ensuring privacy in the cloud comes at a cost, and businesses are willing to bear these costs for data security. However, there is still a high risk of data being tracked and stolen due to existing vulnerabilities in the Internet environment. The purpose of the article is to analyze threats to data in the cloud environment under conditions of uncertainty and to reveal their increase in the virtual IT infrastructure of the enterprise. The advantages and disadvantages of enterprises using cloud services for data storage were revealed. Considering the amount of financial losses and reputational risks, the issue of protecting networks and services in the cloud, especially when hosting confidential or secret information, is a priority for enterprises of all industries. According to Significant Cyber Incidents, cyber incidents against government, defence and high-tech companies in the world were analyzed during 2021-2022. It was found that the attacks were primarily aimed at critical infrastructure enterprises and government organizations. Analysis of data from the Future Risk Report 2022 shows that climate change, geopolitical tensions, cyber security risks, and energy risks will remain the most significant risks over the next decade. It was revealed that since the beginning of the full-scale invasion, the number of attacks on Ukrainian enterprises of critical infrastructure and the telecommunications sphere has increased significantly. This shows that hacker attacks are one of the tools of hybrid warfare, capable of causing significant damage to the country's economy. The revealed trend in Ukraine confirms the predictions of international experts that cyber threats will grow in conditions of uncertainty and geopolitical instability. The article provides a chronology of massive cyberattacks on Ukrainian enterprises and organizations in the IT sphere over the past two years. It was determined that the means of reducing risks in the field of cyber security, which lead to the saving of costs of enterprises for data security, are the tools of artificial intelligence of security and further automation of threat identification. Thus, cyber security becomes an integral component in ensuring the full functioning of the enterprise, and the ways and means of its achievement require further research. [ABSTRACT FROM AUTHOR]

Copyright of Scientific Bulletin of National Mining University is the property of National Mining University, State Higher Educational Institution and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Relevance of the research topic. Modern requirements for enterprises include compliance with environmental norms and standards to ensure not only the safety of people's lives and health but also the preservation of the natural environment. Such an approach is a necessary condition for the development of sustainable business and ensuring economic stability of enterprises in the long term. Problem statement. Environmental safety management of enterprises is one of the most pressing and complex problems faced by business structures today. On the one hand, companies are interested in maximizing sales of their goods and services, while on the other hand, they must comply with the requirements of state legislation and international recommendations in the field of environmental protection. Analysis of recent research and publications. The works of such Ukrainian scientists as O.I. Basarab, Ye.S. Belash, I.V. Breslavska, V.I. Danylevsky, H.M. Drozd, O.O. Drozdova, M.I. Zhurba, I.P. Kalinina, and others are devoted to the study of theoretical, methodological, and practical aspects of environmental safety management of enterprises. Highlighting previously unresolved parts of a common issue. Despite the abundance of scientific studies on the management of environmental safety in enterprises, the question of its role and position within the broader system of national security of the state remains a topic of ongoing discussion. The aim of the article is to develop a theoretical and definitive exposition of the categorical apparatus for managing the environmental safety of enterprises. The main objectives of the study are: to investigate existing approaches to interpreting the essence of the concept of «environmental safety management of enterprises» and to develop, based on their analysis, a theoretical and definitive exposition of the categorical apparatus for managing the environmental safety of enterprises, taking into account modern trends and challenges of sustainable development. Research methods. The article utilized a historical approach, a systems approach, methods of analysis and synthesis, deduction, logical method, and generalization as the basis of the research. Results of the research. The following approaches to interpreting the essence of the concept of «environmental safety management of enterprises» were identified: social, complex, sectoral, legal, regional, natural resource, risk-oriented, process-oriented, and results-oriented approaches. Each of these approaches has its own characteristics and is used depending on the needs of the enterprise and the specific situation. A theoretical and definitive exposition of the categorical apparatus for managing the environmental safety of enterprises was developed. Field of application of the results. The research findings can be used to improve theoretical approaches and develop effective strategies for managing the environmental safety of enterprises. Conclusions. Thus, the environmental safety of an enterprise is an integral part of national security. The theoretical and definitive exposition of the categorical apparatus for managing the environmental safety of an enterprise is presented as follows: Safety is a comprehensive state of absence of threats and risks that can cause harm to people, the environment, and property, which is ensured not only by reactive responses to potential threats but also by a proactive approach to ensuring safety through preventive measures and reducing the potential consequences of potential threats. Environmental safety of an enterprise is a complex state in which the activities of the enterprise do not violate the self-regulation ability of natural ecosystems, ensure the preservation of biodiversity and climate, avoid the creation of new environmental risks, reduce the negative impact of anthropogenic factors on the environment, and ensure the safety and health of the population. Management of the environmental safety of an enterprise is a system of strategic planning, coordination, and implementation of measures to minimize the negative impact of the enterprise on the environment, ensure compliance with environmental legislation and standards, reduce environmental risks, and promote the principles of sustainable development.

