Search

Despite many benefits, the extensive deployment of Health Information Technology (HIT) systems by healthcare organizations has encountered many challenges, particularly in the field of telemetry concerning patient monitoring and its operational workflow. These challenges can add more layers of complexity when an unplanned software security patching is performed, affecting patient monitoring and causing disruption in daily clinical operations. This study is a reflection on what happened associated with software security patching and why it happened through the lens of an incident report to develop potential preventive and corrective strategies using qualitative analyses--inductive and deductive approaches. There is a need for such analyses to identify the underlying mechanism behind such issues since very limited research has been conducted on the study of software patching. The incident was classified as a "software functionality" issue, and the consequence was an "incident with a noticeable consequence but no patient harm", and the contributing factor was a software update, i.e., software security patching. This report describes how insufficient planning of software patching, lack of training for healthcare professionals, contingency planning on unplanned system disruption, and HIT system configuration can compromise healthcare quality and cause risks to patient safety. We propose 15 preventive and corrective strategies grouped under four key areas based on the system approach and socialtechnical aspects of the patching process. The key areas are (i) preparing, developing, and deploying patches; (ii) training the frontline operators; (iii) ensuring contingency planning; and (iv) establishing configuration and communication between systems. These strategies are expected to minimize the risk of HIT-related incidents, enhance software security patch management in healthcare organizations, and improve patient safety. However, further discussion should be continued about general HIT problems connected to software security patching. [ABSTRACT FROM AUTHOR]

Cybersecurity failures have become increasingly detrimental to organizations worldwide, impacting their finances, operations, and reputation. This issue is worsened by the scarcity of cybersecurity professionals. Moreover, the specialization required for cybersecurity expertise is both costly and time-consuming. In light of these challenges, this study has concentrated on automating cybersecurity processes, particularly those pertaining to continuous vulnerability detection. A cybersecurity vulnerability scanner was developed, which is freely available to the community and does not necessitate any prior expertise from the operator. The effectiveness of this tool was evaluated by IT companies and systems engineers, some of whom had no background in cybersecurity. The findings indicate that the scanner proved to be efficient, precise, and easy to use. It assisted the operators in safeguarding their systems in an automated fashion, as part of their security audit strategy. [ABSTRACT FROM AUTHOR]

The concept of trust has been extensively studied within the field of medicine. Yet, a list of factors that clearly influence patients' trust is still under debate. Moreover, the methodological approaches found in literature have been reported to be lacking in their assessments and measurements of trust relationships in the medical field although trust between a patient and medical provider has been proven to increase adherence and improve health outcomes. Hence, adding data to this debate and exploring a reliable method to explore the construct of trust is relevant. This study collects new evidence of the most salient indicators of patient trust by using a narrative approach and highlighting the potential of this method in collecting indicators that could be used to build training that aims to increase patients' trust. We used the Linguistic Inquiry and Word Count software for text analysis to examine the spontaneous narrations of episodes of trust and distrust within the doctor-patient relationship with a sample of 82 adult patients. Results demonstrate the role of the emotional aspects of the doctor-patient relationship. Data highlights the importance of doctors' benevolence toward patients, and positive emotions seem to be deeply connected with any experience of trust, which leads patients to feel more secure. Methods are presented to use these insights to construct mechanisms that establish medical trust and allow providers to implement effective interventions. [ABSTRACT FROM AUTHOR]

Copyright of Ordnance Industry Automation is the property of Editorial Board for Ordnance Industry Automation and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Individual internet users are commonly considered the weakest links in the cybersecurity chain. One reason for this is that they tend to be overoptimistic regarding their own online safety. To gain a better understanding of the cognitive processes involved in this assessment, the current study applies an extended version of the protection motivation theory. More specifically, this study includes perceived knowledge and internet trust to discover how these antecedents influence the threat and coping appraisal processes. Based on representative survey data collected from 967 respondents, we found that people who feel well-informed about online safety feel less vulnerable to cybercrime and are less inclined to take security measures. At the same time, feeling informed is associated with being more convinced of the severity of cybercrime. High levels of trust in the safety of the internet are linked to the feeling that one is less vulnerable to cybercrime and the perception that cybercrime is not a severe threat. Future interventions should remind internet users about their own perceived vulnerability and the risks that exist online while ensuring that internet users do not lose their trust in the internet and confidence in their own online knowledge. [ABSTRACT FROM AUTHOR]

