Search

This paper deals with security problems in the context of records systems, collaborative environments which due to the importance of the knowledge that they manage must implement consistent security and confidentiality policies and comply with the regulations in force. The study presented describes the design and implementation of a security model applied to the records management in an organisation in the nuclear energy sector. The aim of this paper is to present the security model in operation, transmit the acquired knowledge and analyse the advantages offered by the model for security management on the basis of the experience of the last three years. The ultimate purpose of the paper is to act as a guide to other kinds of organisations for the secure management of their records. [ABSTRACT FROM AUTHOR]

Abstract: The rise of the potential risks from different attacks on ICT systems means the investment in security technology is growing and is becoming a serious economic issue for many organizations. The assessment of the appropriate investment that is economically affordable and provides enough protection for the enterprise information system is an issue that is analysed here. The paper discusses the identification of the assets, the threats, the vulnerabilities of the ICT systems and provides an approach for the quantification of the necessary investment. The paper concludes with a recommendation for a standard approach to security-information investment assessment. [Copyright &y& Elsevier]

The internet and local area networks, which are growing rapidly, have witnessed an increase in malicious threads. Therefore, the deployment of security tools is necessary for protecting organisations from external attacks on their information systems, preventing information losses and ensuring secure communication. To this end, the primary objective of this paper is to propose an enhanced methodology for supporting the decision maker in selecting the appropriate security tools for information systems in organisations. First, we construct a security criteria hierarchy as the decision criteria. Then, based on the criteria, we compute the competitiveness score of each security tool and the relative weights among different types of security tools utilising an analytic hierarchy process (AHP). Finally, in order to incorporate a trade-off between all the competitiveness aspects associated with the security tools and costs, a prioritising/weighting mixed integer goal programming (GP) model or a combination of mixed integer GP and weighted-sum model to determine the optimal solutions for the security tools is employed. [ABSTRACT FROM AUTHOR]

Ready or not, the digitalization of information has come, and privacy is standing out there, possibly at stake. Although digital privacy is an identified priority in our society, few systematic, effective methodologies exist that deal with privacy threats thoroughly. This paper presents a comprehensive framework to model privacy threats in software-based systems. First, this work provides a systematic methodology to model privacy-specific threats. Analogous to STRIDE, an information flow-oriented model of the system is leveraged to guide the analysis and to provide broad coverage. The methodology instructs the analyst on what issues should be investigated, and where in the model those issues could emerge. This is achieved by (i) defining a list of privacy threat types and (ii) providing the mappings between threat types and the elements in the system model. Second, this work provides an extensive catalog of privacy-specific threat tree patterns that can be used to detail the threat analysis outlined above. Finally, this work provides the means to map the existing privacy-enhancing technologies (PETs) to the identified privacy threats. Therefore, the selection of sound privacy countermeasures is simplified. [ABSTRACT FROM AUTHOR]

The paper describes the state of the art in the standardization in information security management. The requirements to the standards being developed, the types of standards, and the principles to adhere to are discussed. The study is based on the documents adopted within the subcommittee 27 “IT Security techniques” of the joint technical committee ISO/IEC JTC 1 “Information technology”. [ABSTRACT FROM AUTHOR]

Abstract: The ability to perform scalar products of two vectors, each known to a different party, is a central problem in privacy preserving data mining and other multi-party computation problems. Ongoing search for both efficient and secure scalar product protocols has revealed that this task is not easy. In this paper we show that, indeed, scalar products can never be made secure in the information theoretical sense. We show that any attempt to make unconditionally secure scalar products will inevitably allow one of the parties to learn the other parties input vector with high probability. On the other hand, we show that under various assumptions, such as the existence of a trusted third party or the difficulty of discrete logarithms, both efficient and secure scalar products do exist. We proposed two new protocols for secure scalar products and compare their performance with existing secure scalar products. [Copyright &y& Elsevier]