The main purpose of the article is to study the key aspects of digital personnel management of socio-economic systems in terms of security and safety. The object of the study will be enterprises providing engineering services to ensure safety and security. According to the results of the study, the main scientific and theoretical novelty was the formation of a model for the implementation of digital personnel management in terms of ensuring security and safety for an enterprise providing engineering services. The study has limitations and they consist in considering only enterprises providing engineering services, which are a specific type of activity. Further research should be devoted to the study of personnel security against the background of the formation of new principles of digital human resource management. The focus of the study is to focus on the features of digital personnel management and how it can be improved within the framework of security and safety as part of the active development of Industry 4.0. For practitioners and scientists, the consequences of the results of the study may have some beneficial effect on the way the proposed model and its components work. [ABSTRACT FROM AUTHOR]

With the advent of the Fourth Industrial Revolution, the paradigm of finance is also changing. As remote work becomes more active due to cloud computing and coronavirus, the work environment changes and attack techniques are becoming intelligent and advanced, companies should accept new security models to further strengthen their current security systems. Zero trust security increases security by monitoring all networks and allowing strict authentication and minimal access rights for access requesters with the core concept of doubting and not trusting everything. In addition, the use of NAC and EDR for identification subjects and data to strengthen access control of the zero trust-based security system, and strict identity authentication through MFA will be explained. Therefore, this paper introduces a zero-trust security solution that strengthens existing security systems and presents the direction and validity to be introduced in the financial sector. [ABSTRACT FROM AUTHOR]

The aim of the article is to justify the theoretical and methodological basis of management of enterprise development security. The article determines that, under modern conditions, the complexity of the functioning of all levels of the national economy, including industrial enterprises, requires revolutionary changes in their management system if an enterprise is considered as a complex multi-structural system. The crisis signs observed over the past ten years can have both negative and positive impact on the transformation in activities of individual enterprises, lead to both development and degradation of an enterprise. Therefore, the theoretical and methodological basis of management of enterprise development security is proposed. The fundamental components of the theoretical and methodological basis of management of enterprise development security include: management goal, objectives, management principles, approaches, management methods and tools, which, in turn, is the basis for the formation of a convergent integrated mechanism for managing development security with a synergistic effect. In particular, the choice of a mechanism for managing enterprise development security is based on appropriate approaches. Along with the existing general scientific theoretical approaches to forming an effective enterprise management system, there proposed approaches to creating a system for managing enterprise development security, namely: aspectual, situational, systems, process, synergistic and systems-synergistic ones. The convergent integrated mechanism with a synergistic effect is based on the process of convergence of all methodological bases of security and development of an enterprise with obtaining a synergetic effect on its individual components.