Telemedicine has recently garnered more attention from healthcare professionals because it provides access to health services to patients in rural areas while making patient healthcare information more vulnerable to security breaches. The objective of this research is to identify factors that play a critical role in possible adoption of telemedicine in the United States and Brazil. A model with eight hypotheses was used to establish a research framework. A survey was conducted involving healthcare professionals in the aforementioned countries. The results show that telemedicine adoption is influenced by policies and culture in both countries and influenced by security and privacy in the United States. It can be inferred from the research that perceptions of the American and Brazilian healthcare professionals are similar in telemedicine issues covered in this research. These healthcare professionals, however, disagree on how patients' privacy should be preserved in the two countries. [ABSTRACT FROM AUTHOR]

Side-channel attacks are a concrete and practical threat to the security of computing systems, ranging from high performance platforms to embedded devices. In this paper, we will provide a brief systematization of the current existing approaches to analyze the side-channel vulnerability of an implementation, or automatically implement countermeasures, relying on methodologies typical of compiler systems. We will dedicate a spotlight to a significant progress in the countermeasures techniques which is represented by the application of dynamic compilation techniques to prevent a side-channel attacker from devising a model of the attacked application. We conclude the work highlighting promising research directions in this field. [ABSTRACT FROM AUTHOR]

Summary: Safety‐critical systems are evolving into complex, networked, and distributed systems. As a result of the high interconnectivity among all networked systems and of potential security threats, security countermeasures need to be incorporated. Nonetheless, albeit cutting‐edge security measures are adopted and incorporated during the system development, such as latest recommended encryption algorithms, these protection mechanisms may turn out obsolete because of the long operational periods. New security flaws and bugs are continuously detected. Software updates are then essential to restore the security level of the system. However, system shutdowns may not be acceptable when high availability is required. As expressed by the European Union Agency for Network and Information Security (ENISA) "the research in the area of patching and updating equipment without disruption of service and tools" is needed. In this article, a novel live updating approach for zero downtime safety‐critical systems named Cetratus is presented. Cetratus, which is based on a quarantine‐mode execution and monitoring, enables the update of non‐safety‐critical software components while running, without compromising the safety integrity level of the system. The focus of this work lies on the incorporation of leading‐edge security mechanisms while safety‐related software components will remain untouched. Other non‐safety‐related software components could also be updated. [ABSTRACT FROM AUTHOR]

Abstract It is a popular belief that humans are the weakest link in cyber-security. However, there has been little research devoted to why people do (or do not) protect themselves and what explains their behaviors. Instead, more attention has been paid to victimization and prevalence of cybercrime. Therefore, we investigate and compare the motivations to protect oneself against scams, malware and cybercrime in general using an adjusted model of the protection motivation theory (PMT), which includes subjective norm, threat and coping awareness. To test this model, different structural equation models (SEM) were used and compared, with each focusing on a specific cybercrime. Our non-random (convenience) sample (n = 1181) is representative for age, residence and gender for the Belgian population. The results show the extended PMT model is a good predictive model to explain people's protection against cybercrime. The findings suggest significant differences when protecting oneself against 'technical' cybercrimes (malware), compared to more 'social' cybercrimes (scams). The differences are situated on the predictive role of coping, threat awareness and perceived vulnerability. Furthermore, we found subjective norm to be an important predictor in the intention toward protecting against all cybercrimes. Recommendations for further research and awareness campaigns are provided in the discussion. Highlights • Subjective norm (SN) strongly predicts the intention to take security measures. • Malware's PMT model is significantly different from Scam's PMT-model. • SN and the PMT model explain 28% of the intention to take security measures. • SE only predicts intention toward security measures for experienced internet users. [ABSTRACT FROM AUTHOR]

It is suggested to use the ensemble of deep neural networks to design an intellectual situation classifier that solves the problem of normal and abnormal situations detection and recognition in a continuous video stream of the security system. The testing of its work was made on the basis of modern hardware and software and computer vision methods, the result of which is the classification probabilities for each video fragment. A software module in Python was created for normal and abnormal situations detection and recognition. [ABSTRACT FROM AUTHOR]

The smart card based password authentication scheme is one of the most important and efficient security mechanism, which is used for providing security to authorized users over an insecure network. In this paper, we analyzed major security flaws of Jangirala et al.’s scheme and proved that it is vulnerable to forgery attack, replay attack, user impersonation attack. Also, Jangirala et al.’s scheme fail to achieve mutual authentication as it claimed. We proposed an improved two factor based dynamic ID based authenticated key agreement protocol for the multiserver environment. The proposed scheme has been simulated using widely accepted AVISPA tool. Furthermore, mutual authentication is proved through BAN logic. The rigorous security and performance analysis depicts that the proposed scheme provides users anonymity, mutual authentication, session key agreement and secure against various active attacks. [ABSTRACT FROM AUTHOR]

As health organisations battle fraud, data theft and cyber-attacks that cost millions of dollars and threaten their ability to provide quality patient care, biometric technology is poised to gain greater traction across this industry – helping hospitals and other health-related organisations to protect patient data, prevent fraud, improve their patient-matching abilities and safeguard their reputations. This article examines the current and likely future impact of biometric systems on healthcare security and patient identification, focusing on the US market. [ABSTRACT FROM AUTHOR]

Virtualization-based memory isolation has been widely used as a security primitive in various security systems to counter kernel-level attacks. In this article, our in-depth analysis on this primitive shows that its security is significantly undermined in the multicore setting when other hardware resources for computing are not enclosed within the isolation boundary. We thus propose to construct a fully isolated micro-computing environment (FIMCE) as a new primitive. By virtue of its architectural niche, FIMCE not only offers stronger security assurance than its predecessor, but also features a flexible and composable environment with support for peripheral device isolation, thus greatly expanding the scope of applications. In addition, FIMCE can be integrated with recent technologies such as Intel Software Guard Extensions (SGX) to attain even stronger security guarantees. We have built a prototype of FIMCE with a bare-metal hypervisor. To show the benefits of using FIMCE as a building block, we have also implemented four applications which are difficult to construct using the existing memory isolation method. Experiments with these applications demonstrate that FIMCE imposes less than 1% overhead on single-threaded applications, while the maximum performance loss on multithreaded applications is bounded by the degree of parallelism at the processor level. [ABSTRACT FROM AUTHOR]

SUMMARY: NTMobile (Network Traversal with Mobility) has been proposed to achieve end‐to‐end encryption communication supporting IP mobility in environments where IPv4/IPv6 networks coexist. However, since NTMobile unconditionally establishes an encrypted User Datagram Protocol (UDP) tunnel between NTMobile‐ready nodes (NTM nodes), a malicious NTM node can attack a target NTM node through the encrypted UDP tunnel without being detected by a firewall. Moreover, since communication with a general server always passes through a relay server (RS), the route becomes redundant even when IP mobility is not needed, and the communication delay increases. In order to solve these problems, this paper proposes an access control function using the name of the correspondent node and a “Route option” that can select whether the RS is used or not. As a result of implementation of the prototype system and evaluation of its performance, it was confirmed that the increase of the start‐up time and that of the overhead at the beginning of the communication were quite small, and there was little influence on practical use. [ABSTRACT FROM AUTHOR]