This paper explains why Active Directory is becoming the core of enterprise security, and how identity management moving from on-premises Active Directory to Azure Active Directory is encouraging IT professionals to redesign their IT infrastructure. This paper is partly based on online research that is drawn from Attosol Technologies and Cyware Social resources. A case study was also conducted to further understand key concepts related to enterprise security. [ABSTRACT FROM AUTHOR]

The article is aimed at forming a system of key indicators of activity in evaluating the optimal level of security of industrial enterprise through the balance of statics and dynamics. It is defined that in order to obtain the optimal level of security of the industrial enterprise development, it is necessary to achieve a balance of the factors wth both static and dynamic nature of action. Moreover, the dynamic status provides two possibilities: to cover statics and characterize the transformation of the totality of all economic systems, which are not static, for a certain time. In the course of the research, considering the experience of scholars on the general economic theory, the choice of static indicators within the activities of a separate industrial enterprise is substantiated, which can include the following: value of non-current assets, including average fixed assets value and depreciation; number of production staff with a fixed salary level; constant part of the cost of sold products; amount and value of equity capital. As a result of production, investment, innovation, financial and management activities, static indicators, which are basic, are transforming into indicators of dynamics that characterize the enterprise’s activities over a certain time along with change of the positive or negative nature of its development. The level of security of industrial enterprise can be evaluated by an integral indicator, which takes into account the specific characteristics of the enterprise and the limitedness of the resources available.

The article is based on the system approach and the analysis of ensuring economic security as well as on the developed conceptual techniques devoted to the security of regional enterprises. We consider the issues of the interaction of subsystems of the general system of national security in regions. The purpose of the study is to develop a comprehensive methodology for the assessment of the national security in regions including all main directions: economy, ecology, information, etc. Currently, the need for a theory of security of regional enterprises has, first of all, an applied nature. At the same time, without basic fundamental knowledge of the theory of comprehensive security, it is impossible to provide sustainable development of regional enterprises. We conduct a comprehensive research of all types of security on the basis of the system approach and the analysis. Furthermore, we move from task-specific study to the system research of the examined objects and systems. It has allowed analysing the internal interrelations of subsystems including the subsystems of economic security in the framework of the general system of national security. We propose the method, which substantiates the quality of enterprise security using the fuzzy set method and fuzzy multi-criteria method in relation to the paper’s topic. Moreover, we apply the Bellman and Zadeh’s principle allowing to choose an option, which satisfies all criteria in the maximum degree. The developed approach to the formation of a comprehensive assessment of all types of security will allow providing sufficient explanations to the influence and interaction of subsystems within the national security’s general system as well as will significantly increase the economic stability of regional enterprises and organizations.

With the dawn of computing era in the enterprise business, the methodologies for business have changed significantly. The enterprise information in the form of multimedia data is now being created and extensively shared over the internet. On the other side, the rapid and continuous growth of enterprises is causing the computing systems to evolve rapidly and continuously to match the pace of growth. This has led to the evolution of new technologies related to the enterprise environment. The advent of Internet of Things (IoT) and Cloud Computing in the enterprise environment is the result of its rapid and continuous requirement. But, their use has increased the complexity of enterprise computing systems especially in the domain of Enterprises Multimedia Security (EMS). In Cloud-IoT environment, the Enterprise Multimedia Data (EMD) stored at remote Cloud premises and subject to various kinds of vulnerabilities like data leakage, data modification and confidentiality breach. Hence, this paper proposes a distinctive EMS approach using Fog and Cloud to store different types of data and maintains their co-relation to prevent various EMD security breaches. In this paper, a Mobile Fog based Cloud-IoT framework for EMS has been designed in which only encrypted data is stored at the Cloud and its keys are securely stored at the enterprise premises on the Fog layer. It uses Advanced Encryption Standard (AES) for encryption, Message Authentication Code (MAC) for data integrity, Secure Socket Layer (SSL) for safe data transmission, tokenizer, hashing and data pointers for easy data search on Fog and Cloud. It stores the encryption/decryption and MAC keys encrypted with Master Encryption Key (MEK) securely at the enterprise premises on the Fog layer. For assured security of keys, the framework doesn't store MEK at any place on the network. The experimental result analyses acknowledge the highest level of security, better scalability and storage management as well as searching time efficiency in the proposed framework. The overall results analysis show that the proposed framework is highly secure to protect the multimedia data of an enterprise from the inside and outside threats and access of data is provided to the authorized enterprise users. [ABSTRACT FROM AUTHOR]