Nowadays the protection of life, health and property of individuals is in the centre of public interest. There is not a distinction between the provision of such protection by private or public sector. The private security services play an important role in protection of persons and property. The subjects of protection are not only people and property, but also sensitive information which is relevant for the state interest or business entities. Based on research, the private security services do not make a selection of employees systematically. One of the reasons is the absence of an analysis of candidates' personal competencies which should take into account the requirements of the protected subject. The aim of the article is therefore a software solution for modelling the personal competencies of applicants for the job in private security services. [ABSTRACT FROM AUTHOR]

In recent years, there has been a great development of methodologies, procedures and software tools for quantitative assessment of reliability, efficiency and effectiveness of physical protection systems. Absence of some important input values, as well as missing method to obtain them, is still the most serious problem. This paper is focused on analysis of possibilities how to obtain delay time values in the case of cylinder pin tumbler locks using non-destructive methods of breaking. In the introduction of the article, a proposal of the methodology for testing the mechanical resistance of cylinder pin tumbler locks is elaborated. Consequently, the focus is set on analysis of results obtained during the pilot tests in order to verify the correctness of the proposed methodology. With the tests, it is possible to assess the resulting resistance of cylinder pin tumbler locks also in terms of classification into resistance classes. The pilot testing needs to be implemented mainly due to the lack of a technical standard that processes the issue within the established methodology. [ABSTRACT FROM AUTHOR]

Radio Frequency IDentification (RFID) as a tool is being used for the better governance and management of libraries. A RFID system offers a complete package from security, theft detection, tracking, monitoring, inventory control, and act as an expedient in books circulation or charging and discharging of books; and, lessens the burden of librarians, who could be better redeployed to other productive activities in the service of the readers. RFID technology was implemented in Defence Science Library, Defence Scientific Information & Documentation Centre (DESIDOC), Delhi, in 2013. The study describes the process of implementation of RFID system in the Defence Science Library, at DESIDOC. It provides an overview of the work to implement the RFID system including the philosophy or the background or thought process that had gone into deciding in its implementation, the various features, technical specification of the library automation software and system itself. The constraints faced during the data migration and the visible advantages from the users' perspective vis-à-vis manual operation are also covered. The study concludes that implementation of RFID technology has brought a bouquet of benefits to librarians, the staff and scientists or user of the Library. [ABSTRACT FROM AUTHOR]

The number of malicious Android apps is increasing rapidly. Android malware can damage or alter other files or settings, install additional applications, and so on. To determine such behaviors, a security analyst can significantly benefit from identifying the family to which an Android malware belongs rather than only detecting if an app is malicious. Techniques for detecting Android malware, and determining their families, lack the ability to handle certain obfuscations that aim to thwart detection. Moreover, some prior techniques face scalability issues, preventing them from detecting malware in a timely manner. To address these challenges, we present a novel machine-learning-based Android malware detection and family identification approach, RevealDroid, that operates without the need to perform complex program analyses or to extract large sets of features. Specifically, our selected features leverage categorized Android API usage, reflection-based features, and features from native binaries of apps. We assess RevealDroid for accuracy, efficiency, and obfuscation resilience using a large dataset consisting of more than 54,000 malicious and benign apps.Our experiments showthat RevealDroid achieves an accuracy of 98% in detection of malware and an accuracy of 95% in determination of their families.We further demonstrate Reveal Droid's superiority against state-of-the-art approaches. [ABSTRACT FROM AUTHOR]

With the increasing connectivity and complexity of embedded systems, security issues have become a key consideration in design. In this paper, we propose a decentralized system-level approach for isolating application tasks without the need to rely on a centralized privileged authority at run-time. We discuss the need for isolation to reduce the potential impact of a task compromise or untrustworthy IP block, and present mechanisms to allow for safe sharing of memory regions and IP blocks between tasks in the system. After exploring the architectural requirements for enforcing our security model we present a hardware Isolation Unit, which can be customized for different types of dynamic permission changes depending on task-resource relationships and added to heterogeneous MPSoCs to enforce our security approach. [ABSTRACT FROM AUTHOR]

The petro-chemical industry is a critical infrastructure that is vulnerable to cybercrime. In particular, industrial process control systems contain many vulnerabilities and are known targets for hackers. A cyberattack to a chemical facility can cause enormous risks to the economy, the environment, and public health and safety. This gives rise to the question how corporate cybersecurity has developed; how it is governed; and whether it should be subject to public oversight. This paper presents a case study of the governance of cybersecurity in the petrochemical industry in the Rotterdam Mainport area in the Netherlands, which reflects the 'new governance' view that cybersecurity can best be governed through voluntary public-private partnerships. The paper finds however that actual collaborative governance is not developing in the petrochemical industry in the port of Rotterdam; that corporate awareness and investment in cybersecurity stay behind standards, and that cybersecurity is not included in regulatory inspections. The paper places these findings in the context of three problems often associated with 'new governance' particularly pressing in cybersecurity governance: a weak role of government in public-private collaborative arrangements; an expectation that businesses will invest in self-regulation even in the absence of incentives to do so, and a lack of information exchange. In the port of Rotterdam, these problems result in a lack of obligations and accountability pressure on petrochemical corporations, leaving on of the most important chemical industrial hazards of today, largely unregulated. [ABSTRACT FROM AUTHOR]

The need for constant availability and integrity of patient data means that many organizations compromise on privacy and security, often to their detriment. This article discusses the current state of healthcare data privacy and security, examines the legal issues requiring attention, discusses risks of the growing use of remote technologies, mHealth, and wearable technology, and finally discusses cybersecurity insurance as a way to mitigate the financial costs of breach. [ABSTRACT FROM AUTHOR]

This article discusses access control in healthcare environment and also discusses the Role-based access control capabilities and the examples of dynamic requirements for controlling the electronic health record systems in the context of healthcare professional use are described. Healthcare routine access control demands and Variations of the RBAC original components and the use of hybrid models or mixed RBAC extensions are also discussed.

This article provides insight into the immense data breach problem affecting the healthcare industry. It also analyzes healthcare breach trends and shows how the threat landscape is changing in recent years. It proceeds to discuss a 2017 healthcare data breach in which protected health information went up for sale on the dark market. The discussion closes with actionable solutions that all healthcare organizations should be accomplishing to minimize the risk of data breach. [ABSTRACT FROM AUTHOR]

Interoperability is a critical healthcare industry initiative. Trust, however, is a major barrier to achieving seamless medical data exchange. An enabler of interoperability, a health information exchange relys on the concept of a trust framework to overcome this hurdle for the exchange of clincial information, a concept that has implications for the trustworthy exchange of other types of health-related information. Healthcare security and privacy professionals should be aware of what a trust framework is, along with the implementation challenges associated with trustworthy sharing of health-related data. [ABSTRACT FROM AUTHOR]

This paper presents a study about hardware attacking and clock signal vulnerability. It considers a particular type of attack on the clock signal in the I2C protocol, and proposes the design of a new sensor for detecting and defending against this type of perturbation. The analysis of the attack and the defense is validated by means of a configurable experimental platform that emulates a differential drive robot. A set of experimental results confirm the interest of the studied vulnerabilities and the efficiency of the proposed sensor in defending against this type of situation. [ABSTRACT FROM AUTHOR]

With the popularity of mobile social network, more and more people are willing to use a mobile device to accomplish some social activities, such as payment when shopping, product information inquiries, where RFID is a technology which can be good to complete payment functions on mobile devices. However, the widespread use of RFID tags brings the possibility for various security risks and privacy problems. In addition, the storage space, processing capability and power supply of RFID tags are limited. In this paper, in order to reduce the computational cost we present an ultra-lightweight RFID authentication scheme, named ULRAS. ULRAS only uses Bit and XOR operations to prevent the DDOS attack. ULRAS introduces the RR method to make the ULRAS more secure in communication, and uses sub-key and sub-index number into its key update process to achieve the forward security. Compared to the SASI protocol and the Gossamer protocol, ULRAS cost less computation and communication resources and have stronger security. [ABSTRACT FROM AUTHOR]