The focus of this study is to find out repeatable features for large-scale enterprise web application production process related to based on OWASP security requirement list. As a result of a rigorous work including domain analysis for Java language and development frameworks and the examination of a large set of technical documents, 230 security qualitative metrics are discovered, under six categories. These security qualitative metrics are beneficial for security analysts as well as other parties such as designers, developers, and testers. The findings provide a developer/designer point of view and would help to make better decisions related to the environment set up, technology selection, and the architecture, design, and implementation details. As a result of this effort, the overall vulnerability level of the web applications would diminish significantly. [ABSTRACT FROM AUTHOR]

Copyright of Problems of Economy is the property of Research Centre for Industrial Developmen Problems of Nas and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

The focus of this study is to find out repeatable features for large-scale enterprise web application production process related to based on OWASP security requirement list. As a result of a rigorous work including domain analysis for Java language and development frameworks and the examination of a large set of technical documents, 230 security qualitative metrics are discovered, under six categories. These security qualitative metrics are beneficial for security analysts as well as other parties such as designers, developers, and testers. The findings provide a developer/designer point of view and would help to make better decisions related to the environment set up, technology selection, and the architecture, design, and implementation details. As a result of this effort, the overall vulnerability level of the web applications would diminish significantly. [ABSTRACT FROM AUTHOR]

Urgency of the research. The complicated economic conditions of the functioning of small enterprises in Ukraine determine the urgency of the problem of maintaining their financial security. Target setting. Management of financial security of an enterprise should be based on the results of assessing its current level, which determines the need to develop a suitable methodology. Actual scientific researches and issues analysis. The issues of assessing the level of financial security of enterprises are investigated in the works of such scientists as I. Blank, A. Verhun, K. Horyacheva, M. Yermoshenko, I. Zhuravlyova, T. Kuzenko, H. Portnova, T. Rzayeva, O. Cherneha. Uninvestigated parts of general matters defining. Most of the methods for assessing the level of financial security of enterprises are not adapted to the analysis of financial security of small business entities. The research objective. To improve the methodology of assessing the level of financial security of small enterprises. The statement of basic materials. The article proposes a methodical approach to assessing the level of financial security of small enterprises, which includes five steps: 1) identification of factors of influence, collection of input data; 2) determination of reference values of indicators; 3) normalization of input data; 4) estimating the deviations of the actual values of indicators from their reference values, calculation of the components of the integral indicator; 5) calculation of the integral indicator, providing the qualitative interpretation of the results. Conclusions. The proposed method for assessing the level of financial security takes into account the impact of factors on the level of financial security of small enterprises; applies different approaches to defining the reference values; provides a qualitative interpretation of the results. [ABSTRACT FROM AUTHOR]

Introduction. Effective business in today's conditions requires the formation of a progressive methodology that will manage and predict the development of all areas of business entities. The main objective of the study is the development and implementation of a universal assessment model and ensuring a high level of economic security from the impact of internal and external threats. Methods. The methods of analysis, deduction, abstraction and analogy are used to reveal and construct the interconnections between elements of the enterprise's value management, the components of economic security and the basic processes of enterprise activity. As a result, an integrated indicator of economic security of the company is formed on the basis of modeling and formalization method. Results. The economic added value (EVA) methodology was analyzed and the enterprise value management factors were identified. The interrelation of the allocated values factors and economic safety's resource-functional components is justified. A set of factors for assessing the value of an enterprise and the level of safety of resource-functional components of economic security is grouped. A criterion for assessing the enterprise's economic security has been developed and proposed. As a result, a model of enterprise management is constructed, with the help of which both the level of economic security and the value of the enterprise are assessed and managed simultaneously. Discussion. Prospects for further research are aimed at improving the methodology for calculating the integral indicator of economic security. The study of the factors and indicators influence on the level of economic security for different ownership forms and management forms. [ABSTRACT FROM AUTHOR]