To solve the autonomous driving problems of underground mining truck, especially the path tracking problem, predecessors have researched articulated vehicle kinematic and control through the analysis of the kinematics modeling. Although articulated vehicle dynamic was taken into consideration in path tracking control fields, there would be also lack of accurate system modeling. So considering this multi variable, strong coupling, highly complex nonlinear dynamic system of articulated vehicles, it's difficult not only for establishment of an accurate model, but also for design of a precise control algorithm. Fuzzy hyperbolic model and the method of pole placement controller design in this article could provide a better way to solve these problems above. In this method, information with driver driving the truck included the vehicle kinematics relations, and by repeat of the same process, the vehicle dynamics relationship would be clearer. This method reduced the complexity in process modeling. The fuzzy hyperbolic model could cleverly convert the coefficient matrix of the nonlinear system to a constant matrix, then neural networks as a supervised learning method could be used to identify the parameters, which made the model more closed to the true model and it would be convenient to design a control algorithm. Pole assignment as a classical control algorithm was simple and effective and it could be appropriately applied into this kind of model. Following steps were needed to establish the fuzzy tangent model and the pole assignment method. Initially, the sample data, including the lateral displacement error and orientation error, were collected through the driver controlling articulated vehicle at the speed of 3 m/s. During the multiple times of driving in the same roadway, little change could be achieved for the lateral displacement error and the orientation error. After that, by using the improved adaptive BP neural network model and the mediation rate of error estimator based on the method of Cauchy robust, the system error of neural network learning was effectively reduced, and the fitting error and relative error of data were decreased. So the system was better matched, and the weights were well identified. Finally, the pole assignment method with choosing the appropriate poles was designed to control articulate angle. The Hardware-In-the-Loop (HIL) simulation platform was set up on the basis of PXI and C-RIO as a host computer. The kinematic model established in the Adams platform was downloaded into the PXI as the simulation plant, and the path tracking algorithm compiled by Simulink was embedded to the C-RIO as the real electronic control unit. The host computer coupled the vehicle model and the path tracking algorithm via the Labview platform and displayed the simulation status in the upper monitor. The results suggested in the process of driving this method could describe both the quantitative relation of the horizontal position deviation and course angle deviation with their rates of change, and could provide an accurate control. HIL results showed that the lateral displacement error, orientation error and the articulate angle of the vehicle were respectively controlled at 0.008 m, 0.07 rad (0.5°), 0.21 rad (12°). All the deviations were asymptotically stable. Overshoot and the response time were less than expectations and eventually stabilize. Articulated vehicles were maintained to the low level deviation and reference trajectory coincides with the track and also the simulation time and calculating time were all 80 s in the hardware in the loop simulation process, so the controller met the requirement of the real-time control performance. The method is demonstrated to be effective and reliable in path-tracking for the underground vehicles. [ABSTRACT FROM AUTHOR]

The majority of mobile apps use credentials to provide an automatic login function. Credentials are security tokens based on a user's ID and password information. They are created for initial authentication, and this credential authentication then replaces user verification. However, because the credential management of most Android apps is currently very insecure, the duplication and use of another user's credentials would allow an attacker to view personal information stored on the server. Therefore, in this paper, we analyze the vulnerability of some major mobile SNS apps to credential duplication that would enable access to personal information. To address the identified weaknesses, we propose a secure credential management scheme. The proposed scheme first differentiates the credential from the smart device using an external device. Using a security mechanism, the credential is then linked with the smart device. This ensures that the credential will be verified by the special smart device. Furthermore, based on experimental results using a prototype security mechanism, the proposed scheme is shown to be a very useful solution because of its minimal additional overhead. [ABSTRACT FROM AUTHOR]