The assets of enterprises are increasingly exposed to internal and external threats like fraud, theft, embezzlement, sabotage, terrorism and industrial espionage. As a result, enterprise security (ES) as a support function is becoming more important and expenses for ES are significant. An important characteristic of ES setting it apart from other support functions is that in addition to the protection of material and immaterial assets, it is concerned with the physical integrity and survival of employees as a the most valuable asset. The management and control of ES is a challenging task as it requires the cooperation and coordination of security experts, individual managers receiving protection and several functional areas of the enterprise. Notwithstanding this development, there is virtually no research on management control of ES. Therefore, the aim of the paper is to present first empirical evidence on the use, measurement, and value contribution of ES and to introduce fundamental concepts and processes of ES management. We present a study based on qualitative interviews with security experts of German DAX-30 companies which we supplement with a standardized survey. Applying Simons' levers of control-framework we find that all four levers of control are used although there are significant differences regarding their elaboration and measurement practice as well as their integration in a consistent management control system. Our study lays conceptual and empirical foundations for future research on ES control. We contribute to research on management control by unlocking a new and increasingly important field of study. [ABSTRACT FROM AUTHOR]

Information security is an imperative factor in organizational success, driven by the need to protect information assets. The continuous evolution of external and internal threats and the associated need to protect and secure information from exploitation of vulnerabilities has become a struggle for many organizations in both the public and private sectors. This struggle is the direct result of the narrow focus on operational security. Just as the lines between business and information technology have disappeared, so have the lines between business and information security. Some organizations simply “check the box” by performing the minimum actions required to pass or meet mandated compliance standards. Without practicing due diligence and by only meeting the minimum requirements, leads to the reactive response of exploited vulnerabilities in addition to the increase of after the fact incident investigations. Organizations need to take a proactive approach using established methodologies known to incorporate security into information technologies and systems. The Sherwood Applied Business Security Architecture (SABSA) is a solution oriented methodology for any business enterprise that seeks to enable its information infrastructure by applying security solutions within every layer of the organization. This article describes how SABSA can be integrated into organizations' existing architectures utilizing organizational business drivers. [ABSTRACT FROM PUBLISHER]

Abstract: With the wide spread use of e-transactions in enterprises, information security risk management (ISRM) is becoming essential for establishing a safe environment for their activities. This paper is concerned with presenting a comprehensive ISRM framework that enables the effective establishment of the target safe environment. The framework has two structural dimensions; and two procedural dimensions. The structural dimensions include: ISRM “scope” and ISRM “assessment criteria”, while the procedural dimensions include: ISRM “process” and ISRM “assessment tools”. The framework uses the comprehensive STOPE (strategy, technology, organization, people, and environment) view for the ISRM scope; while its assessment criteria is considered to be open to various standards. For the procedural dimensions, the framework uses the widely known six-sigma DMAIC (define, measure, analyze, improve, and control) cycle for the ISRM process; and it considers the use of various assessment tools. It is hoped that the framework would be widely used in the future as an open reference for ISRM. [Copyright &y& Elsevier]

This study is aimed at describing the result of collaboration between a hi tech manufacturer and its partners to develop an identity management architecture. The fundamental goal of this architecture is flexible on-boarding which can in turn support quarterly quoting processes. Enabling smooth accessibility to forms, templates, and process documents. This will also increase direct communication of partners with suppliers via e-mail. Enhancing file exchange, archive and storage capabilities are other objectives. This study will help in creating a backbone and framework for next generation collaboration capabilities (ex. Instant messaging, Video on Demand). The transaction time will be reduced by providing access to the right set of tools and systems in one click and enhance security framework for all the data exchanges. [ABSTRACT FROM AUTHOR]